Privacy Policy
Introduction
https://rumya.clsinfo.lu/brunata
The companies of the Marth Group, Brunata Metrona FL Sàrl, E-Trash Location Sàrl, E-Trash Sàrl, Marth Group Sàrl, Marth Invest Sàrl, René Marth Sàrl, RPM SCI, Voltizy Sàrl, Voltizy Community Scop, hereinafter referred to as the “Companies”, offer a wide range of products and services, hereinafter referred to as the “Products & Services”, such as:
• Installation and reading of energy and water sensors
• Preparation and production of energy and water statements
• Manufacturing and installation of waste bins and waste bin surrounds
• Creation and installation of counting systems for waste bins
• Preparation and production of waste statements
• Development of services and databases based on measurement recordings
• Provision of services based on measurement recordings
• Making measurement data available to third parties through IT platforms
• Development and implementation of measurement recording processes with a view to making them available to third parties
• Sale of heating and sanitary equipment, materials and tools
• Management and installation of charging stations, preparation and production of statements
• Energy community, management of the allocation of energy flows and preparation and production of statements
In view of the development of new communication and information technology tools, we consider it necessary to pay the greatest attention to the protection of privacy.
Data Controller
Each company of the Marth Group acts as a data controller for the processing activities carried out within the scope of its own activities.
Where several companies jointly determine the purposes and means of processing, they act as joint controllers in accordance with Article 26 of the GDPR.
For any question relating to the identification of the controller applicable to a particular processing activity, the data subject may contact gdpr@brunata.lu.
Legal Bases for Processing
Depending on the purpose pursued, the processing of personal data is based in particular on the following legal bases:
• Performance of a contract or pre-contractual measures
• Compliance with a legal or regulatory obligation
• The legitimate interest of the Companies, in particular for securing systems, preventing fraud, improving Products & Services, managing business relationships and defending their rights
• The consent of the data subject where required by the applicable regulations
Where processing is based on consent, such consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to such withdrawal.
Personal Information We Collect
We may be required to collect your personal information for various reasons: provision of our Products & Services, professional obligations, performance of a contract, processing of your files, correspondence or job application, etc.
We process in particular the following data:
• Consumption data (heating, water, waste, electricity, etc.) of users
• Billing data, commercial data, supplier data
• Identity, addresses, personal and professional contact details, civil status
• Professions, economic category, activities
• Bank accounts and bank statements
• Identity cards, passports (where authorised)
• Information relating to the Companies' human resources: income, salaries, employee numbers, timekeeping data, working time, bonuses, commissions, travel expenses, benefits in kind, absences, leave, long-term illnesses, wage garnishments and assignments, recruitment, diplomas, authorisations, certifications, etc.
• Photographs for identification or marketing purposes
We collect this data mainly from you or your supplier (property manager, municipality, real estate agency) in connection with the performance of a contract entered into with you or with your supplier for which we act as a processor.
In the interest of our Companies, we may also combine the information collected with data obtained from other sources in order to supplement it, provide our Products & Services and personalise our interactions with you.
With your consent, we collect information related to your use of our websites using various technologies, such as cookies (via Cookie dot).
How Do We Use Your Personal Data?
Personal data communicated by yourself, your supplier or the company employing you, or lawfully received by our Companies from companies related to them or from third parties, may be processed by our Companies in order to:
• Manage contracts
• Activate and provide Products & Services
• Improve Products & Services
• Ensure the operation of the activity and performance
• Provide customer service
• Manage the business relationship and update the customer file
• Detect, prevent and combat fraud
• Produce statistics
• Manage disputes and recover debts
• Settle services
Personal data communicated may be processed by our Companies for direct marketing purposes (commercial actions, personalised advertising, data matching, awareness), with a view to improving knowledge of our customers and prospects and informing them about our activities, products and services.
How Do We Share Your Personal Data?
We share your personal data with your agreement or where it is necessary to carry out a transaction, provide a product or service that you have requested or authorised, or comply with legal obligations.
Your personal data may be communicated to service providers working on our behalf, acting as processors for the benefit of our Companies and who may need access to personal data in order to provide customer service support or help protect and secure our systems and services.
In such cases, these companies must comply with our requirements regarding data confidentiality and security and are not authorised to use the personal data that we communicate to them for other purposes.
We also share your data where required by law, to respond to legal proceedings, to comply with our obligations towards supervisory authorities, to protect our customers, to maintain the security of our Products & Services, to protect the rights or property of the Companies, for the management of litigation and debt recovery, as well as for the settlement of services.
The recipients of the data may include in particular:
• Companies of the Marth Group
• IT service providers
• Hosting providers
• Cloud service providers
• Technical partners
• Energy network operators
• Energy suppliers
• Competent public authorities
• Accounting, legal and audit bodies
• Banks
Transfer of Data Outside the European Union
Where applicable, companies and/or persons related to the Companies to whom personal data is communicated may be located within or outside the European Union.
In the event of transfers of data to third parties located outside the European Union, the Companies comply with the legal and regulatory provisions in force governing such transfers and, in particular, ensure an adequate level of protection for the personal data so transferred, on the basis of alternative mechanisms established by the European Commission or other contractual provisions.
How Do We Protect Your Personal Data?
