Privacy & Data Handling Notice

This Privacy & Data Handling Notice explains how Jamey S.à r.l.s, 177, Rue de Luxembourg, L-8077 Bertrange, Luxembourg, Luxembourg Trade and Companies Register no. B288826 (Jamey, we, us or our), processes personal data in connection with Jamey.lu and its related business services.

For privacy questions or to exercise your rights regarding data for which Jamey is controller, contact privacy@jamey.lu. Before publication, Jamey will ensure that this mailbox is active and monitored.

This Notice does not replace the privacy notice of a business that uses Jamey as its CRM platform. Where Jamey processes personal data entered by a business customer into that customer's CRM or workspace, that business is normally responsible for explaining the processing to the people concerned.

Jamey has different roles depending on the data and purpose:

Depending on your interaction with Jamey, we may process the following categories:

We process controller data for the purposes below, each with its typical legal basis.

Jamey uses WhatsApp only to communicate with a Customer's representatives and Authorised Users in a B2B context. We may use it for onboarding, support, service-operation information, meeting coordination and matters concerning the contractual relationship.

We do not use WhatsApp to contact a Customer's own CRM contacts, clients or prospects for Jamey's benefit. We do not use Customer CRM Data to create Jamey marketing audiences.

You can ask us at any time to stop non-essential WhatsApp communications by replying in the conversation or emailing privacy@jamey.lu. We may use email or in-product messages instead for essential service, security, billing or legal notices. WhatsApp/Meta independently processes information under its own terms and privacy policy when you use that channel.

A Jamey business customer may use the Services as its CRM platform to manage its relationship with its own clients, prospects, suppliers or team members. At that customer's instruction, the platform can link a contact to a business, project, transaction, communication or campaign, and can build recipient segments and exclusions for the customer's campaigns.

For this processing:

the business customer decides the purposes and means of processing and is the controller;

Jamey processes the data only to provide the platform and according to the customer's documented instructions, subject to law and the applicable data-processing agreement;

the business customer must ensure it has an appropriate lawful basis, provides any required privacy information, and honours objections, unsubscribe requests, consent withdrawals and suppression lists; and

Jamey does not sell Customer CRM Data or use it for its own direct marketing.

If you receive a campaign from a Jamey business customer, use the unsubscribe or objection method supplied by that business or contact the business directly. We will forward a verified request to the relevant customer where necessary and appropriate.

We use the following core providers to operate the Services. The current, complete list—including legal entities, functions, locations and transfer safeguards—is published at https://jamey.lu/legal/sub-processors.

AI features are optional. When you deliberately use an AI feature, we send the input necessary to perform the request to OpenRouter and the selected downstream AI model provider. The output is returned to the Services for display or the requested workflow. Onboarding assistance uses OpenAI, image generation uses fal.ai, and building a site from an existing website uses Browserless (San Francisco) for rendering and Firecrawl for crawling.

These features operate on business content — menus, service descriptions, a business's own website — and guest records are not deliberately sent to them and are not routed to them by design. We do not claim more than that: if a business types a person's name into a free-text field that an AI feature then reads, that name would be sent to the model vendor, and the platform does not scan for it. Businesses should keep guest and other personal data out of free-text fields used by AI features.

OpenRouter and individual model providers may process requests outside the EEA and their policies differ by provider and endpoint. A provider may have its own prompt logging, retention or training policy. We maintain a routing policy and, where the selected product configuration supports it, apply available restrictions relating to data retention and model training. We do not promise that every AI request is zero-retention, EEA-only or excluded from model training unless we have specifically confirmed the relevant model/endpoint configuration in writing.

Do not submit sensitive personal data, credentials, payment-card data, special-category personal data, confidential third-party information or data subject to strict residency requirements through AI features unless Jamey has confirmed that the chosen configuration is suitable. For Customer CRM Data, the Customer remains responsible for the lawful basis, notices and instructions for any AI input.

AI results can be inaccurate or unsuitable. Human review remains necessary before output is relied on, communicated externally or used to make a decision with a material effect on an individual.

We share personal data only where necessary for the purposes described above, including with:

Jamey personnel and authorised contractors who need access to perform their work and are subject to confidentiality obligations;

infrastructure, cloud hosting, database, storage, identity/authentication, security, payment, email, support, messaging, analytics and AI providers that process data for us under contract — currently Vercel (hosting in fra1 Frankfurt, plus analytics and speed telemetry), Neon (PostgreSQL database in AWS eu-central-1 Frankfurt), Supabase (dashboard database and sessions), Bunny.net (media storage and delivery), Brevo (transactional email and campaigns), Google (OAuth sign-in and, if connected, Search Console), WhatsApp Business Platform (messaging), Microsoft Clarity (only where a business enables it), Stripe (payments), and OpenRouter, OpenAI, fal.ai, Browserless and Firecrawl with approved model providers (AI, content generation and site building);

the specific Jamey business customer (merchant) that you chose to interact with, for the order, booking, loyalty card, membership, enquiry or subscription you placed with that business — and only that business;

professional advisers, insurers, auditors and competent public authorities where required or permitted by law; and

a successor business where Jamey is involved in a merger, financing, acquisition or sale of assets, subject to appropriate safeguards.

Our current list of sub-processors and service providers is available at https://jamey.lu/legal/sub-processors.

