Privacy Policy: Grand Duchy of Luxembourg

This Policy explains how REXOR GROUP LLC processes personal data in connection with the Luxembourg version of lodgeyard.com: which data, for what purposes and on what legal bases, with whom, where, for how long, and how to exercise your rights. Version 1.1 of 28 October 2026. In the event of any discrepancy between the English and French versions, the French version prevails (Article 24).

Article 1. Purpose and scope

1.1. This Privacy Policy (the "Policy") describes the processing of personal data carried out by REXOR GROUP LLC, owner of the Lodgeyard brand, in connection with: (a) the Luxembourg version of the website lodgeyard.com, in English and in French; (b) quote requests; (c) the chat window, where it is offered on that version; (d) correspondence by electronic mail; (e) prospecting addressed to professionals of camping and tourism; and (f) the pre-contractual and contractual relationship with professional customers whose units are delivered in the Grand Duchy of Luxembourg.

1.2. The Controller applies to the processing described in this Policy Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation, "GDPR"), the Luxembourg Law of 1 August 2018 on the organisation of the National Commission for Data Protection and the general data protection framework, the Luxembourg Law of 30 May 2005 on the protection of privacy in the electronic communications sector, as amended, and Article 48 of the Luxembourg Law of 14 August 2000 on electronic commerce, as amended.

1.3. In brief: we use the information you send us to study your project and answer you. We do not sell or rent it. You may ask us at any time to access it, to correct it or to erase it, and you may object at any time to our prospecting messages.

1.4. The use of trackers on your terminal equipment is described in more detail in the Cookie Policy, which forms part of this Policy.

1.5. This Policy does not govern: the processing carried out by the installer partner, the freight forwarder or customs representative and the carriers for their own contracts or services (Article 8.4); the processing carried out by the operators of third-party websites to which the Website links (Article 22); or the other country versions of the Website, each of which has its own privacy policy, although the processing operations they describe may be identical.

Article 2. Definitions

2.1. The terms "personal data", "processing", "controller", "processor", "recipient", "third party", "consent" and "data subject" have the meaning given to them by Article 4 of the GDPR.

2.2. In this Policy:

• "Controller", "we" and "us" mean REXOR GROUP LLC, identified in Article 3;
• "Website" means the website lodgeyard.com, including its Luxembourg version published under the addresses beginning with /lu/;
• "Chat Window" means the window of the Website which, where it is offered, displays the replies of an automated conversational system;
• "Quote Request" means a request sent through the quote request form of the Website or by electronic mail;
• "Customer" means a professional which has signed a quote of the Controller;
• "Prospect" means an establishment to which the Controller writes without a prior request from it;
• "CNPD" means the Commission nationale pour la protection des données, the Luxembourg supervisory authority.

Article 3. Controller and contact

3.1. The controller of the processing described in this Policy is REXOR GROUP LLC, a limited liability company governed by the laws of the State of New Mexico, United States of America, whose address is 8206 Louisiana Blvd NE, Ste A #9493, Albuquerque, NM 87113, United States of America. Lodgeyard is a brand of REXOR GROUP LLC.

3.2. For any question relating to this Policy or to your personal data, you may write to contact@lodgeyard.com or to the postal address indicated in Article 3.1.

3.3. The Controller has not appointed a data protection officer, as its activities do not fall within the cases in which Article 37 of the GDPR makes such an appointment compulsory. Requests are handled by the Controller directly at the address indicated in Article 3.2.

3.4. Where the Controller designates a representative in the Union within the meaning of Article 27 of the GDPR, the identity and contact details of that representative will be indicated in this Article. You may then address the representative, in addition to or instead of the Controller, on all issues relating to the processing of your personal data.

Article 4. Principles applied

4.1. In accordance with Article 5 of the GDPR, the Controller processes personal data lawfully, fairly and transparently; for specified, explicit and legitimate purposes; limited to what is necessary for those purposes; accurate and kept up to date; for no longer than necessary; and in a manner that ensures appropriate security.

4.2. Your personal data are neither sold nor rented.

4.3. The Controller does not ask you for any special category of personal data within the meaning of Article 9 of the GDPR, such as data concerning health, political opinions or religious beliefs. Please do not include such data in your messages, in the quote request form or in the Chat Window.

4.4. To obtain prices, the Controller sends manufacturers the technical characteristics of your project, without your contact details.

4.5. The personal data processed by the Controller are collected: (a) directly from you, when you fill in the form, write to us, use the Chat Window or sign a quote; (b) from your undertaking, when it designates you as its contact person; and (c) for prospecting only, from the publications of the establishment concerned, in particular its website, as indicated in Article 7.

