Privacy Policy

B&C Consulting Privacy Policy Last updated: October 2026 This policy explains which personal data B&C Consulting collects when you visit our website, contact us, use our services or write to us on WhatsApp, why we do so, how long we keep it, and which rights you have. We process personal data in line with the EU General Data Protection Regulation (GDPR) and Luxembourg law. 1. Who is responsible B&C Consulting S.à r.l. Zone Industrielle Rolach, Hall n°2, L-5280 Sandweiler, Luxembourg RCS B169121, VAT LU 25481811, business permit n° 10026849/1 Email: info@bcconsulting.lu Phone: +352 691 230 974 For any question about your personal data, write to info@bcconsulting.lu. 2. Visiting our website When you visit our website, our servers and our security and delivery provider (Cloudflare) process technical data: your IP address, browser and device type, the pages you request, the time of the request and error information. We need this to deliver the website, keep it secure and fix problems. Error reports (Sentry) are configured not to send personal data such as IP addresses, cookies or user details. • Legal basis: our legitimate interest in a secure, working website (Article 6(1)(f) GDPR). • Retention: server and error logs are kept for security purposes for at most 2 years and then deleted. 3. Cookies and analytics We use strictly necessary cookies and similar storage to run the website, for example to keep forms secure and to remember your cookie choice. Only if you accept analytics do we load Google Analytics 4 through Google Tag Manager, to understand how visitors use the site. You can decline, and change your choice at any time. Details are in our Cookie Policy. • Legal basis: necessary cookies, our legitimate interest (Article 6(1)(f) GDPR); analytics, your consent (Article 6(1)(a) GDPR). 4. Contact form When you use our contact form, we receive your name, email address, the type of request (sales or technical support) and your message. The form sends it by email to our sales or support team, who use it to answer you. • Legal basis: handling your request and steps you ask for before a contract (Article 6(1)(b) GDPR), and our legitimate interest in answering enquiries (Article 6(1)(f) GDPR). • Retention: as long as needed to handle your request and the follow-up, and no longer than 2 years after our last contact, unless it becomes part of a customer relationship (section 7). After that the emails are deleted. 5. Trade shows and lead forms At trade shows (for example SEMA) we offer a short form. We collect your name, email address, type of business, the product you are interested in, your country, your consent and, for abuse prevention, the IP address of the submission. Our sales team uses it to contact you about our services. • Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time by writing to info@bcconsulting.lu; this does not affect contact that took place before. • Retention: until you withdraw your consent, and no longer than 2 years after our last contact; after that the data is deleted automatically. 6. WhatsApp support and AI-assisted handling When you contact us on WhatsApp, we process your messages to answer your question and to support you. • What we process: your WhatsApp phone number and profile name (and username, if you share one), the content of your messages, and the photos, documents and other files you send us. • WhatsApp and Meta: our WhatsApp number runs on the WhatsApp Business Platform of Meta Platforms Ireland Limited. Meta transmits and processes these messages on our behalf, as our processor. Your use of WhatsApp itself is also subject to WhatsApp's own terms and privacy policy. • Our support system: your messages and files are stored in our own support system. Only authorised staff have access, each limited to the requests they handle. • Automatic reply: when you start a new conversation, you receive one standard automatic reply. This text is fixed and not written by AI. • AI-assisted handling: to route and answer requests faster, the content of your messages, including photos, is analysed by an AI model (Claude, provided by Anthropic PBC). The AI suggests a summary, a category, the right department and a draft reply. Our staff review these suggestions and decide what happens; the AI never sends messages to you and takes no decisions with legal or similarly significant effects on you. Before the analysis, we remove obvious sensitive data such as card numbers, bank account numbers and passwords. Anthropic processes this data as our processor and does not use it to train its models. • Legal basis: handling your request and providing the support you ask for (Article 6(1)(b) GDPR), and our legitimate interest in handling support requests quickly and consistently (Article 6(1)(f) GDPR). You can object to the AI-assisted handling (section 11). • Retention: 2 years after the last message between you and us. After that, your messages, files, conversations and contact details are deleted automatically; support tickets are kept for statistics only, without any personal data. Please do not send passwords or payment details through WhatsApp. 7. Customer account, file service and orders Our customer area (account registration and login on www.bcconsulting.lu/app) is used to order and receive our services, such as file service and software. For this we process your account and company details (such as your name, company, contact details and VAT number), your orders and invoices, and the vehicle and ECU data and files you upload for a job. • Legal basis: performing our contract with you (Article 6(1)(b) GDPR) and our legal obligations, such as accounting and tax rules (Article 6(1)(c) GDPR). • Payments: you can pay by card through Stripe, through PayPal, or by bank transfer. Card and PayPal payments are processed by Stripe and PayPal; we never receive or store your card details. • Retention: account data as long as your account is active; invoices and accounting records for 10 years, as required by Luxembourg law; ECU files and job data you upload for support are deleted after 50 days. 8. Emails from us Service emails (for example confirmations, password resets and answers to your requests) are sent through our email provider Mailgun, in the EU, including the emails from our customer area. We only send you news or offers if you agreed to it or, as an existing customer, about similar products and services; every such email lets you unsubscribe. • Legal basis: performing our contract (Article 6(1)(b) GDPR), your consent (Article 6(1)(a) GDPR) or our legitimate interest in informing existing customers (Article 6(1)(f) GDPR). 9. Who receives your data We never sell your personal data. We share it only with service providers who process it on our behalf and under a data processing agreement, and only as far as they need it: • Combell, in Belgium (hosting of our website and systems); • Cloudflare (website security and delivery); • Mailgun (sending email, EU region); • Google (analytics, only with your consent); • Sentry (error monitoring); • Stripe and PayPal (payments); • Meta Platforms Ireland Limited (WhatsApp Business Platform); • Anthropic PBC (AI-assisted handling of support requests). We may also disclose data when the law requires it, for example to tax authorities, or to protect our rights. 10. Transfers outside the European Economic Area Some providers (such as Google, Cloudflare, Meta, Sentry, Stripe, PayPal and Anthropic) may process data outside the European Economic Area, for example in the United States. In that case the transfer is protected by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or by the EU Standard Contractual Clauses. 11. Your rights You have the right to: • access the personal data we hold about you and receive a copy; • have incorrect data corrected; • have your data deleted; • restrict how we use it; • receive data you gave us in a common, machine-readable format; • object to processing based on our legitimate interest, including the AI-assisted handling of your support messages; • withdraw your consent at any time, without affecting earlier processing. To use these rights, write to info@bcconsulting.lu. We answer within one month. You can also lodge a complaint with the Luxembourg data protection authority: Commission nationale pour la protection des données (CNPD), www.cnpd.lu. 12. Security We protect your data with encrypted connections (HTTPS), access limited to authorised staff, encrypted storage of passwords and access keys, and regular software updates. No system is completely secure; if a data breach affects you, we will inform you and the CNPD as the law requires. 13. Children Our services are intended for professionals and businesses. We do not knowingly collect data from children under 16. 14. Changes to this policy We update this policy when our services or the law change. The date at the top shows the latest version.