Client portal

Legal Notice

INTRODUCTION

Protecting and respecting privacy at Volpe Accounting (“VOLPE”) is a priority.

Our personal data protection policy concerns individuals and aims to clearly and simply explain how we process your personal data in accordance with applicable laws and for the purposes defined below. This includes the categories of personal data collected (directly or indirectly, mandatorily or voluntarily, manually or otherwise) from the data subjects themselves, as well as from their clients, third parties (such as potential clients, subcontractors, suppliers, or any stakeholders involved with VOLPE), and/or publicly accessible sources when applicable.

This policy applies both to data initially collected when you contact a VOLPE company and to data subsequently obtained by VOLPE (e.g., during a business relationship, when requesting additional services, or updating initially provided data).

The processing of your personal data is subject to the European Regulation (EU) 2016/679 of April 27, 2016, on data protection known as “GDPR” or any other legislative act modifying it.

The terms “data subjects,” “personal data,” “processing,” “data controller,” and “processor” have the meanings given to them in the General Data Protection Regulation.

You can obtain more information on data protection from the National Commission for Data Protection (CNPD) for Luxembourg (https://cnpd.public.lu/en/legislation.html) or the Data Protection Authority for Belgium (https://www.privacycommission.be/).

This policy is regularly updated. We invite you to consult our website to review the latest version in effect.

1 - WHO ARE WE?

VOLPE refers to a group of legal entities:

Volpe Accounting S.à.r.l., accredited by the Luxembourg authorities and subject to the control of the Ordre des Experts-Comptables of Luxembourg (“OEC”) (RCS Luxembourg B225915)

Volpe Accounting Srl, accredited by the Belgian authorities and subject to the control of the Institute for Tax Advisors and Accountants (“ITAA”) (CBE number 0791.326.691)

Both as Data Controller and as Processor, here are our contact details:

Volpe Accounting S.à.r.l.
20, Avenue Pasteur
L-2310 Luxembourg
Tel. +352 671 885 625
tgillet@volpe.eu

We strive to comply with the current data protection regulations.

For certain services, if we engage specialized partners acting as processors, they must adhere to our personal data protection policy and their legal obligations. We ensure the protection of your personal data through appropriate provisions in our contracts with processors and other parties who may assist us in processing your personal data or to whom we communicate your information.

2 - WHO IS AFFECTED BY THE PROCESSING OF PERSONAL DATA?

VOLPE processes personal data of individuals or legal entities with whom it has had or may have a direct or indirect relationship.

Clients

As a data controller, VOLPE processes personal data relating to each (co-)signatory of a contract, their representatives, or any person acting as their representative. For corporate clients, VOLPE may process personal data of individuals associated with the legal entity, such as representatives, directors, employees, and ultimate beneficial owners.

External Service Providers and Subcontractors

VOLPE may process personal data related to its external service providers or subcontractors, as well as their representatives and/or employees who interact with VOLPE.

Visitors

VOLPE collects and processes personal data of visitors accessing its website and visitors in physical premises.

Third Parties

Depending on the circumstances, VOLPE may process data of third parties linked to the client. The client who provides VOLPE with personal data of third parties such as family members, close associates, beneficiaries, representatives, or employer and their representatives, must inform these third parties about VOLPE’s processing of their data and the existence of this Policy.

Prospects or potential clients

VOLPE may retain, use, and process personal data of prospects or potential clients showing interest in its products and services, within legal and/or contractual limits.

3 - CATEGORIES OF PERSONAL DATA PROCESSED

In its commercial activities and depending on the purpose, VOLPE may collect and process various categories of personal data. These include data that directly identifies you and those that do so indirectly.

The different personal data we usually collect include:

  • Identification and administrative data: names, addresses, ID card numbers, email addresses, phone numbers, age, gender, date of birth, place of birth, marital status, nationality, etc.;
  • Professional data: job title, company, etc.;
  • Financial data: invoices, payslips, income, value of movable or immovable property, origin of funds or wealth, tax data, transaction data, etc.;
  • Household composition data: family situation, details about other household members, etc.;
  • Investor profile data: knowledge and experience with financial instruments, financial situation, ability to bear losses, investment objectives, and risk tolerance;
  • Digital data: email communication records, IP addresses, strictly necessary cookies for our website’s functionality, etc.;
  • Environmental data: characteristics, habits, social media information, etc.;
  • Data obtained via third parties: data provided by public authorities.

