Privacy Policy
Last Updated: 30 September 2026
1. Introduction
Welcome to The Modern Reference (“We”, “Our”, “Us”).
We are committed to protecting and respecting your privacy. This Privacy Policy explains how We process, collect, use, disclose, store and protect your personal data (as defined in Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data of 27 April 2016 (“GDPR”) when you:
Visit Our website: www.themodernreference.com
Create an account in Our Members’ Area, the private online space of tmr Circle
available at thecircle.themodernreference.com
Take part in the Members’ Area: conversations, live talks and their replays, the Members’ directory
Apply for and join tmr Circle, Our private membership circle
Book a seat at Our gatherings (tmr Evenings, Special Editions, Open Events, dinners
and other activities) through Our ticketing service
Subscribe to The Letter, Our editorial letter, and to Our communications
Interact with Us through any other services We provide.
We process personal data in accordance with:
GDPR
Any applicable national data protection laws within the European Economic Area (“EEA”)
Any other applicable privacy legislation.
By using Our services, you acknowledge that your personal data will be processed asdescribed in this Privacy Policy.
2. Data controller
The data controller responsible for processing your personal data is: The Modern Reference
21 rue Glesener, L-1631 Luxembourg (from 1 October 2026: 128, rue de Mühlenbach, L-2168 Luxembourg)
Email: hello@themodernreference.com Company Registration Number: A46902 Business Licence number: 10192784/0
VAT Number: LU34970625
Data Protection Contact: privacy@themodernreference.com
If you have any questions regarding this Privacy Policy or the processing of your personal data, please contact Us using the details above.
3. The services We provide
The Modern Reference operates tmr Circle, a women's private circle in Luxembourg, where members meet through gatherings and curated experiences, with a private online Members’ Area extending the circle between gatherings, and publishes The Letter, an editorial letter.
The Modern Reference provides:
• Membership access to a women's private circle;
• Artistic, cultural and wellbeing activities;
• Gatherings: tmr Evenings, Special Editions, Open Events, dinners, workshops and conversations;
• Subscription-based membership services, including the Members’ Area, live conversations with guests and their replays, a members’ directory, a membership card and privileges with partner houses;
• The Letter, in a short version distributed through Substack and a full version reserved for members, and communications relating to the circle and its activities.
Certain services may be available only to registered members.
4. Personal data We collect
Depending on your interactions with us, We may collect the following categories of personal data.
a) when you navigate on the website
Standard technical data (eg logs, cookies). Please refer to the cookies policy for more information.
b) When you subscribe to Our newsletter (without being a member)
Your email address. The short version of The Letter is distributed through Substack, which processes your email address for that purpose.
c) When you register on the waiting list
Email and consent to the registration on the waiting list
d) In relation to the membership
i) as a candidate: first name, last name, email, job title, Instagram account (optional) and LinkedIn account (optional), the answers to the questions of the membership form, the information on how you know Us and, where applicable, the member who referred you to Us. Please note that if you have been referred to Us by a member, we will ask you to disclose the first name and last name of this member.
ii) As member: the aforementioned information, your membership option and rate, the date of your subscription, your member number and membership status, your payment history (payments are processed by Stripe, and We never receive your full card number), the login details of your account in the Members’ Area (your password is never accessible to Us), your entry in the Members’ directory (your first name, a short description of your activity and your interests, visible to other members only), your bookings and Included Evenings, and the image consent choices you make for each gathering. Please note that if you refer a person to become a member, this person will be asked to disclose your first name and last name.
e) Content
Information you voluntarily post in the Members’ Area, including messages, comments, images, responses to surveys or discussion topics. When you take part in a live conversation or talk held in the Members’ Area with your camera or microphone on, your participation may be recorded in the replay made available to members.
Please remember that information shared in the Members’ Area is visible to the other members.
f) Event Information and pictures
When booking a seat at a gathering through Our ticketing service (Luma): first name, last name, email address, the type of seat booked (included seat or paid seat), your image consent choice for that gathering, accessibility requirements, event preferences, and feedback submitted after events.
Some pictures or videos may be taken during a gathering. No picture or video on which you can be identified is published, shared or transferred to anyone without your express consent, collected for each gathering as described in section 12.
g) When you communicate with Us
Email correspondence, support requests, feedback, complaints, survey responses.
h) Payments
When you pay a membership fee or a seat at a gathering, your payment is processed by Stripe. We receive the confirmation of the payment, its amount and date, and the last four digits of your card, never your full card number.
