Technical and Organisational Measures

This document outlines the technical and organisational measures (TOMs) implemented by LuxRelo to ensure the security, confidentiality, integrity, and availability of personal data processed during the course of providing relocation and immigration services.

2.1 Data Protection Governance

• Appointment of a Data Protection Officer (DPO) or designated data privacy contact.
• Regular GDPR training and awareness sessions for staff handling personal data.
• Strict data access policies based on role/responsibility.
• Implementation of data processing agreements (DPAs) with subcontractors and partners.

2.2 Risk Management

• Annual risk assessments on data processing activities.
• Data Protection Impact Assessments (DPIAs) conducted where necessary.

2.3 Incident Response

• Documented data breach response plan.
• Procedures in place for notification to authorities and impacted individuals within GDPR timelines.

2.4 Physical Security

• Restricted access to physical offices.
• Lockable storage for sensitive documents.
• Secure shredding and disposal of physical records.

3.1 Access Control

• Role-based access control (RBAC) for internal systems.
• Strong authentication protocols (e.g. password policies, MFA).
• Unique user credentials; no shared accounts.

3.2 Data Encryption

• Encryption of data in transit using HTTPS/TLS protocols.
• Encryption at rest on servers and storage devices.

3.3 System and Network Security

• Firewalls and antivirus/antimalware tools in place.
• Regular software updates and patching.
• Network monitoring and logging of access activities.

3.4 Data Backup and Recovery

• Daily automated backups of key data.
• Offsite storage or cloud backups with redundancy.
• Periodic testing of data restoration procedures.

LuxRelo uses the secure platform Relocation Online for document exchange and client interaction. Security features include:

• Encrypted storage and secure access to uploaded documents.
• Client-specific access permissions.
• Audit trails for document access and changes.

• Vetting of all third-party service providers.
• Execution of Data Processing Agreements (DPAs).
• Verification of adequate TOMs in place by subcontractors.

Ongoing review and updates of TOMs in response to:

• Regulatory changes
• Emerging security threats
• Technological advancements

Related pages: List of Sub-Processors, Privacy Policy.