The application and the primary database are pinned to Frankfurt. That does not cover the whole provider list: OpenAI, fal.ai, Browserless, Firecrawl, OpenRouter, Microsoft and Meta are US-based or US-operated, and Vercel, Google and Stripe involve group processing in the United States. Each such transfer is covered by an appropriate safeguard, such as the European Commission's Standard Contractual Clauses, with supplementary measures where required.

If you are a guest using a Jamey-powered business page, your data are visible to the business (merchant) you interacted with, and to nobody else on the platform.

Order, booking, reservation, loyalty, membership and enquiry records are written to our Neon PostgreSQL database in Frankfurt and stored inside that merchant's workspace. Access is scoped per workspace, so a different merchant on Jamey cannot query, export or receive your record.

A single Jamey Account can be reused across participating businesses so that you do not create a new password each time. That account only carries your identity; each business still sees only the transactions, loyalty balance, messages and contact details that arose from its own relationship with you. Being signed in at a business records you as a member of that business page; it does not give you or anyone else staff access.

Jamey does not sell end-customer data, does not build cross-merchant marketing profiles, and does not add you to another merchant's list. Jamey staff access workspace data only where necessary for support, security or a legal obligation, under confidentiality obligations and logging.

Beyond the merchant, your data reach only the providers listed in section 7 acting on documented instructions (for example Neon for storage, Bunny.net for images and documents, Brevo for email, WhatsApp for messaging, Stripe for payment).

Where a business uses Jamey to run its page, the following records are held in that business's workspace. The business is the controller of these records; Jamey stores and processes them on its instructions.

Our first-party page analytics record the path, referrer, UTM parameters, language, device type and timestamp — and nothing else. No IP address, no user identifier, no cookie and no cross-site identifier is stored, so those records are not personally identifying.

IP addresses are used in four places and stored in only one: rate limiting and interest-signal processing use the IP address transiently and do not store it; the requesting IP address is forwarded to Brevo on sign-in requests for its own abuse controls; and a website form submission stores the submitter's IP address with the submission.

Microsoft Clarity is different and is off by default. Where a business enables it on its own site, Clarity records session replays and heatmaps of visits to that site, and that business is responsible for its lawful basis and its own consent banner.

We keep controller data only for as long as necessary for the purposes in this Notice, including to meet legal, accounting, tax, security and dispute-resolution requirements. The exact periods must reflect the actual system configuration:

We use technical and organisational safeguards appropriate to the risk, including access controls, authentication measures, least-privilege access, encryption where appropriate, logging, backup and recovery processes, confidentiality obligations and security monitoring. No online service is completely secure; you should protect your credentials and notify us promptly if you suspect unauthorised access.

Card data never reach our servers. Payments use Stripe Elements, so card details pass from your browser to Stripe directly; we store only payment status, amount, currency and Stripe identifiers — never a card number or a security code. Wallet payments (Apple Pay, Google Pay) expose a device account number rather than the funding card.

Third-party credentials a business connects (for example Google, Search Console, Clarity) are encrypted with AES-256-GCM before storage using a platform key, and are never returned to a browser.

A guest signed in on a business's own domain holds a short-lived, origin-bound bearer token — one hour, or twelve hours where they chose to be remembered — rather than a long-lived cookie. The token is bound to a registered origin, re-checked on every request, and removing an origin invalidates every token bound to it at its next use.

All traffic is served over HTTPS. Stored media are proxied on read rather than served from raw storage URLs, so a stored URL is not itself an access key.

Every Jamey business-service login page provides a Manage your account link. The account-management screen must clearly separate the following actions:

Subject to the conditions and limits in applicable law, you may have the right to request access to your personal data; correction of inaccurate data; deletion; restriction of processing; portability; and objection to processing based on legitimate interests.

You have the right to object at any time to the use of your personal data for direct marketing, including profiling related to that direct marketing. Once you object, we will no longer use your data for that purpose.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. To exercise your rights regarding data for which Jamey is controller, contact privacy@jamey.lu. You also have the right to lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD) or another competent supervisory authority.

Where the conditions for the GDPR right to data portability are met, you may request the personal data you provided to Jamey as controller in a structured, commonly used and machine-readable format. For records held by a separate Jamey business—such as that business's orders, delivery data or CRM history—contact that business directly.

For CRM data controlled by a Jamey business customer, contact that business directly. We will assist it where we are required to do so.

The Services are intended for professional and business users, not for children. We do not knowingly collect personal data from children through the Services. If you believe a child has provided personal data to us, contact privacy@jamey.lu.

We use strictly necessary technologies required for authentication, security and basic Service operation. Guest identity is held in browser storage as a short-lived token rather than in a cookie, and our own page analytics set nothing on your device. Non-essential analytics, preference or marketing technologies are not enabled without consent, and a technology a business enables on its own site (such as Microsoft Clarity) is that business's responsibility. Details are in our separate Cookie Notice at https://jamey.lu/cookies.

The providers that process personal data on our behalf are listed, with their roles, locations and transfer safeguards, at https://jamey.lu/legal/sub-processors.

We may update this Notice when our processing, Services or legal requirements change. For material changes, we will give appropriate advance notice through the Services, by email or another durable method. The latest version will be published at Jamey.lu with its effective date.