How we handle your data.

Last updated · 21 May 2026

DIGICIUS S.A.R.L takes privacy seriously — not as a compliance theatre, but as a default operating principle. This page explains, in plain English, what personal data we collect, why, and what you can do about it. We do not use cookies for advertising. We do not sell data. We do not profile visitors.

1. Who we are

DIGICIUS S.A.R.L, a Luxembourg-registered private limited liability company, acting as data controller within the meaning of Article 4(7) of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

• Registered office: 13, rue Evrard Ketten, L-1856 Luxembourg, Grand Duchy of Luxembourg
• VAT identifier: LU32215968
• Website: www.digicius.com
• Contact: via the contact form on this website

2. What personal data we collect

We collect only the data you actively send us via the website’s forms.

Contact form ("Start a conversation")

• Your name
• Your work email address
• Company name
• Role (optional)
• Industry (selected from a dropdown)
• Indicative quarterly budget range
• Your free-text message describing your need

Lead-magnet form ("B2B SEO audit checklist")

• Your work email address
• Company name

Technical data collected automatically

• Your IP address (transient — used by our hosting provider Vercel for security and traffic routing; not stored by us)
• Standard browser metadata (user agent, referrer page, timestamp) — only attached to your form submission so we can understand context

We do not use behavioural analytics, tracking pixels or advertising cookies.

3. Why we process this data

• Respond to your enquiry — legal basis: pre-contractual measures at your request (Art. 6(1)(b) GDPR)
• Send the requested checklist — legal basis: your consent (Art. 6(1)(a) GDPR)
• Maintain a record of B2B prospects — legal basis: legitimate interest in business development (Art. 6(1)(f) GDPR)
• Comply with legal obligations — legal basis: Art. 6(1)(c) GDPR

4. How long we keep it

• Contact-form submissions: up to 24 months after last interaction, then deleted
• Lead-magnet email addresses: until you ask us to remove them
• Active client data: for the duration of the engagement + 10 years (Luxembourg accounting obligations)

5. Who has access to it

Inside DIGICIUS, only Philippe Grenevic (founder) has access to the prospect inbox. No data is shared with marketing networks, ad partners or data brokers.

Sub-processors we rely on

• Web3Forms (Web3Forms, LLC, USA) — relays your form submission into our inbox. Data in transit only; not stored beyond delivery. EU-US data transfer covered by Web3Forms’ Data Processing Agreement and standard contractual clauses.
• Vercel (Vercel Inc., USA) — hosts and serves this website. EU edge servers used in priority (Frankfurt region). Standard contractual clauses in place.
• Google Fonts (Google LLC, USA) — serves the typography. Receives your IP when fonts are loaded; sets no cookies. This is the only third-party request the site makes.

6. Your rights under GDPR

You have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Request deletion ("right to be forgotten")
• Request portability of your data in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time (without affecting prior processing)
• Lodge a complaint with the supervisory authority: Commission Nationale pour la Protection des Données (CNPD), Luxembourg

To exercise any of these rights, contact us via the contact form. We respond within one business day.

7. International data transfers

Some of our sub-processors are located outside the European Economic Area (notably in the United States). These transfers are governed by the EU Commission’s standard contractual clauses (Decision 2021/914), providing equivalent safeguards.

8. Security

The website is served over HTTPS with HSTS enabled. Forms use anti-bot protection and modern security headers (CSP, X-Frame-Options, Referrer-Policy). Access to the prospect inbox is protected by 2FA.

9. Updates to this policy

We may update this policy when the law changes, when we add a sub-processor, or when we materially change how data is handled. The "Last updated" date at the top reflects the most recent revision. Substantive changes will be announced on the homepage.