Last updated: 2 October 2026
We take the protection of your personal data seriously. In accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Luxembourg data protection law, this privacy policy explains which data we process when you visit our website www.a-scheiwesch.com, order in our online shop or contact us, for what purposes and on what legal basis, and what rights you have.
1. Controller
A Schéiwesch
Owner: François Kieffer
30, rue d’Oetrange
L-5333 Moutfort
Luxembourg
Phone: +352 691 499 021
Email: info@a-scheiwesch.com
VAT no.: LU12542423
For any questions about data protection and to exercise your rights, please contact us at info@a-scheiwesch.com or at the postal address above. We have not appointed a data protection officer, as there is no legal obligation to do so.
2. Hosting, content delivery network and server log files
Our website runs on the “Managed WordPress” product of Host Europe GmbH (Hürth, Germany) in a European data centre. To deliver the website quickly and securely, a content delivery network (CDN) operated by Cloudflare, Inc. (San Francisco, USA) and provided by the host is used. When you visit the website, technically necessary data sent automatically by your browser is processed: IP address, date and time of access, page requested, referrer URL, browser type and operating system. Cloudflare sets the cookie __cf_bm to detect automated traffic (bots).
The legal basis is our legitimate interest in a secure, fast and functional website (Art. 6(1)(f) GDPR). We have a data processing agreement with the host (Art. 28 GDPR). Log data is stored only for a limited period and then deleted.
3. Online shop, customer account and order processing
When you order in our shop, we process the data you provide during checkout: first and last name, address, email address, phone number, the products ordered, the chosen pickup location or pickup/delivery date, the payment method and any notes on your order. We need this data to accept, prepare, hand over or deliver and invoice your order. We send you an order confirmation and status updates by email.
You can create a customer account. It stores your contact details and past orders so that you can order more quickly in future. You can ask us to delete your account at any time. Customer accounts that have never been used to place an order are deleted automatically after 24 months without a login.
The legal basis is the performance of the sales contract or of pre-contractual measures (Art. 6(1)(b) GDPR). Because of statutory commercial and tax retention obligations (Art. 16 of the Luxembourg Commercial Code), we keep order and invoice data for 10 years (Art. 6(1)(c) GDPR).
Payment: you can pay in cash on pickup or by bank transfer. For bank transfers, our bank provides us with the usual payment information (account holder’s name, IBAN, amount, reference). No card data is processed on the website.
To manage pickup and delivery days and to number orders sequentially, we use extensions that run solely on our server and do not transmit any data to third parties.
4. Sending emails
Emails sent by our website (such as order confirmations, status updates, password resets and form messages) are delivered via the email service Resend (Resend, Inc., San Francisco, USA). Your email address, your name and the content of the email are transmitted to Resend for this purpose. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) or our legitimate interest in reliable delivery (Art. 6(1)(f) GDPR).
For troubleshooting, we keep a copy of sent emails in our website database. These copies are deleted automatically after 90 days.
5. Newsletter and Mailchimp
You can subscribe to our newsletter using a sign-up form on our website or the checkbox at checkout. The checkbox is not pre-ticked. For the newsletter we process your email address and, where provided, your name and preferred language. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time using the link in every newsletter or by emailing us.
We send the newsletter via Mailchimp (The Rocket Science Group LLC / Intuit Inc., Atlanta, USA). When you sign up on our website, you first receive an email asking you to confirm your subscription (double opt-in). Our shop is connected to Mailchimp: your order data (products ordered, order value, date) is transmitted to Mailchimp only if you have subscribed to the newsletter. We use it to send you relevant information and to measure the newsletter’s performance (for example whether an email was opened). Mailchimp can also detect an unfinished shopping cart and send a reminder. Order data of customers who have not subscribed is not transmitted to Mailchimp. We have a data processing agreement with Mailchimp.
6. Contact forms and contact by email or phone
When you contact us via a contact or pre-order form, by email or by phone, we process the data you provide (such as name, email address, phone number and your message) to handle and answer your request. Form messages are sent to us by email (see section 4).
The legal basis is the performance of pre-contractual measures or of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete your request once it has been fully dealt with, and at the latest three years after the last contact, unless it leads to a contract.
