Legal

Privacy Policy (GDPR)

Updated: 2026-09-14

The French version of this policy is the legally binding version. The English version is provided for information only.

MAPA Synergy Sàrl ("MAPA Property") values your privacy. This policy informs you about data processing on mapaproperty.lu under EU Regulation 2016/679 (GDPR) and Luxembourg law of 1 August 2018.

1. Data controller

MAPA Synergy Sàrl, RCS Luxembourg B241974, 26, rue du Commerce, L-3450 Dudelange. Data referent: Frédéric Mannis (contact details via the "Contact us" button at the bottom of the page). No DPO designation required, but Frédéric Mannis fulfils this role.

2. Data collected

Identification (name, email, phone), wealth data (on explicit request), connection data (anonymised IP, timestamp, pages), preferences, chatbot history.

3. Purposes and legal bases

Lead management (pre-contractual / consent), off-market under NDA (pre-contractual), AML/KYC (legal obligation), security (legitimate interest), audience measurement (legitimate interest), occasional marketing (consent).

4. Retention

Prospection data / forms (untransformed leads): 3 years from last contact. Contractual data (mandates, KYC AED files, accounting): 7 years after end of relationship, per Luxembourg AML/CFT and tax regulations. Cookies and technical logs: 13 months maximum.

5. Recipients

Notaries and partner lawyers when needed; technical subprocessors: site hosting (Vercel Inc.), database (Supabase), file storage (Supabase and Cloudflare, Inc.), form anti-bot protection (Cloudflare, Inc.), transactional emails (IONOS), processing of chatbot conversations with Eléna (Mistral AI, a French company), under GDPR-compliant data processing agreements; the MAPA Property team, through data exports generated from the administration area, for managing mandates and incoming requests; public authorities upon legal request only.

6. Transfers outside the EU

The site's host, Vercel Inc. (440 N Barranca Avenue #4133, Covina, CA 91723, USA), runs the site's pages and functions in the Stockholm region. The database is hosted by Supabase in the Stockholm region. Form anti-bot protection and file storage are provided by Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA). The domain name is registered with Gandi SAS, Paris, France. Transfers to providers established in the USA are covered by GDPR safeguards, including Vercel's certification under the EU-US Data Privacy Framework.

7. Your rights

Access, rectification, erasure (30-day response), restriction, portability, objection, consent withdrawal, post-mortem instructions.

8. Exercise of rights

Email via the « Contact us » button at the bottom of the page (GDPR contact: Frédéric Mannis) with proof of identity. Response within 30 days (extendable by two months for complex requests), per articles 6, 13, 15, 16, 17 and 21 GDPR.

9. Security

MAPA implements the following technical measures: encryption in transit with a hybrid key exchange resistant to future quantum computers, provided by our host, encryption at rest, application firewall provided by our host, anti-bot verification on forms, request rate limiting, administration access restricted to a named list of addresses, access rights segregation within the database, access logging, regular backups.

10. Cookies

The site uses strictly necessary cookies (language preference, dark/light mode, favourites) — always active, cannot be disabled. Audience-measurement cookies (internal statistics, Vercel Analytics, Google Analytics) and, in the future, marketing cookies (Meta Pixel, Google Ads) are only set after your explicit consent, collected via the banner shown on your first visit. You can change your choice at any time via the "Manage cookies" link in the footer.

11. Complaints

Luxembourg Data Protection Commission (CNPD): www.cnpd.lu — 15, boulevard du Jazz, L-4370 Belvaux.

12. Amendments

This policy may evolve. Current version available on the site, with update date.