---
title: "Privacy policy and GDPR at a premium IT MSP | DataRoad IT"
description: "Privacy policy and GDPR at DataRoad, a premium MSP: data processed, legal bases, retention, security and your rights. Request a no-commitment proposal."
language: en
url: https://www.dataroad-it.com/en/privacy-policy-gdpr-dataroad/
source: https://www.dataroad-it.com/en/privacy-policy-gdpr-dataroad/
publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal
---

> Privacy policy and GDPR at DataRoad, a premium MSP: data processed, legal bases, retention, security and your rights. Request a no-commitment proposal.

# Privacy policy and GDPR at a premium IT MSP

At a glance For decision-makers short on time.

- 01 DataRoad processes personal data under the GDPR and Law 58/2019; revision in force since May 2026.
- 02 We never sell, rent or hand over personal data for commercial purposes.
- 03 Access, correction or erasure requests: DPO@DATAROAD.PT, answered within 30 days.
- 04 A breach that puts data subjects at risk is notified to the CNPD within 72 hours.

A personal data leak costs fines, contracts and reputation. The **privacy and GDPR policy** of DataRoad - IT Services and Consulting exists so that this never happens to those who entrust us with information. It tells you, plainly, what data we collect, why, for how long, who it flows to and how you control it. *Revision in force: May 2026.*

It covers the website, commercial enquiries, clients, suppliers, candidates and the managed IT services we operate. The framework is the GDPR (EU Regulation 2016/679) and Law 58/2019, which implements it in Portugal.

## Who is the controller and how do I contact them?

DataRoad is a Portuguese MSP (Managed Service Provider). We operate networks, systems and managed cybersecurity for national and international organisations that do not tolerate failure. Protecting data is part of the service we sell, not a legal appendix.

| Item | Information |
| --- | --- |
| Company name | DATAROAD IT SERVICES AND CONSULTING LDA, trading as DataRoad |
| Tax ID (NIPC) and registration | 513368078, Lisbon Commercial Registry |
| Address | Av. dos Moinhos, 12 B, Quinta Grande, 2610-119 Alfragide, Portugal |
| Main line | +351 211 459 950 |
| Sales | sales@dataroad.pt |
| DPO (data protection) | DPO@DATAROAD.PT |

### In what capacity do we act?

**Controller** whenever we are the ones collecting the data: website, forms, sales process and human resources.

**Processor** when we manage a client's networks, monitoring or infrastructure and therefore handle data that belongs to them. In that case we follow their written instructions, under a data processing agreement (DPA) and Article 28 of the GDPR.

## What terms do we use?

- **Data subject** The natural person the information relates to.
- **Personal data** Anything that identifies, or makes it possible to identify, that person.
- **Processing** Any action on that data: collecting, storing, consulting, organising, sharing or erasing.
- **Controller** Whoever decides what the data is for and by what means it is processed.
- **Processor** Whoever processes data on behalf of, and on the instructions of, the controller.

### Which core rules do we follow?

Article 5 of the GDPR sets seven principles. In practice, they translate as follows:

- **Transparency**: we explain what we do, lawfully and fairly.
- **Purpose**: each item of data serves a specific, explicit and legitimate purpose.
- **Minimisation**: we ask only for what is essential.
- **Accuracy**: we correct whatever is wrong or out of date.
- **Storage limitation**: nothing is kept beyond the justified period.
- **Security**: integrity and confidentiality ensured by technical and organisational controls.
- **Accountability**: we can demonstrate, with documents, that we comply with all of this.

## What data do we collect, depending on the relationship?

| Relationship | Data |
| --- | --- |
| Website visitor | IP, browser, operating system, language, screen resolution, pages viewed, visit duration, originating page (*referrer*) and cookies, described in the Cookie Policy |
| Information or proposal request | Name, company, job title, email, telephone, the message sent and anything the person chooses to add |
| Client | Identification of the company and its legal representatives; commercial and technical contacts; tax ID, registered address and commercial terms; proposals, contracts, invoices, communications, tickets, interventions and reports; technical data on systems and users |
| Supplier or partner | Contacts for the company and its representatives, billing, transactions and correspondence |
| Candidate | CV, cover letter, experience, education, references and any other data they choose to send |

### What about users of the networks we manage?

When we operate a client's infrastructure, we may access data on that organisation's employees or users:

- **Accounts**: user name, *username* and company email.
- **Technical credentials**: tokens and certificates. Plain-text passwords, never.
- **Logs**: records from devices, applications and the network.
- **Managed devices**: configurations of personal and business devices.
- **Telemetry**: IP addresses, technical location and monitoring metrics.

