Privacy Policy

What is personal data?

Personal data refers to any information — in any format — that relates to a person who is identified or can be identified directly or indirectly via a name, ID number, location data, online identifiers, or other details.

Who are the data subjects?

The customer or user of our services and products is the data subject.

If the customer is a business, we may also collect data on the employees who interact with us.

What type of data do we collect?

• Identification and contact details;
• Job-related data;
• Contractual relationship data;
• Service usage data;
• Security-related information.

The Eurotux Group company that provides your product or service is responsible for collecting and processing your data — deciding what's collected, how it's used, and why.

Eurotux has a Data Protection Officer (DPO) who (i) Ensures compliance with data laws, (ii) acts as a point of contact with the customer or user for privacy matters, (iii) cooperates with regulators, (iv) provides information and advises Eurotux on its data obligations.

You can contact the DPO at the following address:

Email: dpo@eurotux.com

We may process your data based on your consent, the performance of a contract or pre-contractual steps, compliance with legal obligations, or our legitimate interests.

Consent: when you have given us your clear and informed consent – whether in writing, verbally, or by selecting an option – before any processing takes place. This consent must be freely given, specific, and unambiguous. Examples include agreeing to receive communications about Eurotux Group’s products and services, or allowing us to record service desk calls to help improve our customer support; or

Contractual necessity: when processing your personal data is required to enter into, manage, or fulfil a contract with Eurotux – such as preparing service proposals, using identification and contact information, or processing billing details; or

Legal compliance: when we are required to process personal data to comply with legal obligations, such as providing identification or service usage data to law enforcement, judicial authorities, tax bodies, or regulators, or collecting video footage from surveillance systems; or

Legitimate interests: when processing your personal data supports a legitimate interest of Eurotux or third parties – for example, protecting network and service security, detecting fraud, or securing revenue – and when these interests outweigh your rights to data protection.

Purposes include:

• Customer and partner management;
• Delivering and improving services;
• Marketing and customer experience;
• Recruitment;
• Legal compliance;
• Pursuit of legitimate interests;
• Accounting, tax and administrative management;
• Litigation management;
• Fraud detection, revenue protection and auditing;
• Network and systems management;
• Security control;
• Physical security and access.

How long is data kept?

Data is stored only as long as necessary for its purpose — or as required by law.

There are cases where the law requires data to be processed and stored for a minimum period of time, namely 10 years for data required for accounting or tax purposes to be provided to the Tax Authority.

However, where there is no specific legal obligation, the data will only be processed for the period necessary to fulfil the purposes for which it was collected and preserved, and always in accordance with the law, guidelines and decisions of the CNPD. Therefore:

• Eurotux will process and retain your personal data for as long as it has a contractual relationship with you;
• With regard to video surveillance of its premises, Eurotux will only keep image recordings and related personal data for a maximum period of 30 days.

Eurotux may retain other personal data for periods longer than the duration of the contractual relationship, either based on your user consent, to ensure rights or duties related to the contract, or because it has legitimate interests that justify it, but always for the period strictly necessary to achieve the respective purposes and in accordance with the guidelines and decisions of the CNPD.

Examples include contact relating to commercial prospecting activities, the preservation of data in the context of recruitment processes, event management, invoice claims, the collection of equipment after termination of the contract, or legal proceedings, for as long as they are pending.

We collect personal data when you purchase Eurotux services, contact us, or take part in events or market studies.

Your personal data may also be collected from publicly available sources.

What are your rights?

Under the GDPR, you have the right to access your data, correct it, delete it, transfer it, restrict processing, or object to it. Where processing is based on consent, you may withdraw it at any time.

How can you exercise your rights?

These rights can be exercised in writing to the email address indicated in point 2.

Each request must be accompanied by the information necessary to prove your identity. Responses to requests will be provided within a maximum of 30 days, unless the request is particularly complex.

If, after contacting us, you feel that your rights have not been respected, you may also lodge a complaint with the competent data protection authority.

Under what circumstances is your personal data communicated to other entities, subcontractors or third parties?

Your data may be shared with subcontractors for processing on behalf of Eurotux. Contractual safeguards will be in place to ensure data protection.

Data may also be shared with entities legally entitled to access it: tax authorities, police, courts, regulators, or other public bodies.

Under what circumstances does Eurotux transfer your data to a third country?

Data may be transferred to third countries not recognised by the EU as having adequate data protection. In such cases, Eurotux will follow all applicable legal safeguards.

Eurotux adopts suitable technical, organisational and security measures to prevent destruction, loss, alteration, unauthorised access or unlawful use of your data.

Measure include:

• Organisational security measures, such as the implementation of the Information Security Standard (ISO/IEC 27001) and Quality Standard (ISO 9001);
• Logical security requirements and measures, such as the use of firewalls and intrusion detection systems in its systems, the existence of a strict policy on access to systems and information, and the recording of actions performed by Eurotux employees on the personal data of customers or users;
• Physical security measures, including strict control of access to Eurotux's physical facilities by employees, partners and visitors, as well as very restricted and permanently monitored access to Eurotux's essential technological infrastructure;
• Means of data protection from the design stage (‘privacy by design’) using technical means such as masking, encryption, pseudonymisation and anonymisation of personal data, as well as a set of preventive measures favourable to privacy (‘privacy by default’);
• Scrutiny, audit and control mechanisms to ensure compliance with security and privacy policies;
• An information and training programme for Eurotux employees and partners;
• Access rules for customers or users to certain products or services, such as the introduction of a password, to reinforce control and security mechanisms;
• A cybersecurity risk-based approach.