Privacy Policy

Last updated: 14 January 2026

ELM Development Estate SA (“ELM Development Estate”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose and protect personal data when you visit or interact with our website:

www.elmdevelopment-estate.lu

ELM Development Estate SA acts as the data controller for the personal data processed in connection with this website, within the meaning of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

We encourage you to read this Privacy Policy carefully so that you understand how and why your personal data may be processed.

1. Data Controller

The controller responsible for the processing of your personal data is:

ELM Development Estate SA
Luxembourg

Email: contact@elmdevelopment-estate.lu
Website: www.elmdevelopment-estate.lu

If you have any questions regarding the processing of your personal data or wish to exercise your rights, you may contact us at the email address above.

2. Personal Data We Collect

Depending on how you interact with our website, we may collect and process different categories of personal data.

Information you provide to us

When you voluntarily contact us or submit information through our website, we may collect information such as:

• First name and surname;

• Email address;

• Telephone number;

• Company or organisation;

• City or country of residence;

• Information contained in your message or enquiry; and

• Any other information you choose to provide to us.

You are not generally required to provide personal data simply to browse our website. However, certain information may be necessary if you wish to contact us, request information or use specific website functionalities.

Information collected automatically

When you visit our website, certain technical information may be collected automatically, depending on the cookies and technologies enabled on the website.

This information may include:

• IP address;

• Browser type and version;

• Device type;

• Operating system;

• Time zone;

• Date and time of access;

• Pages visited;

• Referring website or search terms;

• Approximate location derived from technical information; and

• Information relating to your interaction with the website.

We refer to this information collectively as “Technical Data”.

3. How We Use Your Personal Data

We may process your personal data for the following purposes:

• To operate, maintain and secure our website;

• To respond to enquiries and requests;

• To communicate with you regarding our activities, services or projects;

• To provide information you have requested;

• To manage and maintain our business relationships;

• To improve the functionality, security and performance of our website;

• To monitor and prevent fraudulent, abusive or unlawful activity;

• To comply with applicable legal and regulatory obligations; and

• Where applicable, to send communications or newsletters where you have provided the necessary consent.

We will not process your personal data for purposes incompatible with those described in this Privacy Policy unless we are legally permitted or required to do so.

4. Legal Basis for Processing

Depending on the circumstances, we process personal data on one or more of the following legal bases under Article 6 of the GDPR:

Performance of a contract
Where processing is necessary to enter into or perform a contract with you.

Legitimate interests
Where processing is necessary for our legitimate business interests, provided that those interests are not overridden by your fundamental rights and freedoms.

Consent
Where you have given us your consent to process your personal data for a specific purpose. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Legal obligation
Where processing is necessary for compliance with a legal or regulatory obligation applicable to ELM Development Estate SA.

The specific legal basis applicable to a particular processing activity will depend on the circumstances and nature of the processing.

5. Cookies and Similar Technologies

Our website may use cookies and similar technologies to ensure its proper functioning, improve user experience, analyse website traffic and, where applicable, provide additional functionalities.

Cookies may include:

• Strictly necessary cookies, which are required for the website to function properly;

• Analytics cookies, where applicable, which help us understand how visitors use the website; and

• Marketing or other optional cookies, where applicable and subject to the appropriate consent requirements.

Where required by applicable law, non-essential cookies will only be activated after you have provided the necessary consent.

You may manage or withdraw your cookie preferences through the cookie management mechanism made available on our website.

Our Cookie Policy, where applicable, provides further information regarding the cookies used, their purposes, retention periods and relevant third parties.

6. Data Sharing and Recipients

We do not sell your personal data.

We may disclose personal data to trusted third parties where this is necessary for the purposes described in this Privacy Policy, including, where applicable:

• Website hosting and technical service providers;

• IT and cybersecurity providers;

• Website analytics providers;

• Communication and email service providers;

• Professional advisers;

• Legal, accounting or other professional service providers;

• Competent public authorities or regulatory bodies where required by law; and

• Other service providers acting on our behalf and under appropriate contractual arrangements.