We do not process sensitive data revealing racial or ethnic origin, religious or philosophical beliefs, union membership, genetic data, biometric data, health data, or data concerning sexual life or orientation. However, we may be required, under certain legal obligations, to process data relating to criminal convictions and offenses and public/political office holding.

4 - WHEN AND HOW DO WE COLLECT THESE DATA?

VOLPE may collect personal data in the following ways:

  • When you become a client and provide your personal data by any means, or when a third party or your advisor provides your data, including pre-contractual measures;
  • When you have made your personal data public by any means;
  • When VOLPE obtains data from external sources as part of anti-money laundering and terrorism financing checks (such as UN/EU consolidated sanctions list, OFAC, HM Treasury, SECO, Rosfinmonitoring, Interpol);
  • When you access our website;
  • When you visit our premises or have telephone contact with our services;
  • When you fill out one of our forms or sign a contract with a VOLPE company.

5 - PURPOSES OF PERSONAL DATA PROCESSING

VOLPE may process personal data in accordance with applicable laws and solely for the following purposes (collectively, the “Purposes”):

  • Providing professional services, including:
    • Audit and assurance;
    • Tax, accounting, and reporting (tax advice, consolidation, global tax compliance, personal income tax, accounting and bookkeeping, payroll preparation, employment contracts, etc.);
    • Consulting (corporate finance, people and organizations, regulatory and compliance, technology, etc.);
    • Coaching and human resources consulting;
    • Real estate assistance (property search, office search, advice, lease contracts, etc.);
  • Maintaining its administrative and customer/supplier relationship management systems, including:
    • Issuing offers and drafting contracts;
    • Monitoring and managing clients/suppliers;
    • Billing and payment of invoices;
    • Advertising, communication, and public relations;
    • Event organization;
    • Quality controls;
    • Improving client or user experience and personalizing service delivery;
  • Applying acceptance and maintenance procedures (including anti-money laundering, anti-corruption, and counter-terrorism financing);
  • Facilitating compliance with its legal, regulatory, professional, and/or contractual obligations (including independence and archiving requirements);
  • Maintaining and protecting its buildings, equipment, IT infrastructure, and data (including access management and authentication, security, and performance control);
  • Ensuring business continuity;
  • Risk and dispute management;
  • Processing data subject requests;
  • Managing its website.

6 - LEGAL BASES

6.1 Legal Obligations

VOLPE companies are bound by numerous legal and regulatory obligations requiring the processing of your data. These obligations primarily cover the following legal and regulatory areas:

  • Responding to legitimate requests from a public, judicial, prudential, or tax authority;
  • Contributing to the prevention of money laundering and terrorist financing by identifying clients, representatives, and beneficial owners, determining profiles, and monitoring operations and transactions;
  • Complying with embargo legislation imposed by competent authorities against individuals, organizations, or nationals of certain states, including identifying the persons and assets concerned;
  • Recording and archiving certain data.

The list of legal and regulatory areas under which VOLPE companies process your data is non-exhaustive and subject to change. In fulfilling its legal obligations in anti-money laundering and terrorist financing, VOLPE conducts automated checks using external sources or specifically requested data. These automated checks may result in contract refusal or additional information requests, with a human intervention validating the decision.

6.2 Contractual Relationships

Before concluding contracts/engagement letters, VOLPE companies may need to obtain and process certain data to:

  • Respond to your request;
  • Follow up on a request, evaluate the opportunity, and assess risks related to a potential contract/engagement letter.

6.3 Legitimate Interest

VOLPE also processes your data to pursue its legitimate interests. VOLPE ensures a fair balance between the need to process data and your rights and freedoms, particularly privacy protection.

Personal data are processed for:

  • Organizing promotional events;
  • Organizing thematic conferences.

6.4 Consent

In some cases, VOLPE will only process your personal data if it has obtained your specific consent.

For example:

VOLPE will only send you advertising communications by email or SMS and process your electronic communication data for this purpose if you have specifically consented (see 6.5).

