Privacy Policy | DBX Finance Advisory

Short version: We collect only the information you voluntarily submit via our contact form. We use it solely to respond to your enquiry. We do not sell your data, run analytics, or set tracking cookies. You can request deletion at any time.

1. Who We Are

Controller: Dennis Barreto, trading as DBX Finance Advisory
Address: Luxembourg City, Luxembourg
Contact: legal@dbx.lu

DBX Finance Advisory is an independent consulting practice registered in Luxembourg. This privacy policy explains how we handle personal data collected through our website in accordance with Regulation (EU) 2016/679 (GDPR) and Luxembourg's implementing legislation.

2. Data We Collect and Why

We collect personal data only when you voluntarily submit our contact form. The data collected includes:

First and last name — to address you appropriately in our response
Email address — to reply to your enquiry
Company / organisation name (optional) — to understand the context of your request
Service of interest (optional) — to route your enquiry correctly
Your message — the substance of your enquiry

We do not collect sensitive personal data (health, financial account details, political opinions, etc.) through this website.

3. Legal Basis for Processing

We process your data on the basis of legitimate interest (Art. 6(1)(f) GDPR): responding to a business enquiry you initiated is a legitimate purpose, and it is reasonable for you to expect a response when you submit a contact form.

Where you provide your data with the explicit expectation of receiving a commercial response, processing may also be based on pre-contractual measures (Art. 6(1)(b) GDPR).

4. How We Use Your Data

To respond to your enquiry by email
To follow up on an ongoing consulting engagement if one is initiated
To maintain a record of client communications for the duration of any engagement

We do not use your data for automated decision-making or profiling. We do not send marketing emails or newsletters without your explicit consent.

5. Third-Party Processors

Your form submission is routed through Formspree, Inc. (USA), a form processing service. Formspree acts as a data processor on our behalf under a data processing agreement that includes EU Standard Contractual Clauses, ensuring an adequate level of protection for data transfers outside the EEA.

Formspree's privacy policy: formspree.io/legal/privacy-policy

We do not use Google Analytics, Facebook Pixel, or any other third-party tracking or advertising technology on this website.

6. Cookies and Local Storage

This website does not set any cookies.

We use your browser's localStorage to remember your language preference (e.g. English, French, German). This stores only a language code (e.g. en, fr) — no personal data — and is not transmitted to any server.

7. Data Retention

Enquiry data (form submissions received by email) is retained for 24 months from the date of last contact, after which it is permanently deleted. Data related to active or completed consulting engagements is retained for 7 years in accordance with Luxembourg's commercial record-keeping obligations.

8. Your Rights Under GDPR

As a data subject, you have the following rights:

Right of access — request a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate data
Right to erasure — request deletion of your data ("right to be forgotten")
Right to restriction — request that we limit how we process your data
Right to data portability — receive your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interest

To exercise any of these rights, contact us at legal@dbx.lu. We will respond within 30 days.

9. Supervisory Authority

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with the Luxembourg data protection authority:

Commission Nationale pour la Protection des Données (CNPD)
15, Boulevard du Jazz · L-4370 Belvaux · Luxembourg
cnpd.public.lu

10. Data Security

All data transmitted via the contact form is sent over encrypted HTTPS connections. We do not store form submissions on this website's server — they are delivered directly to our email inbox via Formspree. Access to that inbox is protected by strong passwords and two-factor authentication.

11. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top of this page reflects the most recent revision. Material changes will be noted prominently. Continued use of the website after changes constitutes acceptance of the updated policy.

12. Contact

For any privacy-related questions or to exercise your rights:
Dennis Barreto · DBX Finance Advisory
legal@dbx.lu
Luxembourg City, Luxembourg