The purpose of this Privacy Policy (hereinafter "the Policy") is to inform users of the Smarty PRO mobile application about how their personal data is collected, used and protected in the context of the use of the application and its services.

It applies to all personal data processing carried out by Creos Luxembourg S.A. when using the Smarty PRO application, whether this data concerns the User of the application or the Customer who initiated a connection request.

This Policy is intended to explain to you:

• What personal data is collected,
• For what purposes they are used,
• On what legal basis is this processing based,
• How long the data is kept,
• As well as the rights you have over your data and the means of exercising them. 

1. Definitions

For the purposes of this Policy,

Personal Data: This is any information relating to an identified or identifiable living natural person.

Processing: Any operation or set of operations which is performed on personal data or sets of personal data, whether by automated means.

Data controller: Creos Luxembourg S.A., which determines the purposes and means of the processing of personal data.

User: any person using the Smarty PRO mobile application and services in a professional capacity, as an electrician.

Application: the Smarty PRO mobile application available on the Apple and Google digital platforms.

Installation: a photovoltaic installation or a residential charging station installation

Customer: the person, or the person's representative, who is making a request to connect the Facility. 

What personal data do we collect? 

The personal data we collect is the personal data that you transmit to us directly in the context of the use of the Application.

• User data: surname, first name, email, telephone number
• Customer data: name, surname, address, technical data related to its Installation, photos of the Installation

Some data may also be collected automatically: user account, login data, logs, identifiers, etc.

The Application is intended for professional use. However, some information entered by the User may concern Customers. In this context, the User undertakes to transmit only accurate data that is necessary for the processing of the file and to possess all the necessary authorisations in the context of its relationship with the Client. 

Why do we collect your personal data? 

The data is collected in connection with connection requests for photovoltaic installations and residential charging stations made by Customers, and for:

1. The constitution and sharing of the documents necessary for the completion of the connection request (including the notification of the end of the work) between the parties involved (Creos, Electrician and Customer),
2. Checking the information provided to identify and correct incorrect or incomplete requests (Creos, Electrician and Customer),
3. Keeping the technical documentation of the electricity network up to date for Creos,
4. Validation of the conformity of the Installation required before its activation. 

What is the basis of lawfulness used for the collection of your personal data? 

• Basis of lawfulness 

Art.6 1 (C) GDPR: processing necessary for compliance with a legal obligation to which the Data Controller is subject.   

The personal data collected and processed in the context of the Application is necessary to comply with a legal obligation incumbent on Creos as a network operator. Indeed, the network operator is required to connect any installation to the electricity network, as well as to check their technical compliance, in accordance with the amended law of 1 August 2007 on the organisation of the electricity market.  

What are the retention periods applied? 

The personal data collected in the context of the processing of requests for connection to the Installations are kept for a maximum period of 30 years from the conclusion of the connection contract with the Customer, 

Data related to the Smarty Pro application but not related to the connection management process will be kept for a maximum period of 2 months from the closure of the project in the SmartyPro application.

How is the security of your personal data ensured? 

The protection and confidentiality of your personal data is very important to us. As such, we implement appropriate technical and organizational measures to ensure their security and to prevent unauthorized access, use, disclosure, alteration or destruction.

Access to personal data is strictly limited to authorised employees, who have been specifically trained in data protection and subject to confidentiality obligations.

Before implementing any processing of personal data, we carry out an assessment of the risks and security needs, to adapt the protection measures regarding the nature of the data and the purposes pursued. Our information security policies and practices are based on internationally recognized standards, such as ISO 27000.

In the event of a personal data breach that may pose a risk to your rights and freedoms, you will be informed under the conditions and within the time limits provided for by the GDPR. 

Is personal data disclosed to third parties? 

Your data is not sold, exchanged or communicated to third parties for commercial purposes.

Your data may be disclosed to Creos' strictly authorized internal teams, within the limits of their attributions as well as in the context of the application of a law, a regulation or if a decision of a competent regulatory or judicial authority requires it. 

Is personal data transferred outside the European Economic Area? 

No personal data is transmitted outside the European Economic Area. 

What rights do you have over your personal data? 

In accordance with the GDPR, you have the following rights over your personal data:

• Right to information – You have the right to be informed, in a clear and transparent manner, about how your personal data is collected and processed.
• Right of access – You have the right to know exactly what information is held about you and how it is processed.
• Right to rectification – You have the right to request the rectification of personal data concerning you if it is inaccurate or incomplete.
• Right to erasure - Also known as the "right to be forgotten", this means your right to have your personal data deleted or deleted without the need for a specific reason as to why you wish to erase it, in certain circumstances provided for by the GDPR.
• Right to restriction of processing – you can request the restriction of the processing of your personal data.
• Right to object - In certain circumstances provided for by the GDPR, you can object to your personal data being used for reasons relating to your situation. 

Who are your contact persons regarding your questions and exercising rights over your personal data? 

The Creos Data Protection Officer can be reached under the email address dpo@creos.net.

They will take care of your request as soon as possible. For complaints relating to the processing of your personal data, you can contact the Luxembourg Data Protection Authority: 

Commission Nationale pour la Protection des Données (CNPD)
15, boulevard du Jazz
L-4370 Esch-sur-Alzette
Tél.: 2610 60 1
Fax: 2610 60 29
e-mail: info@cnpd.lu
Web: www.cnpd.lu

This Policy may be updated at any time. In the event of an update, the date will be changed and the updated version will be published on the Creos website, Smarty PRO section.