Fair Processing Notices – TMRW – Building the Internet of Life

Fair Processing Notice

Thank you for visiting TMRW and reviewing our Fair Privacy Notices. The Fair Processing Notices provide comprehensive information on how we handle personal data in relation to our clients/users, external staff/consultants/suppliers, and employees. They outline our practices and procedures regarding the collection, use, and protection of personal data, ensuring transparency and compliance with applicable data protection regulations.

A. CLIENTS/USERS

TMRW Reality S.à.r.l., 14-16, Avenue Pasteur, L-2310, Luxembourg, (“TMRW”) collects and processes personal data on you if you (or your company, which you represent or for which you act as a contact person or user) are an actual, former or prospective client of TMRW, or a user of TMRW products and services.

TMRW acts as the controller of such processing and is committed to respecting your privacy and protecting your personal data in accordance with the law, in particular the EU General Data Protection Regulation 2016/679 (GDPR).

PROCESSING PURPOSES. The processing of your data is based on the following grounds:

PURPOSE OF PROCESSING	GDPR LEGAL BASIS
TMRW processes your data:	The processing is necessary:
– to manage your or your company’s subscription to our products and services and the onboarding process	– in order to take steps prior to entering into a contract with you or your company – for purposes of legitimate interests pursued by TMRW (that is, client/prospect management)
– to manage the delivery of products and services you or your company have ordered or use, to manage your use of such products and services, including payments and other transactions you make through our products and services, as well as for billing, accounting and administrative management purposes	– for the performance of a contract with you or your company – to comply with legal obligations to which TMRW is subject – for purposes of legitimate interests pursued by TMRW (that is, product/service delivery and improvement, client and user transactions and management)
– for marketing (including client relationship management, subscription to newsletter, alerts and marketing materials, social media, communities and event management), business intelligence and product/services improvement purposes	– for purposes of legitimate interests pursued by TMRW (that is, marketing, business intelligence and product/services improvement)
– to manage and analyze your interactions with our website and products (see cookie policy)	– for purposes of legitimate interests pursued by TMRW (that is, business intelligence, product and website management and improvement)

In exceptional cases, TMRW may need your consent for certain processing operations (which is not the case for the processing purposes detailed above). In such case, TMRW will ask for your consent separately.

DATA CATEGORIES. In addition to the information you have communicated to TMRW directly or through your company, TMRW may collect and process the following categories of personal data:

identity/details (contact person, company, phone, email, address, social media details, personal interests),
account details (subscription details, subscribed options/products/services), credentials (login, password, security data, OTP), account profile (license/account type, profile picture and details, contact list),
products/services data (information provided through online form, products/services ordered/used, communications contents, whiteboard contents, pictures/text/files shared by users, chat, audio/videos recordings, clickstream data),
technical data (user account details, email, browser/devices/applications used, issue description by user, technical measures/recommendations, user follow up, technical support query status),
user interactions with products/services, use of product, server logfiles, identifiers (user name, IP address, email address, connection logfiles, cookies),
newsletter subscription form/details, social media user subscriptions
and if you take part in events organized by TMRW: invitees lists, significant other, event management data (no shows, venue, catering/food allergies where specified by you), photos/videos. Where you provide personal data on third-parties (whether your employees, users or relatives) to TMRW you should make sure you have informed them accordingly.

DATA RECIPIENTS. TMRW may share your data with affiliated or third-party service providers as necessary to deliver the products/services to you and other purposes listed above, as well as to competent local authorities (tax authorities, regulators, law enforcement agencies), external auditors, payment providers, banks and, where applicable (events) communication agencies and event management providers (venue, catering, security).

DATA TRANSFERS OUTSIDE THE EU/EEA. TMRW may transfer your personal data outside of the EU/EEA, including to countries which do not have a similar level of protection of personal data as the EU. In such case, and in accordance with GDPR, data transfers will: be limited to what is necessary to perform the contract with you, or conclude a contract with a third-party in your interest, or be justified by the establishment, exercise or defense of legal claims, or if appropriate, be covered by appropriate safeguards, such as certification mechanisms (including US processors certified under the Trans-Atlantic Data Privacy Framework), entering into EC approved standard contractual clauses, or in exceptional cases, take place with your consent. In such case, TMRW will ask for your consent separately.

DATA RETENTION. TMRW will retain your personal data for as long as required to deliver the products/services you or your company have ordered or use, and/or for the mandatory retention duration set forth by applicable law (up to 10 years after the termination of our relation for certain accounting and contractual data).

YOUR STATUTORY RIGHTS. You have certain rights concerning your personal data under GDPR as mentioned below, and can exercise them by contacting TMRW at dataprotection@tmrw.com.

