1. Informations générales

Last updated	13/04/2026
Commitment of Sudstroum	Respecting everyone’s privacy is the objective of Sudstroum S.àr.l & Co S.e.c.s. We are committed to protecting and processing your personal data in strict compliance with European Regulation 2016/6791.
Scope and target audience	This privacy statement applies to all PII you provide when contacting a Sudstroum representative or when using any of the applications developed by Sudstroum and accessible through the www.sudstroum.lu website.
Responsible for processing your data	Sudstroum S.àr.l & Co S.e.c.s. 11, rue de Luxembourg L-4220 Esch-sur-Alzette
DPO contact	In order to ensure compliance, Sudstroum S.àr.l & Co S.e.c.s has appointed a Data Protection Officer (DPO) who can be contacted at the following e-mail address for any questions regarding the security of your data: dpo@sudstroum.lu.
Modifications	Sudstroum may change this privacy statement by posting an updated version on our website.

2. Principles at Sudstroum

Sudstroum attributes great importance to the protection of personal data and the respect of privacy. This is confirmed by the implementation of a data protection policy specific to Sudstroum.

Sudstroum’s approach as a company is based on six principles:

1. we always use your PII in a fair, trustworthy and transparent way for specified, explicit and legitimate purposes;
2. Sudstroum is committed to taking all appropriate technical and organisational measures to protect the security of your personal data and in particular the confidentiality, integrity and availability of your personal data.
3. you have the right to be clearly informed about how we use your PII. Sudstroum will always be transparent to you about the data we collect and the way we use it;
4. If you have any concerns about our handling of your personal data, we invite you to contact us and we will try to answer your questions as soon as possible.
5. We will take all reasonable steps to protect your data from misuse and to keep it secure.
6. Sudstroum cooperates with the Commission Nationale pour la Protection des Données (hereinafter, the CNPD), having its registered office at L-4361 Esch-sur-Alzette, 1 avenue du Rock’n’roll.

3. Rules of conduct at Sudstroum

3.1. What is the mission of Sudstroum?

In the context of the execution of its tasks in the public interest, Sudstroum processes and uses your personal data in accordance with the legal provisions, namely:

• Loi du 3 février 2021 modifiant la loi modifiée du 1er août 2007 relative à l’organisation du marché de l’électricité ;
  • Loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et mise en œuvre du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/CE (règlement général sur la protection des données), portant modification du Code du travail et de la loi modifiée du 25 mars 2015 fixant le régime des traitements et les conditions et modalités d’avancement des fonctionnaires de l’État.
  • Loi du 30 mai 2005 sur les réseaux et les services de communications électroniques et Loi du 30 mai 2005 portant organisation de la gestion des ondes radioélectriques ;
  • Loi du 3 février 2021 modifiant la loi modifiée du 1er août 2007 relative à l’organisation du marché de l’électricité ;
  • Règlement grand-ducal du 7 août 2015 relatif au fonctionnement du mécanisme d’obligations en matière d’efficacité énergétique.
  • Loi du 28 mai 2019 portant transposition de la directive (UE) 2016/1148 du Parlement européen et du Conseil du 6 juillet 2016 concernant des mesures destinées à assurer un niveau élevé commun de sécurité des réseaux et des systèmes d’information dans l’Union européenne et modifiant 1° la loi modifiée du 20 avril 2009 portant création du Centre des technologies de l’information de l’État et 2° la loi du 23 juillet 2016 portant création d’un Haut-Commissariat à la Protection nationale.

3.2. What are the purposes of the treatments?

The collection and processing of your PII is limited to the following purposes:

• To intervene in emergencies to prevent or remedy breakdowns, continually improve the service, process interventions and draw up activity reports, to process service calls and produce activity reports.
• To ensure the supply of electricity in accordance with the contractual terms with the customer and continually improving customer service and expanding the customer base, to provide information on events and marketing initiatives.
• To justify invoicing and make information available to customers or energy advisers (appointed by customers), to forecast consumption (after anonymisation) to purchase energy in advance at the most favourable price and to size the network.
• To Issue invoices to customers and managing and limiting unpaid bills.
• To offer telecom business services operated by Eltona.
• To install and connect meters and maintain the electricity network.
• To keep customers informed, including via the customer portal, and collecting meter readings online.

The data may also be used for statistical, research and archiving purposes in accordance with applicable legislation.

3.3. Who is concerned by data processing?

This concerns all customers of Sudstroum S.àr.l & Co S.e.c.s as electricity consumers, meter tenants or users of telecommunications, internet and television services.

3.4. How is your PII collected?

Concerning the persons mentioned in point 3.3, data are collected from

1. information you give us directly;
   1. Information from state authorities such as the National Register of Persons, the National Health Insurance Fund, Occupational Health, etc;
   1. Information we collect through automated collection systems: system logs, badges, etc;
   1. Information collected on the Sudstroum website;
   1. Internet, partners under NDA, and other people based on consent (related to candidate assessment).

We do not use automated decision-making, including profiling, within the meaning of applicable data protection laws.

As part of our recruitment process, we may consult publicly available information about you on professional networking platforms (such as LinkedIn) to assess your application.