4.6. Providing your data is not a statutory obligation. It is, however, a necessary condition for the study of your project, the preparation of a quote and the conclusion and performance of a contract. If you do not provide the data indicated as necessary, the Controller cannot answer your request or perform the contract. Providing your contact details in the Chat Window is optional.

Article 5. Data processed when you request a quote

5.1. When you send a Quote Request through the form, we process the data that you enter in it, namely: your surname and first name; your establishment or activity; your electronic mail address; your telephone number, which is optional; the region of the site; the number of units; the model concerned; the desired timeframe; and the description of your project, in particular the land, the access for a lorry and a crane, seasonal or year-round use, and your questions.

5.2. We also record the country and language version of the Website from which the request is sent, in order to answer you in your language and to apply the rules of your country. We then process the content of our exchanges by electronic mail.

5.3. Fields indicated as optional on the form are optional. The other fields are necessary to study your project and to prepare a quote: without them, we cannot prepare a quote.

5.4. Each Quote Request is notified by electronic mail to the Controller's mailbox, so that it can be dealt with.

5.5. To limit abuse of the form, our hosting provider counts submissions per IP address for one minute; that address is not kept. The form also contains a field which is invisible to human visitors and is used only to filter out automated submissions.

Article 6. Data processed through the chat window

6.1. Where the Chat Window is offered on the Luxembourg version of the Website, it puts you in contact with an automated conversational system using artificial intelligence, not a person. The window tells you so when it opens.

6.2. When you use the Chat Window, we process: (a) your messages and its replies; (b) the contact details that you choose to leave, namely an electronic mail address or a telephone number; and (c) your IP address, which is processed by our hosting provider to route the conversation. To limit abuse, we keep only an encrypted fingerprint of that address, which does not make it possible to retrieve it.

6.3. If you ask to speak to a person, or if you leave your contact details, the Lodgeyard team receives your contact details and the transcript of the conversation through the internal messaging service of the team, in order to answer you.

6.4. The database of conversations is hosted in the Asia-Pacific region. Each conversation is automatically erased twelve (12) months after its last message.

6.5. Please do not enter in the Chat Window any special category of data, any bank or payment details, any password or any personal data of third parties. No bank details are ever communicated through the Chat Window.

6.6. The conditions of use of the Chat Window, in particular the non-binding nature of its replies, are set out in the Website Terms of Use.

6.7. The automated nature of the replies in the Chat Window is indicated so that you know at all times that you are not conversing with a person. If you ask whether you are speaking to a person, the Chat Window answers truthfully. At any time, you may ask to be contacted by a member of the Lodgeyard team or write directly to contact@lodgeyard.com.

Article 7. Data processed when we contact you first

7.1. If we write to you without a request on your part, we use the name of your establishment and the professional electronic mail address that it publishes, in particular on its website. That publication is the source of the data.

7.2. We write only to general addresses of establishments, such as addresses beginning with info@ or contact@, and never to a personal address.

7.3. We send at most two messages: a first message and a single follow-up. Without a reply from you, we erase the address twelve (12) months after our last message.

7.4. Under Article 11(5) of the Law of 30 May 2005 and Article 48(2) of the Law of 14 August 2000, the requirement of prior consent for direct marketing by electronic mail applies to subscribers who are natural persons. Where an establishment is operated by a natural person, we send it a prospecting message by electronic mail only with its prior consent. Our messages are addressed to establishments at their general address; they are identified as commercial communications as soon as they are received, indicate the identity of the sender, and contain a valid address and a link allowing you to request that such communications cease, in accordance with Article 48(1) of the Law of 14 August 2000 and Article 11(4) of the Law of 30 May 2005.

7.5. Where we write to you first, our message provides, at the latest at that first communication, the information required by Article 14 of the GDPR, in particular the source of the address, or refers to this Policy, together with the means of objecting described in Article 17.

Article 8. Data processed in the pre-contractual and contractual relationship

8.1. When you prepare or conclude a contract with us, we process the identification and contact details of your contact persons (surname, first name, function, electronic mail address, telephone number), the identification data of your undertaking, the address of the delivery place, your EORI number and value added tax identification number, the validations of plans, our correspondence, the payment records (amount, date, ordering party), the delivery notes, the notices of non-conformity and the photographs that you send us.

