Website visitors, leads, demo requests, cookies, analytics, marketing and social links
| Scope: this Policy covers the public website senseliving.app only. Guest App account data, pre-check-in, PMS, access, payments, AI concierge, wellness services and Supplier Admin Panel processing are covered by the Guest App Privacy Policy and the other applicable notices available in the Legal Center. |
1. Controller and contact
The controller is Sense App S.à r.l., RCS Luxembourg B300482, registered office 115 Route d'Esch, L-1471 Luxembourg. General contact and correspondence address: 136 Rue Principale, L-5366 Munsbach, Luxembourg.
For any question regarding this Privacy Policy, the processing of your personal data or the exercise of your rights, please contact [email protected]. General enquiries: [email protected]. Support enquiries: [email protected].
2. Personal data processed on the Website
| Category | Examples | Source |
|---|---|---|
| Contact and demo data | Demo form: first name, last name, building name, work email, phone, asset type, number of units, message. Corporate form: full name, company name, email, phone, type of stay, who the request is for, total number of guests, number of children, arrival date, length of stay, estimated departure, preferred location, additional services, estimated budget. | Provided by the user. |
| Technical and security data | IP address, browser, device, operating system, URL path, timestamps, security events and server logs. | Generated automatically by the website, hosting and security systems. |
| Cookie and analytics data | Cookie IDs, consent status, pages visited, referral source, analytics events and campaign conversion events where enabled. | Generated by cookies and scripts according to CMP choices. |
| B2B commercial data | Correspondence, meeting notes, demo history, organisation profile and opt-in and opt-out status. | Provided by the user or generated through sales interactions. |
| Social link interaction | Clicks to SENSE social profiles or embedded external content where activated by the user. | User interaction and third-party platforms. |
3. Purposes, legal bases, recipients and retention
| Purpose | Data | Legal basis | Recipients | Retention |
|---|---|---|---|---|
| Operate and secure the Website | Technical logs, IP, security events | Legitimate interest, GDPR Art. 6(1)(f) | Hosting, security, infrastructure and professional IT providers | 6 to 12 months by default; longer only for incidents, legal claims or security investigations |
| Respond to demo and contact requests | Contact and demo data and communications | Pre-contractual measures, Art. 6(1)(b), and legitimate B2B interest, Art. 6(1)(f) | Email, calendar, CRM or sales-support providers; internal sales and legal teams | 24 months after the last meaningful contact, unless a longer period is required for legal claims or an active relationship |
| B2B relationship management | Business contact history, organisation profile, notes | Legitimate interest, Art. 6(1)(f), subject to the right to object | CRM and internal commercial and legal teams | Duration of the relationship plus 24 months, unless objection, suppression record or legal need requires otherwise |
| Newsletter and promotional updates | Email, preferences, opt-in and opt-out status | Consent, Art. 6(1)(a), withdrawable at any time | Email marketing provider and CRM | Until withdrawal; a suppression record is retained to evidence the opt-out |
| Non-essential analytics | Cookie IDs, usage analytics, referral data | Consent, Art. 6(1)(a), and Luxembourg ePrivacy consent | Analytics provider, only where activated through the CMP | Per the Cookie Policy, the CMP and the cookie table |
| Marketing and retargeting | Campaign IDs, conversion pixels, advertising IDs | Consent, Art. 6(1)(a) | Marketing and advertising providers, only where activated through the CMP | Per the Cookie Policy, the CMP and the cookie table |
| Legal compliance and claims | Relevant records and correspondence | Legal obligation, Art. 6(1)(c), or legitimate interest, Art. 6(1)(f) | Authorities, courts, professional advisers | Legal or limitation period applicable to the relevant claim or obligation |
4. Cookies and terminal equipment
Strictly necessary cookies may be used where required to provide the Website or store user choices. Analytics, marketing, retargeting, social plugins, embedded content and similar non-essential technologies remain disabled until valid consent is recorded through the CMP.
Users can reject non-essential cookies as easily as accepting them and withdraw consent at any time through the persistent Cookie Settings link. The Cookie Policy and the CMP preference centre contain the active cookie categories and the operational consent controls.
5. Data sharing and processors
SENSE may disclose Website personal data to processors and service providers for hosting, security, CRM, email, analytics, consent management, support, professional advice and legal compliance. SENSE does not sell personal data. Each processor is governed by appropriate contractual and security controls.
6. International transfers
Transfers outside the EEA may occur only where an adequacy decision, EU Standard Contractual Clauses, a transfer impact assessment, EU-US Data Privacy Framework certification where applicable, or another valid GDPR transfer mechanism is in place. Hosting locations and transfer mechanisms are documented per provider in the SENSE vendor register.
7. Mandatory data and consequences
Website visitors can browse the Website without submitting a demo form. If a visitor does not provide the minimum requested contact data, SENSE may be unable to respond. Non-essential cookies can be refused without denial of Website access.
8. Data subject rights
Individuals may request access, rectification, erasure, restriction, portability, objection to legitimate-interest processing and withdrawal of consent by contacting [email protected]. SENSE responds within one month, extendable where the GDPR permits.
Individuals may lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg, or through cnpd.public.lu.
9. Security
SENSE applies technical and organisational measures including encrypted transport, access control, least privilege, secure hosting, logging, vulnerability management, backup controls, incident response and vendor due diligence. Public security summaries may be made available without disclosing sensitive internal security details.
10. Changes and versions
This Policy may be updated to reflect legal, technical or operational changes. The current version is published in the Legal Center with its version number and effective date, and previous versions are archived. Material changes are announced prominently on the Website before they take effect and, where a change relies on consent, the corresponding consent is collected before the change applies.