PRIVACY POLICY

Illumus Unipessoal, Lda. respects the privacy of users of its website and is committed to processing personal data lawfully, fairly, transparently and securely, in accordance with the General Data Protection Regulation — Regulation (EU) 2016/679, hereinafter referred to as the “GDPR” — and the applicable national legislation.

This Privacy Policy explains which personal data may be collected by Illumus, how it is used, the applicable legal grounds, how long it may be retained, with whom it may be shared and the rights available to data subjects.

This Policy applies to data processed through the Illumus Lighting website and its contact channels, as well as in connection with enquiries, quotation requests, business relationships, projects, orders, supplies, warranties and after-sales service.

1. DATA CONTROLLER

The controller responsible for processing personal data is:

Illumus Unipessoal, Lda.
Private limited company
Tax identification and commercial registration number: 515 437 816
Share capital: €5,000.00
Rua Principal, No. 416, Fujacos
3750-717 Recardães, Águeda
Portugal
Telephone: (+351) 938 777 726
Email: geral@illumus.pt
Website: www.illumus.pt

For any matter relating to privacy, data protection or the exercise of rights, the data subject may contact Illumus using the email address above.

2. PERSONAL DATA THAT MAY BE COLLECTED

Depending on the nature of the contact, request, project or business relationship, Illumus may collect and process the following categories of personal data:

• name;
• email address;
• telephone number;
• job title or professional role;
• company, organisation or entity represented;
• business address, country or project location;
• tax identification and billing details;
• data required to prepare and manage proposals or contracts;
• information relating to projects, products or quotation requests;
• the content of messages and communications exchanged with Illumus;
• files, drawings, plans, images, photographs, specifications, measurements or other documentation provided voluntarily;
• data relating to orders, payments, dispatch, delivery, installation, warranty or after-sales service;
• basic technical data relating to the use of the website, where required for its operation, security and prevention of abuse;
• other data voluntarily provided by the data subject.

Illumus does not intentionally request special categories of personal data, including data concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data or data concerning a person’s sex life or sexual orientation.

Users should not include this type of information in forms, messages or documents sent to Illumus unless it is strictly necessary, legally permitted and agreed in advance.

Where submitted documentation contains personal data relating to third parties, the person or entity submitting it must ensure that it has a lawful basis for doing so and that the data transmitted is adequate, relevant and limited to what is necessary.

3. HOW PERSONAL DATA IS COLLECTED

Personal data may be collected through:

• contact forms available on the website;
• requests for information, contact or quotations;
• email communications;
• telephone contacts;
• contacts initiated by the user through WhatsApp;
• in-person or remote meetings and other communications relating to projects;
• business, pre-contractual or contractual relationships;
• documentation sent directly by clients, prospective clients, suppliers, partners or their representatives;
• technical interactions required for the operation and security of the website.

3.1. SOURCE OF PERSONAL DATA

Personal data may be provided directly by the data subject or, where applicable, by clients, prospective clients, employers, represented entities, suppliers, partners, installers, carriers or other parties involved in a project or business relationship.

Personal data may also be obtained from publicly or professionally accessible sources where this is necessary, proportionate and legally permitted for the relevant purpose.

4. PURPOSES OF PROCESSING

4.1. Responding to contacts and enquiries

Data may be used to receive, assess and respond to questions, messages or requests submitted through the website, email, telephone, WhatsApp or other channels made available by Illumus.

4.2. Preparation of proposals and quotations

Data may be processed to understand a request, assess project feasibility, request technical clarification, study solutions and prepare estimates, commercial proposals or quotations.

4.3. Pre-contractual steps

Data may be used to take steps requested by the data subject before entering into a contract, including meetings, technical assessment, preliminary development, preparation or revision of drawings, material selection, estimates and negotiation of terms.

4.4. Performance of contracts and orders

Data may be used to manage contracts, orders, projects, approvals, production, supplies, invoicing, payments, transport, delivery, installation, warranty and after-sales service.

4.5. Technical development of projects

Data and documentation provided may be processed to develop, adapt, validate or manufacture lighting solutions, prototypes, samples, technical drawings, specifications, components and bespoke products.

4.6. Management of clients, suppliers and partners

Data may be processed to maintain administrative, commercial, accounting and operational records relating to clients, suppliers, manufacturers, partners, installers, carriers and other professional contacts.

4.7. Compliance with legal obligations

Data may be processed to comply with tax, accounting, employment, legal, regulatory, administrative or judicial obligations applicable to Illumus.

