Privacy Policy
Colibri Advisory | www.colibri-advisory.org
Version 1.3 (website, advisory services and resources), effective 12 October 2026
This notice explains how Colibri Advisory SàRL (“Colibri Advisory”, “we”, “us”) handles the personal data of the people it works with: what we collect, why, on what legal basis, who sees it, how long we keep it and how you can exercise your rights. It covers the website www.colibri-advisory.org, our governance, strategy and execution advisory services, and our commercial, contractual and marketing relationships.
Training and education activities operated by Colibri Advisory SàRL under the TheDigitalBoard brand are covered by the privacy notice published on that brand’s own website.
We apply Regulation (EU) 2016/679 (the GDPR), the Luxembourg Data Protection Act of 1 August 2018 and the Luxembourg rules on electronic communications and cookies. Terms such as “personal data”, “controller” and “processor” have the meaning given to them in the GDPR.
1. THE PERSONAL DATA WE HOLD
What we hold about you depends on how you interact with us (clients and prospective clients, board members and executives of client organisations, newsletter subscribers, website visitors, suppliers and business contacts). The main categories are:
- Identity and contact: name, e-mail address, postal address, telephone number, country, preferred language, LinkedIn profile;
- Professional profile: employer or organisation, position, board mandates, areas of expertise and biography, and your CV if you apply to work with us as an associate or senior consultant;
- Organisation details: legal name, registered office, country, VAT number and billing contact;
- Billing and payment: invoicing details, payment status and transaction references. We receive bank transfers only; no card details are collected through the website;
- Correspondence: messages sent through our contact form, e-mails, call notes and the topic of your enquiry;
- Engagement data: your organisation, your role, the scope of the mandate, meeting notes, deliverables and the correspondence exchanged during an advisory engagement;
- Resource requests: the resource selected, your e-mail address, any optional name, organisation or role you provide, and the date and status of your request;
- Marketing preferences: newsletter subscription, your communication choices and whether you open or click our e-mails;
- Technical and usage data: IP address, browser and device type, pages viewed, referring page, timestamps and cookie identifiers generated when you browse our website.
Our services are intended for organisations and professionals. We do not seek special categories of data.
2. WHERE THE DATA COMES FROM
- You: when you complete the contact or newsletter form on www.colibri-advisory.org, sign an engagement letter, correspond with us or give us your business card;
- Your browser: through cookies and similar technologies, described in section 8;
- Public sources: LinkedIn, company websites, business registers, professional directories and publications, which we consult to identify and approach potential clients and partners;
- Third parties: your organisation when it engages us, and the platforms we use to run our business.
Providing personal data is voluntary unless a contract or a legal requirement says otherwise. If you prefer not to share certain information, the practical consequence may be that we cannot answer your request or deliver a service.
2A. RESOURCE REQUESTS AND OPTIONAL EMAIL UPDATES
Where a resource request form is offered, we use your e-mail address to provide the resource you select and deal with delivery or access problems. The form identifies any required fields. Your e-mail address is required for delivery by e-mail; additional profile fields are optional unless the form explains a specific need. Please do not include confidential documents or sensitive personal information.
Requesting a resource does not subscribe you to marketing messages. You may separately choose to receive Colibri Advisory insights, new resources and occasional information about our advisory services. This choice is optional, specific and made through an unticked checkbox. You can receive the requested resource without choosing marketing updates.
We record the subscription choice, the date and the wording presented when consent is given, together with confirmation details where a confirmation step is used. Each marketing message provides an unsubscribe option. You may also withdraw consent by writing to contact@colibri-advisory.org. Withdrawal does not affect the lawfulness of processing before withdrawal.
We do not add resource requesters who have not opted in to a marketing mailing list, and we do not treat acceptance of website terms as marketing consent. We do not share your subscription with Nasaq Partners or TheDigitalBoard for their own marketing without a separate lawful basis and appropriate information or consent.
3. PURPOSES AND LEGAL BASES
Each use of your data rests on one of the legal bases provided by Article 6 GDPR:
| What we do | Legal basis |
|---|---|
| Answer enquiries received through our form, e-mail or phone | Steps taken at your request before entering a contract (Art. 6(1)(b)); our legitimate interest in responding to people who contact us |
| Schedule and hold introductory calls and meetings | Pre-contractual steps (Art. 6(1)(b)) |
| Deliver advisory services under an engagement letter | Performance of a contract (Art. 6(1)(b)) |
| Issue invoices, collect payment, keep accounts and file tax returns | Legal obligation (Art. 6(1)(c)); performance of a contract |
| Deliver a resource you requested and address access or delivery questions | Legitimate interest (Art. 6(1)(f)) in responding to your express request and providing the selected resource, limited to what is necessary for that purpose |
| Send optional Colibri newsletters, insights, resource updates and information about our advisory services | Your consent (Art. 6(1)(a)). A resource request alone does not provide this consent. Every marketing message includes an unsubscribe option |
| Keep proportionate consent and unsubscribe records | Legal obligation (Art. 6(1)(c)) where required to demonstrate compliance, and legitimate interest (Art. 6(1)(f)) in respecting your choices and handling related claims |
| Develop our business: identify and approach potential clients and partners; maintain our contact database | Legitimate interest (Art. 6(1)(f)), weighed against what you can reasonably expect as a professional |
| Run, secure and improve our website; measure audience; block spam and abuse | Legitimate interest (Art. 6(1)(f)); your consent for non-essential cookies |
| Meet legal, regulatory and accounting obligations and answer lawful requests from authorities | Legal obligation (Art. 6(1)(c)) |
| Establish, exercise or defend legal claims; handle disputes and insurance matters | Legitimate interest (Art. 6(1)(f)) |
We never sell personal data and we take no decisions about you by purely automated means that would have legal or similarly significant effects.
