Privacy policy applicable to access control system (ACS)
This privacy policy (the “Policy”) is intended to explain how we process your personal data in connection with the operation of the electronic access control system (the “ACS”) we installed in our buildings of the TECHNOPOLIS complex (excluding buildings A & B) located at 12, rue Guillaume J. Kroll, L-1882 Luxembourg, Grand Duchy of Luxembourg (the “ACS”) and to provide you with more information on your privacy rights and how to exercise them.
We hope this will help you to have a clear view of how your personal data are processed.
1 Data controller
The data controller under the General Data Protection Regulation (EU 2016/679) (“GDPR”) is, in relation to the processing of your personal data when we operate our ACS:
KOWAC S.à r.l.
Société à responsabilité limitée
40, Rue de la Vallée
L-2661 Luxembourg
R.C.S. Luxembourg: B240412
We, KOWAC S.à r.l., as “data controller” under the GDPR are responsible for deciding how we hold and use the personal data we have about you.
References, herein to “we”, “us” or “our” shall refer to KOWAC S.à r.l. as data controller. References to “you” or “your” shall refer to data subjects whose personal data may be processed by the data controller.
2 What is a personnal data and what do we mean by processing personnal data?
- “Personal data” means any information relating to an identified or identifiable natural person (a “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Example of personal data: logs of the date, time and location of entry or exit of a named access card holder - “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction
Examples of processing: the recording of the entries and exists of a named access card holder
3 Purpose of the processing of your personal data
The ACS has been installed and is operated, and your personal data is accordingly processed, for the following purposes in accordance with article 6(1)(f) GDPR (legitimate interests):
- securing the accesses to the buildings;
- ensuring the safety and security of people such as our and our tenants’ employees, customers, visitors, contractors;
- preventing and detecting theft, vandalism, trespassing, or other unlawful activities in our properties and protecting our and our tenant’s assets;
- supporting incident investigations and insurance claims.
The provision of our personal data is required to grant you access to our real estate property following your employment or business relationship with us or our tenants, suppliers or cooperation partners. Failure to provide such data may result in you being denied access to our property.
4 Personal data collected
The following personal data is collected and processed for the purpose or as a part of the operation of the ACS:
- Identity data: first name and last name, phone number, email address, company/employer name and access level;
- Stamp details: approved and rejected passage;
- Access control logs: access reader location, dates and times.
5 Source of the personal data collected
Your personal data is collected directly from you or from your company/employer following the request to grant you an access to our property. The ACS generates the access control log based on where you show the access card or tag to the reader. The ACS does not use any other sources of information.
6 Legal basis for processing
The processing of personal data via the ACS is based on our and our tenants’ legitimate interests as per article 6(1)(f) GDPR.
7 Data retention period
Personal data processed by the ACS are retained for a maximum of one year from the date of the relevant access attempt, unless:
- a specific incident (e.g., theft, accident, security breach) has occurred, in which case relevant data may be retained for the duration of any investigation, legal proceeding, or insurance claim;
- a longer retention period is required by law enforcement or a court order;
- a data subject has submitted a request for access to the data relating to them — in which case the relevant data will be retained until the request is fully resolved.
Access to such personal data is strictly restricted.
8 Data recipients
Your personal data may be accessed or disclosed to the following categories of recipients:
- internal personnel: authorized employees with a legitimate need to view the ACS logs;
- our tenants: upon their request and when this is necessary for identifying, investigating and verifying acts of vandalism or other criminal activity or for establishing liability for damage;
- law enforcement authorities: only upon lawful request and in compliance with Luxembourg criminal procedure;
- insurance providers or legal advisors: in the context of claims or litigation;
- public authorities, courts, institutions, administrations, governmental corporations: in the context of a litigation or when we are legally obliged to do so;
- subcontractors: our subcontractors such as, but without being limited to:
- the contractors in charge of the ACS’ operation, maintenance and/or technical support,
- the contractors in charge of the security of our buildings;
- our IT service providers, auditors, advisors and external consultants;
- our assets managers;
- Technopolis Holding Plc and its affiliates.
Your personal data is not regularly processed outside the European Union (EU) and the European Economic Area (EEA). In case your personal data mentioned in this Policy have to be processed outside the EU and the EEA, we will do it only in the following cases:
- if such countries are granted an adequacy decision by the European Commission;
- if such countries have not been granted an adequacy decision by the European Commission:
- if one of the conditions laid down by article 49 GDPR is met; or
- if appropriate safeguards are provided in accordance with article 46 GDPR.
9 Your rights as a data subject
Under the GDPR, you have the following rights regarding your personal data processed via the ACS:
| Right | Description |
|---|---|
| Access | You may request a copy of your access logs and associated data. |
| Rectification | You may request correction of inaccurate data (if applicable). |
| Erasure (Right to be Forgotten) | You may request deletion of your personal data, subject to legal retention obligations. |
| Restriction of Processing | You may request temporary suspension of processing under certain conditions. |
| Objection | You may object to processing based on legitimate interests, and we will cease processing unless we demonstrate compelling legitimate grounds. |
| Data Portability | You may request your data to be provided in a structured, machine-readable format (e.g., CSV). |
| Lodge a Complaint | You have the right to lodge a complaint to the Commission Nationale pour la Protection des Données (“CNPD”) which is the Luxembourg supervisory authority for data protection issues. We would, however, appreciate the chance to discuss with you about your concerns before you reach out to the CNPD so please do not hesitate to contact us.<br>The details of the CNPD are the following:<br>Commission nationale pour la protection des données<br>15, Boulevard du Jazz<br>L-4370 Belvaux<br>Phone: (+352) 26 10 60 -1 |
To exercise any of these rights, please submit a written request to our contact person (see Section 9 below). We will respond within one month (extendable to two months for complex requests). To protect your privacy and prevent unauthorised access, you may be asked to provide proof of identity.
10 Contact
For questions, requests, or complaints regarding this CCTV System, this Policy or your personal data, please contact:
Mr. Valentin Tosolini by email addressed to Valentin.Tosolini@technopolis.lu or by mail addressed to the attention of Mr. Valentin Tosolini at:
KOWAC S.à r.l.
Société à responsabilité limitée
40, Rue de la Vallée
L-2661 Luxembourg
R.C.S. Luxembourg: B240412
11 Updates to this policy
We may update this Policy from time to time to reflect changes in law, technology, or our practices. The most current version will always be available on our website and at the reception of the TECHNOPOLIS complex.
Updated 30 July 2026