Privacy notice

Version 1.0, 14 Oct 2026

This notice says what Settled does with the personal data that Settled decides about. GDPR art. 13 and art. 14 require it.

1. Who decides

1. Settled S.à r.l.-S, 10, Rue Antoine-François Van Der Meulen, L-2152 Luxembourg, R.C.S. Luxembourg B312854, decides what happens to the data in this notice. Settled is its controller (GDPR art. 4(7)).
2. Contact: support@settled.lu, +352 621 768 201, or a letter to the address in point 1.
3. Settled has no data protection officer. The law does not require one for Settled (GDPR art. 37).

2. What this notice covers, and what it does not

1. It covers the data of a person who visits Settled's site, books a demo, opens an account, signs in as a member, writes to Support, or pays Settled for a business.
2. It does not cover the buyer's data: the books, the invoices, the contacts and the KYC files in an account. The buyer decides about that data. Settled works on it only on the buyer's instructions, under the Data Processing Agreement. A person whose data is in an account writes to the buyer.

3. The general rules

1. The data stays in the European Union. §6 names the only exceptions.
2. Settled gives the data to nobody except the companies that §4 and §5 name.
3. Settled sells no data and shows no advertising.
4. No decision by a machine alone. Settled makes no decision about a person by a machine alone (GDPR art. 22).
5. No cookie. Settled sets no cookie. §9 says what the site and the apps keep in the browser.

4. Each use of the data

Each section below gives the data, where it comes from, why Settled uses it, the basis in the GDPR, who receives it, and how long Settled keeps it.

4.1 A visit to the site and the apps

• The data: the internet address, the browser, the page asked for, and the time.
• Where it comes from: the person's browser sends it with each request.
• Why, and the basis: to deliver the page, and to find and stop attacks. The basis is Settled's interest in a site that works and is safe (art. 6(1)(f)).
• Who receives it: the companies that rent Settled its servers (§5).
• How long: 14 days.

4.2 A demo

• The data: the name, the email, the time chosen, and what the person writes on the booking page.
• Where it comes from: the person, on the booking page.
• Why, and the basis: to hold the demo that the person asks for. The basis is the steps that the person asks for before a contract (art. 6(1)(b)).
• Who receives it: Google Ireland Limited runs the booking page and Settled's calendar. Google receives only what the person types on that page.
• How long: 3 years after the last contact, when no contract follows. When a contract follows, §4.3 to §4.7 apply.

4.3 An account and its sign-ins

• The data: the member's name, email, language and role. The password and the codes that Settled emails, kept only in a form that cannot be read back. For each device of a sign-in: the browser, the system, and the day of the last code.
• Where it comes from: the person who opens the account. For an invited member, the Owner who invites gives the name and the email.
• Why, and the basis: to open the account, to sign in its members, and to keep the account safe. A code by email confirms the address before the account opens. A code also protects a sign-in on a new device. The basis is the contract with the buyer (art. 6(1)(b)). For a member who is not the buyer, the basis is the interest of the buyer and of Settled in an account that works and is safe (art. 6(1)(f)).
• Who receives it: the email provider sends the codes and the invitations (§4.5).
• How long: an account whose email is never confirmed: 7 days. A member's sign-in and its devices: 12 months after the member leaves the last account.

4.4 The record of acts in an account

• The data: each act in the account: what was done, when, by which member, and the internet address it came from.
• Where it comes from: the product writes it at each act.
• Why, and the basis: to prove what was done in the books and by whom, and to find a misuse of the account. The basis is the law for the books (art. 6(1)(c); Code de commerce art. 16). For the rest, the basis is the interest of the buyer and of Settled in an account that is safe (art. 6(1)(f)).
• Who receives it: nobody outside Settled and the buyer.
• How long: 10 years after the act. The internet address: 12 months after the act. When a member's sign-in is erased, the record names "a former member".

4.5 The emails that Settled sends

• The data: the address, the name, the subject, the facts of the message, the time it was sent, and whether it arrived.
• Where it comes from: the account, and the act that the email is about.
• Why, and the basis: to send what the account needs: the codes, the invitations, the notices about the subscriptions and the payments, and the answers of Support. The basis is the contract with the buyer (art. 6(1)(b)). For a member who is not the buyer, the basis is art. 6(1)(f), as in §4.3.
• Who receives it: Amazon Web Services EMEA SARL, Luxembourg, sends the emails from servers in the European Union.
• How long: 24 months after the email was sent.

4.6 A payment to Settled

• The data: the buyer's name, address and VAT number; the Owner who orders; the orders; Settled's invoices and credit notes; the result of each card payment. Settled never receives the full number of a card.
• Where it comes from: the Owner who orders. Stripe tells Settled the result of each card payment.
• Why, and the basis: to take the payment and to issue the invoice. The basis is the contract (art. 6(1)(b)). For the invoices, the basis is the law (art. 6(1)(c); Code de commerce art. 16).
• Who receives it: Stripe Payments Europe, Limited, Ireland, takes the card payments.
• How long: 10 years after the end of the financial year of the invoice.

4.7 Support

• The data: the messages and the files that a person sends to Support, and the answers of Settled's team.
• Where it comes from: the person who writes.
• Why, and the basis: to answer the person. The basis is the contract (art. 6(1)(b)). For a person who is not the buyer, the basis is the interest of the buyer and of Settled in an answer (art. 6(1)(f)).
• Who receives it: nobody outside Settled's team. An answer by email goes through the email provider (§4.5).
• How long: 3 years after the last message.

5. The companies that run Settled's servers

1. Hetzner Online GmbH, Germany, and Google Cloud EMEA Limited, Ireland, rent Settled its servers. The servers are in Germany.
2. Amazon Web Services EMEA SARL, Luxembourg, and Google Cloud EMEA Limited keep the copies of Settled's backups. The copies are in the European Union.
3. Each company works on the data only on Settled's instructions, under a contract with Settled (GDPR art. 28).

6. Data outside the European Union

1. Stripe and Google can send data of §4.2 and §4.6 to the United States.
2. They do so under the EU-US Data Privacy Framework (Commission decision of 10 July 2023), or under the standard contractual clauses of the European Commission.
3. The companies of §5 and the email provider of §4.5 keep Settled's data in the European Union.

7. The person's rights

1. A person can ask Settled to show its data (GDPR art. 15), to correct it (art. 16), to erase it (art. 17), to stop its use for a time (art. 18), or to give it back in a file (art. 20).
2. A person can object at any time to a use whose basis is an interest (art. 6(1)(f); art. 21).
3. The request goes to support@settled.lu. Settled can ask for proof of who the person is.
4. Settled answers within 1 month. For a hard request, Settled can take 2 more months, and says so within the first month (art. 12(3)).
5. Where a law orders Settled to keep data, Settled says which law and which data.

8. A complaint

A person can complain to the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu.

9. Cookies and the browser

1. Settled sets no cookie and loads nothing from another company.
2. The site and the apps keep a few items in the browser. Each one is necessary for something that the person asks for. The law asks no consent for them (loi du 30 mai 2005, art. 4(3)(e)).
3. The list of the items is at the end of this page.

10. What a person must give

1. An account needs a name and an email. Without them, Settled cannot open a sign-in.
2. A purchase needs a card payment through Stripe.
3. Nothing else is required.

11. A new version

Settled publishes each new version of this notice on this page, with its date. The version in force is the one with the latest date.

Cookies: the items kept in the browser

Each one is necessary for something that a person asks for, so the law asks no consent for it.