Sedlo Law Firm (“SLF”, “we”, “us” or “our”) receives, collects and processes personal data that is necessary for us to provide our services, to maintain business relationships and to perform marketing activities in relation to such services, while also complying with the applicable laws and regulations. SLF undertakes to protect your privacy and keep collected data safe and secure. In this respect, SLF acts as data controller and data processor, as such roles are further detailed in the applicable Luxembourg legislation on the protection of individuals with regard to the processing of personal data, as may be amended from time to time (the “Law”). These general terms of privacy serve to provide you with information as to how SLF collects, saves, uses and shares personal data (about you or in general) and what rights data subjects are entitled to (the “General Terms”).
A. SOURCES OF DATA COLLECTED BY SLF
We obtain data from various sources, depending on the services we provide and the context of our relationship with you. Data that we collect in principle stems from the following sources: you as a prospective or established client of SLF, when you communicate with us by electronic means or in paper form, such communication can be made directly by you or indirectly via a person you instruct to contact us; third parties, being information that is provided about you by third parties in relation to a specific subject matter, within the course of our services provision to you; and public sources, being information that is publicly available, such as public registers, the internet, online brochures, directories, etc.
B. CATEGORIES OF DATA COLLECTED AND PROCESSED
Data collected and processed by SLF can be summarised in (but is not limited to) the following categories: identification data (first and last name, email and postal address, phone number, date and place of birth, gender); professional information (name of the company, job function and title, location); financial information (account number and banking details); contractual information (information provided by you that is necessary for us to perform our contractual obligations and provide our services); electronic data (your IP address, frequency and length of usage of our website); and employment data (first and last name, gender, nationality, email and postal address, experience, education, skills and achievements).
The above list of collected and processed personal data is not exhaustive and there may be other types of data that may be collected by us. We however do not collect and/or process any special categories of personal data within the meaning of the Law, this includes, among others, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or medical and health data. We also do not in principle process any personal data relating to criminal convictions and offences.
C. LEGAL BASIS AND PURPOSE OF PROCESSING OF YOUR DATA
SLF receives, collects, stores, shares, transfers and generally processes your personal data based on the following legal bases and purposes:
1. The processing is necessary for SLF to perform its contract with you or for requested pre-contractual elements. This relates to the provision of services that you have requested from us, either directly or indirectly by other service providers with which you have contractual or pre-contractual arrangements.
2. The processing is necessary to comply with legal and regulatory obligations. As Luxembourg lawyers, we are required to verify your identity and undertake the necessary “know your customer” (KYC) checks and thereby comply with the applicable anti-money laundering and counter-terrorism financing laws and regulations. We are also bound by a set of rules provided for by the Luxembourg Bar Association. Other laws and regulations may also oblige us to provide assistance in the enforcement of laws or otherwise cooperate with the relevant authorities, which will require us to process personal data.
3. The processing is necessary for our legitimate interests. This may include management of the infrastructure and operations of SLF, as per internal policies and procedures, maintenance of IT systems, etc. Moreover, your data may be used by SLF for marketing activities and commercial communication, such as the distribution of newsletters and brochures or invitations to events and trainings. For the avoidance of doubt, you have the right to object at any time to such communication, any such communication includes an option to unsubscribe, and you can alternatively contact SLF at info@sedlo.lu and request that no such communication be sent to you. SLF may also connect and communicate with you via social media, and we monitor the usage of our website in order to improve our marketing activities and communication, please consult our Website Terms of Use & Privacy.
4. The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. SLF may be requested by you or required by law to make certain filings with various authorities, including but not limited to the Luxembourg register of commerce and companies, the CSSF and the Luxembourg register of beneficial owners.
5. The processing is made with your consent. SLF may communicate to you a consent form whereby we may (i) inform you that we process your data and (ii) ask you to consent to our processing of your data. You may also correct and/or update any data that is processed by us.
For the avoidance of doubt, SLF never sells or leases your information to third parties.