In these cases we act **solely as processor**: we process this data on the client's behalf, with documented instructions and a signed DPA (Article 28).

## What is the data used for, and on what legal basis?

| Legal basis (Article 6(1) GDPR) | Purpose | Data |
| --- | --- | --- |
| Consent, point (a) | Website statistics and optimisation; newsletter and marketing | Cookies, browsing, name and email |
| Pre-contractual steps, point (b) | Answering enquiries and preparing proposals; selecting candidates | Contacts and application data |
| Performance of the contract, point (b) | Managing clients, suppliers and partners | Client data, contacts and correspondence |
| Performance of the contract + DPA (Article 28) | Operating managed IT services | Technical and end-user data |
| Legal obligation, point (c) | Invoicing, tax and other legal requirements | Billing data and whatever the law requires |
| Legitimate interest, point (f) | Information security, fraud prevention and defence before the courts or authorities | Logs, technical data and only what is strictly necessary |

### Where do we obtain the data?

Almost always from the data subject: through the website, a sales contact or over the course of the contract. There are three other possible sources:

- **Public information**: company registers, official websites and professional profiles such as LinkedIn, for B2B prospecting.
- **Our clients**: who give us user data so that we can provide the service.
- **Manufacturers and technology partners**: in the context of certifications, partnerships and distribution.

## Does the data leave DataRoad?

Only when necessary and never for sale. DataRoad **does not sell, rent or hand over** personal data for commercial purposes. The possible recipients are:

- **Our team** Only those who need access to do their work (*need-to-know*), under a duty of confidentiality.
- **Contracted providers** Microsoft 365 and Google Workspace; the helpdesk, including the helpdesk.dataroad.pt portal; RMM (Remote Monitoring & Management) tools; monitoring and alerting, which is 24/7 only on the Premium 365 plan; backup and cloud storage; hosting; web analytics and marketing, such as Google Analytics; accounting, invoicing and legal support; telecommunications and post.
- **Public bodies and courts** If required by law or a court decision.
- **Auditors and consultants** Limited to the work they are asked to do.
- **Insurers** In claims or professional liability matters.

Each provider is selected for quality, security and GDPR compliance. All sign a written contract with confidentiality and data protection obligations, as Article 28 requires.

### Are there transfers outside Europe?

We always prefer servers within the European Economic Area (EEA). Some services from global providers, such as Microsoft or Google, may take data outside the EEA, particularly to the United States.

In those cases we use the safeguards in Article 46 of the GDPR:

- **Adequacy recognised by Brussels**: for example, the EU-US Data Privacy Framework.
- **Standard Contractual Clauses (SCCs)**: on the European Commission model.
- **Binding Corporate Rules (BCRs)**: where the provider has them.

On request, the DPO will detail the transfers that apply to you.

Chosen by respected and international companies

★★★★★ 5,0 · 52 Google reviews

★★★★★ 5,0 · 52 Google reviews

## How long is the data kept?

| Period | Data |
| --- | --- |
| 12 months | Contacts that did not proceed; access and security logs (or longer, if the law requires); unsuccessful applications, with consent and unless otherwise requested |
| Up to 26 months | Website logs and analytics, per the Google Analytics 4 default |
| 5 years | Proposals (from issue); tickets and technical reports (from closure); emails |
| 10 years | Contracts and invoicing, as required by tax law (Article 123 of the CIRC) |
| For the duration of the contract | Active clients |
| Until consent is withdrawn | Newsletter and marketing |

Once the period expires, we erase or anonymise the data securely and irreversibly. The exception is where the law requires us to keep it or it is needed to defend rights in court.

## How do we protect the information?

Managed cybersecurity is at the heart of what we offer. On our own systems we apply the standard we apply to client networks, to stop unauthorised access, loss, destruction or accidental disclosure.