8.2. Please avoid sending photographs on which natural persons can be identified, unless this is necessary.

8.3. To prepare and perform your turnkey quote, we also communicate your contact details and the address of your site to the installer partner named in the quote. For customs clearance, we communicate your business name and your EORI and value added tax numbers to the freight forwarder or customs representative acting in your name. For transport, we communicate to the carriers involved the information strictly necessary for delivery, in particular the address of the delivery place and the contact details of the person designated to receive the delivery. These undertakings process those data for their own contract with you or for the performance of their own services, as independent controllers.

8.4. The installer partner, the freight forwarder or customs representative and the carriers determine themselves the purposes and means of the processing that they carry out for their own contract or services. Questions relating to that processing are to be addressed to them. The Controller communicates to them only the data indicated in Article 8.3.

8.5. The data necessary to establish invoices and payment records are kept for the periods imposed by law for accounting documents, in accordance with Article 14, even after the end of the business relationship.

Article 9. Data processed when you browse the Website

9.1. Our hosting provider processes your IP address and the technical data of your requests (in particular the page requested, the date and time, the browser) in order to deliver the pages of the Website and to protect it against attacks and abuse.

9.2. On your arrival on the home page, we direct you to the version of the Website for your country, according to the country of your connection. That country is neither recorded nor kept.

9.3. If you yourself choose a country or a language in the menu, a functional cookie named "pays" retains that choice for twelve (12) months. It serves only to stop redirecting you.

9.4. We measure audience with an analytics service which uses neither cookies nor identifiers: page views are counted in aggregate, without following a person from one visit to another.

9.5. Our hosting provider may place a technical cookie that is strictly necessary for the security of the Website. The Chat Window does not place cookies and writes nothing in your browser before you open it; it then keeps certain information in the session storage of your browser, erased when the tab is closed. Once you have sent a first message, it also keeps the identifier of your conversation in the local storage of your browser, on lodgeyard.com and on rexorcloser.com, for twelve (12) months after your last message, as long as the conversation itself is kept (Article 6.4), so that the conversation can pick up where it left off when you come back. This identifier is used for nothing else: no advertising, no tracking from one website to another. You can also erase it from the chat window, with the "New conversation" link. These operations are described in the Cookie Policy. You can erase it by clearing the data of lodgeyard.com and of rexorcloser.com in your browser; the conversation then no longer resumes automatically, but it remains kept under the conditions of Article 6.4 and can be deleted on request at contact@lodgeyard.com.

Article 10. Purposes, legal bases and retention periods

10.1. The table below sets out, for each purpose, the legal basis of the processing under Article 6(1) of the GDPR and the applicable retention period. The retention periods are detailed in Article 14.

10.2. Where the processing is based on our legitimate interest, the Controller considers that this interest is not overridden by your interests or fundamental rights and freedoms, taking into account in particular the professional context of the relationship, the limitation of the data processed and the means of objection offered to you. You may obtain information on this balancing by writing to us.

10.3. The legitimate interests pursued by the Controller are the following: protecting the Website, the form and the Chat Window against abuse and attacks; making its offer known to professionals of camping and tourism, by a limited number of messages sent to general addresses of establishments; ensuring that objections are respected; presenting to each visitor the version, the rules and the prices of his or her country; knowing in aggregate how the Website is used, in order to improve it; complying with the obligations to which it is subject under the laws of its place of establishment; and establishing, exercising or defending its rights.

10.4. The Controller does not currently base any processing described in this Policy on your consent. If it were to do so, you could withdraw your consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal.

Article 11. Automated processing and artificial intelligence

11.1. No decision producing legal effects concerning you or similarly significantly affecting you is taken on the basis of automated processing alone, within the meaning of Article 22 of the GDPR.

11.2. The replies of the Chat Window are generated by an automated system. Quotes, prices and commercial commitments are established by the Controller in writing, in accordance with the general terms of sale.

11.3. The Controller uses artificial intelligence service providers to draft and review the replies of the Chat Window and to assist in drafting and sorting its correspondence. For the Chat Window, the Controller excludes providers that keep or reuse the data.

Article 12. Recipients

12.1. Your personal data are processed by REXOR GROUP LLC and by the members of its team who need them for their tasks.

12.2. They are also processed by technical service providers acting on the instructions of the Controller as processors, within the meaning of Article 28 of the GDPR, belonging to the following categories:

• hosting and content delivery providers: hosting of the Website and of the Chat Window, storage of requests and conversations, routing of electronic mail, security of the Website and audience measurement;
• electronic mail service providers: mailbox of the Controller;
• artificial intelligence service providers, established in the United States: drafting and review of the replies of the Chat Window, excluding providers that keep or reuse the data, and assistance in drafting and sorting the Controller's correspondence;
• internal messaging service providers: internal messaging of the team, for contact requests made in the Chat Window.

