Privacy policy

This policy explains what we do with personal data when we decide why and how it is used - when you visit salary.lu, subscribe to the Service, contact our support, or apply for a job with us.

It does not cover the payroll data our customers put into the platform. We do not decide what happens to that data: the employer does, and we act on their instructions. How we handle it is set out in our data processing agreement instead.

Who we are

The data controller for everything described in this policy is:

Company	SALARY S.A.
Address	34 rue Hiel, 6131 Junglinster, Luxembourg
Trade register	RCS Luxembourg B242985
Contact	info@salary.lu

Write to that address for anything in this policy, including if you want to exercise one of the rights described below.

If you visit our website

You can read salary.lu without telling us who you are. Some data is still collected in the background:

• Technical data your browser sends - IP address, browser type and version, operating system, and the pages you looked at
• Cookies and similar technologies, described in our cookie policy

We use analytics to understand which pages are useful and where people get stuck, and remarketing tools that let us show ads to people who have visited the site. Neither runs until you allow it in the cookie banner, and you can change your mind at any time.

Which cookies we set, what each one does and how long it lasts is in our cookie policy.

If you use our free tools

Our salary calculator and the other public tools work in your browser and do not require an account. The figures you enter are not linked to you or to any account.

We do count how often the tools are used, through the same analytics described above, so that we know which ones are worth improving.

If you are a customer

When you create an account and subscribe, we hold data about you as our customer. This is separate from the payroll data you enter about your employees.

What we hold

• Account and identity: name, email address, telephone number, company name, role
• Business details: registered address, RCS number, VAT number
• Billing: bank details for SEPA direct debit, invoices and payment history
• Usage: which features you use, when you sign in, and what your account is configured to do
• Support: the messages you exchange with us by chat or email

What we do with it

We use it to give you access to the Service, to invoice you, to answer your questions, to keep the platform secure, and to tell you about changes that affect you - new features, price changes, updates to these documents.

We may also send you occasional information about our own services. You can opt out of those at any time, and doing so does not affect the messages we need to send you about your subscription.

If you contact our support

Our chat and support inbox run on Crisp, a French provider. When you write to us, Crisp stores the conversation so that both sides can go back to it, and so that whoever picks up your next message can see the history.

Please do not send us employee payroll details through the chat when you do not have to. If we need to look at something specific, we will tell you the safest way to share it.

If you apply for a job

Applications reach us by email at jobs@accounttech.lu. SALARY S.A. is the controller for everything you send us: your CV, your covering letter, and any notes we make during the process.

We use it only to assess your application and, if it goes well, to make you an offer. We keep applications for six months after the process ends, in case a similar role opens up, and then delete them. Ask us and we will delete yours sooner.

If you are an employee of one of our customers

If your payslip was produced with Salary.lu, your employer - or the fiduciary or accountant who runs their payroll - decided to use us. They determine what happens to your data. We process it on their instructions and for no purpose of our own.

That means requests about your data go to your employer first: access to what they hold, corrections, and everything else. They are the ones who can answer, and they have their own privacy notice covering it.

If you contact us directly, we will not act on the request ourselves - we will pass it to your employer and let you know we have done so. What we commit to as processor is set out in our data processing agreement.

What we base each use on

The GDPR requires us to have a legal basis for each thing we do with personal data. Here they are.

Where the basis is legitimate interests, we have weighed what we want to do against what you would reasonably expect. You can object to any of it - see your rights below.

How long we keep things

What	How long
Your account and its contents	For as long as the account exists. We do not delete it automatically when a subscription ends, because you may still need your payroll history - deletion happens when you ask for it.
Invoices and accounting records	Ten years, as Luxembourg law requires
System and connection logs	A maximum of one year, for debugging and where the law requires us to keep them
Support conversations	Held in Crisp for as long as your account remains open and active. Crisp keeps its own technical and connection logs for a maximum of one year, as French law requires.
Job applications	Six months after the recruitment process ends
Cookies	Each cookie has its own lifetime - see the cookie policy

Where something is covered by more than one line, the longer period applies.

Who we share data with

We do not sell personal data and we do not share it for anyone else's marketing.