Note: Your consent is only required for commercial communications via electronic means. We reserve the right to contact you in person or by phone for direct marketing purposes based on our legitimate interests.

6.5 Commercial Prospecting

VOLPE offers you a wide range of products and services, and as a company, it has a legitimate interest in informing you about the products or services it provides or promotes. In this context, it may use your personal data, particularly your contact details, to send you commercial or informative communications.

This means that you may be contacted, for example, in the following cases:

  • About products in which you have shown interest (e.g., by registering for an information session);
  • When VOLPE launches new products or services;
  • When you have started a subscription process for a product or service but have not completed it

As part of this prospecting, VOLPE may contact you through traditional means such as telephone or regular mail. VOLPE will only use these traditional communication methods if you have not exercised your right to object to the use of your data for direct marketing purposes (see 12.6).

VOLPE may also contact you by email (e-mail, fax, or SMS). However, it will only do so if you have agreed to it.

Under no circumstances does VOLPE disclose your data to third parties to allow them to send you commercial communications for their own products and services. Furthermore, VOLPE never processes sensitive data for commercial prospecting purposes.

Finally, VOLPE does not use profiling or similar identification technologies.

7 - VOLPE ACTING AS A PROCESSOR

As a processor, VOLPE undertakes to process personal data only on the legal and documented instruction of the controller, as provided in the contractual documents applicable to the services and in this notice, and to ensure that its employees authorized to access personal data are subject to an appropriate confidentiality obligation. For the avoidance of doubt, this notice is designed to meet the requirements of Articles 28 and 29 of the General Data Protection Regulation (GDPR).

VOLPE provides the controller with the necessary lawful information to demonstrate compliance with the obligations set out in this notice. The controller may conduct audits and inspections to the extent permitted by law, subject to reasonable notice. Audits/inspections are carried out during VOLPE’s normal business hours and no more than once a year. VOLPE hereby informs the controller that audits/inspections must not infringe on VOLPE’s legal, regulatory, and contractual obligations, such as professional secrecy. Therefore, the controller and its potential auditors are not permitted to access (i) data or information relating to other VOLPE clients, (ii) any proprietary VOLPE data, or (iii) any other confidential information held by VOLPE that is not relevant or strictly necessary for the purposes of the audit/inspection.

VOLPE assists the controller by taking appropriate technical and organizational measures, depending on the nature of the processing, to the extent possible, necessary to meet the controller’s obligations to:

  • Respond to requests to exercise the rights of the data subject as defined in this notice;
  • Conduct and/or assist the controller with data protection impact assessments as provided for in Article 35 of the GDPR and conduct prior consultations with a supervisory authority or other governmental authority when required by applicable laws;
  • Notify a personal data breach to the competent supervisory authority and/or the data subjects. To this end, VOLPE promptly notifies the controller of any security breach that accidentally or unlawfully results in the destruction, loss, alteration, unauthorized disclosure, or access to personal data; and
  • Provide the information reasonably requested by the controller to enable compliance with its obligations under applicable laws when the requested information is in VOLPE’s possession or under its control and the controller has no other reasonable means of obtaining this information.

When VOLPE engages other processors to carry out specific processing activities on behalf of the controller, it imposes the same data protection obligations on them as those set out in this notice through a contract or other legal act under European Union or Member State law. Any planned changes concerning the addition or replacement of these processors are communicated to the controller.

8 - OBLIGATIONS OF CLIENTS

Depending on the purposes, providing personal data may be a legal and/or contractual obligation; failure to provide such personal data may make it impossible for VOLPE to perform the services.

As an essential condition for the performance of services, VOLPE assumes that clients (and stakeholders in an engagement with VOLPE for which the clients concerned vouch) ensure that:

  • The personal data they provide (or give access to) VOLPE is accurate, adequate, relevant, and limited to what is necessary for the specific purpose for which it is disclosed and is adequately safeguarded in their systems;
  • They comply with applicable laws on the processing of personal data by VOLPE (including the lawfulness of providing the data and, if applicable, collecting and managing the consent of the data subject accordingly);
  • The data subjects are informed of the terms and conditions of the processing of their personal data by VOLPE as described in this notice in the form required by applicable laws; and
  • They will immediately inform VOLPE if any of the above conditions cease to be met.

