Privacy Policy
Last updated: 4 September 2026
1. Who we are
Thymes S.à r.l. ("Thymes", "we", "us") is a design and creative studio incorporated in Luxembourg.
- Registered office: 12C Impasse Drosbach – Building C, L-1882 Luxembourg
- R.C.S. Luxembourg: B130158
- VAT number: LU21988252
- Contact: info@thymes.agency
Thymes is the "controller" of any personal data collected through this website under Regulation (EU) 2016/679 (GDPR) and the Luxembourg Law of 1 August 2018.
2. What data we collect
We collect the following categories of personal data:
- Data you give us when you submit our contact form: your name, email address, company name, and any information you include in your message.
- Data collected automatically when you visit the site: IP address, browser type and version, device type, pages visited, referring URL, and campaign parameters (UTMs). See our Cookies Notice for detail.
3. Why we use your data (legal bases)
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry, sending you a proposal, following up on a project | Steps prior to entering a contract at your request (Art. 6(1)(b) GDPR) |
| Managing our client relationship after engagement | Contract performance (Art. 6(1)(b)) |
| Keeping our records for legal, tax and accounting purposes | Legal obligation (Art. 6(1)(c)) |
| Measuring how our marketing is performing and improving our website | Our legitimate interest in running our business (Art. 6(1)(f)) |
| Sending you occasional updates about our work (only if you have opted in) | Consent (Art. 6(1)(a)) |
4. Who we share it with
We share your data only with:
- HubSpot (contact form intake and CRM) — HubSpot Ireland Ltd, hosted in the EU.
- Google Workspace (email) — Google Ireland Ltd.
- Squarespace (website hosting) — Squarespace Ireland Ltd.
- Our accountants and legal advisers where required by law.
Each of these providers acts as our processor and is bound by a data processing agreement. Where any data is transferred outside the EEA, we rely on Standard Contractual Clauses approved by the European Commission.
We never sell your data.
5. How long we keep it
- Enquiries that don't lead to a project: 24 months from your last contact.
- Client records: for the duration of the engagement and for 10 years after our last invoice, in line with Luxembourg accounting law.
- Marketing consent records: until you unsubscribe, plus 3 years.
6. Your rights
Under the GDPR you can, at any time, ask us to:
- give you a copy of the data we hold about you (access);
- correct data that is wrong (rectification);
- delete your data (erasure);
- limit what we do with it (restriction);
- give it to you in a portable format (portability);
- object to us processing it, including for marketing.
To exercise any of these rights, email us at info@thymes.agency. We respond within one month.
If you feel we haven't handled your data properly, you can complain to the Luxembourg data protection authority (CNPD): www.cnpd.lu.
7. Security
We use industry-standard measures — encryption in transit, access controls, and regular reviews — to protect your data. No system is perfectly secure, but we take it seriously.
8. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top always shows the current version.