Privacy policy and GDPR at a premium IT MSP

DataRoad is a Portuguese MSP (Managed Service Provider). We operate networks, systems and managed cybersecurity for national and international organisations that do not tolerate failure. Protecting data is part of the service we sell, not a legal appendix.

• Data subject The natural person the information relates to.
• Personal data Anything that identifies, or makes it possible to identify, that person.
• Processing Any action on that data: collecting, storing, consulting, organising, sharing or erasing.
• Controller Whoever decides what the data is for and by what means it is processed.
• Processor Whoever processes data on behalf of, and on the instructions of, the controller.

Only when necessary and never for sale. DataRoad does not sell, rent or hand over personal data for commercial purposes. The possible recipients are:

• Our team Only those who need access to do their work (need-to-know), under a duty of confidentiality.
• Contracted providers Microsoft 365 and Google Workspace; the helpdesk, including the helpdesk.dataroad.pt portal; RMM (Remote Monitoring & Management) tools; monitoring and alerting, which is 24/7 only on the Premium 365 plan; backup and cloud storage; hosting; web analytics and marketing, such as Google Analytics; accounting, invoicing and legal support; telecommunications and post.
• Public bodies and courts If required by law or a court decision.
• Auditors and consultants Limited to the work they are asked to do.
• Insurers In claims or professional liability matters.

Each provider is selected for quality, security and GDPR compliance. All sign a written contract with confidentiality and data protection obligations, as Article 28 requires.

Once the period expires, we erase or anonymise the data securely and irreversibly. The exception is where the law requires us to keep it or it is needed to defend rights in court.

Managed cybersecurity is at the heart of what we offer. On our own systems we apply the standard we apply to client networks, to stop unauthorised access, loss, destruction or accidental disclosure.

Technical controls

• Encryption TLS 1.3 in transit, AES-256 at rest.
• MFA Multi-factor authentication mandatory on critical systems.
• Least privilege Nobody has more access than they need.
• Segmented network Protected by next-generation firewalls.
• Backups Redundant, with regular restore tests.
• SIEM/SOC Security event monitoring, continuous 24/7 only on the Premium 365 plan.
• Patching Methodical updating of systems and software.
• Vulnerabilities Managed and audited periodically.
• EDR and anti-malware Installed on every endpoint.

Organisational controls

• Written internal policy Reviewed regularly.
• Training Ongoing, in privacy and cybersecurity.
• NDAs Signed by employees and providers.
• Incident response plan With notification to the CNPD within 72 hours.
• DPIAs Impact assessments where warranted.
• Record of processing activities Kept up to date.
• Audits Internal and external, on a schedule.

• Access To know whether we process your data and obtain a copy.
• Rectification To correct whatever is wrong or out of date.
• Erasure The so-called right to be forgotten, in the cases the GDPR provides for.
• Restriction To freeze processing for a time.
• Objection To refuse processing, particularly for marketing.
• Portability To receive the data in a structured, machine-readable format, or have it sent to another organisation.
• Withdrawing consent At any time; what has already been done remains valid.
• Not being subject to solely automated decisions Including profiling, save for legal exceptions.
• Complaint To the supervisory authority.

Simply write to DPO@DATAROAD.PT or send a letter for the attention of the Data Protection Officer at the head office address. We may ask for proof of identity, so as not to release data to anyone other than the data subject.

Response time: 30 days. For complex or numerous requests it may be extended by a further two months, and we will inform the data subject of this.

• Cookies Governed by the Cookie Policy, which forms part of this document.
• Minors The website and services are intended for people aged 18 or over. We do not knowingly collect data from minors; if this happens without parental authorisation, we erase it immediately.
• DPO Appointed to oversee compliance and liaise with data subjects and the CNPD, at DPO@DATAROAD.PT or by letter to the head office.
• Revisions We update the policy when the law, case law, regulation or best practice changes. The current version is kept on the website with its date. Significant changes are communicated by email or a prominent notice.

The GDPR is not complied with through a PDF. It is complied with through controlled access, encrypted backups and logs that stand up to an audit. That is exactly what DataRoad implements in the infrastructures it manages. Request a no-commitment proposal to protect your company's data.

More than 10 workstations · support contract · remote, on-site and telephone support. Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.