Privacy policy

Last updated: 7 October 2026

1. Introduction

SPEAR Sàrl (“SPEAR”, “we”) is committed to protecting your personal data and your privacy. This policy explains how we collect, use, store and protect your information when you visit spear.lu or use our services, in accordance with the GDPR and Luxembourg law.

2. Data controller

• Company: SPEAR Sàrl
• Trade register (RCS Luxembourg): B250943
• VAT number: LU32863446
• Share capital: EUR 21,000
• Address: 95 Avenue G.D Charlotte, L-3441 Dudelange, Luxembourg
• Email: [email protected]
• Phone: +352 621 968 929

3. Data we collect

Data you give us directly:

• First and last name, company, job title
• Email address, phone number, postal address
• Login credentials (hashed), account preferences
• Contract and billing information

Data collected automatically:

• IP address, browser, device type, operating system
• Pages viewed, time spent, referring site
• How you interact with the site (clicks, form submissions) and technical errors you run into
• Cookies and trackers (see section 10)

Data from third parties:

• Information from social networks (LinkedIn, Twitter) when you interact with us there

4. Why we process your data

We process your data to:

• Answer your enquiries and quotation requests
• Manage the client relationship and our contracts
• Provide and improve our services
• Send newsletters or invitations (with your consent)
• Keep our systems secure, prevent fraud and meet our legal obligations
• Manage recruitment and job applications

5. Legal bases

We process your data on the basis of:

• Performance of a contract (delivery of our services)
• Your consent (newsletters, cookies, prospecting)
• Our legitimate interest (security, continuous improvement)
• Our legal obligations (invoicing, record keeping)

6. Who receives your data

Your data may be shared with:

• Authorised SPEAR staff
• Our service providers (hosting, IT, payment, support, analytics: Google and PostHog, see section 10)
• The competent authorities where the law requires it

We do not sell or rent your data.

7. International transfers

We host and process data in the EU wherever possible. Where a transfer outside the EU is necessary (for example, cloud providers), we apply appropriate safeguards such as standard contractual clauses.

8. How long we keep it

• Client and prospect data: 3 years after the last contact or the end of the contract
• Candidate data: 2 years after the last exchange
• Contract and billing data: 10 years (legal obligation)
• Cookies: see section 10

9. Data security

We put in place:

• Secure hosting (OVH, Google Cloud)
• Strict access controls
• Encryption of sensitive data
• Regular backups
• Security audits and penetration tests
• Privacy training for our staff

10. Cookies and trackers

This site uses three categories of cookies and trackers:

• Essential (no consent needed): the “_cfuvid” cookie set by Cloudflare, which protects the site against abuse, and the record of your cookie choice in your browser’s local storage: the “spear-consent” key, kept for 6 months, and the “__ph_opt_in_out_*” marker in which PostHog remembers that same choice.
• Analytics (with your consent): two tools, switched on only after you agree via the banner.
  • Google Analytics 4, provided by Google Ireland Limited, tells us which pages are viewed, where visits come from and what device is used. It sets the “_ga” and “_ga_*” cookies, kept for 13 months at most. Google Analytics 4 does not record IP addresses. Data may be processed in the United States by Google LLC under the EU–US Data Privacy Framework.
  • PostHog, provided by PostHog Inc. and hosted in the European Union (PostHog Cloud EU), tells us which pages are viewed, where visits come from, what device is used, how the site is interacted with (clicks, contact-form submissions) and which technical errors occur. It sets the “ph_*_posthog” cookie and entries in your browser’s local storage, kept for 12 months at most.
• Marketing: we use no advertising or targeting cookies.

You choose whether to accept or decline analytics on your first visit. You can change your mind at any time through the “Cookie settings” link in the footer: declining switches Google Analytics off and deletes its cookies, and PostHog then stores no cookie and no browsing data in your browser, only the marker of your refusal. If you decline, PostHog keeps only an anonymous count of visits, computed on its servers with no identifier stored on your device, on the basis of our legitimate interest in knowing the site’s audience. We ask again after 6 months. You can also delete or block cookies in your browser settings.

11. Your rights

You have the following rights over your data:

• Access
• Rectification
• Erasure
• Restriction of, or objection to, processing
• Portability
• Withdrawal of your consent at any time

To exercise your rights, write to us at [email protected]. We may ask you for proof of identity.

12. Complaints

If you believe your rights are not being respected, you can contact the CNPD (Commission Nationale pour la Protection des Données): https://cnpd.public.lu

13. Changes to this policy

We may change this policy at any time. We will flag significant changes on the site or by email, and we encourage you to check back from time to time.

Questions? Write to us at [email protected]