12.3. The list of these service providers is available on request at contact@lodgeyard.com.

12.4. The Controller chooses service providers presenting sufficient guarantees as to the implementation of appropriate technical and organisational measures, as required by Article 28(1) of the GDPR. They may process your data only on the documented instructions of the Controller and for the purposes described in this Policy.

12.5. Your data may also be communicated, within the limits described in Article 8.3, to the installer partner, to the freight forwarder or customs representative acting in your name and to the carriers, who process them as independent controllers.

12.6. Your data may be communicated to administrative or judicial authorities where the law so requires, or where this is necessary for the establishment, exercise or defence of legal claims.

Article 13. Transfers outside the European Union

13.1. Your data are processed outside the European Union: (a) in the United States, where the Controller and its service providers are located; (b) in the Asia-Pacific region, where the database of conversations of the Chat Window is hosted; and (c) in the Philippines, from where the Controller's manager works.

13.2. The Philippines are not the subject of an adequacy decision of the European Commission.

13.3. Transfers to our service providers are governed by the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) and, for those providers that are certified under it, by the EU-US Data Privacy Framework, which is the subject of the adequacy decision adopted by the European Commission on 10 July 2023.

13.4. You may obtain a copy of these safeguards by writing to contact@lodgeyard.com.

13.5. As the Controller is established outside the European Union, the data that you send to it, in particular through the form, the Chat Window or electronic mail, are received and processed outside the European Union.

Article 14. Retention

14.1. Your personal data are kept for no longer than is necessary for the purposes for which they are processed, namely:

• establishment that we contacted and that did not reply: address erased twelve (12) months after our last message;
• conversation of the Chat Window: erased automatically twelve (12) months after its last message;
• if you do not become a Customer: three (3) years from your last contact with us;
• if you become a Customer: the duration of the business relationship, then three (3) years, subject to the periods imposed by law for accounting documents;
• objection list: at least three (3) years, solely so as not to write to you again;
• "pays" cookie: twelve (12) months;
• conversation identifier kept in the local storage of your browser: up to twelve (12) months after your last message;
• IP address counted by the form: one minute, without being kept;
• encrypted fingerprint of the IP address used by the Chat Window: for the period strictly necessary to limit abuse.

14.2. At the end of these periods, the data are erased or made anonymous. They may be kept for a longer period only where a legal obligation so requires.

14.3. Where a period is defined by reference to what is strictly necessary, the Controller determines it according to the purpose concerned, in particular the time needed to detect and stop a repeated abuse, and erases the data as soon as that purpose no longer requires them.

Article 15. Security

15.1. The Controller implements technical and organisational measures appropriate to the risk, within the meaning of Article 32 of the GDPR, in particular: encryption of exchanges with the Website (HTTPS with strict transport security); restriction of access to the persons who need it; multi-factor authentication on the main administration accounts; authentication of the electronic mail domain to combat the usurpation of its address; and the selection of service providers in accordance with Article 12.4.

15.2. In the event of a personal data breach, the Controller complies with Articles 33 and 34 of the GDPR, including, where required, notification to the competent supervisory authority and communication to the data subjects.

15.3. No transmission over the internet is entirely secure. Do not send us by electronic mail or through the Chat Window any data that are not necessary for your request.

Article 16. Your rights

16.1. Under the conditions and within the limits laid down by the GDPR, you have the following rights:

• right of access to your data and to information on their processing (Article 15);
• right to rectification of inaccurate data and to completion of incomplete data (Article 16);
• right to erasure (Article 17);
• right to restriction of processing (Article 18);
• right to data portability, for data that you have provided and whose processing is based on a contract or on consent and carried out by automated means (Article 20);
• right to object, on grounds relating to your particular situation, to processing based on our legitimate interest (Article 21(1));
• right to object at any time, without having to give reasons, to processing for direct marketing purposes (Article 21(2) and (3));
• right to withdraw your consent at any time, where a processing is based on it (Article 7(3)).

16.2. The Controller notifies any rectification, erasure or restriction to each recipient to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort (Article 19 of the GDPR).

16.3. You also have the right to lodge a complaint with a supervisory authority (Article 77 of the GDPR, see Article 19 of this Policy) and the right to an effective judicial remedy (Article 79 of the GDPR).

Content and limits of your rights

16.4. The right of access allows you to obtain confirmation as to whether data concerning you are processed and, where that is the case, a copy of those data together with the information listed in Article 15 of the GDPR, in particular the purposes, the categories of data, the recipients, the retention period, the source of the data and the safeguards applicable to transfers. The right to obtain a copy must not adversely affect the rights and freedoms of others.