4.8. Website security and operation

Technical data strictly necessary to ensure the operation, stability and security of the website and to prevent fraud, abuse, spam, unauthorised access and other security incidents may be processed.

4.9. Establishment, exercise and defence of legal rights

Data may be retained and used where necessary to establish, exercise, evidence or defend Illumus’s rights in judicial, administrative, arbitral or out-of-court proceedings.

5. LEGAL GROUNDS FOR PROCESSING

Depending on the purpose and specific context, personal data processing may be based on one or more of the following legal grounds:

• the data subject’s consent, where required and validly given;
• taking pre-contractual steps at the request of the data subject;
• performance of a contract to which the data subject is a party;
• compliance with legal obligations to which Illumus is subject;
• the legitimate interests pursued by Illumus or a third party, provided that those interests are not overridden by the fundamental rights and freedoms of the data subject.

Illumus’s legitimate interests may include managing and organising its business activities, maintaining professional contacts, preparing and monitoring projects, website security, preventing fraud, handling complaints and defending its rights.

Where processing is based on consent, consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.

6. MANDATORY AND OPTIONAL DATA

Fields marked as mandatory in forms are required to allow Illumus to receive, assess and respond to the user’s request.

Failure to provide such data may prevent Illumus from responding to the contact, assessing a project, preparing a proposal, entering into a contract or providing the requested service.

Other data is optional, although it may be necessary to understand the technical, commercial or logistical characteristics of the request correctly.

7. RECIPIENTS AND SERVICE PROVIDERS

Personal data may be processed, accessed or disclosed, only where necessary and within the limits permitted by law, to the following categories of recipients:

• authorised Illumus employees and service providers;
• website hosting, maintenance and security providers;
• email, communications and storage providers;
• software, management systems and technical service providers;
• accountants, consultants, lawyers, insurers and other professionals subject to confidentiality obligations;
• suppliers, manufacturers, subcontractors and partners involved in the development or manufacture of a project;
• carriers, freight forwarders, installers or technicians involved in delivery, installation or service;
• banks and payment service providers, where necessary;
• public, tax, judicial, law-enforcement or regulatory authorities where disclosure is legally required.

Illumus seeks to limit any access to or disclosure of data to what is strictly necessary for the relevant purpose.

Providers processing personal data on behalf of Illumus are subject to the applicable legal obligations, confidentiality duties and appropriate data protection instructions.

8. INTERNATIONAL DATA TRANSFERS

Illumus seeks to use providers that process personal data within the European Economic Area or that provide appropriate safeguards.

Certain technology services, communication platforms or external providers may involve the processing of or access to personal data outside the European Economic Area.

Where this occurs, Illumus will ensure that the transfer is covered by an adequacy decision adopted by the European Commission, standard contractual clauses, applicable binding rules or another legally valid transfer mechanism, together with any supplementary measures that may be required.

9. RETENTION PERIODS

Personal data is retained only for as long as necessary for the purposes for which it was collected, without prejudice to applicable legal, contractual or limitation periods.

As a general rule:

• contact requests with no subsequent commercial follow-up: up to 24 months after the last communication;
• quotation requests and proposals not accepted: up to 3 years after the last communication;
• data relating to clients, contracts, orders and completed projects: throughout the contractual relationship and subsequently for the applicable statutory or limitation periods;
• technical project documentation: for the period required for performance, traceability, warranty, service and defence of rights;
• accounting, tax and invoicing documents: for the periods required by law;
• data required for the establishment, exercise or defence of rights: until expiry of the applicable limitation periods;
• data processed on the basis of consent: until consent is withdrawn or the data is no longer required for the authorised purpose.

A longer retention period may apply where required by law or justified by litigation, a complaint, an ongoing warranty or another legitimate reason.

Once data is no longer required, it will be deleted, anonymised or retained on a restricted basis where there is a lawful basis for doing so.

10. DATA SECURITY

Illumus adopts appropriate and proportionate technical and organisational measures to protect personal data against:

• accidental loss, destruction or damage;
• improper alteration;
• unauthorised access;
• improper disclosure;
• unlawful or unauthorised processing.

These measures may include, where appropriate:

• access controls and restrictions;
• the use of passwords and authentication mechanisms;
• regular updating of systems and software;
• backups;
• the use of secure website connections;
• confidentiality obligations;
• incident monitoring, prevention and management.

