What data we process on mako.lu, why we do so, and how you exercise your rights under the General Data Protection Regulation.
Last updated: September 3, 2026
The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:
For any question about data protection and to exercise your rights, write to us at info@mako.lu.
We collect only the data we actually need for the purpose at hand.
Each time a page is requested, your browser transmits technically necessary data to our server, where it is stored in log files:
The purpose is the technical operation of the site along with its stability and security. The legal basis is our legitimate interest in a secure service free of disruption (Art. 6(1)(f) GDPR). This data is not combined with other sources and is not evaluated for marketing purposes.
The contact form and the enquiry feature on the machine pages let you reach us without obligation. In doing so we process:
This data serves to handle your enquiry and to prepare a possible contract; the legal basis is Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR where your message has no contractual context. The hash of the IP address serves solely to fend off automated bulk submissions — five enquiries per hash per fifteen minutes — and allows no conclusion about the IP address itself (Art. 6(1)(f) GDPR). Your enquiry is stored in our database, forwarded by e-mail to the responsible mailbox and, where that feature is enabled, answered with an acknowledgement of receipt. Providing the data is voluntary; without a name and e-mail address, however, we cannot process an enquiry.
For notifications and acknowledgements of receipt we use the Microsoft Graph interface of Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Where that route is not configured, messages are sent via our e-mail provider's SMTP server. In both cases the sender and recipient details and the content of the message are processed. The legal basis is Art. 6(1)(b) and (f) GDPR.
The accessibility tools on this site — font size, contrast, reading guide and read-aloud — store your selection in your browser's local storage so that it is retained on your next visit. This information does not leave your device and is not evaluated by us; you can delete it at any time in your browser settings.
The read-aloud feature uses the speech synthesis of your browser or operating system. Depending on the vendor and the voice selected, that speech may be generated on the servers of the browser or system provider; we have no control over this.
Until you have decided, nothing requiring consent is loaded on the public pages. On your first visit a plain banner asks for your decision, where declining is exactly as easy as accepting. In detail:
You can change or withdraw your decision at any time via “Cookie settings” in the footer of every page. Withdrawal takes effect for the future; the lawfulness of the processing carried out until then remains unaffected.
If you have agreed, we embed the visitor action pixel of Meta Platforms Ireland Limited (pixel ID 2801407590260439). It reports your visit to Meta and helps us tell whether our ads on Facebook and Instagram have any effect. Without your consent the script is not loaded and no connection to Meta is established.
For collecting the data and transmitting it to Meta, we and Meta Platforms Ireland Limited are joint controllers under Art. 26 GDPR; Meta publishes the essence of that arrangement at www.facebook.com/legal/controller_addendum. For everything Meta does with the data afterwards, Meta alone is responsible — see www.facebook.com/privacy/policy. You may assert your rights both against us and against Meta; you withdraw your consent via “Cookie settings” in the footer of every page.
We embed no maps, videos or social media plugins directly in our pages. The addresses in the footer and on the contact page are plain links to Google Maps; the icons link to our profiles on Facebook, Instagram and TikTok. Only when you click such a link does your browser establish a connection to the provider concerned, transmitting your IP address among other things. We have no control over that processing; the privacy terms of the respective provider apply.
The Meta pixel by Meta Platforms Ireland Limited is a different matter: it loads only after your consent and is described in the preceding section.
The typeface used is bundled when the site is built and served from our own server. No connection to Google Fonts or any other font provider is made when the pages are loaded.
Within our company, only those departments that need your data to handle your request have access to it. In addition, the following may be recipients:
We conclude agreements pursuant to Art. 28 GDPR with our processors.
If you consent to the Meta pixel, data may be transferred to Meta Platforms, Inc. in the United States. Meta Platforms Ireland Limited bases that transfer on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR and on its certification under the EU-US Data Privacy Framework. Despite those safeguards, access by US authorities cannot be ruled out entirely; your consent is given in the knowledge of that. Apart from what is described in this policy, no transfer to a third country takes place.
You have the following rights in relation to us:
An informal message to info@mako.lu is enough. We reply within one month; if a request is particularly extensive, we will inform you that this period has been extended.
If you believe that we process your data unlawfully, you may — without prejudice to any other remedy — lodge a complaint with the competent supervisory authority: Commission nationale pour la protection des données (CNPD), 15, boulevard du Jazz, L-4370 Belvaux, Luxembourg — cnpd.public.lu
No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place. Quotations, rental agreements and sales are decided exclusively by our staff.
We adapt this policy when our website or the legal framework changes. Only the version published here applies; this version dates from September 3, 2026.
Questions? Get in touch