7. Website security and spam protection
To protect our website against attacks and misuse, we use the security solution Wordfence (firewall and malware scanner). It runs on our server and processes, among other things, IP addresses, requested URLs, browser identifiers and failed login attempts in order to detect and block attacks. To update its security rules and check known malicious IP addresses, Wordfence exchanges data with its provider Defiant, Inc. (USA).
Our forms and account registration are protected by invisible form fields (“honeypot”) that only automated programs (bots) fill in. This check runs solely on our server, sets no cookies and transmits no data to third parties.
The legal basis is our legitimate interest in the security of our website and in preventing attacks and spam (Art. 6(1)(f) GDPR). Security logs are kept for no more than six months unless they are needed longer to investigate a specific incident.
8. Cookies and consent management
Cookies are small text files stored on your device. We use strictly necessary cookies without which the shop cannot work, for example for the shopping cart, logging into your customer account, your language choice and your cookie choice. The legal basis for strictly necessary cookies is Art. 4(3)(e) of the Luxembourg Law of 30 May 2005 on privacy in electronic communications, in conjunction with Art. 6(1)(f) GDPR. For all other cookies and services we ask for your consent (Art. 6(1)(a) GDPR). A list of all cookies is available in our cookie policy.
We use the plugin Complianz to manage your consent. It runs entirely on our own server and transmits no data to its developer or any other third party. Services that require consent (Google Analytics and Google Maps) are loaded only after you have agreed. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, we treat it as a refusal. You can withdraw or change your consent at any time using the “Manage consent” button at the edge of the screen or in our cookie policy.
9. Web analytics with Google Analytics
If you have consented to the “Statistics” category, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), integrated via the Google Site Kit plugin. Google Analytics records how visitors use our website (such as pages viewed, time on site, device type and approximate region) and sets the cookies _ga and _ga_* for this purpose. Google Analytics 4 does not store IP addresses. Data may be transferred to Google LLC in the USA. We use these statistics solely to improve our offering; they are not combined with your order data.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. The data is deleted after 14 months.
10. Google Maps
On our contact page we embed a map from Google Maps (Google Ireland Limited, Dublin, Ireland). When the map loads, your IP address and technical browser data are transmitted to Google; data may be transferred to Google LLC in the USA and Google may set cookies. The map is loaded only after you have consented (“Marketing” category); until then you see a placeholder (Art. 6(1)(a) GDPR).
Links to social networks: our website contains simple links to our Instagram and Facebook pages and to content on RTL Play. These are not embedded content; no data is transmitted to these providers unless you click a link.
Fonts: the fonts used on our website are loaded locally from our server; there is no connection to Google Fonts.
11. Backups
To protect against data loss, our host regularly makes backup copies of the website, including its database. These backups also contain the personal data described in this policy; they are stored in the host’s data centre in Europe and overwritten automatically when the host’s retention period ends. The legal basis is our legitimate interest in data security (Art. 6(1)(f) GDPR).
12. Transfers to third countries and recipients
Some of the providers mentioned (Cloudflare, Resend, Mailchimp, Google, Defiant) are based in the USA or transfer data there. Such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).
Within our business, only the people who need your data to handle your order or request have access to it. The only external recipients are the service providers named in this policy, our bank for bank transfers, our accountant for bookkeeping and, where required by law, public authorities. We do not sell your data.
13. Your rights
Under the GDPR you have the following rights:
- access to the data we hold about you (Art. 15 GDPR);
- rectification of inaccurate data (Art. 16 GDPR);
- erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR), subject to statutory retention obligations;
- data portability (Art. 20 GDPR);
- objection to processing based on our legitimate interest (Art. 21 GDPR);
- withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR).
To exercise your rights, simply write to info@a-scheiwesch.com.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg, cnpd.public.lu.
14. Obligation to provide data, no automated decision-making
Providing your data is voluntary. However, without the information marked as required at checkout or in a form, we cannot process your order or request. No automated decision-making, including profiling (Art. 22 GDPR), takes place.
15. Changes to this privacy policy
We update this privacy policy when our website or the legal requirements change. The version published on this page applies.