Privacy notice.

Who we are

SPC Studio is the creative sub-brand of SP Consultants Sàrl-S, Bertrange, Luxembourg (RCS B306306, VAT LU37434006). SP Consultants is the controller of your data. Questions or requests: studio@spconsultants.lu.

What we collect

• The brief form on the homepage: your name, email, project and, if you give it, a budget.
• The package form on the packages page: your name, email, company and message if you give them, your country, whether you buy as a business, your VAT number if you give it, and the package you built.
• Server logs: your IP address and the time of each request, used to keep the forms safe from abuse. We keep them for 30 days, then delete them.

We do not use analytics, advertising or tracking cookies. The site sets one short-lived cookie (20 seconds) when you move between the SPC and SPC Studio sites, only to carry the page transition across.

Why we use it

To answer you and prepare the quote you asked for. That is a step you asked us to take before a possible contract (GDPR, Art. 6(1)(b)). When you give a VAT number, we check it with the European Commission's VIES service to apply the right VAT. Keeping the forms safe from abuse is our legitimate interest (Art. 6(1)(f)).

What happens when you send a package

You get an email with your package. A copy goes to our sales and studio inboxes, and the package is filed as a draft in our internal client system so we can prepare your quote. We never sell or share your details for marketing.

Who processes it for us

• Hetzner Online GmbH, Germany: hosts this site, its forms and our internal client system.
• Proton AG, Switzerland: our email. Switzerland has an EU adequacy decision.
• The European Commission's VIES service: only your country code and VAT number, only when you give one.

How long we keep it

• Enquiries that do not lead to a project: the draft in our internal client system is deleted automatically 12 months after you sent it. The emails about it (the copy of your package in our inboxes, our reply and any messages that follow) are deleted 12 months after the last message, unless you become a client.
• If you become a client: we keep what the law requires for accounting, in Luxembourg 10 years for invoices and their records, and the correspondence that belongs to the project for as long as the contract and any claims under it can run.
• Backups: deleted data can remain in our backups until they expire: about 3 days in the daily copies on our server, and up to 12 months in encrypted offsite backups at Hetzner.

Your rights

You can ask to see, correct, delete or export your data, to restrict how we use it, or object to it. Write to studio@spconsultants.lu and we answer within one month. You can also complain to the Luxembourg data protection authority, the Commission nationale pour la protection des données (CNPD).

Last updated: 27 October 2026.