Privacy Policy

Introduction

https://rumya.clsinfo.lu/brunata

The companies of the Marth Group, namely Brunata Metrona FL Sàrl, E-Trash Location Sàrl, E-Trash Sàrl, Marth Group Sàrl, Marth Invest Sàrl, René Marth Sàrl, RPM SCI, Voltizy Sàrl and Voltizy Community Scop, hereinafter referred to as the “Companies”, offer a wide range of products and services, hereinafter referred to as the “Products & Services”, including:

Installation and reading of energy and water meters
Preparation and issuance of energy and water statements
Manufacturing and installation of waste bins and waste bin enclosures
Design and installation of waste bin counting systems
Preparation and issuance of waste statements
Development of services and databases based on measurement data collection
Provision of services based on measurement data collection
Provision of measurement data to third parties through IT platforms
Development and implementation of measurement processes for use by third parties
Sale of heating and sanitary equipment, materials and tools
Management and installation of charging stations, and preparation and issuance of related statements
Energy communities, management of energy flow allocation, and preparation and issuance of related statements

In view of the development of new communication and information technology tools, we believe it is necessary to pay the utmost attention to the protection of privacy.

Data Controller

Each company of the Marth Group acts as a data controller for processing activities carried out within the scope of its own operations.

Where several companies jointly determine the purposes and means of processing, they act as joint controllers in accordance with Article 26 of the GDPR.

For any questions regarding the identification of the controller responsible for a specific processing activity, data subjects may contact gdpr@brunata.lu.

Legal Bases for Processing

Depending on the purpose pursued, the processing of personal data is based in particular on the following legal grounds:

Performance of a contract or implementation of pre-contractual measures
Compliance with a legal or regulatory obligation
The legitimate interests of the Companies, including securing systems, preventing fraud, improving Products & Services, managing business relationships, and defending their rights
The consent of the data subject where required by applicable regulations

Where processing is based on consent, such consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Personal Information We Collect

We may collect your personal information for various reasons, including the provision of our Products & Services, compliance with professional obligations, performance of a contract, processing of your files, correspondence, or job applications, etc.

In particular, we process the following data:

Consumption data (heating, water, waste, electricity, etc.) of users
Billing data, commercial data, and supplier data
Identity information, addresses, personal and professional contact details, and civil status information
Professions, economic categories and activities
Bank accounts and bank statements
Identity cards and passports (where permitted)
Information relating to the Companies’ human resources management, including income, salaries, employee numbers, timekeeping records, working hours, bonuses, commissions, travel expenses, benefits in kind, absences, leave, long-term illnesses, wage garnishments and assignments, recruitment, diplomas, authorisations, certifications, etc.
Photographs for identification or marketing purposes

We collect this data mainly from you or from your service provider (property manager, municipality, real estate agency) in the performance of a contract concluded with you or with your service provider, for whom we act as a processor.

In the interests of our Companies, we may also combine information collected with data obtained from other sources in order to supplement it, provide our Products & Services and personalise our interactions with you.

With your consent, we collect information relating to your use of our websites through various technologies such as cookies (via Cookie dot).

How Do We Use Your Personal Data?

Personal data provided by you, your service provider, or the company employing you, or lawfully received by our Companies from related companies or third parties, may be processed by our Companies for the purpose of:

Managing contracts
Activating and providing Products & Services
Improving Products & Services
Ensuring business operations and performance
Providing customer service
Managing business relationships and updating customer records
Detecting, preventing and combating fraud
Producing statistics
Managing disputes and debt recovery
Settling services

The personal data provided may also be processed by our Companies for direct marketing purposes (commercial actions, personalised advertising, data matching, brand awareness), in order to improve knowledge of our customers and prospects and to inform them about our activities, products and services.

How Do We Share Your Personal Data?

We share your personal data with your consent or where necessary to carry out a transaction, provide a product or service you have requested or authorised, or comply with legal obligations.

Your personal data may be disclosed to service providers acting on our behalf as data processors for our Companies and who may require access to personal data in order to provide customer support or help protect and secure our systems and services.

In such cases, these companies must comply with our data protection and security requirements and are not permitted to use the personal data we provide for any other purpose.

We also share your data where required by law, to respond to legal proceedings, to comply with obligations towards supervisory authorities, to protect our customers, to maintain the security of our Products & Services, to protect the rights or property of the Companies, for litigation and debt recovery management, and for the settlement of services.

Recipients of the data may include in particular:

Companies within the Marth Group
IT service providers
Hosting providers
Cloud service providers
Technical partners
Energy network operators
Energy suppliers
Competent public authorities
Accounting, legal and audit bodies
Banks

Transfer of Data Outside the European Union

Where applicable, companies and/or individuals associated with the Companies to whom personal data is disclosed may be located within or outside the European Union.

In the event that personal data is transferred to third parties located outside the European Union, the Companies shall comply with the applicable legal and regulatory provisions governing such transfers and shall, in particular, ensure an adequate level of protection for the personal data transferred, based on mechanisms established by the European Commission or other contractual safeguards.

How Do We Protect Your Personal Data?

The personal information we collect is stored in a secure environment. Individuals working for us are trained to respect the confidentiality of your information.