16.5. The right to erasure applies in particular where the data are no longer necessary for the purposes for which they were collected, where you have objected to their processing and there are no overriding legitimate grounds, or where they have been processed unlawfully. It does not apply to the extent that processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims (Article 17(3) of the GDPR).

16.6. The right to restriction allows you to obtain that your data be retained but no longer used, in particular for the time needed to verify their accuracy or to examine your objection, or where you need them for the establishment, exercise or defence of legal claims although the Controller no longer needs them.

16.7. The right to data portability allows you to receive the data that you have provided in a structured, commonly used and machine-readable format, and to transmit them to another controller, or to have them transmitted directly where this is technically feasible.

16.8. Where you object to processing based on the Controller's legitimate interest, the Controller no longer processes the data concerned unless it demonstrates compelling legitimate grounds which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. Where you object to prospecting, the Controller stops it without any further examination, in accordance with Article 17 of this Policy.

Article 17. Objecting to prospecting

17.1. You may at any time, without giving reasons and free of charge, refuse to receive our prospecting messages:

• by replying "STOP";
• by clicking on the unsubscribe link at the bottom of our message; or
• by writing to contact@lodgeyard.com.

17.2. You receive a confirmation within forty-eight (48) hours.

17.3. We then keep your address in an objection list, which serves solely to stop writing to you, for at least three (3) years.

Article 18. How to exercise your rights

18.1. To exercise your rights, write to contact@lodgeyard.com, specifying the right that you wish to exercise. You may write in French or in English.

18.2. The exercise of your rights is free of charge. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the Controller may charge a reasonable fee or refuse to act on them, in accordance with Article 12(5) of the GDPR.

18.3. The Controller answers without undue delay and in any event within one (1) month of receipt of the request. That period may be extended by two (2) further months where necessary, taking into account the complexity and number of requests; you are then informed of the extension and of the reasons for it within the first month (Article 12(3) of the GDPR).

18.4. Where the Controller has reasonable doubts concerning your identity, it may request additional information necessary to confirm it (Article 12(6) of the GDPR). It requests only the information strictly necessary for that purpose.

18.5. The Controller answers by electronic mail, unless you request another means. Where you have made your request by electronic means, the information is provided by electronic means where possible.

18.6. A person whom you have authorised may exercise your rights on your behalf, on presentation of a written authorisation. The Controller may then verify that authorisation and your identity under the conditions of Article 18.4.

Article 19. Complaints

19.1. If you consider that your rights have not been respected, you may lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Grand Duchy of Luxembourg, website cnpd.public.lu.

19.2. The CNPD offers an online complaint form on its website and also accepts complaints sent by post.

19.3. You may also lodge a complaint with the supervisory authority of the Member State of the European Union in which you have your habitual residence or your place of work, or in which the alleged infringement took place.

19.4. You may contact us first at contact@lodgeyard.com so that we can try to resolve your request. This step is not a precondition for lodging a complaint.

Article 20. Data relating to the staff of our customers

20.1. Where a professional communicates to us the personal data of its staff or of third parties, in particular in a Quote Request, in correspondence or in contractual documents, it informs them of that communication and of the existence of this Policy, and communicates only the data necessary for the relationship.

Article 21. Minors

21.1. The Website is intended for professionals. It is not directed at minors, and the Controller does not knowingly collect personal data relating to them.

Article 22. Third-party websites

22.1. The Website may contain links to websites of third parties, in particular administrations. Those websites have their own personal data policies, for which the Controller is not responsible.

Article 23. Changes to this Policy

23.1. The Controller may amend this Policy, in particular to take account of changes in its processing operations or in the applicable law. The amended version is published on the Website with its date.

23.2. Where a change materially affects the processing of data concerning you, the Controller informs you by appropriate means before it takes effect, in particular by electronic mail if it has your address.

23.3. The previous versions of this Policy are available on request at contact@lodgeyard.com.

Article 24. Language and version

24.1. This Policy is published in English and in French. In the event of any discrepancy, the French version prevails, French being the language in which the legislation of the Grand Duchy of Luxembourg is drawn up and is authoritative (Law of 24 February 1984 on the language regime, Article 2).

24.2. This is version 1.1 of the Policy for the Grand Duchy of Luxembourg, dated 28 October 2026. The French version is published at /lu/juridique/politique-de-confidentialite. The other legal documents are listed on the legal information page.