Privacy policy

Last updated: April 3, 2026

1. Data controller
The data controller for the personal data processed through this website is Les Petits Tournesols SARL, a private limited liability company registered with the Luxembourg Trade and Companies Register under number B149121.

Reference address: 2, rue de l??glise, L-3636 Kayl, Luxembourg.

The Les Petits Tournesols website is intended to present the Les Petits Tournesols nurseries in Luxembourg, make it easier for families to get in touch and manage requests sent through the website.

The general contact details currently confirmed in the project are as follows:
Email: contact@lespetitstournesols.lu
Phone: +352 26 56 79 07

2. Personal data processed
Depending on how you use the website, Les Petits Tournesols may process the following categories of data:
- identification and contact data voluntarily submitted through the contact form: name, email address, phone number, nursery concerned and message content;
- technical data related to the form submission and anti-abuse protection: timestamp, language, hashed IP address, user agent, security tokens and temporary anti-spam counters;
- browsing data strictly necessary for the operation of the website: technical session, cookie consent choice and stored preferences state;
- data relating to professional contact details published on the website to allow contact with the organisation or certain authorised persons;
- internal management data for the website administration: administrator account identifier, display name, role, nursery assignment and password stored in hashed form.

The website does not currently offer any public user account or family portal.

3. Purposes of processing
The processing carried out on this website mainly serves the following purposes:
- replying to requests sent through the contact form;
- guiding families towards the most suitable nursery, arranging visits and preparing exchanges relating to a potential registration;
- displaying practical information about the nurseries, the team and current availability;
- ensuring the technical operation of the website, access security, session management and the prevention of automated abuse;
- allowing, depending on your choice, the display of certain third-party content such as the Google Maps interactive map on the contact page;
- allowing, depending on your choice, the activation of the Google Ads tag and the conversion measurement associated with the contact form submission;
- administering website content, management accounts and received messages.

4. Legal bases
Depending on the case, the processing is based on the following legal grounds:
- the performance of pre-contractual steps or the handling of a request at your initiative when you contact Les Petits Tournesols to obtain information, arrange a visit or prepare a registration;
- the legitimate interests of Les Petits Tournesols in ensuring website security, preventing spam, limiting brute-force attempts, protecting published contact details against abusive automated collection and administering the website in general;
- your consent for non-essential trackers or services, in particular for displaying the Google Maps interactive map through the ?Preferences? category and for Google Ads services through the ?Marketing / advertising? category;
- compliance with applicable legal obligations where retention or a response must be ensured on that basis.

5. Contact details published on the website and protection against abusive use
The website deliberately publishes certain contact details in order to make it easier for families and interested persons to reach Les Petits Tournesols:
- the postal addresses of the nurseries;
- the general contact email address;
- professional email addresses and phone numbers linked to the nurseries or certain authorised persons.

These contact details are made available strictly for professional contact and public information purposes.

Postal addresses are publicly displayed. Certain professional email addresses and phone numbers may also be displayed directly on some pages in order to allow simple and prompt contact. The website implements technical and organisational measures intended to limit unnecessary technical exposure, reduce superfluous duplication, restrict access to internal data and reduce simple forms of abusive automated harvesting of these details, including server-side checks, rate limiting, restricted administration access and centralised management of published data sources.

These measures are intended to reduce the risk, but they cannot guarantee absolute protection against every attempt to collect or bypass them.

6. Recipients of the data
Depending on the need, the data is intended for authorised persons within Les Petits Tournesols and its technical administration, within the limits of their duties.

The following parties may also be involved, depending on the processing actually used:
- technical service providers for hosting, maintenance, backups or support acting on behalf of the controller;
- Google, only if you authorise the ?Preferences? category for the Google Maps interactive map on the contact page or the ?Marketing / advertising? category for Google Ads services activated after consent.

The detailed legal identity of these service providers is not published individually on this page.

7. Cookies, trackers and third-party services
The website currently uses the following elements:
- cookies strictly necessary for the operation of the website, including the PHP session cookie and the cookie used to remember your consent choice;
- a consent management mechanism allowing you to accept, refuse or customise tracker categories;
- the Google Maps map on the contact page, blocked until you authorise the ?Preferences? category;
- the Google Ads tag and the conversion measurement associated with the contact form, blocked until you authorise the ?Marketing / advertising? category.

As of the date of this update, no audience measurement service is activated by default before consent. Google Ads services are loaded only after a valid choice on the ?Marketing / advertising? category.

The consent cookie is kept for 180 days. The session cookie is kept for the duration of your session or according to the applicable technical security settings.

You can change your choice at any time via the ?Manage cookies? link available on the website.

8. Possible transfers outside the European Union
No transfer outside the European Union has been identified in the standard operation of the website apart from the voluntary activation of a third-party service.

However, if you choose to enable the Google Maps interactive map or Google Ads services, certain technical data required for those services may be transmitted to Google and processed outside the European Economic Area, including in the United States, according to Google?s own conditions and safeguards.

9. Retention periods
The retention periods currently observable or confirmed in the project are as follows:
- consent cookie: 180 days;
- technical session: session duration or the necessary technical duration;
- temporary anti-abuse counters, session tokens and other technical traces strictly linked to security: short retention limited to the corresponding security need;
- administrator account data: retained while the account is active, then until deletion or administrative cleanup.

As for messages sent through the contact form, the website stores them in an internal administration area so they can be reviewed and processed. No automatic deletion period is currently coded in the project for these messages. Their retention therefore depends on the effective handling of requests and the applicable internal organisation.

10. Data security
Technical and organisational measures are implemented to strengthen the confidentiality, integrity and availability of the data processed on the website. As of the date of this policy, the following points are confirmed in the project:
- administrator access protected by authentication, roles and scope restrictions;
- administrator passwords stored in hashed form;
- session regeneration and hardened session cookies;
- protections against certain automated attacks, spam and brute-force attempts;
- server-side checks on forms;
- HTTP security headers and restricted access to certain sensitive directories and files;
- measures intended to limit unnecessary technical exposure of published contact details and centralised management of their sources within the application.

Despite these measures, no Internet-connected system can offer absolute security. Les Petits Tournesols endeavours to reduce risks and adapt its measures to the sensitivity level of the processing actually carried out.

11. Your rights
Under the GDPR, you may, depending on the applicable situation, request:
- access to your personal data;
- rectification of inaccurate or incomplete data;
- erasure of your data;
- restriction of processing;
- objection to certain processing based on legitimate interest;
- withdrawal of your consent for processing based on consent;
- portability of your data where this right applies.

You may also lodge a complaint with the competent supervisory authority in Luxembourg: the National Commission for Data Protection (CNPD).

12. Exercising your rights and contact
For any question relating to this policy or to exercise your rights, you may write to: contact@lespetitstournesols.lu.

If your request requires formal handling by post, the reference legal address of the data controller is: Les Petits Tournesols SARL, 2, rue de l??glise, L-3636 Kayl, Luxembourg, registration number B149121.

We recommend that you specify the subject of your request, the nursery concerned if relevant, and any information useful for identifying the data concerned.

13. Policy updates
This policy may change to reflect modifications to the website, the services actually used, applicable obligations or the internal practices of Les Petits Tournesols. The version published on this page is the reference version as of the date indicated above.