GDPR · Data protection

Privacy policy

In accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the Luxembourg law of 1 August 2018 on the organisation of the National Data Protection Commission.

1. Controller

IN-WESTER S.à r.l., 2A, rue Gabriel de Marie, L-2131 Luxembourg, represented by its managing director Tommy WESTER – email: info@in-wester.lu. A data protection officer is not required by law and has not been appointed.

2. Principle

We process as little personal data as possible. This website works without user accounts, analytics tools, advertising trackers or embedded third-party content.

3. Visiting the website (server log files)

When you visit the website, our hosting provider automatically processes technically necessary data: IP address, date and time, page requested, referrer URL and browser and operating system details. The purpose is to provide the website securely and reliably. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Log files are kept only as long as needed for operation and security and are then deleted.

4. Contact by email

If you contact us by email, we process your details (e.g. name, email address, content of your message) in order to answer your request. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) (legitimate interest in replying). The data is deleted once it is no longer needed, unless statutory retention obligations apply (e.g. 10 years for commercial records under Art. 16 of the Luxembourg Commercial Code).

5. Visitor statistics without cookies

To improve our website we count page views as daily totals: page requested, language, referring website (domain only) and device type (computer, smartphone, tablet – derived from the browser identifier, which is not stored). We also count how often each choice is made in the consent dialog. No IP addresses, identifiers or cookies are stored and nothing is stored on or read from your device; no individual can be identified. The legal basis is our legitimate interest in privacy-friendly audience measurement (Art. 6(1)(f) GDPR).

6. Marketplace orders

When you place an order, we process your name, email address, phone number, delivery address and order details to perform the contract (Art. 6(1)(b) GDPR). We pass this data to the respective seller so that the goods can be delivered. Payment is processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland), which does not share your payment details with us; Stripe’s privacy policy also applies. Stripe may also transfer data to Stripe, Inc. (USA) on the basis of the EU-US Data Privacy Framework or standard contractual clauses (Art. 45, 46 GDPR). Order and invoice data is kept for 10 years in line with statutory obligations (Art. 16 Luxembourg Commercial Code). Your cart contents are stored only locally in your browser (technically necessary).

7. Cookies and local storage – consent management

This website sets no cookies for analytics or advertising. At most, the following information is stored in your browser’s local storage:

• Functional (necessary): your choice in the consent dialog. This storage is technically necessary and does not require consent (Art. 4(3)(e) of the Luxembourg law of 30 May 2005 on privacy in electronic communications; Art. 5(3) Directive 2002/58/EC).
• Preferences (only with consent): your preferred language, so the website greets you in that language on your next visit. The legal basis is your consent (Art. 6(1)(a) GDPR).
• Statistics and marketing: not used on this website.

This data stays in your browser and is not sent to us. You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link in the footer of every page (Art. 7(3) GDPR).

8. Fonts and external links

The font used is loaded directly from our own server; no connection is made to Google or any other font provider. Links to external websites (e.g. LinkedIn, infirmier.lu, gutt-versuergt.lu, quartermaster.lu) are only opened when you click them. From then on, the privacy policy of the respective provider applies.

9. Recipients and transfers outside the EU

Our hosting provider Hostinger International Ltd. (Cyprus, EU) processes data on our behalf under a data processing agreement (Art. 28 GDPR) on servers in the European Union. We ourselves do not transfer any data to countries outside the European Economic Area (for Stripe, see above). Data is only disclosed to authorities where we are legally required to do so.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), as well as the right to withdraw consent at any time. Please contact info@in-wester.lu. No automated decision-making or profiling takes place.

11. Right to lodge a complaint

You may lodge a complaint with the supervisory authority: Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux – cnpd.public.lu.

12. Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies.

Last updated: September 2026