Privacy Policy

GRIDX Management SA, a company in the Giorgetti Group ("we", "us", "our") operates GIOLABS, the digital immersion space located at 4-6 Rue des Trois Cantons - L-3980 Wickrange, as well as its website accessible at https://giolabs.lu/fr ("Site", "Service").

This Privacy Policy sets out our rules of conduct regarding respect for privacy when you use this Site, when you purchase our products and services, when you are in contact with us as part of a contract, when you communicate with us or deal with us in any other way.

If necessary, we will inform you of any data processing activities not covered by these rules by means of notices, forms, general conditions or additional data protection statements.

We may amend these rules by publishing an updated version on our Site. These changes are binding on the User ("you", "your") as soon as they are published online.

I. Definitions

The expressions Personal Data, Sensitive Data, Data Subject, Data Controller, Joint Controller, Data Processor and Personal Data Processing are used herein with the meaning given in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of Personal Data and on the free movement of such data, known as the GDPR - General Data Protection Regulation.

Customer data means all information pertaining to you as a customer, as a guest who stayed or is staying with us. Customer data may include your contact details, reservation history, personal preferences, claims and complaints you have made or marketing communication preferences.

Applicant means any person who applies for an internship or a job.

User means individual or Data Subject who use our product or service.

Partners refers to tenants and companies belonging or not belonging to the group.

Tenant means the company that rent commercial space in the GRIDX Complex.

II. Our engagement

Protecting Personal Data is a paramount concern for GRIDX Management SA, who, depending on the circumstance, acts as the Data Controller, Joint Controller or as the Data Processor. We take the necessary steps to ensure that your Personal Data is processed securely in accordance with the GDPR.

We will always use your Personal Data in a fair and trustworthy manner and will take all reasonable measures to protect your information from misuse and to keep it safe.

We will always be transparent with you about the data we collect and how we use it.

We comply with current regulations concerning the protection of Personal Data and cooperate with the authorities, including the CNPD - National Commission for Data Protection, the Luxembourgish supervisory authority for data protection.

III. Processing of Personal Data

During our activities and to respond to your request or application, or to provide, to manage, to maintain or improve our products and services, we may collect various types of Personal Data based on the categories of Data Subjects.

Employees (applicants, permanent staff, temporary staff, interns)

• Identification data.
• Sensitive data.
• Data relating to personal life.
• Data relating to professional life.
• Application and recruitment data.
• Economic and financial information.
• Login data.

Third parties (prospects, customers, government agencies, suppliers, service providers and their staff)

• Identification data.
• Data relating to personal life.
• Data relating to professional life.
• Economic and financial information.
• Data from forms and newsletter subscriptions.

Users of the Site

• Identification data.
• Application and recruitment data.
• Personal account and login details.
• Data relating to Internet activity.
• Data from forms and newsletter subscriptions.

How do we collect your Personal Data?

We may collect this information from different sources, namely:

Data provided: Information you give us directly via the Site, our social networks, our subcontractors, our customer service department or when you visit the GRIDX Complex.

Incoming data: Information from government organisations, social networks or online platforms, for example when you engage with our content or provide feedback on our services.

Data collected: Information that we collect via automatic collection systems, information that we may collect via our partners, suppliers, subsidiaries, group companies and others, information that we collect from operators, social networks or when you visit us and use our services.

Where the Data Subject is not a natural person, we collect the Personal Data described above from their employees, contact people or designated representatives.

If you provide us with Personal Data about other people, we assume that you are authorised to do so, that the data concerned is accurate and that you authorise us to use this data to respond to your request for services. Please ensure that these persons have been informed of these rules of conduct.

Other data are that generally do not reveal your specific identity or relate to an individual. Other data include:

• browser and device data,
• data collected through cookies and other technologies,
• demographic data and other data provided by you,
• aggregated data.

Your browser or device. We collect certain data through your browser or automatically through your device, such as your Media Access Control (MAC) address, computer type (Windows or Macintosh), screen resolution, operating system name and version, device manufacturer and model, language, internet browser type and version and the name and version of the Online Services (such as the Apps) you are using. We use this data to ensure that the Online Services function proper.