The personal information we collect is stored in a secure environment. Persons working for us are trained to respect the confidentiality of your information. In order to ensure the security of your personal data, we limit it to the strict minimum and make use in particular of the following measures:
• Management of access rights and authorisations of authorised persons and data subjects
• Securing workstations: anti-spam, anti-virus, leak detection
• Securing mobile IT and telephones
• Protection of the IT network and servers: encryption, backups, flow management, firewalls
• Business continuity plan
• Supervision of developments
• Protection of premises: fire detection, anti-intrusion system, surveillance cameras
• Secure exchange of information
• We undertake to maintain a high degree of confidentiality by integrating the latest technological innovations enabling the confidentiality of your transactions to be ensured.
• Retention of your personal data
We retain your personal data for as long as necessary to provide the Products & Services and carry out the transactions you have requested, or for other essential purposes such as complying with our legal obligations, resolving disputes and enforcing our agreements. To the extent that these needs may vary depending on the types of data in the context of different products, actual retention periods may vary considerably.
Criteria Used to Determine Retention Periods
The criteria taken into account in determining retention periods include the following:
• Necessity of retention in order to provide the requested Products & Services
• Sensitivity of the data collected or entrusted
• Particular consent or agreed limitation
• Legal or contractual obligation
• Retention policy adopted by the Companies according to their legitimate interests
These retention periods may be:
• 10 years from the end of the contract for consumption measurement data (heating, water, waste, etc.) of users
• 10 years for data relating to accounting, commercial management, purchase and sales registers, real estate assets and commercial leases
• 5 years for the general documents of our Companies: shareholders’ resolutions, board deliberations, meeting minutes, articles of incorporation, shareholders’ registers, internal regulations, lawyers’ documents
• Up to 10 years for documents relating to human resources, employment contracts and salaries: payslips, taxes, social security, overtime, bonuses, benefits in kind, severance payments, notice periods, approval of the competent authorities, labour court decisions, correspondence, dismissal compensation, declarations to the CCSS and ACD
• 3 years for data relating to workplace accidents, working conditions, labour inspection, health and safety committee
Upon expiry of the legal or contractual retention periods applicable in Luxembourg, personal data is deleted, anonymised or securely archived. Data subjects may exercise their right to erasure under the conditions provided for in Article 17 of the GDPR, subject to legal obligations requiring retention.
COOKIES AND TRACKERS
Our websites may use different types of cookies and similar technologies:
• Cookies strictly necessary for the operation of the website
• Audience measurement cookies
• Functional cookies
• Cookies enabling improvement of the user experience
• Communication and marketing cookies where user consent has been obtained
The placement of non-essential cookies is subject to the prior consent of the user where required by the applicable regulations.
The user may at any time modify their preferences or withdraw their consent via the cookie manager made available on the relevant website.
AUTOMATED DECISION-MAKING AND PROFILING
The Companies do not make decisions producing legal effects concerning data subjects solely on the basis of automated processing of personal data.
Should such processing be implemented in the future, data subjects would be informed in accordance with the provisions of the GDPR.
Personal data is not subject to profiling within the meaning of Article 4.4 of the GDPR.
Right of Access, Rectification, Restriction and Objection
Our Companies comply with Regulation EU/2016/679 on the protection of personal data and guarantee you the following rights:
• Where the processing of personal data is based on your consent, you have the right to withdraw your consent at any time
• You may consult your personal data, have it rectified and restricted
• You have the right to object to the processing of your personal data
• You have the right to lodge a complaint with a data protection authority
• You also have the right to the erasure of your personal data where the conditions provided for by the GDPR are met
• The right to data portability is applicable only in the cases provided for in Article 20 of the GDPR, where processing is based on consent or on a contract and is carried out by automated means.
PROCESSING RELATING TO ENERGY COMMUNITIES AND ENERGY MANAGEMENT
As part of the operation of energy communities, charging stations, metering systems or energy management services, the Companies may process data relating to:
• Energy production
• Energy consumption
• Supply points
• Energy flows
• Data necessary for the allocation, statements or invoicing of services
• Installed equipment
These processing activities are carried out as part of the performance of contracts concluded with members of energy communities, customers, co-ownerships, network operators or any other concerned partner.
The data is processed only to the extent necessary for the management of the services provided, compliance with regulatory obligations and the preparation of the associated statements and statistics.
The data may be obtained directly from members of the energy community, network operators, charging station operators, metering devices or other authorised parties.
This data is used for the calculation of energy allocations, the administrative management of energy communities, the preparation of statements, invoicing, as well as compliance with applicable regulatory obligations.
MODIFICATION OF THE PRIVACY POLICY
The Companies reserve the right to modify this Privacy Policy in order to take into account legal, regulatory, case law or technical developments.
Any new version will be published on the relevant websites and shall take effect as soon as it is published online.
HOW TO CONTACT US
For any question concerning the confidentiality of your data, any complaint or any question relating to your rights, you may send your dated and signed request together with a photocopy of both sides of your identity card to:
To the Marth Group
15, Zone d’Activités Economiques
L-8287 Kehlen
Tel.: +352 30 92 06-1
To the National Commission for Data Protection (CNPD)
15, Boulevard du Jazz
L-4370 Belvaux
Tel.: +352 26 10 60 -1
Last update: 24 August 2026