D. DISCLOSURE OF DATA
SLF may disclose your data. Such disclosure will depend on the services we provide and the scope of our mandate and can also be made for our marketing activities. Accordingly, your data may generally be disclosed to the following (non-exhaustive) recipients: lawyers and employees of SLF; IT service providers of SLF; service providers that provide services to you (auditors, domiciliation agents, administration agents, etc.); entities and persons to whom you have allowed us, implicitly or explicitly, to disclose your personal data (this could include your investment partners, managers, ultimate beneficial owners, etc.); lawyers and employees of a correspondent and/or counterparty law firm; third parties involved when providing services to you, including third-party advisers or service providers, notaries and courts; governmental bodies in Luxembourg and abroad; third-party service providers that assist us with the organisation of events and presentations; and third parties that manage legal directories.
The above recipients are generally located in the European Union, but some of them may, due to a particular transaction and/or service provision, be located outside of the European Union. SLF will take utmost care that no personal data is transferred outside of the European Union to a country which does not ensure an adequate level of protection (unless you authorise us to do so) and/or we will take specific measures to comply with the Law.
E. DURATION OF STORAGE OF YOUR DATA
In accordance with the Law, SLF cannot store data for longer than is necessary for the purposes for which the data are processed. However, certain legal periods of limitation may apply and certain rules and regulations require us to retain your data for a certain period of time after the termination of our contractual and/or commercial relationship. Examples include: accounting documents (and any personal data therein), which shall be kept for 10 years after the end of the accounting period to which they relate; documents held by Luxembourg lawyers, which shall be kept for 5 years after the termination of their mandate in accordance with Article 2276 of the Luxembourg Civil Code; and identification documentation and the contractual limitation of liability, which shall be kept for 10 years as from the termination of the relevant contractual relationship.
As a general rule, SLF will only conserve your data (i) for the duration necessary to fulfil the purpose it was collected for, subject to any legal period(s) of limitation, (ii) for a legitimate business purpose and (iii) within the limits and to the extent provided for by the applicable laws.
F. RIGHTS OF THE DATA SUBJECT
Within the limits of the Law, you may exercise the following rights: the right to be informed (encompassing our obligation to be transparent in how we collect and use your personal data and to inform you that we process it); the right of access to your data; the right of rectification of the personal data we process; the right of erasure (you can request that we delete or remove your personal data where there is no compelling reason to continue processing); the right to restriction of processing (where you consider the data inaccurate or incomplete, where you object to processing while we consider whether a legitimate interest subsists, or where we no longer need the data for the original purpose but may need it to support a legal claim); the right to data portability (where processing is based on your consent or necessary for the performance of a contract, you can request that a copy of the data be provided to a third party in electronic form); and the right to object, under certain circumstances, to our processing of your personal data.
Should you wish to exercise any of these rights, please send a written request to info@sedlo.lu. Please note that you also have the right to address any complaint to the Luxembourg data protection supervisory authority (Commission Nationale pour la Protection des Données: CNPD).
G. OUR EXPECTATION FROM DATA SUBJECTS
We expect you to inform us in writing and without undue delay of changes in the information you provided to us or others about you, so that we can keep it up to date. If you provide us with personal information not relating to you (e.g. information about your representatives, staff members and agents, beneficial owners, shareholders or any third party), you must first inform them about this fact and make sure they acknowledge that we can use such information as set out in these General Terms. In particular, you must provide them with the information relating to their rights as data subjects. We assume that these third parties are informed of the processing of any personal information relating to them that we may carry out and of the disclosure of the same to third parties and countries as described herein and that, as far as necessary, you obtained these data subjects’ prior written consent.
H. CHANGES TO THESE GENERAL TERMS
SLF may amend these General Terms in order to comply with the Law and/or any other applicable regulation in this respect. Further changes may also be made to accurately reflect our data collection and processing practices. We therefore advise you to regularly check these General Terms for any updates and amendments.
I. FURTHER INFORMATION AND QUESTIONS
Feel free to contact us should you require any further information with respect to these General Terms or if you have any questions in this respect. You can reach us by email at info@sedlo.lu. Alternatively, you can also write to us at 19, rue Eugène Ruppert, L-2453 Luxembourg, Grand Duchy of Luxembourg.
GOVERNING LAW AND JURISDICTION
These General Terms shall be governed by and construed in accordance with the laws of the Grand Duchy of Luxembourg. Any disputes arising out of or in connection with these General Terms shall be submitted exclusively to the courts of the city of Luxembourg, Grand Duchy of Luxembourg.