3.5. What PII does Sudstroum have at its disposal?

‘PII’ means information that identifies you or makes you identifiable. This may include in particular, but is not limited to:

• Sudstroum customers’ personal data (surname, first name, matricule, address, telephone number, marital status, e-mail address, etc.) description of how an intervention is carried out ;

• Sudstroum customers’ bank details are stored for billing purposes;
  • Electricity consumption data of Sudstroum’s customers;
  • Customer data from telecommunications, internet, and television;
  • Log data (each access to the customer area is logged with username, date and time) and (session) cookies to maintain sessions in the customer area (closed) and for investigation in case of fraudulent access.

3.6. What is the legal basis for the processing?

We process PII only when we have a valid legal basis to do so under applicable data protection laws.

Depending on the context, we rely on one or more of the following legal bases:

Performance of a contract

We process PII where it is necessary to perform a contract with you or to take steps at your request prior to entering into a contract.

This includes, for example, managing our relationship with you, providing our services, and handling billing and administration.

We process PII on behalf of our B2B customer according to the rules set up in a contract and under the strict supervision the customer acting as PII controller.

Legal obligation

We process PII where necessary to comply with legal or regulatory obligations to which we are subject. This includes, for example, accounting, tax, and reporting requirements.

Legitimate interests

We process PII where it is necessary for legitimate interests, provided that these interests are not overridden by your fundamental rights and freedoms. Our legitimate interests may include:

• managing and improving our services,
• ensuring the security of our systems and thus protecting our people if they have been attacked,
• internal administrative purposes,
• preventing fraud or misuse.

Consent

We sometimes process PII based on your consent, e.g. if the web site visitors accept cookies, or if we provide PII of consultants to a potential customer for evaluation of skill and trustworthiness.

You have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

3.7. How long is the data retained?

Your personal data is kept for the time necessary to achieve the above-mentioned purposes.

These periods may, however, be increased by the need to apply statutory limitation periods. The retention periods have been defined in the record of processing activities and can be consulted on the premises of SM.

Alternately a concise table from record of processing is Table 1: Retention time from record of processing activities. The customers’ data are retained during all the period of services with SM. For any question about the time retention of your PII, you can contact our DPO.

Depending on the purpose or provisions of the archiving laws, the retention period could be extended. Indeed, some images are kept and used for historical purposes.

In anonymised form, your personal data may be used for statistical purposes beyond the above-mentioned retention period.

Type of data	Retention time	Deletion time after request
Phone number, email, address for emergency service	15 years	Depends on request
Matricule             for             customer management	10 years after the end of the contract	Immediate deletion is feasible for online data, but deleting paper records is not economically justifiable.
Electric consumption per day	15 years	1 month
Invoicing information	10 years after the end of the contract	1 month
Recording of client service	cf. Eltrona	1 month
Information for technical service	5 years	1 month

Table 1: Retention time from record of processing activities for management of customer data

3.8. With whom is your PII shared?

We share data with your electricity supplier or electricity network operator if you have chosen a company other than Sudstroum.

We also share your data with the LENEDA project, operated by CREOS under the responsibility of the regulator ILR, as this is a legal requirement. For further information, please contact the ILR.

As a general rule, we do not share your personal data outside Sudstroum, unless required by law. However, we may use carefully selected and monitored data processors to assist with the processing of your data, all of whom are obliged to delete your data at our request. If you would like a list of these data processors, please contact our DPO (see section 3.10).

Anonymised versions of your data may also be shared with private or public emergency services (in the event of a breakdown).es à caractère personnel sont-elles transférées vers des pays tiers (hors UE et pays partenaires) ?

3.9. Are your PII transferred to third countries (outside the EU and partner countries)?

We do not transfer any of your personal data to servers outside the European Union and use subcontractors who agree to store your data within the European Union. If we change our policy, we will do so in accordance with data protection laws, and you will be informed.

3.10. How is your PII protected?

We aim to keep your personal data as secure as possible and only for as long as is necessary for the purposes for which it is processed. In this respect, we take appropriate physical, technical and organisational measures to prevent the modification or loss of your data as far as possible and appropriate.

When Sudstroum works with other companies, the selection of these companies is made only after a thorough selection process. During this selection process, each individual service provider is carefully assessed for its technical and organisational data protection competence.

Access to your personal data is restricted to prevent unauthorised access, modification or misuse and is only permitted to our agents who need the data for their work.

3.11. What are your rights and how do you exercise them?

The legal rules on the protection of PII, in particular the rights of the data subjects concerned by the processing operations carried out are applicable under the relevant conditions and subject to the exceptions and derogations provided for.

For questions relating to the processing of your data or in order to exercise your rights, you may contact the Data Protection Officer of Sudstroum,

• by sending an email to the following address: dpo@sudstroum.lu.
  • or by registered mail to:

Sudstroum S.àr.l & Co S.e.c.s. Data Protection Officer

11, rue de Luxembourg L-4220 Esch-sur-Alzette

while enclosing with your application a legible and valid copy of your identity document and, if applicable, that of the person for whom you are the legal representative.

If you have any questions, you can also contact the person who carried out the data processing directly.

You have the right to:

1. request a copy of the PII that Sudstroum holds about you;
2. ask Sudstroum to correct, update, or delete your PII from its files and soon as possible, and
3. to report to Sudstroum any misuse of your PII.

In the event of a request for deletion of your data, Sudstroum will check that there are no other purposes or rights of another data subject that would oblige it to keep them. In this case, the decision should be notified.

If you request a copy of your file, Sudstroum will analyse it in order to delete any information on other persons.

If you believe that your personal data have not been processed in accordance with the law, you have the right to contact the CNPD (www.cnpd.lu) or to lodge a complaint with them.