Privacy policy

Data controller

The data controller is [LEGAL ENTITY NAME], 33 Boulevard Prince Henri, [L-POSTCODE] Luxembourg. Privacy contact / Data Protection Officer (where appointed): [DPO NAME OR FUNCTION] — [DPO EMAIL]. For any privacy-related request, you may also write to contact@deltacc.net.

Categories of data and sources

Depending on how you interact with us, we may process:

• Contact-form data you submit on this site: name, work email, company, industry, message, GDPR consent.
• Recruitment data: CV, cover letter, application details and any other information you share through our recruitment platform (Workable).
• Technical and server logs collected automatically (e.g. IP address, user-agent, timestamps), used to operate and secure the site.
• Cookies and similar technologies — see our Cookie Policy.

Purposes and legal bases

We process personal data for the purposes and on the legal bases listed below (GDPR Article 6):

• Responding to enquiries and managing our client relationships — pre-contractual measures at your request (Art. 6(1)(b)) and/or our legitimate interest in operating our business (Art. 6(1)(f)).
• Recruitment — pre-contractual measures at your request (Art. 6(1)(b)) and, where applicable, your consent (Art. 6(1)(a)).
• Operating and securing the website (server logs, abuse prevention, rate limiting) — our legitimate interest (Art. 6(1)(f)).
• Analytics and measurement — your consent (Art. 6(1)(a)) collected via our cookie banner; you can withdraw it at any time.

Recipients and processors

We rely on a small set of carefully selected processors who process personal data on our behalf and under data-processing agreements (DPAs):

• Vercel Inc. — website hosting, CDN and edge functions.
• Resend — transactional email delivery for the contact form.
• Sanity — content management system (where used to publish editorial content).
• Workable — recruitment platform (job-board, applications, candidate management).
• [ANALYTICS PROVIDER TO CONFIRM] — website analytics, loaded only after consent.
• Authorised members of our staff and group entities, on a need-to-know basis.

International transfers

Some of our processors are established outside the European Economic Area. Where this is the case, transfers take place on the basis of an adequacy decision of the European Commission or, where none applies, of appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs), supplemented by additional technical and organisational measures where required. Specific transfer mechanisms per processor are documented internally and available on request — [TRANSFER DETAILS PER PROCESSOR TO CONFIRM].

Retention periods

We keep personal data only for as long as needed for the purposes set out above and to comply with our legal obligations. Indicatively:

• Contact-form data — [CONTACT RETENTION TO CONFIRM, e.g. 24 months from the last interaction].
• Recruitment data — [RECRUITMENT RETENTION TO CONFIRM, e.g. up to 24 months after the end of the recruitment process, subject to your consent for talent-pool retention].
• Server logs — [LOGS RETENTION TO CONFIRM, e.g. 12 months].
• Cookies and analytics — see the Cookie Policy and the cookie table for per-cookie durations.

Your rights

Subject to the conditions set by the GDPR, you have the right to access your personal data, to obtain rectification or erasure, to restrict or object to certain processing, to data portability, and to withdraw any consent you have given (without affecting the lawfulness of processing carried out before the withdrawal). To exercise these rights, please write to contact@deltacc.net. We may need to verify your identity before responding.

Lodging a complaint

If you consider that our processing of your personal data infringes data-protection law, you have the right to lodge a complaint with the Luxembourg supervisory authority: Commission nationale pour la protection des données (CNPD) — 15 Boulevard du Jazz, [L-POSTCODE] Belvaux, Luxembourg — [CNPD WEBSITE / PHONE TO CONFIRM].

Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access — including access controls, encryption in transit, secret-management, regular reviews and supplier due diligence.

Recruitment data — specific information

Applications submitted through our Careers page are processed via Workable. The data you provide (CV, cover letter, application details) is used to assess your candidacy and to communicate with you. Where you give us consent, we may keep your file in a talent pool to consider you for future openings — you can withdraw this consent at any time. Retention: [RECRUITMENT RETENTION TO CONFIRM].

Changes to this policy

We may update this policy from time to time. Material changes will be flagged on this page with a new "last updated" date and, where appropriate, communicated through the site.