Privacy notice
1. Controller and scope
RRoman AI Systems S.à r.l., 6 rue Henri M. Schnadt, L-2530 Luxembourg, Luxembourg, RCS Luxembourg B301911, is responsible for the personal data processing described here. For privacy enquiries and rights requests, contact contact@rroman-systems.lu or write to that address. This notice concerns this corporate website and enquiries sent to us; other group websites have their own notices. MaiBiz and future applications are outside the scope of this notice; the privacy information for the respective service applies when it is used.
2. Website access and security
When your browser requests a page, our hosting infrastructure processes your IP address, request time, requested URL, browser and operating-system information, response status and, where transmitted, the referring page. This enables page delivery, troubleshooting and protection against misuse. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in providing a reliable and secure corporate website. Connection data are necessary to deliver the page. Technical access and security logs may also be evaluated to diagnose errors and unusual traffic; they are not used by us for advertising profiles.
3. Cookies and external resources
The website code loads no third-party analytics or advertising tools, contact forms, newsletter subscriptions, social-media embeds, external font services or embedded maps. Its code sets no cookies and does not store your language choice on your device; the selected language is reflected in the URL. Images, logos, scripts and styles are served from this website. Clicking an external link connects you to the destination provider. The email link opens your email application; no message is sent until you send it.
4. Contact by email
If you contact us, we process your email address, name and professional details where supplied, the message, attachments and correspondence metadata to handle your enquiry and follow up. For enquiries about a contract with you, the basis is Article 6(1)(b) GDPR; for other business correspondence, Article 6(1)(f), reflecting our interest in responding to enquiries and maintaining business relationships. Where a legal obligation requires retention, Article 6(1)(c) applies. Supplying contact information is voluntary, but without a usable reply address and enough information we may be unable to respond. We do not use website enquiries for automated marketing subscriptions.
5. Service providers and recipients
Our website and mailbox use LuxHosting (Stablepoint Limited, United Kingdom). We access the contact mailbox through Outlook with Microsoft Cloud synchronisation: a copy of email data is also processed by Microsoft. Internal access is limited to those who need the information to handle your enquiry. Hosting and IT providers process data to provide and secure their services; professional advisers and public authorities may receive data where necessary for advice, legal claims or legal obligations. Provider information: LuxHosting privacy policy and Microsoft privacy statement.
6. International processing
Our service providers may process data outside the European Economic Area, including for support, backups and Microsoft Cloud synchronisation. LuxHosting describes international service providers and contractual protections in its privacy policy. Microsoft describes international processing and safeguards including European Commission standard contractual clauses and, where applicable, adequacy decisions and the EU–US Data Privacy Framework. The applicable mechanism depends on the recipient and destination. We rely on an applicable adequacy decision or appropriate safeguards under the GDPR for transfers that require them. You may contact us for information or a copy of the applicable safeguards; provider privacy notices are linked above.
7. Retention
General enquiries that do not result in a business relationship are deleted no later than 12 months after the enquiry is concluded. Correspondence needed for an ongoing business relationship is retained while needed for that relationship and reviewed when it ends. Accounting records and supporting documents subject to Luxembourg retention duties are kept for 10 years from the end of the financial year concerned. Data necessary for a specific dispute may be retained until its final resolution and expiry of the relevant claim periods; access is then restricted to that purpose.
Technical access and security logs are retained for as long as needed to operate the service, diagnose faults and investigate security incidents. Provider-controlled logs and backups follow the applicable service recovery, security and legal retention cycles. We have not confirmed a single fixed period for all such data. When assessing retention, we take account of incident resolution, recovery needs and applicable legal obligations. The correspondence periods above are our company policy and require regular mailbox review.
8. Your rights
Subject to the conditions of the GDPR, you may request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. If processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. Contact us using the details above; where necessary, we may request proportionate information to verify your identity. We normally respond within one month; a legally permitted extension will be explained within that period. No solely automated decisions producing legal or similarly significant effects, and no profiling, are carried out through this website.
9. Complaints and updates
You may complain to a competent supervisory authority, including the authority where you habitually reside, work or consider an infringement to have occurred. In Luxembourg: Commission nationale pour la protection des données (CNPD), Service des réclamations, 15, boulevard du Jazz, L-4370 Belvaux. CNPD complaints information. You need not contact us first. We update this notice when our processing changes. Last updated: 14 September 2026.