To ensure the security of your personal data, we limit its processing to what is strictly necessary and, in particular, implement the following measures:

Management of access rights and authorisations for authorised persons and data subjects
Workstation security: anti-spam, antivirus, and data leak detection
Security of mobile devices and telephones
Protection of IT networks and servers: encryption, backups, traffic management, and firewalls
Business continuity plan
Supervision of development activities
Physical security of premises: fire detection systems, intrusion detection systems, surveillance cameras
Secure exchange of information
We are committed to maintaining a high level of confidentiality by incorporating the latest technological innovations to ensure the confidentiality of your transactions
Retention of your personal data

We retain your personal data for as long as necessary to provide the Products & Services and carry out the transactions you have requested, or for other essential purposes such as complying with legal obligations, resolving disputes and enforcing our agreements.

As these needs may vary depending on the type of data and the context of the different products, actual retention periods may vary considerably.

The criteria taken into account when determining retention periods include:

The need to retain data in order to provide the requested Products & Services
The sensitivity of the data collected or entrusted to us
Any specific consent or agreed limitation
A legal or contractual obligation
Retention policies adopted by the Companies based on their legitimate interests

These retention periods may include:

10 years from the end of the contract for consumption measurement data (heating, water, waste, etc.) relating to users
10 years for data relating to accounting, commercial management, purchasing and sales registers, real estate assets and commercial leases
5 years for the Companies’ general corporate documents: shareholders’ resolutions, board decisions, meeting minutes, articles of incorporation, shareholder registers, internal regulations and legal documents from lawyers
Up to 10 years for human resources documents, employment contracts and payroll records: payslips, taxes, social security records, overtime, bonuses, benefits in kind, severance payments, notice periods, approvals from competent authorities, labour court decisions, correspondence, dismissal indemnities, and filings with the CCSS and ACD
3 years for data relating to workplace accidents, working conditions, labour inspections, and health and safety committees

Upon expiry of the legal or contractual retention periods applicable in Luxembourg, personal data is deleted, anonymised or securely archived.

Data subjects may exercise their right to erasure under the conditions set out in Article 17 of the GDPR, subject to any legal obligations requiring the retention of such data.

COOKIES AND TRACKING TECHNOLOGIES

Our websites may use different types of cookies and similar technologies:

Cookies strictly necessary for the operation of the website
Audience measurement cookies
Functional cookies
Cookies designed to improve the user experience
Communication and marketing cookies where the user's consent has been obtained

The placement of non-essential cookies is subject to the user's prior consent whenever required by applicable regulations.

Users may modify their preferences or withdraw their consent at any time through the cookie management tool available on the relevant website.

AUTOMATED DECISION-MAKING AND PROFILING

The Companies do not make decisions producing legal effects concerning data subjects solely on the basis of automated processing of personal data.

Should such processing activities be implemented in the future, data subjects will be informed in accordance with the provisions of the GDPR.

Personal data is not subject to profiling within the meaning of Article 4(4) of the GDPR.

Right of Access, Rectification, Restriction and Objection

Our Companies comply with Regulation (EU) 2016/679 on the protection of personal data (GDPR) and guarantee you the following rights:

Where the processing of personal data is based on your consent, you have the right to withdraw that consent at any time
You may access your personal data, request its correction, and request restriction of its processing
You have the right to object to the processing of your personal data
You have the right to lodge a complaint with a data protection supervisory authority
You also have the right to have your personal data erased where the conditions provided for by the GDPR are met
The right to data portability applies only in the cases provided for under Article 20 of the GDPR, where processing is based on consent or a contract and is carried out by automated means

PROCESSING RELATED TO ENERGY COMMUNITIES AND ENERGY MANAGEMENT

As part of the operation of energy communities, charging stations, metering systems or energy management services, the Companies may process data relating to:

Energy production
Energy consumption
Supply points
Energy flows
Data required for allocation, billing or invoicing of services
Installed equipment

Such processing is carried out in connection with the performance of contracts concluded with members of energy communities, customers, co-ownership associations, network operators or any other relevant partners.

Data is processed only to the extent necessary for the management of the services offered, compliance with regulatory obligations, and the preparation of related statements and statistics.

Data may be obtained directly from members of the energy community, network operators, charging station operators, metering devices or other authorised parties.

This data is used for calculating energy allocations, managing energy communities, preparing statements, invoicing services, and ensuring compliance with applicable regulatory obligations.

CHANGES TO THE PRIVACY POLICY

The Companies reserve the right to modify this Privacy Policy in order to reflect legal, regulatory, case law or technical developments.

Any new version will be published on the relevant websites and shall become effective upon publication.

How to Contact Us

For any questions concerning the confidentiality of your data, complaints, or requests relating to your rights, you may send a dated and signed request together with a copy of both sides of your identity card to:

Marth Group
15, Zone d’Activités Economiques L-8287 Kehlen Tel.: +352 30 92 06-1 gdpr@brunata.lu

National Commission for Data Protection (CNPD)
15, Boulevard du Jazz L-4370 Belvaux Tel.: +352 26 10 60-1 info@cnpd.lu

Last updated: 24 August 2026