Privacy Policy

1. Who is responsible for processing your data?

The controller responsible for the processing activities described in this Privacy Policy is:

Luxembourg Trade and Companies Register: B204620
Contact: dpo@myhr.lu

2. What data do we collect, why do we collect it and on what legal basis?

2.1. Browsing our website

When you visit our website, our servers automatically record certain technical information, including your IP address, the date and time of the request, the pages visited, your browser type and your operating system.

This data is used to ensure the operation and security of the website, prevent abuse and diagnose technical incidents. This processing is based on our legitimate interest in operating an available and secure service (Article 6(1)(f) GDPR).

2.2. Demo and free trial requests

Our demo and free trial request forms may collect your name, professional email address, telephone number, company name and any information you choose to provide in a free-text field.

We use this information to respond to your request, organise the demo or trial and provide the related commercial follow-up. This processing is necessary in order to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).

This data is recorded in our customer relationship management system, which is developed and hosted by myHR.

2.3. Newsletter

If you subscribe to our newsletter, we retain your email address in order to send you our publications. Subscription is based on a double opt-in process: you receive a confirmation email and your subscription only becomes effective after you have confirmed it.

This processing is based on your consent (Article 6(1)(a) GDPR). You may withdraw your consent at any time by using the unsubscribe link included in each mailing. The withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

We do not send offers from third parties and do not disclose your email address to third parties for marketing purposes.

2.4. Protection of forms against abuse

Our forms are protected by Google reCAPTCHA in order to detect and prevent automated submissions, abuse and fraudulent activities. In this context, reCAPTCHA analyses certain technical information and signals relating to the device, application and use of the service in order to assess whether an interaction presents a risk of being automated.

Google acts as a processor for data processed in connection with reCAPTCHA and processes this data in accordance with the Google Cloud terms and its Cloud Data Processing Addendum. According to Google, the information collected by reCAPTCHA is used to provide, maintain and improve the service as well as for general security purposes and is not used for personalised advertising.

The use of Google reCAPTCHA requires your consent. If you refuse its activation, no data is transmitted to Google through reCAPTCHA, but you will not be able to submit forms protected by this service.

You may still contact us directly by email at support@myhr.lu without using these forms.

3. Cookies and tracking technologies

A cookie is a small file stored on your device when you visit our website. Cookies that are strictly necessary for the operation of the website may be used without your consent. Other cookies and tracking technologies are only activated after obtaining your consent.

• Google Analytics - audience measurement used in particular to analyse the pages visited, the origin of visits and the use of the website. This service is provided by Google and is subject to your consent.
• Google reCAPTCHA - protection of forms against automated submissions, abuse and fraudulent activities. reCAPTCHA processes certain technical information relating to your device and use of the service in order to assess the risk associated with an interaction. reCAPTCHA is only activated after obtaining your consent. If you refuse its activation, you will not be able to submit forms protected by this service, but you may contact us directly by email.
• Crazy Egg - analysis of website usage, including through heatmaps (Snapshots) and session recordings (Recordings). Data used for Snapshots is aggregated and anonymised and visitors' IP addresses are not retained. In session recordings, characters entered by visitors into form fields are masked. This service is only activated after obtaining your consent.

You can accept, refuse or modify your choices regarding non-essential cookies and tracking technologies through our cookie management tool. You may withdraw your consent at any time as easily as you gave it.

4. Who receives your data?

Your data is neither sold nor rented to third parties. It is accessible to members of our team who need it in the performance of their duties.

It may also be transmitted to the following service providers in connection with the services they provide to myHR:

• Hetzner Online GmbH - website hosting in Germany;
• Google - processor for the reCAPTCHA service used to protect forms against abuse and automated submissions, and provider of the Google Analytics audience measurement service;
• Crazy Egg, Inc. - analysis of website usage.

We may also be required to disclose certain data where required by law or in response to a request from a competent judicial or administrative authority, within the limits provided for by applicable law.

In the event of a merger, acquisition, restructuring or transfer of all or part of our business, certain data may be transferred to the entity concerned to the extent necessary for the transaction and in compliance with applicable data protection legislation.

5. Transfers outside the European Union

The website is hosted in Germany and the data that you provide to us directly through our forms is stored within the European Union.

The use of certain services provided by Google and Crazy Egg may, however, result in data being transferred to or accessed from countries outside the European Economic Area, including the United States.

Where such transfers take place, they are governed in accordance with the requirements of the GDPR, including on the basis of an applicable adequacy decision or, where necessary, appropriate safeguards such as the Standard Contractual Clauses adopted by the European Commission.

For the relevant Google Cloud services, including reCAPTCHA, Google provides mechanisms in its Cloud Data Processing Addendum to govern international data transfers in accordance with the GDPR. Where a transfer to a country that does not benefit from an adequacy decision requires appropriate safeguards, Google provides, in particular, for the application of the Standard Contractual Clauses adopted by the European Commission.

Crazy Egg states that it makes available to its clients a GDPR-compliant Data Processing Agreement (DPA) as well as the European Commission's Standard Contractual Clauses intended to govern international data transfers where applicable.

6. How long do we retain your data?

• Technical and website connection logs: 12 months.
• Demo and free trial requests that do not result in a contract: 3 years from the last contact.
• Data used to send the newsletter: until you withdraw your consent or unsubscribe.
• Audience measurement data: 14 months.

After you unsubscribe from the newsletter, your email address is no longer used to send the newsletter. Certain information relating to your consent and its withdrawal may nevertheless be retained for a limited period where necessary to demonstrate compliance with our legal obligations.

Where a request results in a contract, certain data required to manage the commercial and contractual relationship is retained for the duration of the contract and subsequently for the periods necessary to comply with our legal and accounting obligations and for the establishment, exercise or defence of legal claims.

7. Security

We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access, disclosure, alteration or destruction. These measures include, in particular, encryption of communications, access controls and segregation according to roles, as well as hosting in data centres certified to ISO/IEC 27001.

Despite the measures implemented, no information system or means of electronic transmission can guarantee absolute security.

8. Your rights

Subject to the conditions laid down by the GDPR, you have the following rights in relation to your personal data:

• right of access: to obtain confirmation as to whether your data is being processed and, where applicable, to receive a copy;
• right to rectification: to have inaccurate data corrected or incomplete data completed;
• right to erasure, in the circumstances provided for by the GDPR;
• right to restriction of processing, in the circumstances provided for by the GDPR;
• right to object, in particular to processing based on our legitimate interests;
• right to data portability, where the conditions set out in Article 20 GDPR are met;
• right to withdraw your consent at any time where processing is based on consent.

To exercise these rights, you may contact us at dpo@myhr.lu.

We will respond to your request within the time limits laid down by the GDPR, in principle within one month of receipt. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. In such cases, we will inform you of the extension and the reasons for it.

If you believe that the processing of your personal data does not comply with applicable data protection law, you have the right to lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15 boulevard du Jazz, L-4370 Belvaux, Luxembourg, telephone (+352) 26 10 60 - 1, cnpd.public.lu.

9. Mandatory information in forms

Fields identified as mandatory in our forms are necessary for us to process your request. If you do not provide this information, we may not be able to respond to your request or organise a demo or trial.

10. Changes to this Privacy Policy

We may amend this Privacy Policy to reflect changes to our website, services, tools or applicable legislation. The date of the latest update is displayed at the top of this page.

In the event of a material change, we will take appropriate measures to inform you, for example by displaying a prominent notice on the website.