We use your contact details and project information to help you find suitable companies.
Your request may be passed to a maximum of two companies or agencies selected for your project.
The Meta Pixel, the Conversions API and non-essential measurement tools are used only on the basis of your consent.
You can ask to access, correct or erase your data and withdraw your consent at any time.
1. Who is responsible for your data?
The controller is the company that operates the HomeUpdate brand:
Parcours S.à r.l.-S12, Rue St. Willibrord
L-2729 Luxembourg
Email: info@homeupdate.lu
For any question about this policy or the use of your data, you can contact us at that email address.
2. What data do we process?
Depending on how you use HomeUpdate, we may process the following categories:
- Contact details and identity: surname, first name, email address, phone number, address and postcode.
- Information about your project and your home: the service you are looking for, property type, technical characteristics, budget, schedule, questionnaire answers and free-text comments.
- Request and follow-up data: date, request status, partners proposed, exchanges with our team and consents given.
- Technical and usage data: IP address, browser, device, pages visited, source of the visit, actions in the form, timestamps and technical identifiers.
- Advertising attribution data: UTM parameters, landing page, Meta click identifier (
fbclid) and the identifiers_fbp/_fbc, where you have consented. - Newsletter: email address, date and proof of consent, plus the information needed to unsubscribe.
Mandatory fields are marked in our forms. Without that information we may not be able to handle your request or introduce you to partners.
Sensitive data: HomeUpdate does not ask for special categories of data within the meaning of Article 9 GDPR, such as health data, political opinions or religious beliefs. Please do not include such information in free-text fields.
3. Why do we use your data?
| Purpose | Main data | Legal basis |
|---|---|---|
| Receiving, qualifying and following up your project request | Contact details, project, property, form answers | Pre-contractual steps requested by you — Art. 6(1)(b) GDPR |
| Selecting suitable companies and passing your request to them | Contact details and the information needed for the quote | Pre-contractual steps — Art. 6(1)(b), and consent where required — Art. 6(1)(a) |
| Contacting you by phone or email about your request | Contact details, history and status of the request | Pre-contractual steps — Art. 6(1)(b) |
| Ensuring security, preventing abuse and improving the reliability of the service | Technical data, logs and interactions | Legitimate interest — Art. 6(1)(f) |
| Measuring site usage and campaign effectiveness | Events, device, source, advertising identifiers | Consent — Art. 6(1)(a) |
| Sending the newsletter and marketing communications | Email and proof of consent | Consent — Art. 6(1)(a) |
| Meeting our legal obligations and defending our rights | The data needed for the file in question | Legal obligation — Art. 6(1)(c), or legitimate interest — Art. 6(1)(f) |
Where we rely on our legitimate interest, we balance that interest against your rights and freedoms. You can object to such processing on the terms set out below.
Qualifying your request
Qualification may take place directly in our digital questionnaire or, if clarification is needed, during a call from our team. We then use the answers given to understand the specifics of the project and identify suitable partners. Calls are not recorded unless you are informed in advance and there is an appropriate legal basis.
Technical server logs
When the site is accessed, our infrastructure may temporarily record technical information such as the IP address, the resource requested, the date and time, the browser, the operating system, the previous page and the result of the request. These logs serve to keep the site available, diagnose errors and detect unauthorised access attempts. This processing rests on our legitimate interest in securing and operating the service.
4. Who do we share your data with?
We do not sell your personal data. It is accessible only where necessary:
- To the partners matching your request: a maximum of two selected companies, tradespeople or agencies. They use your data to contact you, understand your project and prepare a proposal. Once they have received your request, each partner acts as controller for its own exchanges with you.
- To our technical providers: in particular Supabase for the data infrastructure, plus our hosting, email, maintenance, security and newsletter providers. Where they act as processors, they follow our instructions.
- To Google Ireland Limited as part of Google Analytics 4, only when audience measurement is enabled with your consent.
- To Meta Platforms Ireland Limited as part of the Meta Pixel and the Conversions API, only when those tools are enabled with your consent.
- To our advisers and the competent authorities where necessary to comply with the law, protect our rights or respond to a valid official request.
Before passing a request on, we aim to limit the information to what the partner actually needs in order to reply.
5. Google Analytics 4, Meta Pixel and Conversions API
Google Analytics 4
With your consent to audience measurement, Google Analytics 4 helps us understand which pages are viewed, aggregate progress through the form, and which requests were actually recorded. A recorded request is measured as a generate_leadevent. HomeUpdate does not send the free text of your project, your name, your phone number or your email address to Google Analytics.