4. RECIPIENTS AND PROCESSORS
Your data is accessible only to people and providers who need it for the purposes above, each bound by confidentiality or by a data-processing agreement under Article 28 GDPR:
- Our team: authorised personnel, associates and senior consultants of Colibri Advisory SàRL working on your file;
- Squarespace: website hosting, contact and newsletter forms, and site analytics;
- CRM, e-mail and prospecting tools: the platforms we use to keep contact records, send communications and manage business development;
- Business software: e-mail, calendar, cloud storage, video-conferencing and document tools;
- Banks: processing of bank transfers under their own terms;
- Professional advisers: accountants, auditors, lawyers and insurers;
- Authorities: when the law requires it, in answer to a lawful request or to protect our rights.
Transfers outside the European Economic Area. Some of these providers (Squarespace among them) are headquartered in the United States or operate infrastructure outside the EEA. Website and form data may be processed outside the EEA, including in the United States. For transfers requiring safeguards, we rely on a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified companies) or on the Commission’s Standard Contractual Clauses, supplemented where necessary. Write to contact@colibri-advisory.org if you would like a copy of the safeguards in place.
5. YOUR RIGHTS
Under the GDPR you may, within the conditions it sets:
- Access: ask whether we hold data about you and receive a copy;
- Rectification: have inaccurate or incomplete data corrected;
- Erasure: have your data deleted where there is no longer a reason for us to keep it;
- Restriction and objection: limit or stop processing based on our legitimate interests, including any profiling for direct marketing;
- Opt-out of marketing: leave our mailing list at any time via the unsubscribe link or by e-mailing us;
- Portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another provider;
- Withdrawal of consent: withdraw consent at any time, without affecting processing already carried out;
- Complaint: contact the Commission nationale pour la protection des données (CNPD), 15 boulevard du Jazz, L-4370 Belvaux, www.cnpd.lu, or the authority of your own country.
Send requests to contact@colibri-advisory.org or to our postal address in section 10. We may need to verify your identity first. You will hear from us within one month; for complex or multiple requests we may take up to two further months and will tell you if so. If a legal duty, the rights of another person or an overriding interest prevents us from acting on a request in full, we will explain our reasons.
6. HOW WE PROTECT YOUR DATA
We apply technical and organisational safeguards proportionate to the sensitivity of the data and the risks involved:
- Encrypted connections (HTTPS/TLS) on our website;
- Access limited to authorised persons on a need-to-know basis, protected by strong passwords and multi-factor authentication;
- Providers selected for their security certifications and bound by GDPR-compliant processing agreements;
- Confidentiality undertakings from every team member and associate;
- Periodic review of access rights, backups and retention.
Should a breach occur that is likely to put your rights and freedoms at high risk, we will inform you and notify the CNPD within the statutory deadlines.
7. RETENTION PERIODS
We keep personal data no longer than the purpose requires or the law demands. Our standard periods are:
- Enquiries and prospects: 3 years after our last meaningful exchange, then deleted or anonymised;
- Clients: the life of the relationship plus 10 years, in line with Luxembourg accounting and commercial record-keeping rules;
- Invoices and accounting records: 10 years from the close of the financial year;
- Resource requests without marketing consent: only for the time needed to deliver the resource and resolve related access questions, then deleted or anonymised unless a separate enquiry, legal obligation or claim justifies retaining a limited record;
- Newsletter and marketing lists: until you unsubscribe, or 3 years after your last affirmative interaction, whichever occurs first. Subscription renewal, a new request or a direct reply can be an affirmative interaction; passive tracking such as an e-mail open does not by itself restart this period;
- Consent and suppression records: limited information needed to demonstrate the consent relied on, handle related complaints and ensure that unsubscribed contacts are not added back to marketing. Retention is restricted to those purposes and reviewed against applicable legal requirements and claim periods;
- Form submissions and anti-spam data: as long as needed to deal with your request. We apply the relevant deletion or anonymisation rules to records under our control and instruct processors accordingly;
- Litigation files: the applicable limitation period.
Data needed to satisfy a legal, regulatory or contractual obligation, or to defend a claim, may be placed in restricted archives beyond these periods.
8. COOKIES
This website uses Squarespace essential cookies for website operation, security and remembering your preferences. Squarespace non-essential analytics cookies are restricted until you consent. The banner offers Accept all, Decline all and Manage cookies. Continuing to browse does not count as consent.
You can change or withdraw optional cookie consent at any time using the Cookie Preferences control on the website. The Squarespace visitor activity log is disabled. Read our Cookie Policy for the categories, provider information and details of how to manage your choices. Cookie consent is separate from consent to receive marketing emails.
9. THIRD-PARTY LINKS
Our pages and messages link to external services (LinkedIn and others). Their privacy practices are their own; please read their notices before sharing data with them.
10. CONTROLLER AND CONTACT
Colibri Advisory SàRL
177 rue de Luxembourg
L-8077 Bertrange, Luxembourg
RCS Luxembourg B159422 | VAT LU24599487
E-mail: contact@colibri-advisory.org
We review this notice whenever our activities, our providers or the law change. The version published on www.colibri-advisory.org is the one that applies; if a change materially affects you, we will tell you by e-mail or by a notice on the site. Questions about this notice go to contact@colibri-advisory.org.
Colibri Advisory Privacy Policy, version 1.3, 12 October 2026