Privacy Policy

Last updated: July 2026

1. General statement

Data OPP places great importance on the security and confidentiality of your personal data. We process your data in accordance with the applicable legislation, particularly Regulation (EU) 2016/679 of 27 April 2016 ("GDPR") and Directive 2002/58/EC ("ePrivacy"), respecting the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

The company Data OPP S.à r.l., a limited liability company under Luxembourg law with a share capital of 12,000 euros, registered with the Luxembourg Trade and Companies Register under number B257953, identified for VAT purposes under number LU33337974, whose registered office is located at 9, rue de Louvigny, L-1946 Luxembourg, Grand Duchy of Luxembourg, represented by its managing director (hereinafter "Data OPP" or "we"), is engaged in connecting professionals with users (individuals or businesses) seeking goods and services.

For the purposes of this activity, Data OPP collaborates with Data Hope S.L., a limited liability company under Spanish law, registered with the Registro Mercantil de Barcelona under number B16685935, whose registered office is located at c/ Carrer del Consell de Cent, 357, Piso 6º, L’Eixample, 08007 Barcelona, Spain, represented by its sole acting director (hereinafter "Data Hope"). Data Hope operates the call centre and the operational qualification of contacts initiated via the Data OPP site.

This policy applies to the processing of personal data carried out by Data OPP and Data Hope acting as joint controllers within the meaning of Article 26 of the GDPR, when they fall within the scope of the GDPR, particularly when the data subjects are located in the territory of the European Union, regardless of their nationality or place of residence.

When the telephone qualification activity targets consumer individuals residing in France, it falls under the prior consent regime for telephone marketing established by law no. 2025-594 of 30 June 2025 and articles L. 223-1 and following of the Consumer Code, applicable from 11 August 2026.

2. Joint liability between Data OPP and Data Hope

In accordance with Article 26 of the GDPR, Data OPP and Data Hope have entered into a joint responsibility agreement formalising the distribution of their roles and obligations in the processing of your data. The key points of this agreement are as follows:

Data OPP (Luxembourg) is responsible for the initial collection of data via the Site (contact forms), the acquisition of leads from external sources where applicable, the definition of processing purposes, and the contractual management of relationships with business partners.

Data Hope (Spain) operates the call centre responsible for contacting the data subjects, qualifying their requests, directing them to the most relevant business partner, and ensuring the operational follow-up of the connection.

Decisions regarding the essential means of processing (categories of data collected, retention periods, security measures, procedures for exercising rights) are made jointly by Data OPP and Data Hope.

In accordance with Article 26(3) of the GDPR, you can exercise your rights with either Data OPP or Data Hope. For operational simplicity, it is recommended to direct any requests to the data protection officer at dpo@data-opp.com, who coordinates responses on behalf of both entities.

The full text of the joint liability agreement is available to the individuals concerned upon simple request to the same address.

3. Personal data collected

3.1 Data collected directly via the Site. When you fill out our forms, we collect the following data (mandatory fields are marked with an asterisk):

• First name and surname

• Email address

• Date of birth (age)

• Phone number

• Postal address

This data is collected for the purpose of processing your request to connect with a business partner.

3.2 Data collected indirectly. We may also receive your personal data through the following means:

• From external lead acquisition sources (affiliated advertisers, lead generation providers) that have previously obtained your consent to transfer your personal data to Data OPP. Where such data is used to contact individuals residing in France by telephone, the consent obtained by the source must comply with the requirements of French Law No. 2025-594, including, in particular, the specific identification by name of the advertiser(s) on whose behalf you may be contacted. The origin of each lead is documented and may be made available to you upon request.

• From our business partners who inform us of the response you have given to the offer presented to you (for example: appointment made, refusal, conversion).

In accordance with Article 14 of the GDPR, these indirectly collected data are processed transparently: the nature of the data received, source, purposes and legal bases are identical to those described in this policy.

3.3 Data Generated During Processing by the Call Center
During telephone contact initiated by the call center operated by Data Hope, the following data is collected and generated:

• The status of the call (answered, missed, declined, abandoned, converted)

• The elements qualifying your request (expressed needs, preferences, availability)

• Evidence of your consent to receive telephone marketing communications and, where applicable, the withdrawal of such consent (French Law No. 2025-594).

Audio recordings of telephone conversations, where applicable, for quality assurance, training, and evidence of consent. Where calls are recorded, you will be informed at the beginning of the call, and your consent will be obtained in accordance with the requirements of the Spanish Data Protection Agency (AEPD) and the Luxembourg National Commission for Data Protection (CNPD).

We also collect, via cookies and similar technologies placed on your device, information related to your browsing on our sites (traffic data, connection logs, IP address). The placing and reading of non-strictly necessary cookies are subject to your prior consent, obtained via our cookie management banner. You can change your preferences or withdraw your consent at any time. For more information, please consult our cookie policy.

4. Purposes of Processing and Legal Bases

In accordance with Article 13 of the GDPR, you will find below, for each processing purpose, the applicable legal basis and the associated retention period.

Clarification regarding telemarketing (law no. 2025-594). Regardless of the GDPR legal basis, any commercial prospecting call made to a consumer User residing in France requires, from 11 August 2026, the prior collection of their express consent, which: (i) specifically names the advertiser(s) on behalf of whom they may be contacted; (ii) is collected for a limited duration [6; (iii) can be revoked at any time, free of charge and without consequence; and (iv) proof of which is retained by the joint controllers. No call is made on behalf of an advertiser not covered by this consent. 

When processing is based on your consent, you can withdraw it at any time, without affecting the lawfulness of the prior processing, by contacting us at dpo@data-opp.com or via the unsubscribe mechanism present in each electronic communication.