9 - RETENTION PERIOD

We strive not to retain your personal data beyond the time necessary for the processing for which it was collected. When assessing the retention period of your personal data, we must also consider applicable regulatory requirements (e.g., requirements arising from anti-money laundering and counter-terrorist financing laws).

10 - DATA SECURITY

We take appropriate technical and organizational measures to ensure that your personal data is adequately secured against accidental loss or disclosure to unauthorized persons.

We have implemented technical security measures that comply with international rules and current standards to protect your personal data.

You can also contribute to the security of your personal data by following these few tips:

  • Use the latest operating system on your computer and perform all security updates;
  • Use the latest version of your browser and perform all security updates;
  • Install antivirus software, anti-spyware software, and a firewall, and set your preferences so that these protections are regularly updated;
  • Do not leave your device and connection methods unattended;
  • Keep your codes confidential;
  • Only log in from a device you trust and avoid using shared computers/devices for communicating about sensitive transactions.

If you are not comfortable with a website, do not use it and do not enter codes/passwords. Do not open email attachments that you are not expecting.

Emails can contain viruses or malicious software, even if you know the sender. Ensure that your antivirus software also scans incoming email attachments. Activate the email filter in your internet browser.

If you contact us with a question regarding the execution of instructions, we will ask you personal questions to identify you.

11 - WHO ARE THE RECIPIENTS OF YOUR DATA? TO WHOM MAY YOUR DATA BE TRANSFERRED?

Within VOLPE, your personal data is only accessible to those whose mission requires access to that data.

In some cases, the law obliges us to disclose your personal data to third parties:

  • To Luxembourgish or foreign tax authorities when VOLPE is required to disclose client personal data;
  • To public or judicial authorities such as the police, prosecutors, courts... and only upon their express request;
  • To lawyers (e.g., in the context of bankruptcy), notaries (e.g., during incorporation)...

In some cases, VOLPE uses processors to provide the services you have subscribed to or to process your personal data. These may include:

  • Specialized financial sector providers who must also comply with their legal obligations as processors and/or joint controllers in personal data matters (e.g., banking institutions...);
  • Service providers who assist us in:
    • The design and maintenance of our tools;
    • Marketing our activities, organizing events, and managing client communications;
    • Developing and/or managing our products and services.

In these cases, we ensure that these processors only have access to the personal data necessary to carry out the specific tasks required. We also ensure that our processors commit to using the data securely and confidentially and in accordance with our instructions.

We never sell your personal data to third parties.

12 - CROSS-BORDER DATA TRANSFERS

In principle, VOLPE does not transfer any personal data outside the EEA except:

  • To countries that provide an adequate level of protection for personal data as determined by the European Commission; or
  • To recipients under an appropriate agreement that contains the requirements of applicable laws for such a transfer. A copy of the applicable safeguards can be requested from VOLPE’s Data Protection Officer.

13 - WHAT ARE YOUR RIGHTS?

13.1 Right of Access and Rectification

You have the right to access personal data concerning you. VOLPE can provide you with:

  • The categories of personal data processed;
  • The purposes for which we collect your data;
  • The categories of recipients to whom we transfer your data;
  • The retention period of your data;
  • The logic behind any automated processing of your personal data;
  • The source of the personal data processed if they were not collected from you. If you find that your data is inaccurate or incomplete, you can ask us to rectify it.

We take all necessary steps to ensure that your personal data is accurate, up-to-date, complete, and relevant, which is why we ask you to inform us of any changes (e.g., moving, new ID card, adding a new nationality...).

If we correct your data and have previously shared it with a third party, we will also notify that third party.

13.2 Right to be forgotten

In certain specific cases, the legislation allows you to have your personal data deleted. This is particularly the case if the data is no longer necessary for the purposes for which we collected it (for example, because you provided us with your contact details to participate in an event that has ended), if the processing of your data is based solely on your consent and you decide to withdraw it, or if you object to the processing of your data and there are no legitimate reasons for us to prevail over yours. However, VOLPE may retain your personal data when it is necessary for the establishment, exercise, or defense of its legal rights or for VOLPE to comply with its legal obligations. VOLPE will therefore be subject to the retention periods provided by various legislations, particularly when the data was collected as part of our obligations to combat money laundering or terrorist financing (see point 6.1).

