Privacy notice

Controller

Car Repair Sàrl, 170 Z.A.E. Wolser F, L-3290 Bettembourg, Luxembourg. Questions about your data: info@car-repair.lu, 20 62 45-1.

Data collected

The public site has no user accounts. Without your consent to audience measurement, simply reading the pages starts no analytics or session recording.

Like any web server, the host technically logs incoming requests (IP address, date and time, page requested, browser). Those logs are used only for security and for keeping the site running.

Server log retention: [to be completed — period, e.g. 30 days].

Quote request

The quote request form collects your name and email address and, if you provide them, your phone number, vehicle details, description of the work and up to three photographs. This data is used only to answer your request and prepare a quote. The legal basis is the consent you give in the form.

The request and photographs are transmitted to Car Repair through its email provider. They are not stored in the registration SQLite database and are not sent to any other recipient. Emails are retained only as long as needed to handle the request and meet applicable legal obligations. You can withdraw consent by writing to the address above.

Grand Opening registration

When you register, we collect your name, email address, number of guests, selected language, and technical creation or update timestamps. This data is used only to manage attendance and send the requested confirmation. The legal basis is your consent, given through the checkbox in the form.

Registrations are stored in a SQLite database on the Car Repair server. A confirmation is transmitted by Car Repair’s email provider only to your email address; replies are directed to Car Repair. Cancellation notices are additionally copied to Car Repair. The data is not sold or used for advertising.

Trying again with the same email address does not automatically overwrite the existing registration: the form allows the guest either to edit only the number of attendees or cancel attendance. Cancellation retains the registration with a cancellation timestamp but excludes it from attendance totals. The event remains in the guest’s calendar and can be deleted there manually. Database registrations are deleted automatically on 19 October 2026. You may withdraw consent and request earlier deletion by emailing the address above.

Private Grand Opening access

For private Grand Opening access, guests use either a unique personal invitation link sent by email or a reusable link shared by phone, SMS or messaging. Guest-list domains and addresses limit only who the system may email an invitation to. A link authorises access to the form without being bound to the email address the guest enters there.

No password or second sign-in email is required. Opening a link creates a session immediately and displays the registration form. The invitation language and cryptographic hash of the session are stored in SQLite. A regular invitation session is not attached to an email address. When a management link from a confirmation is used, the registration email is attached to that session only to prefill and manage that registration. The session expires after no more than 12 hours and never grants dashboard access.

Private registrations dashboard

Registration access is limited to people who can receive a sign-in link at an @obsidiancorps.com or @car-repair.lu address. No password is stored. The single-use link expires after 15 minutes.

The authorised email address and cryptographic hashes of the link and session are stored in SQLite. Links become invalid after their first use and dashboard sessions expire after no more than seven days.

Cookies

The public pages use browser local storage only to remember your rejection of or consent to audience measurement, together with the banner version and choice date. This record is strictly necessary to manage your choice and is deleted or renewed after no more than 12 months. Umami sets no cookies.

After an authorised link is confirmed, a strictly necessary session cookie maintains event access for no more than 12 hours or, separately, dashboard authentication for no more than seven days. These cookies cannot be read by scripts and are not used for tracking.

Audience measurement and session recording

Only after you consent, the site loads Umami 3.3 from analytics.obsidiancorps.com. You choose audience measurement and session recording with heatmaps separately. The processing measures use of the site and helps identify navigation difficulties. Its legal basis is your consent (Article 6(1)(a) GDPR and Article 4(3) of Luxembourg’s amended law of 30 May 2005). Refusing does not limit any feature.

Audience measurement stores the page path and title, referring site, date and time, language, screen size, browser, operating system, device type and approximate location. Search parameters and URL fragments are excluded. The IP address received by the server is used to determine location and, with the browser and website ID, to generate an anonymous session identifier using a rotating salt; it is not stored in the Umami analytics database.

For a 15% sample of visits, session recording and heatmaps can replay pages viewed, clicks, mouse movements, scrolling and navigation for no more than five minutes. Umami masks all input fields, and the quote and registration forms are completely excluded from recordings. No named identifier is sent to Umami.

Car Repair Sàrl is the controller. Obsidiancorps s.a.r.l.s., 1 rue Pasteur, L-4642 Differdange, Luxembourg, operates the self-hosted service and receives the data as service provider. This integration sends data only to analytics.obsidiancorps.com and does not contact Umami Software. Measurement data is retained for no more than 12 months and session recordings for no more than 30 days. The data is not used for advertising, cross-site tracking, profiling or automated decision-making.

You may withdraw consent at any time using “Manage privacy” at the bottom of pages where measurement is offered. Withdrawal reloads the page to stop an active recording immediately and does not affect earlier lawful processing. You can request access to or deletion of available data using the contact address above.

Google Maps

The map is not loaded automatically. It appears only after you click the button provided.

If you display it, your IP address is sent to Google Ireland Limited, which may set its own cookies. That transfer happens only from this click onwards. The address is written out in full on the page, so you never have to load the map.

Contact by phone or email

If you call or write to us, we process what you send solely to answer your enquiry and, where relevant, to prepare a quote. It is never sold or passed to third parties for marketing.

Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction and objection. Send your request to the email address above.

You may also lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15 Boulevard du Jazz, L-4370 Belvaux.

Changes

This notice will be updated if the site or its processing changes. A material change to audience measurement will trigger a new consent request.