Privacy Policy

1. Data We Collect

We only collect data necessary to perform our role as a direct provider of private office spaces. This may include:

• Business contact details (e.g., name, job title, company, email address, phone number)
• Business contact details (e.g., name, job title, company, email address, phone number)
• Business preferences and requirements (e.g., office size, term length, amenities)
• Correspondence (e.g., emails, inquiries, LinkedIn messages)
• Technical information (website usage statistics)
• Operational data (e.g., badge photos for access, visitor logs)

We do not collect sensitive personal data (e.g., health, religion, biometric data) unless legally required or explicitly provided for a specific purpose (e.g., compliance checks).

2. Purpose of Processing

We process your data solely to:

• Prepare and perform office lease agreements
• Manage day-to-day operations (e.g., access control, mail handling, invoicing)
• Communicate with you about your lease and our services
• Comply with legal obligations (e.g., record keeping under Luxembourg law)
• Improve our website and services

3. Data Sharing

To provide our office lease services, we may share your business contact details and relevant preferences with:

• Processors (e.g., IT/facility providers under data processing agreements)
• Professional advisors (e.g., accountants, lawyers) when required
• Public authorities if legally obliged (e.g., tax audits)

We do not sell your data to third parties for marketing purposes.

4. Legal Basis

We process personal data based on the following GDPR grounds:

• Performance of a contract (to manage your office lease)
• Legitimate interests (to operate our services and improve them)
• Legal obligations (to maintain records or comply with regulatory requirements)
• Consent (where explicitly required, e.g., for newsletters or certain marketing activities)

5. Data Retention

We retain personal data only as long as necessary for the purpose and as required by law (e.g., 10 years under Luxembourg tax/commercial obligations for lease records). Business inquiry data is normally deleted or anonymized within 12 months of the last contact, unless a longer retention period is legally required or explicitly agreed.

6. Data Security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse, including:

• Encrypted communication channels (SSL/TLS)
• Restricted access to personal data within Hubstance
• Regular review of security measures in line with industry standards

7. International Transfers

Hubstance primarily processes and stores data within the European Economic Area (EEA). If transfers outside the EEA are needed (e.g., for global clients), we will ensure adequate safeguards (e.g., EU Standard Contractual Clauses).

8. Your Rights

As a business representative, you have the following GDPR rights regarding your personal data:

• Right of access – request a copy of your data
• Right to rectification – correct inaccurate data
• Right to erasure – request deletion of your data (where legally possible)
• Right to restriction – limit processing in certain circumstances
• Right to data portability – request transfer of your data to another service
• Right to object – object to processing based on legitimate interests or direct marketing

Requests can be made via info@hubstance.eu. We will respond within 30 days. You can also reach out to the Luxembourg data protection authority (CNPD: www.cnpd.public.lu, +352 26 25 00 1).

9. Changes

We may amend this Privacy Policy at any time. Material changes will be communicated via email, website notice, or other channels at least 14 days before taking effect. The latest version will always be available on our website.

10. Contact

If you have questions about this Privacy Policy or how we process your data, please contact us at: