Privacy
Controller and scope
The controller for this personal brand website is RRoman Holding S.à r.l., 6 rue Henri M. Schnadt, L-2530 Luxembourg, Luxembourg, RCS Luxembourg B301011. Privacy requests: contact@rroman-holding.lu or by post to this address. This notice covers www.rizkiroman.com and incoming enquiries; other group websites have separate notices.
Website, email draft and links
The website uses no cookies, analytics or advertising scripts, remote fonts, maps or social embeds. Language selection is part of the URL. The contact fields process input only in your browser and open an email draft in your email application. They do not submit data to a form server. Information is transmitted to the recipient only when you send the email yourself. External links connect to their providers when opened.
Enquiries and legal bases
We process email addresses, names, any company details, messages, attachments and correspondence metadata to answer and follow up enquiries. Article 6(1)(b) GDPR applies to contracts or pre-contractual steps with you; Article 6(1)(f) applies to our legitimate interest in other business correspondence, and Article 6(1)(c) to legal obligations. Providing information is voluntary; without sufficient information and a return address we may be unable to reply. An enquiry does not subscribe you to marketing.
Providers and recipients
The website is hosted by IONOS SE. When the website is accessed, the hosting provider processes technically necessary connection and server-log data. The mailbox rizki@rizkiroman.com is hosted by IONOS, and Outlook is used to handle correspondence. Where Microsoft cloud synchronisation is enabled, Microsoft also processes email data. The Holding privacy contact uses its existing LuxHosting email infrastructure. Access is limited to relevant staff, necessary IT providers and advisers, and legally entitled authorities.
International processing
Support, email and cloud services may involve processing outside the EEA. Applicable safeguards under Chapter V GDPR are required, such as adequacy decisions or standard contractual clauses; a data privacy framework applies only to covered, certified recipients. We do not promise processing exclusively within Europe. Information about specific recipients and safeguards is available on request.
Retention
General enquiries without a subsequent business relationship are deleted no later than twelve months after closure. Business correspondence is kept as required and reviewed at the end of the relationship. Luxembourg accounting records subject to statutory retention are generally kept for ten years after the relevant financial year. Documents needed for disputes may be retained with restricted access until resolution or expiry of relevant periods. Technical server logs are retained only as long as needed for secure and stable operation, troubleshooting and prevention of misuse.
Your rights
Subject to the GDPR, you have rights of access, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Consent may be withdrawn prospectively. Contact us above; proportionate identity verification may be requested if necessary. We normally respond within one month and explain any lawful extension. We do not conduct profiling or solely automated decisions with legal or similarly significant effects.
Complaints and technical delivery
You may complain to a supervisory authority, particularly where you live, work or believe an infringement occurred. In Luxembourg: CNPD, Service des réclamations, 15 boulevard du Jazz, L-4370 Belvaux. You need not contact us first. Website access may result in processing of IP address, timestamp, requested URL, browser, operating system, response status and referrer in server logs. This supports secure and stable delivery, troubleshooting and prevention of misuse under Article 6(1)(f) GDPR. Last updated: 20 September 2026.
IONOS · Microsoft · LuxHosting · CNPD