Privacy & Data Handling Notice

This Privacy & Data Handling Notice explains how Jamey S.à r.l.s, 177, Rue de Luxembourg, L-8077 Bertrange, Luxembourg, Luxembourg Trade and Companies Register no. B288826 (Jamey, we, us or our), processes personal data in connection with Jamey.lu and its related business services.

For privacy questions or to exercise your rights regarding data for which Jamey is controller, contact privacy@jamey.lu. Before publication, Jamey will ensure that this mailbox is active and monitored.

This Notice does not replace the privacy notice of a business that uses Jamey as its CRM platform. Where Jamey processes personal data entered by a business customer into that customer's CRM or workspace, that business is normally responsible for explaining the processing to the people concerned.

Jamey has different roles depending on the data and purpose:

Depending on your interaction with Jamey, we may process the following categories:

We process controller data for the purposes below, each with its typical legal basis.

Jamey uses WhatsApp only to communicate with a Customer's representatives and Authorised Users in a B2B context. We may use it for onboarding, support, service-operation information, meeting coordination and matters concerning the contractual relationship.

We do not use WhatsApp to contact a Customer's own CRM contacts, clients or prospects for Jamey's benefit. We do not use Customer CRM Data to create Jamey marketing audiences.

You can ask us at any time to stop non-essential WhatsApp communications by replying in the conversation or emailing privacy@jamey.lu. We may use email or in-product messages instead for essential service, security, billing or legal notices. WhatsApp/Meta independently processes information under its own terms and privacy policy when you use that channel.

A Jamey business customer may use the Services as its CRM platform to manage its relationship with its own clients, prospects, suppliers or team members. At that customer's instruction, the platform can link a contact to a business, project, transaction, communication or campaign, and can build recipient segments and exclusions for the customer's campaigns.

For this processing:

the business customer decides the purposes and means of processing and is the controller;

Jamey processes the data only to provide the platform and according to the customer's documented instructions, subject to law and the applicable data-processing agreement;

the business customer must ensure it has an appropriate lawful basis, provides any required privacy information, and honours objections, unsubscribe requests, consent withdrawals and suppression lists; and

Jamey does not sell Customer CRM Data or use it for its own direct marketing.

If you receive a campaign from a Jamey business customer, use the unsubscribe or objection method supplied by that business or contact the business directly. We will forward a verified request to the relevant customer where necessary and appropriate.

We use the following core providers to operate the Services. The current, complete list—including legal entities, functions, locations and transfer safeguards—is published at https://jamey.lu/legal/sub-processors [publish before launch].

AI features are optional. When you deliberately use an AI feature, we send the input necessary to perform the request to OpenRouter and the selected downstream AI model provider. The output is returned to the Services for display or the requested workflow.

OpenRouter and individual model providers may process requests outside the EEA and their policies differ by provider and endpoint. A provider may have its own prompt logging, retention or training policy. We maintain a routing policy and, where the selected product configuration supports it, apply available restrictions relating to data retention and model training. We do not promise that every AI request is zero-retention, EEA-only or excluded from model training unless we have specifically confirmed the relevant model/endpoint configuration in writing.

Do not submit sensitive personal data, credentials, payment-card data, special-category personal data, confidential third-party information or data subject to strict residency requirements through AI features unless Jamey has confirmed that the chosen configuration is suitable. For Customer CRM Data, the Customer remains responsible for the lawful basis, notices and instructions for any AI input.

AI results can be inaccurate or unsuitable. Human review remains necessary before output is relied on, communicated externally or used to make a decision with a material effect on an individual.

We share personal data only where necessary for the purposes described above, including with:

Jamey personnel and authorised contractors who need access to perform their work and are subject to confidentiality obligations;

infrastructure, cloud hosting, database, storage, identity/authentication, security, payment, email, support and messaging providers that process data for us under contract;

professional advisers, insurers, auditors and competent public authorities where required or permitted by law; and

a successor business where Jamey is involved in a merger, financing, acquisition or sale of assets, subject to appropriate safeguards.

Our current list of sub-processors and service providers is available at https://jamey.lu/legal/sub-processors [publish before launch].

We configure the principal hosting and database workloads described in section 7 in European regions. If data are transferred outside the EEA, the United Kingdom or a country recognised as adequate by the European Commission—including due to OpenRouter/selected AI model providers, global infrastructure, support or payment processing—we will use an appropriate safeguard, such as the European Commission's Standard Contractual Clauses, and apply supplementary measures where required.

We keep controller data only for as long as necessary for the purposes in this Notice, including to meet legal, accounting, tax, security and dispute-resolution requirements. The exact periods must reflect the actual system configuration:

We use technical and organisational safeguards appropriate to the risk, including access controls, authentication measures, least-privilege access, encryption where appropriate, logging, backup and recovery processes, confidentiality obligations and security monitoring. No online service is completely secure; you should protect your credentials and notify us promptly if you suspect unauthorised access.

Every Jamey business-service login page provides a Manage your account link. The account-management screen must clearly separate the following actions:

Subject to the conditions and limits in applicable law, you may have the right to request access to your personal data; correction of inaccurate data; deletion; restriction of processing; portability; and objection to processing based on legitimate interests.

You have the right to object at any time to the use of your personal data for direct marketing, including profiling related to that direct marketing. Once you object, we will no longer use your data for that purpose.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. To exercise your rights regarding data for which Jamey is controller, contact privacy@jamey.lu. You also have the right to lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD) or another competent supervisory authority.

Where the conditions for the GDPR right to data portability are met, you may request the personal data you provided to Jamey as controller in a structured, commonly used and machine-readable format. For records held by a separate Jamey business—such as that business's orders, delivery data or CRM history—contact that business directly.

For CRM data controlled by a Jamey business customer, contact that business directly. We will assist it where we are required to do so.

The Services are intended for professional and business users, not for children. We do not knowingly collect personal data from children through the Services. If you believe a child has provided personal data to us, contact privacy@jamey.lu.

We use strictly necessary technologies required for authentication, security and basic Service operation. Non-essential analytics, preference or marketing technologies are not enabled without consent. Details are in our separate Cookie Notice at https://jamey.lu/cookies.

The providers that process personal data on our behalf are listed, with their roles, locations and transfer safeguards, at https://jamey.lu/legal/sub-processors.

We may update this Notice when our processing, Services or legal requirements change. For material changes, we will give appropriate advance notice through the Services, by email or another durable method. The latest version will be published at Jamey.lu with its effective date.