Legal
Privacy policy
Last updated:
Controller and contact details
The controller is Lux Vestra Group LLC, a US company operating the Vestra Lab brand. For any privacy enquiry, write to luxvestraai@gmail.com. Data protection officer (DPO): not appointed. This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679.
Data we collect
Through the “Book a call” form we collect name, surname, email, phone, message, services of interest and, if you provide them, whether you are an individual, professional or business, company name, role, industry, team size, current website, indicative budget, timing, preferred contact method and how you heard about us; plus your consent choices, the page you wrote from and its language. We do not ask individuals for business details. Name, surname, email, message and privacy consent are needed to handle your enquiry; other fields are optional. If you book a call, Google Calendar collects your contact details and chosen time under its own notice. The hosting provider may process technical browsing and security data. Please do not include sensitive data in your message.
AI process analysis
Only when you request an analysis, your process description is sent to Lovable AI Gateway and the AI model to generate suggestions under Article 6(1)(b) GDPR. Do not include personal or sensitive data, credentials or confidential information. Descriptions and results are not saved in the website’s database; providers may process technical data needed for the service under their own terms. Processing may occur outside the EEA; contact luxvestraai@gmail.com for information about providers and applicable safeguards. Results are preliminary and do not make decisions with legal effects.
Purposes and lawful bases
Responding to enquiries and taking pre-contractual steps: Article 6(1)(b) GDPR. Legal obligations: Article 6(1)(c). Site security and operation: legitimate interests, Article 6(1)(f). Marketing: only with separate, optional consent under Article 6(1)(a), which you can withdraw at any time. We do not profile you or make automated decisions.
Retention
Enquiries sent through the site are kept for 24 months and then deleted. Marketing consent lasts until withdrawn.
Recipients
Data is processed by Lux Vestra Group LLC and the providers needed to deliver the service: hosting Lovable; database Supabase, with servers in the United States (Oregon); call booking Google Calendar. It may be disclosed to authorities where required by law. It is never published or sold.
Transfers outside the EU
Data is processed by Lux Vestra Group LLC, a company based in the United States, and stored on servers in the United States (Oregon). When you send the form, your data is therefore transferred outside the European Economic Area. For information about the transfer, write to luxvestraai@gmail.com.
Your rights and complaints
You may request access, rectification, erasure, restriction and portability, object to processing and withdraw consent by writing to luxvestraai@gmail.com. You may lodge a complaint with the Italian data protection authority, Garante (www.garanteprivacy.it), or the authority in your Member State.