13.3 Right to restriction of processing

This specific right allows you to request a temporary lock on your data in specific cases defined by the regulation: VOLPE will then no longer be able to process your data concerned for a defined period. This lock can be requested:

  • When the data in question is inaccurate, incomplete, ambiguous, outdated, during the time necessary for us to verify the accuracy of your data;
  • When their collection, use, communication, or retention is prohibited;
  • When the data is no longer necessary for the purposes of processing;
  • During the period necessary for VOLPE to examine the legitimacy of an objection request.

If you have exercised this right, we can retain your data but can no longer process it without your consent or for the establishment, exercise, or defense of our legal rights (or those of another person).

13.4 Right to data portability

Under this right, you can ask VOLPE to transmit your personal data to you or directly to another data controller when this is technically possible for VOLPE. This right only concerns the data you have provided to VOLPE and which is subject to automated processing based on the contract or your consent.

You can make a request by sending it to dpo@volpe.eu

13.5 Right to withdraw your consent

When the processing of your data is based on your consent, you have the right to withdraw this consent at any time. However, this withdrawal will not affect the legality of the processing carried out during the period preceding your withdrawal of consent.

13.6 Right to object

You always have the right to object without justification and without cost to the use of your data for commercial prospecting purposes (see 15). In this case, your data will no longer be used for this purpose. Additionally, you have the right to object, for reasons relating to your particular situation, to any processing of your personal data based on our legitimate interest. However, your request will not be granted if our legitimate interest prevails over yours or if the processing of your data is required for the establishment, exercise, or defense of our legal rights.

14 - HOW TO EXERCISE YOUR RIGHTS?

To exercise your rights, you can send us your dated and signed request accompanied by a readable copy of the front and back of your identity card, being as precise as possible:

By mail
Volpe Accounting
c/o Data Protection Officer
20, Avenue Pasteur
L-2310 Luxembourg

By email
dpo@volpe.eu

Upon receipt of your complete request, we will respond within the shortest possible time and no later than within one month. However, if your request is complex and requires significant resources, we can extend this period by two months in accordance with Article 12.3 of the GDPR. For any additional copy requested as part of the exercise of your right of access to your personal data or if your request is manifestly unfounded or excessive, we may charge you a reasonable amount based on administrative costs.

15 - HOW TO LET US KNOW THAT YOU NO LONGER WISH TO RECEIVE MARKETING/COMMERCIAL OFFERS?

If you no longer wish to receive commercial offers from us or want to limit them, you can let us know by writing to us by mail or email as indicated in point 13.6. For example, you can ask us to only receive certain of our newsletters or let us know your communication preferences.

16 - WHO TO CONTACT IN CASE OF A DISPUTE?

In case of a dispute regarding the processing of your personal data, you can submit a mediation request to the National Commission for Data Protection or the Commission for the Protection of Privacy at the following addresses:

National Commission for Data Protection
15, Boulevard du Jazz
L-4370 Belvaux
Tél. +352 2610601
Fax +352 26106029

Commission for the Protection of Privacy
Rue de la Presse 35,
B-1000 Bruxelles
Tel: +32 (0)2 274 48 00
Fax: +32 (0)2 274 48 35

Specific provisions apply to VOLPE employees.

ANNEX

USE OF COOKIES AND OTHER TECHNOLOGIES

VOLPE uses cookies and similar identification technologies.

A cookie is a small data file copied to your computer’s hard drive by a website. It records information related to your computer’s navigation on a site (such as the pages visited or the dates and times of visits) that can be read during your subsequent visits to the site.

VOLPE can send cookies when you visit the site or when you register to access an online service.

The cookies set on the site are only those necessary for the site to function optimally.

You can selectively refuse or accept the installation of cookies by configuring your Internet browser used from your Terminal. You can restrict the use of cookies by changing your browser settings. You can object to and delete them using your browser settings, but your user experience may be degraded.

LINKS TO OTHER WEBSITES / THIRD-PARTY CONTENT

If VOLPE links to external sites and resources from its website, this does not constitute an endorsement, and VOLPE assumes no responsibility for the content (or the information contained in) any linked website.