### Technical controls

- **Encryption** TLS 1.3 in transit, AES-256 at rest.
- **MFA** Multi-factor authentication mandatory on critical systems.
- **Least privilege** Nobody has more access than they need.
- **Segmented network** Protected by next-generation firewalls.
- **Backups** Redundant, with regular restore tests.
- **SIEM/SOC** Security event monitoring, continuous 24/7 only on the Premium 365 plan.
- **Patching** Methodical updating of systems and software.
- **Vulnerabilities** Managed and audited periodically.
- **EDR and anti-malware** Installed on every endpoint.

### Organisational controls

- **Written internal policy** Reviewed regularly.
- **Training** Ongoing, in privacy and cybersecurity.
- **NDAs** Signed by employees and providers.
- **Incident response plan** With notification to the CNPD within 72 hours.
- **DPIAs** Impact assessments where warranted.
- **Record of processing activities** Kept up to date.
- **Audits** Internal and external, on a schedule.

### What if there is a breach?

We notify the CNPD within 72 hours of becoming aware, where there is a risk to people's rights and freedoms (Article 33). Where the risk is high, we also inform the affected data subjects without undue delay (Article 34).

### Do we use automated decisions or profiling?

No. No decision with legal effect or significant impact depends solely on automated processing, including profiling. Monitoring, firewalls and intrusion detection work on technical parameters, not on people.

## What rights do you have and how do you exercise them?

- **Access** To know whether we process your data and obtain a copy.
- **Rectification** To correct whatever is wrong or out of date.
- **Erasure** The so-called right to be forgotten, in the cases the GDPR provides for.
- **Restriction** To freeze processing for a time.
- **Objection** To refuse processing, particularly for marketing.
- **Portability** To receive the data in a structured, machine-readable format, or have it sent to another organisation.
- **Withdrawing consent** At any time; what has already been done remains valid.
- **Not being subject to solely automated decisions** Including profiling, save for legal exceptions.
- **Complaint** To the supervisory authority.

Simply write to DPO@DATAROAD.PT or send a letter for the attention of the Data Protection Officer at the head office address. We may ask for proof of identity, so as not to release data to anyone other than the data subject.

Response time: **30 days**. For complex or numerous requests it may be extended by a further two months, and we will inform the data subject of this.

### Where can I complain?

Without prejudice to other administrative or judicial remedies, the competent authority is the CNPD, Comissão Nacional de Proteção de Dados (the Portuguese data protection authority):

- **Online**: [www.cnpd.pt](https://www.cnpd.pt) · geral@cnpd.pt
- **Address**: Avenida D. Carlos I, 134, 1.º, 1200-651 Lisboa
- **Telephone**: +351 213 928 400

## What else do you need to know?

- **Cookies** Governed by the Cookie Policy, which forms part of this document.
- **Minors** The website and services are intended for people aged 18 or over. We do not knowingly collect data from minors; if this happens without parental authorisation, we erase it immediately.
- **DPO** Appointed to oversee compliance and liaise with data subjects and the CNPD, at DPO@DATAROAD.PT or by letter to the head office.
- **Revisions** We update the policy when the law, case law, regulation or best practice changes. The current version is kept on the website with its date. Significant changes are communicated by email or a prominent notice.

### Which legislation applies?

- **GDPR**: Regulation (EU) 2016/679, adopted on 27 April 2016 by the European Parliament and the Council.
- **Law 58/2019** (8 August), implementation of the GDPR in Portugal.
- **Law 41/2004** (18 August), privacy in electronic communications.
- **Decree-Law 7/2004** (7 January), electronic commerce.
- **Law 46/2018** (13 August), cybersecurity legal framework.
- **Law 48/2024** (21 November), transposes the NIS2 Directive.
- **Guidance**: CNPD and the European Data Protection Board (EDPB).

## Want this rigour applied to your company's network?

The GDPR is not complied with through a PDF. It is complied with through controlled access, encrypted backups and logs that stand up to an audit. That is exactly what DataRoad implements in the infrastructures it manages. [Request a no-commitment proposal to protect your company's data](https://www.dataroad-it.com/en/contact-dataroad-managed-it-proposal/?assunto=RGPD%20e%20dados).

**More than 10 workstations · support contract · remote, on-site and telephone support.** Call +351 211 459 950 * or write to sales@dataroad.pt.