Right to information. If you are a client-related third party (e.g., an employee of a corporate client), TMRW may not have your current details and thus cannot contact you conveniently and in confidentiality. You can find updated information on TMRW’s processing of your data at any time on this website, or by contacting TMRW at dataprotection@tmrw.com.
Access right. You have the right to access your personal data. TMRW processes a large quantity of information, and can thus request, in accordance with GDPR, that before the information is delivered, you specify the information or processing activities to which your request relates.
Right to rectification. You can ask TMRW to rectify, correct or update inaccurate and/or incorrect data.
Revocation of your consent to the processing of data. Where TMRW asked for your consent to a specific processing, you have the right to withdraw such consent at any time (for future processing).
Other rights. In certain limited cases (in which case TMRW will first analyze whether the conditions for the exercise of such rights are fulfilled, in line with GDPR), you may object to, or request the limitation of, the processing of your personal data, or request the erasure or portability of your personal data.
Right to complain to the competent supervisory authority. Finally, you can contact the Luxembourg data protection authority, the Commission nationale pour la protection des données (CNPD), which serves as our lead authority, to lodge a complaint. Additionally, in accordance with the law, you may have the right to lodge a complaint with a supervisory authority, particularly in the EU member state where you reside, work, or where the alleged infringement took place, if you believe that the processing of your personal data violates the provisions of the GDPR.

You should note that the law authorizes TMRW to retain and continue processing certain personal data, even where you have exercised your rights to object or erasure or -if applicable- withdrawn your consent: this is the case in particular where TMRW has legitimate and compelling reasons for continuing the processing, such as compliance with applicable law.

CONTACT. You can contact TMRW’s Data Protection team here:

TMRW Reality S.à.r.l.

14-16, Avenue Pasteur

L-2310, Grand Duchy of Luxembourg

Email: dataprotection@tmrw.com

B. EXTERNAL STAFF/CONSULTANTS/SUPPLIERS

TMRW Reality S.à.r.l., 14-16, Avenue Pasteur, L-2310, Luxembourg (“TMRW”) collects and processes personal data on you if you (or your company) are an actual, former or prospective supplier of TMRW.

If you are detached to TMRW, please also refer to the Privacy Notice concerning TMRW’s employees as some of processing operations detailed therein might also apply to your personal data.

PROCESSING PURPOSES. The processing of your data is based on the following grounds:

PURPOSE OF PROCESSING	GDPR LEGAL BASIS
TMRW processes your data:	The processing is necessary:
– to manage the contractual relation with you or your company, the services you deliver, as well as for billing, payment and accounting purposes	– in order to take steps prior to entering into a contract with you or your company, or to perform such contract – for purposes of legitimate interests pursued by TMRW (that is, supplier management) – to comply with legal obligations to which TMRW is subject
– for supplier onboarding purposes, including granting you access to TMRW’s IT systems as applicable	– in order to perform a contract with you or your company – for purposes of legitimate interests pursued by TMRW (that is, supplier management, IT systems and security management)
– for communication and marketing purposes	– for purposes of legitimate interests pursued by TMRW (that is, communications and marketing)

DATA CATEGORIES. In addition to the information you have communicated to TMRW directly or through your company, TMRW may collect and process the following categories of personal data: identity/details (name, contact details), work done, tariffs/expenses, time spent, bank details, invoice payment status, pictures, photos, videos, articles, contributions, and if you take part in events organized by TMRW: invitees lists, significant other, event management data (no shows, venue, catering/food allergies where specified by you), photos/videos. Where you provide personal data on third-parties (whether your employees, users or relatives) to TMRW you should make sure you have informed them accordingly.

DATA RECIPIENTS. TMRW may share your data with affiliated or third-party service providers as necessary to receive and use the products/services you deliver and other purposes listed above, as well as to your company, competent local authorities (tax authorities, regulators, law enforcement agencies), external auditors, payment providers, banks and, where applicable (events) communication agencies and event management providers (venue, catering, security).

DATA TRANSFERS OUTSIDE THE EU/EEA. TMRW may transfer your personal data outside the EU/EEA, including to countries which do not have a similar level of protection of personal data as the EU. In such case, and in accordance with GDPR, data transfers will: be limited to what is necessary to perform the contract with you, or conclude a contract with a third-party in your interest, or be justified by the establishment, exercise or defense of legal claims, or if appropriate, be covered by appropriate safeguards, such as certification mechanisms (including US processors certified under the Trans-Atlantic Data Privacy Framework), entering into EC approved standard contractual clauses, or in exceptional cases, take place with your consent. In such case, TMRW will ask for your consent separately.

such as entering into EC approved standard contractual clauses, or in exceptional cases, take place with your consent. In such case, TMRW will ask for your consent separately.

