Privacy Policy

Effective date: 15 July 2026

1. Who we are

The website vmerci.lu is operated by Clickbye Sàrl, a private limited liability company (société à responsabilité limitée) incorporated under Luxembourg law, operating the Vmerci brand and website (vmerci.lu). Vmerci is a digital marketing agency based in Luxembourg, founded by Nessim Medjoub.

Data controller within the meaning of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679):

• Legal name: Clickbye Sàrl (private limited liability company / société à responsabilité limitée incorporated under Luxembourg law)
• Registered office: 85 rue de Reckenthal, L-2410 Strassen, Luxembourg
• Trade register: RCS Luxembourg B211848
• Intra-community VAT: LU29281505
• Contact: [email protected]

Clickbye Sàrl has not appointed a Data Protection Officer, as such an appointment is not required given the nature and scale of the processing. Requests concerning your data can be sent to [email protected].

This policy explains what personal data we process when you visit vmerci.lu, why we process it, and what rights you have.

2. What data we collect, and why

We collect very little data, and only what is needed to run the website and to work with you.

2.1 Technical server logs

Like any website, our infrastructure records technical logs when you visit: IP address, browser type, pages viewed, timestamps. These logs are used solely to keep the site secure, stable and working properly.

• Purpose: security and proper operation of the website
• Data: IP address, user agent, requested URL, timestamp

2.2 Audience measurement (Umami, self-hosted)

We use Umami, an open source analytics tool that we host ourselves on our own infrastructure (analytics.vmerci.lu). Umami works without cookies and cannot identify you personally: statistics are aggregated (page views, referrers, device type, country) and your IP address is not stored in readable form. No analytics data is shared with any third party.

• Purpose: understand how the site is used and improve our content
• Data: aggregated, anonymised browsing statistics

2.3 Online appointment booking (Cal.com, self-hosted)

The "Book a call" page embeds a scheduling module based on the open source software Cal.com, which we host ourselves on our own infrastructure (cal.vmerci.lu). When you book a slot, you send us the information requested by the booking form.

• Purpose: organise the meeting you requested and follow up with you about it
• Data: name, email address, chosen time slot, and any information you enter in the form (such as a description of your project)

2.4 Direct contact

If you reach out to us by email or through our LinkedIn profile, we process the information you share with us in order to respond. Conversations on LinkedIn are also subject to LinkedIn's own privacy policy, which we do not control.

• Purpose: respond to your enquiries and manage the business relationship
• Data: whatever you choose to share with us

2.5 What we do not do

vmerci.lu loads no advertising tools, no social media pixels, and no third-party profiling tools. We do not sell or rent your personal data. Web fonts are served from our own servers: no requests are sent to any external font provider.

3. Legal bases

4. Cookies and trackers

Our approach is deliberately minimal:

• No advertising or third-party tracking cookies are set by vmerci.lu.
• Analytics is cookieless: Umami uses no cookies or persistent identifiers, and does not follow you across other websites.
• The booking module (cal.vmerci.lu, self-hosted) may use storage elements that are strictly necessary for it to work (for instance to keep your booking session active). These are never used for advertising.

This is why the site does not display a cookie consent banner: we use no trackers that require consent. Should a marketing measurement tool (for instance Google Analytics 4, Google Tag Manager or an advertising pixel) be activated in the future, a compliant consent mechanism will be put in place beforehand and this policy will be updated before that tool goes live.

5. Who has access to your data

Your data is processed by the Vmerci team (Clickbye Sàrl). We rely on a small number of technical providers:

• Hosting: the website, the analytics tool and the booking module all run on infrastructure that we administer ourselves. The hosting provider is Hetzner Online GmbH, a company incorporated under German law with its registered office in Gunzenhausen, Germany. The servers are located in the European Union, and the application is deployed on this infrastructure in a self-hosted setup using Coolify. The hosting of your data therefore involves no transfer outside the European Union; the only transfer outside the EU concerning this site is the Cloudflare transfer described in section 6.
• Cloudflare, Inc.: the site's traffic passes through Cloudflare's network, which provides content delivery (CDN) and protection against attacks. The self-hosted booking module (cal.vmerci.lu) is also served behind Cloudflare. In that role, Cloudflare processes technical connection data (including your IP address) as a data processor.

We do not share your data with any other recipient, unless required by law.

6. Transfers outside the European Union

Our analytics and booking tools are self-hosted: the related data is not transferred to third-party service providers.

Cloudflare, Inc. is a company established in the United States that acts as a data processor for content delivery and security functions. Technical data (including your IP address and request metadata) therefore passes through its global network. The vmerci.lu Cloudflare account is on a standard plan: no specific regional data localisation (a Data Localization Suite type option, reserved for Enterprise plans) is configured on it. These transfers outside the European Union are governed by the European Commission's Standard Contractual Clauses and by the EU-U.S. Data Privacy Framework, to which Cloudflare adheres.

7. How long we keep your data

• Technical server logs: 12 months.
• Analytics statistics (anonymised, Umami): 25 months at most, in line with the maximum retention period recommended by supervisory authorities for audience measurement data.
• Booking data (Cal.com): the duration of the relationship, then 3 years from the last contact for prospects; the applicable legal period for clients.
• Business correspondence (emails, enquiries): 3 years after the last contact for prospects; the duration of the contractual relationship plus applicable legal periods (accounting and tax obligations, up to 10 years) for clients.

Once these periods expire, the data is deleted or anonymised.

8. Your rights

Under the GDPR, you have the following rights over your personal data:

• right of access,
• right to rectification,
• right to erasure,
• right to restriction of processing,
• right to object, in particular to processing based on our legitimate interest,
• right to portability of the data you provided to us.

To exercise these rights, contact us at [email protected]. We respond within one month, extendable under the conditions set out in the GDPR.

If you believe that the processing of your data does not comply with the law, you can lodge a complaint with the Luxembourg supervisory authority:

Commission nationale pour la protection des données (CNPD)
15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg
https://cnpd.public.lu

References: Regulation (EU) 2016/679 (GDPR) and the official CNPD website, consulted on 15-07-2026.

9. Updates to this policy

We may update this policy to reflect changes to the website or to the law. The date of the latest update is shown at the top of this page. In the event of a substantial change (for instance the addition of a new tool that processes personal data), we will update this page before that tool goes live.