Privacy Policy
Last updated: September 2026
HL Audit S.à r.l. is committed to protecting your personal data. This policy explains what we collect, why, and the rights you have under the EU General Data Protection Regulation (GDPR) and Luxembourg data-protection law.
Data controller
What data we collect
- Data you send us — when you contact us by email (name, company, email address and the content of your message).
- Engagement data — where you become a client, the information needed to carry out our mandate and to meet our legal and professional obligations.
- Technical data — standard server logs kept by our hosting provider (e.g. IP address, browser type, pages visited) for security and operation of the website.
Why we process it (purposes & legal bases)
- To respond to your enquiries and provide our services — performance of a contract or steps prior to it (Art. 6(1)(b) GDPR).
- To comply with our legal, accounting and professional obligations — legal obligation (Art. 6(1)(c) GDPR).
- To secure and improve the website — legitimate interest (Art. 6(1)(f) GDPR).
- Optional audience measurement, if enabled — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
Who has access
Your data is accessed only by HL Audit and, where necessary, by service providers acting on our instructions (in particular our hosting provider). We may disclose data to competent authorities where required by law. We do not sell your personal data.
International transfers
Our website is hosted by Netlify, Inc. in the United States, and it loads fonts from Google Fonts, which transmits your IP address to Google LLC (United States). Where personal data is transferred outside the European Economic Area, appropriate safeguards apply (such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework).
How long we keep it
We keep personal data only for as long as necessary for the purposes above. Enquiry correspondence is kept for the time needed to handle your request; client and accounting records are retained for the statutory periods required under Luxembourg law (generally up to 10 years).
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict or object to the processing of your data, the right to data portability, and the right to withdraw consent at any time. To exercise these rights, email contact@hlaudit.lu.
You also have the right to lodge a complaint with the Luxembourg supervisory authority, the Commission nationale pour la protection des données (CNPD) — cnpd.public.lu.
Cookies
The website uses only strictly necessary storage by default. Details are set out in our Cookie Policy.
Changes
We may update this policy from time to time. The date at the top of this page indicates the latest revision.