We do use other companies to run the Service. Each of them acts on our instructions, under a written agreement, and only for what we have asked them to do.

Heroku (Salesforce) Hosting

Runs the platform and the production database, in the EU region. Heroku holds SOC 2 Type II certification.

Amazon Web Services Infrastructure

Stores documents and attachments (S3, Paris), sends transactional and notification email (SES, Frankfurt), and hosts the dedicated server we use to transmit payroll declarations to the CCSS.

Crisp Support

Provides the chat and support inbox. Crisp IM SARL, 149 rue Pierre Semard, 29200 Brest, France.

Privacy policy: crisp.chat/en/privacy

Calendly Scheduling

Used for booking appointments. Clicking "request a demo" opens Calendly, and when you book a slot it receives your name, email address and whatever you write in the booking form.

Privacy policy: calendly.com/privacy

Sentry Monitoring

Collects error and performance reports so that we can find and fix problems. Error reports can include technical details of the request that failed.

Privacy policy: sentry.io/privacy

SolarWinds Papertrail Logs

Collects application logs for debugging and security monitoring.

Google Analytics and ads

Google Analytics and Google Tag Manager measure how the site is used. Google Ads lets us show ads to people who have visited the site. Both run only if you accept the relevant cookies.

Privacy policy: policies.google.com/privacy · Ad settings: google.com/settings/ads

LinkedIn Ads

Lets us show ads on LinkedIn to people who have visited the site, if you accept marketing cookies.

Opt out: linkedin.com/psettings/guest-controls

Facebook Ads

Lets us show ads on Facebook and Instagram to people who have visited the site, if you accept marketing cookies.

Opt out: facebook.com/help · EU choices: youronlinechoices.eu

We also share data where the law requires it - with an authority, a court, or where we need to establish or defend a legal claim. And if our business were ever sold or reorganised, data would move with it, on the same terms.

The providers that handle payroll data on our customers' behalf are listed separately, in Annex 3 of our data processing agreement.

Where your data is

Our infrastructure runs in the European Union: the platform and database on Heroku in the EU region, document storage in Paris, and email delivery in Frankfurt.

Some of the tools above are provided by companies based outside the EU. Where that means data leaves the EU, the transfer is covered by a legal mechanism permitted under Chapter V of the GDPR - an adequacy decision, or the European Commission's standard contractual clauses with additional safeguards.

Automated decisions

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not profile you in that sense. The platform calculates payroll automatically, but those calculations are your employer's, applying the rules that Luxembourg law sets - not decisions we take about you.

Your rights

You have the following rights over the data we hold about you as controller:

• Access - ask what we hold and get a copy of it
• Rectification - have it corrected if it is wrong or incomplete
• Erasure - ask us to delete it, where we have no reason to keep it
• Restriction - ask us to stop using it while something is being sorted out
• Portability - get it in a machine-readable format, or sent to someone else
• Objection - object to a use we base on legitimate interests, and to direct marketing at any time
• Withdraw consent - where we relied on it, without affecting what we did before you withdrew it

Write to info@salary.lu. We answer within one month; if a request is complex we may take longer, and we will tell you if so. We may ask you to confirm who you are first.

If you are unhappy with how we have handled something, you can complain to the Luxembourg data protection authority:

Commission nationale pour la protection des données (CNPD), 15 boulevard du Jazz, 4370 Belvaux, Luxembourg. cnpd.public.lu

How we protect it

Data is encrypted in transit and at rest. Access inside the platform is role-based, two-factor authentication is available on every account, and our own staff get only the access their job requires. The infrastructure sits with providers holding recognised security certifications, and we keep no servers in our own office.

The full set of measures is described in Annex 2 of our data processing agreement.

Changes to this policy

We update this policy when what we do changes, or when the law does. The date at the top shows when the current version came into force, and we will tell you by email and on the News page in the platform before a material change takes effect.

Contact us

For anything about this policy, or to exercise one of your rights, write to us at info@salary.lu

Related policies

Terms of service

The rules for using Salary.lu - subscriptions, billing, your data, liability and cancellation.

Data processing agreement

How we handle employee payroll data on your behalf, and what we commit to under the GDPR.

Cookie policy

Which cookies we set, what they do, and how to control them.