**Call to a Portuguese landline.*

News

## Projects delivered and news from DataRoad.

[See all news →](https://www.dataroad-it.com/en/news/)

[NewsFrance Affiches: three sites, no single point of failureA French group founded in 1984 hands a Portuguese MSP the infrastructure of Antony, Wissous and Vialonga: high-availability firewalls, fibre…25 October 2026 · 4 min read](https://www.dataroad-it.com/en/france-affiches-it-three-sites-paris-lisbon/)[NewsSSAP: a managed business wireless network with 14 access pointsA sixth project for the same public body since 2019: when a tender goes to the same company again, it is the previous network doing the talk…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/ssap-managed-wireless-network-14-access-points/)[NewsManaged cybersecurity: one architecture, no incidents in 11 yearsThe same security architecture for every client, operated rather than merely installed. In 11 years, DataRoad has never suffered a security …12 October 2026 · 8 min read](https://www.dataroad-it.com/en/managed-cybersecurity-single-architecture/)[NewsManaged Ubiquiti UniFi: more than 138 sites and 1321 devicesA network made of different brands and installers fails at the joins. DataRoad has managed more than 138 Ubiquiti UniFi sites on the same te…10 October 2026 · 3 min read](https://www.dataroad-it.com/en/managed-ubiquiti-unifi-networks/)[NewsFrance Affiches: an on-site IT audit in ParisA premium Portuguese MSP at a French group's headquarters: the audit of France Affiches' network and systems was done on site in Paris and d…10 October 2026 · 4 min read](https://www.dataroad-it.com/en/france-affiches-it-audit-paris/)[NewsManaged remote support for companies without a fixed officePaying for a provider's offices speeds nothing up. Immediate remote support, an in-house datacentre and on-site work only when the network c…8 October 2026 · 5 min read](https://www.dataroad-it.com/en/managed-it-remote-companies-europe-usa/)[News24 public IT contracts: the standard of RTP, Técnico and SSAPA public tender gives no second chances. Since 2017, eight public bodies, from RTP to SSAP, have awarded DataRoad 24 IT contracts, all verif…3 October 2026 · 5 min read](https://www.dataroad-it.com/en/public-contracts-it-partner-rtp-tecnico-ssap/)[NewsEmbassies and international groups: why they choose DataRoadEmbassy of Korea, Consulate of Brazil, DCIAP, Reltio by SAP, beQom, Mitrelli Group: organisations that demand written guarantees chose DataR…12 September 2026 · 4 min read](https://www.dataroad-it.com/en/embassies-international-groups-msp-portugal/)[NewsDataRoad in five languages: managed IT for overseas head officesWhoever chooses the IT partner for a subsidiary in Portugal is often in Geneva or New York. DataRoad's website now speaks the language of th…12 September 2026 · 4 min read](https://www.dataroad-it.com/en/managed-it-services-five-languages/)

Numbers you can verify

**11** years in business

**232** clients

**< 10 min** average response time

**15+** IT vendor certifications

**10+** Countries with clients supported

**5.0 ★** 52 Google reviews

Transparency

## What many providers hide, we publish.

[See plans and prices →](https://www.dataroad-it.com/it-unlimited/)

- **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200.
- **No lock-in** Annual contract, no lock-in and no joining fees.
- **Everything in writing** What is included, the scope and the price, before you sign.
- **Support without counted hours** Remote and phone in every plan; on-site support from Premium.

Partners and certifications

DataRoad · Managed cybersecurity

## One StepAhead of IT.

The risk belongs to the board, the protection is ours. In 11 years, DataRoad has never suffered a security incident.

- **11** years in business, since 2015
- **5 ★** on Google · 52 reviews
- **0** DataRoad security incidents in 11 years

We do **IT** right.

Contact

## Does your IT depend on a single person?

Documentation, inventory and one contact who answers for everything.

Phone +351 211 459 950 * *Call to a Portuguese landline

Sales email sales@dataroad.pt

Headquarters Avenida dos Moinhos 12 B, 2610-119 Alfragide, Portugal

More than 10 workstations · support contract · remote, on-site and phone support

DataRoad works only for companies under an IT Unlimited contract. We do not take subcontracted work or one-off call-outs.

---
Versão HTML desta página: https://www.dataroad-it.com/en/privacy-policy-gdpr-dataroad/