5. How We use your personal data
We only use your personal data for the following purposes:
a) Review of applications and management of the admission process, including the assessment of applications, interviews, and admission decisions.
b) Membership administration, including the collection of membership fees through Stripe, issuance of a membership card, physical or digital, containing the member's first name, last name and membership number, creation and management of the member's account in the Members’ Area, publication of the member's entry in the Members’ directory, management of the Included Evenings, and member communications.
c) Organisation and administration of gatherings, including ticketing through Luma, guest list management, seat allocation and the collection of your image consent choice.
d) Distribution of The Letter, in its short version through Substack and in its full version to members, including the management of subscriptions and the delivery of editorial content.
e) Regarding photography and video recording during gatherings for communication, promotional and editorial purposes, including publication on Our website, social media channels, The Letter and partner communication materials. By default, no picture or video on which you can be identified is used. Your consent is collected for each gathering at the time of booking, through a choice among three options, as described in section 12, and separate specific consent is obtained before using a named portrait of a member.
f) Accounting, financial management and compliance with legal obligations, including the transmission of required accounting records and supporting documents to Our accountants, auditors, fiduciary service providers and other professional advisers where necessary.
g) Advertising, analytics and campaign optimisation, including the measurement, analysis and improvement of marketing and communication campaigns, subject to applicable consent requirements and data protection laws.
h) Operation and moderation of the Members’ Area, including the hosting of conversations, live talks and their replays, the Members’ directory and the enforcement of the Discretion Rules set out in Our General Terms and Conditions.
6. Legal basis for processing
We process personal data under one or more of the following GDPR legal bases:
a) The performance of the contract (or pre-contractual measures)
Where processing is necessary to:
Create and manage your account in the Members’ Area
Process your application and provide the membership services, including the Members’ directory, the Included Evenings and the membership card
Process your bookings of seats at gatherings
b) With your explicit consent
Where you have given consent, including for:
Marketing communications
Certain cookies
Optional profile information
Transfer of personal data outside the EEA to a country which does not benefit from an
adequacy decision from the European Commission, where no other safeguard applies
Publication of testimonials or of photographs on which you can be identified
You may withdraw consent at any time.
c) Legitimate Interests
We may process personal data where necessary for Our legitimate interests, including:
Improving services
Management and moderation of the Members’ Area
Website security
Fraud prevention
Internal administration
We ensure such interests do not override your rights and freedoms.
d) Legal obligations
We process personal data where necessary to comply with Our legal obligations, including accounting and tax obligations and requests from competent authorities.
7. Sharing personal data
Only where it is necessary, We may share personal data with:
a) Service Providers, in particular Circle (CircleCo, Inc.), which hosts the Members’ Area; Stripe, which processes payments; Luma, which operates the ticketing of Our gatherings; Substack, which distributes the short version of The Letter; Squarespace, which hosts the Website and sends Our email campaigns; Microsoft 365, for Our professional email and document storage; Passcreator (Passcreator GmbH, Germany), which issues and manages the digital membership card; as well as analytics providers and customer support systems
These providers process personal data on Our instructions and under Our responsibility or, for certain operations such as payments, as independent controllers under their own privacy policies. If they are not located in a country benefiting from an adequacy decision from the European Commission, We will ensure that appropriate contractual and security safeguards are in place and/or that you have given explicit consent.
b) Event Partners
Where necessary to organise specific gatherings, workshops or activities, for instance the venue hosting a gathering, which may receive the first names and the number of guests.
c) Professional Advisors
Including lawyers, accountants, auditors and insurers, only where legally necessary.
d) Other members
Your entry in the Members’ directory and the content you post in the Members’ Area are visible to the other members of tmr Circle, who are bound by the Discretion Rules set out in Our General Terms and Conditions.
8. International transfers
Some of Our service providers, in particular Circle, Stripe, Luma and Substack, are established in the United States or may process personal data there. Where personal data is transferred outside the European Economic Area, We ensure that appropriate safeguards are in place, including:
European Commission adequacy decisions, including the EU-U.S. Data Privacy Framework for providers certified under it;
Standard Contractual Clauses (SCCs);
Other approved transfer mechanisms under GDPR.
You may request additional information regarding such safeguards.
9. Personal data retention
We retain personal data only as long as necessary for the purposes described in this Privacy Policy.
Retention periods may include:
Personal Data type & Retention Period
Data processed in relation to any rejected candidate: 1 month
Data of a candidate who asked to be kept on the waiting list: 12 months from that request, unless renewed
Data processed in relation to Membership: All the duration of the membership and 3 years after its termination
Content posted in the Members’ Area: All the duration of the membership; removed or anonymised when the account is closed, subject to replays and backups
Replays of live sessions held in the Members’ Area: 18 months from the date of the session, then deleted; backup copies are deleted in accordance with Our backup cycles
Data processed for accounting purposes: 10 years
Data processed for any attendance to an event: 2 months after the event if you are not a member
All the duration of your membership and 3 years after if you are a member
The Letter (subscription): As long as you have not unsubscribed from The Letter
Photographs and videos on which you can be identified: Until you withdraw your consent, and in any event for a maximum of 18 months from the date of the gathering, after which identifiable images are deleted.
Technical data (eg website Logs): up to 7 days, where Activity Log is enabled. Other technical logs may be retained by Squarespace in accordance with its own privacy policy and applicable documentation.