Meta Pixel
The Meta Pixel is a technology loaded in the browser that can record events such as viewing a page, starting a form or submitting a request. It helps measure campaigns and, depending on your settings at Meta, personalise advertising. Meta may link this information to your Meta account.
Meta Conversions API (CAPI)
The Conversions API sends certain events from our server to Meta. The Pixel and CAPI may use the same event identifier to avoid double counting. Depending on the event and your consent, the transfer may include the source URL, the time, the project type, attribution data and technical identifiers such as _fbp or _fbcinclude. We do not send the free text of your project to Meta for advertising purposes.
HomeUpdate audience measurement
We also measure, in aggregate, progress through the form (for example the step seen or completed) in order to spot errors and improve the experience. Where a measurement uses non-essential identifiers or sends data to a third party, it rests on your consent.
You can refuse non-essential marketing and measurement tools without losing access to the site or the introduction service. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.
For more information, see the Google privacy policy, the Meta privacy policy and its cookie policy.
6. Cookies and local storage
HomeUpdate uses cookies as well as the browser's local or session storage. Items needed for the form to work may be used without consent. Non-essential marketing or measurement items are only activated after you have chosen.
| Item | Purpose | Indicative duration | Category |
|---|---|---|---|
hu_consent_v1 | Remember your choices about cookies and tracking tools | Up to 6 months | Necessary |
hu_pc | Keep the postcode while you move through the form | Browser session | Necessary / functional |
hu_attribution | Remember the source of the visit and the campaign parameters | Up to 90 days | Marketing — consent |
hu_funnel_stats | Measure steps seen and completed locally | Until deleted by the user or the configured expiry | Audience measurement — consent where not strictly necessary |
_ga / _ga_* | Distinguish visits and measure site usage with Google Analytics 4 | Up to 2 years depending on the Google Analytics configuration | Audience measurement — consent |
_fbp / _fbc | Attribute visits and conversions to Meta campaigns | In principle up to 90 days according to Meta | Marketing — consent |
You can also delete cookies and local data from your browser settings. That may reset your progress in a form.
7. How long do we keep your data?
We keep data only for as long as each purpose requires, then delete or anonymise it unless the law requires otherwise. The reference periods are:
- Requests without a lasting business relationship: up to 6 months after the last exchange, unless deletion is requested earlier or certain evidence must be kept.
- Active files and the relationship with a partner: while the project is being handled, then for as long as is needed for follow-up and to defend any claims.
- Newsletter: until you withdraw your consent or after a period of inactivity set by HomeUpdate.
- Proof of consent and objection: for as long as is needed to show that your choices were respected and to handle any complaints.
- Advertising attribution data: up to 90 days in the browser, subject to the platforms' own periods.
- Accounting and tax documents: up to 10 years where Luxembourg law requires it.
A dispute, a regulatory obligation or an official request may justify keeping only the necessary data for longer.
8. Does data leave the European Economic Area?
Some providers, in particular Meta or their processors, may process data outside the European Economic Area. Where that happens, the transfer relies on a mechanism recognised by the GDPR, such as an adequacy decision, the EU–US framework applicable to the provider concerned, or the European Commission's standard contractual clauses, supplemented where necessary by additional safeguards.
You can contact us for information about the safeguards applying to a particular transfer.
9. What are your rights?
Subject to the conditions laid down by the GDPR, you have the following rights:
- the right to access your data and obtain a copy of it;
- the right to correct inaccurate or incomplete data;
- the right to erasure of your data;
- the right to restrict processing;
- the right to portability of the data you have provided to us;
- the right to object to processing based on legitimate interest and, at any time, to direct marketing;
- the right to withdraw your consent at any time;
- the right not to be subject to a decision based solely on automated processing producing legal or similarly significant effects.
HomeUpdate does not take decisions about you based solely on automated processing with such effects. Partner selection may be assisted by technical criteria, but your request is not subject to an automated legal decision.
To exercise your rights, write to info@homeupdate.lu or to the postal address given at the start of this policy. State which right is concerned and the information that identifies your request. If we have reasonable doubt about your identity, we may ask for additional proof limited to what is necessary.
You may also lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15, boulevard du Jazz, L-4370 Belvaux, Luxembourg.
10. Security, minors and updates
We apply technical and organisational measures appropriate to the risk, including access controls, encrypted connections and limiting access to the people and providers who need it. As no system is entirely free of risk, we review these measures regularly.
The HomeUpdate service is aimed at adults. We do not knowingly collect children's data.
We may update this policy to reflect changes in the service, in our providers or in the law. The date of the latest version appears at the top of this page. If something significant changes, we will provide appropriate information.