Your IP Address. We collect your IP address, a number that is automatically assigned to the computer that you are using by your Internet Service Provider (ISP). An IP address is identified and logged automatically in our server log files when a user accesses the Online Services, along with the time of the visit and the pages that were visited. We use IP addresses to calculate usage levels, diagnose server problems and administer the Online Services. We also may derive your approximate location from your IP address.

How do we use your Personal Data?

We use your Personal Data as part of the overall management of our business, namely:

• To develop, improve and provide you with offers of products and services.
• Process service contracts we have entered with you.
• Process applications and manage recruitment.
• Manage the delivery, invoicing and payment of our services.
• Process your invoices as part of our accounting.
• Establish a customer database, promote and manage our loyalty program.
• Produce statistics from data sets that make it impossible to re-identify the Data Subjects.
• Analyse your behaviour and preferences to make assumptions about your interests.
• Organise the day-to-day activities without any individual profiling.
• Fulfil legal obligations in professional, social, accounting and tax matters.
• Fulfil the contractual obligations inherent in the employment contract.

We use your Personal Data confidentially and do not share it to Third Parties, except where required by law.

Any Data Processor receives only the data required for the task entrusted to it and is bound by strict confidentiality requirements.

If, however, we receive personal information via this Site that requires a personal response, the corresponding data is processed within the specific framework of your request and is not reused or transmitted for other purposes.

As part of the recruitment process, your Personal Data is processed in accordance with the privacy notice attached to our internship and job offers. This data will not be re-used or transmitted for other purposes.

What rules apply to “profiling” and the use of “profiles”?

Profiling - We may automatically assess personal aspects about you based on your data for the purposes set out above, when we wish to establish preference data, analyse statistics or plan commercial activities. For example, we may use "profiling" to determine which other products are likely to be of interest to you based on your consumption and frequentation habits.

Profiles - We may also create 'profiles' for the same purposes, combining behavioural, preference and other data about you to better understand you as a person - with your different interests and other characteristics. These "profiles" are used to draw conclusions about key aspects of your personality (for example, what you like or how you behave in certain situations).

We ensure that the results are proportionate and reliable, and take measures against the misuse of "profiling" or "profiles".

How long do we keep your Personal Data?

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless we need to retain it for legitimate legal or contractual reasons.

To protect this data against accidental or malicious destruction, when we delete it from our services, we may not immediately delete the residual copies from our servers or back-up systems.

Purposes and legal bases of processing

1.Contract management

We process Personal Data to establish, manage and monitor contracts with:

• Employees: employment contract, internship agreement
• Customers: ticketing, concierge services, events, contests, reservations, subscriptions
• Third parties: commercial contracts, service contracts, subcontracting contracts

The legal basis for this processing is the performance of a contract or pre-contractual measures, insofar as such processing is necessary for responding to requests received, or for the establishment or performance of the contract concerned.

2.Compliance with legal obligations

We process Personal Data as part of our real estate activities.

The legal basis for this processing is the response to the following legal obligations:

• Social, accounting and tax obligations
• Obligations of property management professionals

3.The pursuit of legitimate interests

We process Personal Data to organise and optimise our services. These treatments concern:

• Management of personnel, training, remuneration
• Sales, accounting, IT
• Debt collection
• Marketing, communication, digital development
• Customer satisfaction surveys
• Premises management and surveillance
• Protection of property and individuals
• Case compilation in case of disputes, pre-litigation or litigation

The legal basis for this processing is the pursuit of legitimate interests or the safeguarding of vital interests of the Data Subject or of another natural person.

4.Management of Requests

We process your Personal Data in the following cases:

• Welcoming visitors
• Requests from Users of its services
• Processing of requests via forms, subscription to newsletters, cookie management
• Marketing, communication or profiling operations

The legal basis for this processing is your consent, which you can withdraw at any time.

Implementation of your consent

When collecting Personal Data that does not result from a legal or contractual obligation, we inform you that their transmission is optional and therefore implies, as soon as it is transmitted, consent for their subsequent computer processing by GRIDX Management SA in compliance with these conditions.

If you agree, we may send you information, advertising and offers of products and services from us and from Third Parties, in the form of printed documents, by electronic means, by post or by telephone.