No information transmission or storage system is entirely free from risk. Illumus nevertheless seeks to implement measures appropriate to the nature of the data processed, the context of processing and the risks identified.

11. RIGHTS OF DATA SUBJECTS

Subject to the applicable legislation and the relevant conditions, the data subject may exercise the following rights:

• the right to obtain information about the processing of personal data;
• the right of access to personal data;
• the right to rectify inaccurate or incomplete data;
• the right to erasure, where applicable;
• the right to restriction of processing;
• the right to object to processing;
• the right to data portability, where applicable;
• the right to withdraw consent at any time;
• the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects the data subject, where applicable;
• the right to lodge a complaint with the competent supervisory authority.

The exercise of these rights may be subject to the conditions, limitations or exceptions established by applicable law.

12. EXERCISING DATA PROTECTION RIGHTS

Requests concerning the exercise of rights should be sent to:

geral@illumus.pt

The request should clearly state:

• the right the data subject wishes to exercise;
• the data or processing activity to which the request relates;
• sufficient information to identify the data subject and locate the relevant data.

Illumus may request additional information where there are reasonable doubts regarding the identity of the applicant or where it is required to locate and process the request correctly.

Information requested to verify identity will be limited to what is strictly necessary and used solely for that purpose.

Requests will be handled free of charge and, as a rule, within one month of receipt. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. The data subject will be informed of any such extension and the reasons for it.

Without prejudice to applicable law, where requests are manifestly unfounded or excessive, in particular because of their repetitive character, Illumus may take the measures permitted by law.

13. COMPLAINT TO A SUPERVISORY AUTHORITY

Without prejudice to any other administrative or judicial remedy, the data subject has the right to lodge a complaint with the competent supervisory authority, particularly in the Member State of habitual residence, place of work or place of the alleged infringement.

In Portugal, the supervisory authority is:

Comissão Nacional de Proteção de Dados — CNPD
Av. D. Carlos I, 134, 1.º
1200-651 Lisboa
Portugal
Website: www.cnpd.pt

14. COMMERCIAL COMMUNICATIONS

The website does not currently offer a newsletter subscription service.

Illumus may send commercial or marketing communications through other channels only where an appropriate legal basis exists and the applicable legal requirements have been met.

The data subject may withdraw consent or object to receiving commercial communications at any time, using the method indicated in the relevant communication or by contacting geral@illumus.pt.

15. EXTERNAL LINKS AND SERVICES

The website may include links to external platforms, social networks or services, including:

• WhatsApp;
• LinkedIn;
• Instagram;
• Facebook;
• the Electronic Complaints Book;
• websites operated by partners, suppliers or other entities.

When selecting an external link, the user leaves the Illumus website and becomes subject to the policies, terms and data-processing practices of the entity responsible for that service.

Illumus does not control or determine the processing carried out by those external platforms, without prejudice to any responsibilities that may be legally attributed to it in specific circumstances.

16. COOKIES AND SIMILAR TECHNOLOGIES

The website currently uses only cookies or similar technologies that are strictly necessary for its operation, security and the retention of the user’s language preference.

If analytics, non-essential functional, advertising or marketing cookies are introduced, they will be subject to the user’s prior consent whenever legally required.

The categories, purposes, providers and retention periods of the cookies actually used are identified in the Cookie Policy.

Whenever non-essential cookies are used, a mechanism will be made available allowing the user to accept, reject or manage preferences before those cookies are used, whenever legally required.

17. AUTOMATED DECISION-MAKING AND PROFILING

Illumus does not use this website to make decisions based solely on automated processing of personal data that produce legal effects or similarly significantly affect the user.

The website also does not use data submitted through contact forms to create automated profiles intended to evaluate personal aspects of the user.

18. CHILDREN’S DATA

The website is primarily intended for professionals, companies, architects, designers, specifiers, partners and individuals interested in Illumus products and services.

Illumus does not seek to collect personal data relating to children or minors intentionally through the website.

Where data relating to minors is identified as having been submitted without an appropriate legal basis or authorisation, reasonable steps will be taken to delete it.

19. CHANGES TO THIS PRIVACY POLICY

Illumus may update this Privacy Policy whenever necessary to reflect:

• legal or regulatory changes;
• technological changes;
• new services or features;
• changes to the website;
• changes to personal data processing activities;
• guidance issued by competent authorities.

The updated version will be published on this page, together with the date of the latest revision.