Privacy Policy
Last updated: July 2026
1. Data controller
The controller responsible for the processing of your personal data on this website (www.prism-im.com) is:
PSDr Services S.A.
89E rue Pafebruch
L-8308 Capellen
Grand Duchy of Luxembourg
RCS Luxembourg: B267276
Email: privacy@prism-im.com
PRISM IM is the brand under which PSDr Services S.A. conducts its pan-European real-estate investment and asset management activities.
2. What personal data we collect
We collect personal data only when you voluntarily provide it, when you are a professional contact of PRISM IM, or when it is technically necessary to operate the website.
2.1. Contact form submissions
When you use our contact form, we collect:
- Your name
- Your email address
- Your phone number (if provided)
- Your message
2.2. Marketing communications (professional contacts)
If you are a professional or business contact, we may process your business contact details (name, email address, company, and role) to send you newsletters and periodic updates about PRISM IM. These details come from our business relationship with you or your organisation. You can object at any time via the one-click unsubscribe link included in every email — your address is then added to our suppression list and excluded from all future sends.
2.3. Technical data (server logs)
When you visit our website, our hosting provider and CDN (Cloudflare) automatically collect:
- IP address (anonymised where possible)
- Browser type and version
- Operating system
- Date and time of access
- Pages visited and referral URL
This data is processed for security purposes and to ensure the proper functioning of the website. It is not used to identify individual visitors.
2.4. Cookies
We use essential and security cookies. For full details, see our Cookie Policy.
3. Why we process your data (legal basis)
| Purpose | Legal basis (GDPR) |
|---|---|
| Responding to your contact form enquiry | Art. 6(1)(b) — performance of a pre-contractual measure at your request |
| Sending newsletters and updates to professional/business contacts | Art. 6(1)(f) — legitimate interest; you may object at any time via one-click unsubscribe |
| Website security and protection against abuse | Art. 6(1)(f) — legitimate interest |
| Server logs and technical operation | Art. 6(1)(f) — legitimate interest |
| Essential and security cookies | Art. 6(1)(f) — legitimate interest (exempt from consent under ePrivacy Directive Art. 5(3)) |
| Analytics cookies (if activated in future) | Art. 6(1)(a) — your consent |
4. Who receives your data
We may share your personal data with the following categories of recipients, solely for the purposes described above:
- Odoo S.A. (Belgium) — our website, CRM and email platform provider
- Microsoft / Azure Communication Services (EU) — our email delivery infrastructure for newsletters and transactional mail
- Cloudflare, Inc. (USA) — our CDN and security provider, which processes technical data to protect the website
- PSDr Services S.A. staff — employees handling your enquiry or communications
We do not sell, rent, or trade your personal data to third parties.
International transfers. Cloudflare may process data in the United States. Transfers are safeguarded by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
5. How long we keep your data
| Data type | Retention period |
|---|---|
| Contact form submissions | 12 months after your last interaction, or until your enquiry is resolved, whichever is longer |
| Marketing contact data | Until you unsubscribe or object; suppression (opt-out) records are kept indefinitely to honour your choice |
| Server / security logs | Up to 90 days |
| Cookies | See Cookie Policy for per-cookie durations |
6. Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten")
- Restrict processing in certain circumstances
- Object to processing based on legitimate interest, including direct marketing
- Data portability — receive your data in a structured, machine-readable format
- Withdraw consent at any time (where processing is based on consent)
To exercise any of these rights, contact us at privacy@prism-im.com. We will respond within 30 days.
If you believe your rights have not been respected, you have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD), the Luxembourg data protection authority (15, Boulevard du Jazz, L-4370 Belvaux — cnpd.public.lu).
7. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or alteration, including encryption in transit (TLS/HTTPS), access controls, and regular security reviews.
8. Children
This website is not directed at children under 16. We do not knowingly collect personal data from children.
9. Changes to this policy
We may update this privacy policy to reflect changes in our practices or for legal or regulatory reasons. Changes become effective upon publication on this page.
10. Contact
For any questions regarding this privacy policy or the processing of your personal data, please contact PSDr Services S.A. at privacy@prism-im.com.