DATA RETENTION. TMRW will retain your personal data for as long as required to manage the products/services you or your company provide to TMRW and related payments, and/or for the mandatory retention duration set forth by applicable law (up to 10 years after the termination of our relation for certain accounting and contractual data).

YOUR STATUTORY RIGHTS. You have certain rights concerning your personal data under GDPR as mentioned below, and can exercise them by contacting TMRW at dataprotection@tmrw.com.

Right to information. If you are a client-related third party (e.g., an employee of a corporate client), TMRW may not have your current details and thus cannot contact you conveniently and in confidentiality. You can find updated information on TMRW’s processing of your data at any time on this website, or by contacting TMRW at dataprotection@tmrw.com.
Access right. You have the right to access your personal data. TMRW processes a large quantity of information, and can thus request, in accordance with GDPR, that before the information is delivered, you specify the information or processing activities to which your request relates.
Right to rectification. You can ask TMRW to rectify, correct or update inaccurate and/or incorrect data.
Revocation of your consent to the processing of data. Where TMRW asked for your consent to a specific processing, you have the right to withdraw such consent at any time (for future processing).
Other rights. In certain limited cases (in which case TMRW will first analyze whether the conditions for the exercise of such rights are fulfilled, in line with GDPR), you may object to, or request the limitation of, the processing of your personal data, or request the erasure or portability of your personal data.
Right to complain to the competent supervisory authority. Finally, you can contact the Luxembourg data protection authority, the Commission nationale pour la protection des données (CNPD), which serves as our lead authority, to lodge a complaint. Additionally, in accordance with the law, you may have the right to lodge a complaint with a supervisory authority, particularly in the EU member state where you reside, work, or where the alleged infringement took place, if you believe that the processing of your personal data violates the provisions of the GDPR.

CONTACT. You can contact TMRW’s Data Protection team here:

TMRW Reality S.à.r.l.

14-16, Avenue Pasteur

L-2310, Grand Duchy of Luxembourg

Email: dataprotection@tmrw.com

C. JOB APPLICANTS, EMPLOYEES, EXTERNAL STAFF/CONSULTANTS

TMRW Reality S.à.r.l., 14-16, Avenue Pasteur, L-2310, Luxembourg, (“TMRW”)collects and processes personal data on you when you apply for a job with TMRW, or if you are an actual, former or prospective employee or external staff of TMRW.

If you are detached to TMRW as a consultant or external staff, please also refer to the Privacy Notice concerning TMRW’s suppliers as some of processing operations detailed therein might also apply to your personal data.

PROCESSING PURPOSES. The processing of your data is based on the following grounds:

PURPOSE OF PROCESSING	GDPR LEGAL BASIS
TMRW processes your data:	The processing is necessary:
1. FOR JOB APPLICANTS:
– to review job applications and manage recruitments	– in order to take steps prior to entering into a contract with you – for purposes of legitimate interests pursued by TMRW (that is, HR management)
2. FOR EMPLOYEES, INTERNS, EXTERNAL STAFF/CONSULTANTS:
– as required by law (labor, tax, social, corporate, sanitary -e.g., COVID-19 mandatory checks- or other) and make legally required filings or reporting to authorities	– to comply with legal obligations to which TMRW is subject
– to manage staff onboarding, payroll management, process payments and expenses, benefits management	– for the performance of a contract with you or your company – to comply with legal obligations to which TMRW is subject
– for usual human resources management purposes (including employment, service or consultancy contract management and performance, appraisals performance reviews, training, background checks, discipline, investigations, security, emergency contacts, contingency plans, career development, absence/sickness leave, working time, project management, budgeting and financial forecasting and record-keeping purposes), to ensure the security of TMRW’s assets, the continuity of activities and, in general, administer TMRW’s business	– for purposes of legitimate interests pursued by TMRW (that is, HR, asset security, activities and business management) – to comply with legal obligations to which TMRW is subject
– for timekeeping, billing and invoicing	– for purposes of legitimate interests pursued by TMRW (that is, financial management) – to comply with legal obligations to which TMRW is subject
– for physical security (badge issuance and management, access restrictions)	– for purposes of legitimate interests pursued by TMRW (that is, premises, asset and information protection)
– for IT management (IT licenses and accounts management, contacts/agenda management, collaborative tools, visio, chatrooms, file storage), electronic communications management (corporate email, mobile phones, telephony and connectivity) and related monitoring and investigations	– for purposes of legitimate interests pursued by TMRW (that is, IT and asset management and protection)
– for internal communications and marketing purposes	– for purposes of legitimate interests pursued by TMRW (that is, internal communications and marketing)