5. Profiling and automated decisions

As part of the matching between your request and the offers from our partners, we implement a process combining automated pre-selection (algorithmic matchmaking operated by Data OPP) and human qualification ensured by the operators of the Data Hope call centre. This process does not result in a decision that is exclusively automated producing legal effects or significantly affecting you within the meaning of Article 22 of the GDPR, as systematic human intervention conditions the transmission to the partner.

In any case, you have the right to object to this processing and to obtain human intervention.

6. Recipients of the data

Your data is accessible, within the limits of their respective attributions, to the authorised staff of Data OPP (Luxembourg) and Data Hope (Spain), in accordance with the joint controller agreement mentioned in section 2. The transfer of data between Data OPP and Data Hope takes place exclusively within the European Union and does not constitute an international transfer within the meaning of Articles 44 and following of the GDPR.

Your data is also transmitted to the following recipients:

• To selected business partners so that they can respond to your request for connection. Each partner acts as a distinct data controller for the processing they carry out after receiving the data. The updated list of partner categories (and, upon request, the named list) is available from dpo@data-opp.com.

• To subcontractors acting on behalf of Data OPP and Data Hope under contracts compliant with Article 28 of the GDPR: hosting providers, customer relationship management (CRM) providers, telephony and call recording providers, audience measurement providers.

We may also disclose aggregated or anonymised data (in the sense of the GDPR) to our advertisers and advertising partners for statistical purposes.

Finally, we may be required to disclose personal data concerning you in the event of a legal obligation, judicial or administrative procedure, or with your prior consent.

7. Data location and transfers outside the EU

Your data is hosted on servers located within the European Union. The flow of data between Data OPP (Luxembourg) and Data Hope (Spain) takes place exclusively within the European Economic Area and does not involve any international transfer.

8. Data security

Data OPP and Data Hope implement appropriate technical and organisational measures to preserve the confidentiality, integrity, and availability of personal data. These measures include, in particular: encryption of communications (TLS), strict access control, logging of sensitive operations, regularly tested backups, as well as periodic security audits. Access to the data is limited to authorised personnel, who are subject to a contractual obligation of confidentiality.

Specifically regarding the call centre operated by Data Hope, additional measures are implemented: strong authentication of operators, logging of record consultations, restriction of data exports, and enhanced confidentiality clauses in employment contracts.

En cas de violation de données à caractère personnel susceptible d'engendrer un risque pour vos droits et libertés, nous procéderons à la notification à la CNPD dans les 72 heures et, le cas échéant, à votre information individuelle, conformément aux articles 33 et 34 du RGPD.

9. Your rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights regarding your personal data: right of access (art. 15), right to rectification (art. 16), right to erasure (art. 17), right to restriction (art. 18), right to data portability (art. 20), right to object (art. 21), right to withdraw your consent (art. 7(3)), right not to be subject to a solely automated decision (art. 22), and right to give directives regarding the fate of your data after your death.

Regarding telemarketing, you can refuse to be contacted or withdraw your consent at any time, free of charge and without consequence on access to services; this refusal or withdrawal cannot be held against you.

9.1 Methods for exercising your rights. To exercise your rights, simply send an email to dpo@data-opp.com specifying the right you wish to exercise. In accordance with Article 26(3) of the GDPR, your request will be processed indiscriminately under Data OPP or Data Hope; you do not need to contact the two entities separately.

No copy of an identity document will be systematically requested from you. Such a document may only be requested in exceptional cases, in the event of reasonable doubt about your identity, after attempts to verify by other means.

We commit to responding to your request within one month of its receipt, extendable by two months in cases of particular complexity (art. 12(3) GDPR). The exercise of your rights is free of charge (art. 12(5)).

9.2 Right to lodge a complaint. If you believe, after contacting us, that your rights are not being respected, you can lodge a complaint with the competent supervisory authority:

• National Commission for Data Protection (CNPD, Luxembourg) — 15, boulevard du Jazz, L-4370 Belvaux, Luxembourg — www.cnpd.lu (lead supervisory authority within the framework of the joint liability scheme with Data Hope) ;

• or Spanish Agency for Data Protection (AEPD, Spain) — c/ Jorge Juan, 6, 28001 Madrid — www.aepd.es ;

• Ou auprès de l'autorité de contrôle de votre lieu de résidence habituel, de votre lieu de travail ou du lieu où la violation aurait été commise.

10. Protection of minors

Our services are not intended for minors. We do not knowingly collect data concerning individuals under the age of 16 (15 years for users residing in France, in accordance with Article 7-1 of the Data Protection Act). If we were to discover that data collection has involved a minor without the required parental consent, we would proceed to the immediate deletion of that data.

11. Data Protection Officer

Data OPP and Data Hope have jointly appointed a Data Protection Officer (DPO), a single point of contact for the individuals concerned and the supervisory authorities:

Postal address: 9, rue de Louvigny, L-1946 Luxembourg, Grand Duchy of Luxembourg

Email address: dpo@data-opp.com

12. Amendment of this policy

This policy is subject to change. The date of the last update is at the top of this document. In the event of a substantial change affecting your rights, we will inform you by an appropriate means.

13. Contact us

For any questions regarding this policy or the exercise of your rights:

By email: dpo@data-opp.com

By post: Data OPP S.à r.l. — Attention DPO — 9, rue de Louvigny, L-1946 Luxembourg, Grand Duchy of Luxembourg — or — Data Hope S.L. — Attention DPO — c/ Carrer del Consell de Cent, 357 Piso 6º, L’Eixample, 08007 Barcelona