Where we seek your consent for certain processing activities (e.g. marketing or advertising activities), we will inform you separately of the purposes of the processing concerned.

You may withdraw your consent at any time with effect for the future via the Site's Contact Form or via the unsubscribe link in each newsletter.

Upon receipt of notification of withdrawal of consent, we will no longer process your information for the purpose(s) to which you consented, unless we have another legal basis to do so. However, withdrawal of consent does not affect the lawfulness of processing based on consent prior to withdrawal.

Where we do not seek consent for processing, the processing of your Personal Data is based on the necessity of the processing to initiate or perform a contract with you (or the entity you represent) or on our legitimate interest or that of a Third Party in the processing in question, in particular in pursuing the purposes and objectives set out herein, and in implementing measures relating to those purposes and objectives.

Who do we share your Personal Data with?

We process your Personal Data within the EU.

To process your request, provide services and manage staff, we share your data with carefully selected and controlled Data Processors or partners.

We may share your Personal Data if we believe in good faith that this is necessary to:

• Comply with a legal obligation.
• Protect and defend our rights or property.
• Prevent or investigate possible wrongdoing.
• Ensure the personal safety of the public, of Users of the Site and of other users.

Do we transfer your Personal Data to other countries?

Your Personal Data will not be transferred to any organisation or country unless adequate controls are in place regarding the security of your Personal Data.

In certain circumstances, courts, law enforcement agencies, regulatory or security authorities will have the right to access your Personal Data. Where we are required to transfer your Personal Data to other countries or jurisdictions, we will protect such data in accordance with applicable law. If required by applicable law, we will enter binding contractual obligations with the data recipient to safeguard your data protection rights.

How do we protect your Personal Data?

We take all reasonable precautions to keep your Personal Data secure, and we require any third party who handles or processes your Personal Data for us to do so. However, we cannot guarantee them absolute security.

Access to your Personal Data is restricted to prevent unauthorised access, alteration, or misuse, and is only allowed for our employees and agents who need it as part of their mission.

Our staff in charge of processing your Personal Data are regularly trained and made aware of the need to protect Personal Data.

Where appropriate, the Data Protection Officer is consulted prior to any project likely to have an impact on the processing of your Personal Data.

Cookies

A Cookiebot banner informs Users about our cookie policy and the possibility of giving or withdrawing consent for the collection of cookies stored directly on the computer or mobile device they are using.

Use of your data for information and advertising purposes

In addition to providing our services, we also use your Personal Data to communicate with you about our marketing offers or promotions and to recommend other services that may interest you.

Specifically, we may use your Personal Data to send you a newsletter if you have explicitly chosen to receive it on our website, in one of our information emails by clicking on a link indicating that you wish to receive our newsletter or by written consent.

If you no longer wish to receive information or newsletters from us by email, you can object at any time by contacting us by email or by using the link found in each of our emails or newsletters.

Service providers, Links to other websites

We may use third-party Service Providers and third parties as part of the recruitment process or to facilitate the provision of our services, to provide these services on our behalf, to provide services related to our services or to help us analyse how our services are used.

These Third Parties only have access to your Personal Data to conduct these tasks on our behalf and are prohibited from disclosing or using it for any other purpose.

Please note that links to other websites, with different protection rules, are possible. We recommend that you examine the privacy policy on each site you visit. We have no control over the content, policies or confidentiality practices of third-party sites or services and accept no responsibility for them.

What are your rights and how to exercise them?

You have the right to:

• Ask us for a copy of the personal data we hold about you.
• Ask us to correct, update, or delete your Personal Data in our records.
• To report any misuse of your Personal Data to us.
• Contact the CNPD (www.cnpd.lu or databreach@cnpd.lu) and file a complaint with it, if you believe that your Personal Data has not been processed in accordance with the law.

You can contact the Data Protection Officer if you have any questions, comments or concerns about the way we process your Personal Data.

• by email: dpo@gridx.lu
• by telephone: +352 49 88 88
• by mail: GRIDX MANAGEMENT SA, to the attention of PONCIN Gilles, 4-6 rue des Trois Cantons 3980 Wickrange Luxembourg