Privacy Policy

This Privacy Policy explains how Café Club (“we”, “us”, “our”) collects, uses, and protects personal data when you visit cafeclubluxembourg.lu, attend our events, subscribe to our newsletter, or buy from our shop. We comply with the EU General Data Protection Regulation (GDPR) and Luxembourg's data protection law of 1 August 2018.

1. Who we are

Data controller: 3ZAS SARL-S, 97 avenue du Bois, L-1250 Luxembourg-Limpertsberg, Luxembourg. RCS Luxembourg: B250272. VAT: LU32682517.

For any data-related question, contact us at info@cafeclubluxembourg.lu.

2. What we collect

• Newsletter: email address, first name (optional), and consent timestamp.
• Orders: name, billing/shipping address, email, phone, order details, and payment confirmation (we never see full card numbers — Shopify Payments handles them).
• Event ticketing: name and email, processed by our ticketing partner Fourvenues.
• Contact form / email: anything you choose to send us.
• Technical data: IP address, browser type, pages viewed. Vercel Analytics is cookieless and anonymised.

3. Why we use it (legal basis)

• To fulfil orders and tickets — performance of a contract.
• To send our newsletter — your explicit consent (you can withdraw it any time via the unsubscribe link).
• To run and improve the site — our legitimate interest in operating a working website.
• To meet legal obligations — accounting, tax, consumer protection.

4. Who we share it with

We use a small set of vetted processors:

• Shopify — e-commerce platform, order processing, payments (Ireland / Canada).
• Mailchimp (Intuit) — newsletter delivery (United States, EU Standard Contractual Clauses).
• Vercel — website hosting (United States / EU).
• Fourvenues — festival ticketing (Spain).
• Instagram / Meta — only when you choose to follow or message us.

We never sell your data.

5. How long we keep it

• Newsletter data: until you unsubscribe.
• Order data: 10 years (Luxembourg accounting law).
• Contact emails: up to 2 years after the last exchange.
• Analytics: aggregated, no personal identifiers retained.

6. Your rights

Under the GDPR you have the right to access, correct, delete, restrict, port, and object to the processing of your personal data. Email info@cafeclubluxembourg.lu and we will respond within 30 days.

If you believe we have mishandled your data you may lodge a complaint with the Luxembourg supervisory authority, the Commission Nationale pour la Protection des Données (CNPD).

7. Cookies

We use only strictly-necessary cookies (cart session, checkout). We do not currently run advertising or tracking cookies. If we add them, we will request your consent through a cookie banner before they load.

8. Changes to this policy

We may update this policy occasionally. The “last updated” date at the top reflects the most recent version. Material changes will be notified via the newsletter or a banner on the site.