Privacy Policy

1. Data Controller

tevaxia.lu
Contact : contact@tevaxia.lu

2. Data Collected

Browsing data:
Technical cookies required for the operation of the site. Google Analytics (with prior consent) for audience measurement: pages visited, visit duration, browser type, anonymised IP address.

User account:
Email address, name (optional), profession (optional), hashed password. You can create an account via email/password or through a third-party service (Google, LinkedIn).

OAuth login (Google, LinkedIn):
Only your email address and name are transmitted by these services. We do not receive your password, contacts, or any other data from your third-party account. Authentication is managed by Supabase Auth via the OAuth 2.0 / OpenID Connect protocol.

Simulation data:
Data entered in calculators and simulators (amounts, areas, energy parameters, etc.) is stored in Supabase if you are logged in, or in your browser's localStorage otherwise.

Valuer profile:
Name, company, professional contact details — stored in your browser's localStorage or in Supabase if you are logged in. This data is used to personalise valuation reports.

3. Purposes of Processing

• Service operation (calculations, simulations, display of results)
• Saving simulations and valuations to your account
• Personalisation of valuation reports (valuer profile)
• Service improvement (anonymised audience statistics)

4. Legal Basis for Processing

• Consent (Art. 6.1.a GDPR): Google Analytics analytical cookies.
• Performance of a contract (Art. 6.1.b GDPR): creation and management of your account, saving your simulations.
• Legitimate interest (Art. 6.1.f GDPR): service improvement, platform security.

You may withdraw your consent at any time for processing based on this legal basis.

5. Sub-processors

6. Data Retention

• Account data: retained until the account is deleted by the user.
• Simulation data: retained for 2 years from the last activity.
• Cookies: maximum duration of 13 months.

7. Your Rights

In accordance with the General Data Protection Regulation (GDPR) and the Luxembourg law of 1 August 2018, you have the following rights:

• Right of access to your personal data
• Right to rectification
• Right to erasure ('right to be forgotten')
• Right to data portability
• Right to object to processing

To exercise these rights, contact us at contact@tevaxia.lu.

8. Cookies

• Technical cookies (necessary): essential for the operation of the site (language preferences, session). No consent required.
• Analytical cookies (consent): Google Analytics, only set after explicit consent. Enable anonymised audience measurement.
• Authentication cookies: Supabase session management (login token). Required for user account functionality.

9. Data Transfers Outside the European Union

Some of our sub-processors are located in the United States. These transfers are governed by standard contractual clauses approved by the European Commission and/or the EU-US Data Privacy Framework adequacy decision.

Account and simulation data are hosted by Supabase on servers located in the European Union (AWS eu-central-1, Frankfurt, Germany).

10. Security Measures

We implement the following technical and organisational measures to protect your data:

• Encryption of communications via HTTPS (TLS)
• Content Security Policy (CSP)
• Row Level Security (RLS) on Supabase: each user can only access their own data
• Hashed passwords (never stored in plain text)

11. Data Protection Officer / Contact

For any questions regarding the protection of your personal data, you can contact us at contact@tevaxia.lu.

12. Right to Lodge a Complaint

If you believe that the processing of your personal data constitutes a violation of the GDPR, you have the right to lodge a complaint with the Luxembourg supervisory authority:

Commission Nationale pour la Protection des Données (CNPD)
15 Boulevard du Jazz, L-4370 Belvaux, Luxembourg
cnpd.public.lu