DATA CATEGORIES. In addition to the information you have communicated to TMRW directly (or, for external staff/consultants, through your company), TMRW may collect and process the following categories of personal data:

for job applicants: identity (first/last name), contact details (address, phone, email, professional social media profiles), professional details (CV, experience, training, references, licenses, certifications, portfolios), tests, appraisals, role play video recordings, background checks (former employers, schools/universities), sanctions list research, interview notes, assessment, final decision, residence certificate, work permit, email correspondence with you, non-disclosure agreements, disclosures re. conflicts of interest, salary/benefits and professional expectations;
for employees and (where applicable) external staff/consultants: identity (first/last name, social security number/affiliation details, ID/passport, address, phone, email), personal details (next of kin, emergency contacts, date of birth, nationality, civil status, household composition, personal interests), professional details (licenses, certifications), position (service, job description, position/professional profile, seniority, reporting lines, business cards, hiring/termination date), internal employee number, salary, benefits (additional health insurance), financial data and bank details (IBAN), criminal record, residence certificate, visas, work permit, medical certificates, sickness/absence periods, occupational accidents files/reports, workplace/job description adaptation (workplace and equipment preferences), including for disabled employees or employees with particular conditions, food allergies /preferences (internal events organisation), personal leave, parking allocation as applicable, payroll management (tax details, withholdings, tax card, deductions), presence/absence/working time management, time/job allocation, overtime work), attestations (work certificates), professional travel/venue arrangements, expenses (vouchers), employment contract details, disciplinary file, photo, appraisal interview notes and feedback, training followed (contents, certificates, presence, test results), training requests, training or HR-related interviews, feedback on employees, promotions/change, IT account details (internal number, name, account login, passwords, email, phone, address, function, office, department, reporting line/subordinates, professional groups, user profile/access rights, IT user profile, access rights, corporate equipment/allocation, Outlook profile, emails, contacts, tasks, calendar, documents, Teams profile/logs/chats/visio data, access/logfiles, user interactions, IT traces, date/hour of connection, interactions with applications, IP addresses, license management data, software applications or paying/license-based web applications, license rights, account credentials, use logs and related monitoring and investigations results) and project management data (task allocation/completion/priority, assignor/assignee, work log).

Where you provide personal data on third-parties (including your relatives) to TMRW you should make sure you have informed them accordingly.

DATA RECIPIENTS. TMRW may share your data with affiliated or third-party service providers as necessary to achieve the above listed purposes, as well as to your company (for external staff/consultants), competent local authorities (tax authorities, regulators, law enforcement agencies), external auditors, payment providers, banks and, where applicable (events) communication agencies and event management providers (venue, catering, security).

DATA RETENTION.

For job applicants: TMRW will retain your personal data as long as necessary for the hiring process and, if your application is not retained, for up to 2 years as we might have other positions matching your profile, unless you object to such retention by email to your usual HR contact at TMRW or to dataprotection@tmrw.com.
For employees and external staff/consultants: TMRW will retain your personal data for as long as required to manage the employment relation or the business relation with you or your company, and/or for the mandatory retention duration set forth by applicable law (up to 10 years after the termination of our relation for certain accounting and contractual data).

YOUR STATUTORY RIGHTS. You have certain rights concerning your personal data under GDPR as mentioned below, and can exercise them by contacting TMRW at dataprotection@tmrw.com.

Right to information. If you are a client-related third party (e.g., an employee of a corporate client), TMRW may not have your current details and thus cannot contact you conveniently and in confidentiality. You can find updated information on TMRW’s processing of your data at any time on this website, or by contacting TMRW at dataprotection@tmrw.com.
Access right. You have the right to access your personal data. TMRW processes a large quantity of information, and can thus request, in accordance with GDPR, that before the information is delivered, you specify the information or processing activities to which your request relates.
Right to rectification. You can ask TMRW to rectify, correct or update inaccurate and/or incorrect data.
Revocation of your consent to the processing of data. Where TMRW asked for your consent to a specific processing, you have the right to withdraw such consent at any time (for future processing).
Other rights. In certain limited cases (in which case TMRW will first analyze whether the conditions for the exercise of such rights are fulfilled, in line with GDPR), you may object to, or request the limitation of, the processing of your personal data, or request the erasure or portability of your personal data.
Right to complain to the competent supervisory authority. Finally, you can contact the Luxembourg data protection authority, the Commission nationale pour la protection des données (CNPD), which serves as our lead authority, to lodge a complaint. Additionally, in accordance with the law, you may have the right to lodge a complaint with a supervisory authority, particularly in the EU member state where you reside, work, or where the alleged infringement took place, if you believe that the processing of your personal data violates the provisions of the GDPR.

CONTACT. You can contact TMRW’s Data Protection team here:

TMRW Reality S.à.r.l.

14-16, Avenue Pasteur

L-2310, Grand Duchy of Luxembourg

Email: dataprotection@tmrw.com