Where third parties process personal data on our behalf, we take appropriate measures to ensure that such processing is carried out in accordance with applicable data protection requirements.

7. International Data Transfers

Where personal data is transferred outside the European Economic Area (“EEA”), we will ensure that the transfer is carried out in accordance with Chapter V of the GDPR.

Depending on the circumstances, transfers may be based on:

• An adequacy decision adopted by the European Commission;

• Appropriate safeguards, such as the European Commission's Standard Contractual Clauses; or

• Another lawful transfer mechanism recognised under the GDPR.

We will not state that personal data is transferred to a particular country or provider unless such a transfer actually takes place.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, accounting, regulatory or reporting requirements.

The applicable retention period will depend on:

• The nature of the personal data;

• The purpose for which it is processed;

• Whether we have an ongoing relationship with you;

• Applicable legal or regulatory requirements; and

• Our legitimate business needs.

When personal data is no longer required, we will securely delete or anonymise it where appropriate.

9. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

These measures may include appropriate access controls, security procedures, technical safeguards and organisational measures.

However, no method of transmission over the Internet or method of electronic storage can be guaranteed to be completely secure.

10. Your Rights Under the GDPR

Subject to the conditions and limitations provided by applicable law, you may have the following rights in relation to your personal data:

• Right to information — to receive clear information about how your personal data is processed;

• Right of access — to obtain confirmation as to whether your personal data is being processed and, where applicable, access to that data;

• Right to rectification — to request correction of inaccurate or incomplete personal data;

• Right to erasure — to request deletion of your personal data in certain circumstances;

• Right to restriction of processing — to request that processing of your personal data be restricted in certain circumstances;

• Right to data portability — to receive certain personal data in a structured, commonly used and machine-readable format;

• Right to object — to object to certain processing activities, including processing based on legitimate interests; and

• Right to withdraw consent — where processing is based on consent, you may withdraw that consent at any time.

You may also have rights concerning automated decision-making and profiling where applicable.

The exercise of these rights is subject to the conditions and exceptions provided for under the GDPR.

For further information on these rights, please contact us at:

contact@elmdevelopment-estate.lu

The CNPD confirms that these rights and the related information obligations form part of the GDPR framework applicable in Luxembourg.

11. How to Exercise Your Rights

To exercise any of your rights, please contact us by email at:

contact@elmdevelopment-estate.lu

To protect your personal data, we may need to verify your identity before processing certain requests.

We will respond to your request within the time period required by applicable data protection legislation.

12. Complaints

If you believe that your personal data has been processed in violation of applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.

In Luxembourg, the competent supervisory authority is:

Commission nationale pour la protection des données (CNPD)

The CNPD is the Luxembourg supervisory authority responsible for data protection matters.

You may find further information regarding your rights and the complaint procedure on the CNPD's official website:

Commission nationale pour la protection des données (CNPD)

13. Third-Party Websites

Our website may contain links to websites operated by third parties.

ELM Development Estate SA is not responsible for the privacy practices, content or security of third-party websites. We recommend that you review the privacy policies of any third-party website before providing personal data.

14. Automated Decision-Making and Profiling

Unless expressly stated otherwise, ELM Development Estate SA does not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects concerning you.

Where such processing is introduced in the future, we will provide the information required by applicable data protection legislation.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our activities, technology, legal requirements or regulatory obligations.

The updated version will be published on this page together with the relevant “Last updated” date.

We encourage you to review this Privacy Policy periodically.

16. Contact

If you have any questions regarding this Privacy Policy, our data protection practices or the processing of your personal data, please contact:

ELM Development Estate SA
Luxembourg

Email: contact@elmdevelopment-estate.lu
Website: www.elmdevelopment-estate.lu

Last updated: 14 August 2026