After the retention period, personal data will be securely deleted or anonymized.
10. Your GDPR rights
Where applicable, you have the following rights which can be exercised at any time without being charged:
a) Right of access
To obtain a copy of your personal data that We process.
b) Right to rectification
To correct your inaccurate or incomplete personal data. You can update your account details and your directory entry yourself within the Members’ Area.
c) Right to erasure
To request deletion of your personal data from Our system. Please be informed that such deletion can lead to the termination of your membership and/or any other services We provide.
d) Right to restrict processing
To request limitation of processing activities. Please be informed that such limitation can lead to the termination of your membership and/or any other services We provide.
e) Right to personal data portability
To receive your personal data in a structured and machine-readable format.
f) Right to object
To certain processing activities, including direct marketing. Please be informed that such objection can lead to the termination of your membership and/or any other services We provide.
g) Right to withdraw consent
Where processing relies on consent. Please be informed that such withdrawal can lead to the termination of your membership and/or any other services We provide.
h) Right to lodge a complaint
You have the right to lodge a complaint with your local data protection authority.
For individuals located in the EU, complaints may be submitted to the competent supervisory authority in their country of residence.
In Luxembourg, the competent authority is:
La Commission Nationale pour la Protection des Données Address: 15 boulevard du Jazz, L-4370 Belvaux
Tel: +352 26 10 61-1
Website: www.cnpd.public.lu
11. Security measures
We implement appropriate technical and organizational measures to protect personal data, including:
a) Personal data is managed primarily by one person, who is the sole individual with full access to member and operational data or any other employee on a need-to-know basis.
b) Access to the premises is controlled through badge-based entry systems, and members of the workspace are identified prior to being granted access. The workstation is systematically locked whenever left unattended, and the device's hard drive is encrypted using FileVault.
c) No physical documents containing personal data are left unattended on the premises.
d) Access to business applications and systems is protected through the use of strong passwords and a password management solution. Multi-factor authentication (MFA) is enabled on critical accounts and services, including but not limited to Microsoft 365, Squarespace, Circle, Stripe, Luma and Instagram.
e) The mobile device used for business purposes is protected by biometric authentication and/or a secure passcode.
f) A dedicated professional email environment is maintained through Microsoft 365 for all business communications involving personal data.
g) Membership records are maintained in the Members’ Area platform (Circle) and in a password-protected Excel register stored within a secure Microsoft OneDrive environment. Access to this register is restricted exclusively to the founder.
h) Communications between devices and business systems are encrypted using industry-standard Transport Layer Security (TLS) protocols.
Access to personal data is restricted according to operational needs. Only the manager of TMR has full access to the data necessary for operating the membership of the private circle and community. External service providers, including the website administrator and accounting or fiduciary advisers, are granted access only to the personal data strictly necessary for the performance of their respective services and responsibilities.
The organisation does not collect, store, or have access to members' payment card information. Payment transactions are processed exclusively by Stripe, through the Members’ Area platform and the ticketing service (Luma), in accordance with its own security and compliance standards.
Where personal data is temporarily exported for administrative or operational purposes, such exports are deleted promptly once processing has been completed and are not retained longer than necessary.
12. Photographs and event media
During gatherings, photographs and videos may be taken.
These materials may be used for community communications, promotional materials, social media, The Letter and website content. By default, the materials used do not enable the identification of any person: images of the setting, the table, the venue and the atmosphere, on which no one is recognisable, may be used without further consent.
No image on which you can be identified is used without your express consent. For each gathering, at the time of booking or of confirmation of your attendance, you choose whether such images may be used on Our public channels (Website, social media, The Letter, press and partner communications), only within the Members’ Area, or not at all.
Identifiable images are kept for a maximum of 18 months from the date of the gathering, after which they are deleted from the channels We control. You may also withdraw your consent at any time for the future by email to hello@themodernreference.com; We then remove the image from the channels We control, without this affecting the uses made before the withdrawal.
13. Automated decision-making
We DO NOT currently use automated decision-making or profiling that produces legal or similarly significant effects on individuals.
If this changes, We will update this Privacy Policy and inform affected users where required.
We do not use personal information shared within the Members’ Area, at gatherings or wellbeing activities, or in member interactions for behavioral profiling, targeted advertising, or the automated assessment of an individual's personal characteristics, preferences, health, wellbeing, or life circumstances.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time.
Any updated version will be posted on this page with the revised “Last Updated” date.
For significant changes, We may provide additional notice through email or website notifications.
15. Contact Us
For questions regarding this Privacy Policy or your privacy rights, please contact: The Modern Reference
21 rue Glesener, L-1631 Luxembourg (from 1 October 2026: 128, rue de Mühlenbach, L-2168 Luxembourg)
Email: hello@themodernreference.com
Data Protection Contact: privacy@themodernreference.com