article banner

Privacy notice

This Privacy Notice explains how Grant Thornton International and Grant Thornton Luxembourg (“Grant Thornton Luxembourg”, “we”, “us” or “our”) collects, uses, shares, and otherwise processes your personal data when you browse our website in accordance with applicable data privacy laws and regulations, which include the General Data Protection Regulation 2016/679 (“GDPR”).

We control the ways your personal data are collected via the Grant Thornton Luxembourg website and the purposes for which we use your personal data acting as “data controller” in the context of the GDPR.

Grant Thornton Luxembourg includes the following companies: Grant Thornton Tax & Accounting S.A.; Grant Thornton Audit & Assurance S.A.; Grant Thornton Financial Services S.A.; Grant Thornton Recovery & Reorganisation S.A.; Grant Thornton Advisory S.A.; Grant Thornton Vectis S.A; Tax Consult S.A.; Abax Trust SàRL ; Grant Thornton Technology S.A., Immobilière Bitbourg.

1. Personal data we collect about you

When using the term “personal data” in our Privacy Notice, we mean information that relates to you and allows us to identify you, either directly or in combination with other information that we may hold.

Personal data that we collect automatically

Some of your information is collected automatically. Thus, when you access our website, we may automatically collect, through log files and technically necessary cookies, certain information from your device, such as the IP address, the operating system of your device, the pages visited, and the requests made and the day and time of connection. The use of such files allows us to offer you a more consistent experience on the website.   

Cookies

During your visit, a banner appears at the bottom of the screen informing you of the use of cookies when browsing the website. A cookie is a small piece of data or message that is sent from an organisation's web server to your web browser and is then stored on the hard drive of your device (computer, tablet, mobile, etc.). Some cookies do not collect any personal data but simply ensure smooth and optimal navigation on our website.

The cookie banner provide you with information about the types of cookies and similar technologies we use and how you can control these technologies. It is up to you to make a choice between accepting or refusing the use of optional cookies depending on the services proposed.

You can manage your cookie consent preferences at any time by using the dedicated Cookie Consent tab on our website.

Personal data that you provide voluntarily

When you visit our website, make an enquiry, order publications, or request more information, you may be asked to provide some personal data such as your name, address, telephone number, e-mail address and information in relation to materials and communication we send to you electronically.

By providing your information, you agree that your data will be processed by Grant Thornton Luxembourg for the purposes indicated in point 2 below. If there are other purposes than those indicated in point 2, they will be communicated at the end of each form.

In addition, we collect your data when you contact us directly through any communication channel (e.g., when you send us an e-mail containing a comment or a feedback). We may use social platforms for our own purposes (such as recruitment). Where this is the case, we are the data controller for such activities. We nonetheless encourage you to stay informed of the potential consequences of your online activity by checking the privacy policy of such social platforms. Grant Thornton Luxembourg does not control how social networks use your data for their purposes. Therefore, Grant Thornton Luxembourg cannot be held liable for the privacy practices of such social networks when they process your data for their purposes. 

2. How do we use your personal data

Grant Thornton International may process your personal data collected through the use of cookies, in order to ensure a smooth user experience across the Grant Thornton International's websites.

Grant Thornton Luxembourg processes your personal data for the following purposes:

  • Providing you with the information or services you have requested (including sending a commercial offer or responding to a contact request);
  • Contacting you about various events, including product updates and customer support, or sending you a newsletter, only if you consented to it;
  • Collecting the information enabling us to improve/secure our website and services.

3. Legal basis for data processing

For the purposes explained under point 2.:

  • Pre-contractual measures including sending a commercial offer or a response to a contact request;
  • Consent: if you have requested us to send you information about our services or if you have subscribed for receiving our newsletter;
  • Legitimate interest: to guarantee the correct functioning, security, and accessibility of our website.

4. To whom might we disclose your personal data?

To achieve the purposes listed in point 2, the data is transferred to the following recipients:

  • Internal employees who require it for their roles (on a need-to-know-basis);
  • Employees of other member firms of Grant Thornton;
  • Other service providers acting as subcontractors and on instruction from Grant Thornton Luxembourg.

In the latter case, a contract is drawn up between Grant Thornton Luxembourg and the subcontractor in question and appropriate technical and organizational measures are put in place in accordance with Articles 28 and 32 of the GDPR.

When your personal data is transferred (including in the case of remote access) to a country outside the European Economic Area that is not subject to an adequacy decision, appropriate safeguards in accordance with Chapter V of the GDPR are put in place, such as standard contractual clauses adopted and approved by the European Commission.

5. Data retention period

Your personal data is stored by Grant Thornton Luxembourg only for as long as is necessary for the purpose for which we obtained them. The retention period will depend upon several factors, such as the duration of the contract concluded with you, or legal requirements imposed to Grant Thornton Luxembourg.

Whenever we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time by using the contact email address below or by clicking the unsubscribe link in the email communication we send you (e.g., Grant Thornton events, product updates, etc.). Please, note that the withdrawal of your consent does not affect the lawfulness of the personal data processing based on consent prior to its withdrawal.

6. Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk so that the processing complies with the GDPR.

These measures must provide for a level of security considered appropriate considering the technical standards and the type of personal data processed but also:

  • The state of the art and implementation costs;
  • The nature, scope, context, and purposes of processing; and
  • The likelihood and severity of the risk to the rights and freedoms of natural persons.

Grant Thornton Luxembourg is also ISO 27001 certified. This internationally recognized standard demonstrates our dedication to implementing and maintaining robust information security management systems. ISO 27001 sets forth rigorous criteria for identifying, assessing, and mitigating information security risks, ensuring the confidentiality, integrity, and availability of sensitive data.

Security requirements are continually evolving, and effective security requires frequent assessment and regular improvement of outdated security measures. We are committed to continuously evaluate, strengthen, and improve the measures we implement.

7. What are your rights regarding your data?

As a natural person, you have several rights regarding your personal data including:

  • The right of access: You can request access to the data concerning you at any time as well as a copy of the data;
  • The right to rectification: You can request at any time that inaccurate or incomplete data be rectified;
  • The right to request the erasure of data: You can request that your data be deleted when, for example, the data is no longer necessary for the purposes for which it was collected or processed;
  • The right to restriction of processing: You can request that Grant Thornton Luxembourg restrict the processing of data if, for example, you question the accuracy of the data concerning you or if you object to the processing of data concerning you;
  • The right to data portability: You have the right to have your data transferred to another data controller in a structured, commonly used and machine-readable format, if the processing is carried out by automated means or if it is based on prior consent;
  • The right to object to processing: You can object to the processing of your data and can withdraw your consent if the processing is based on consent, for example if the data is used for commercial prospecting purposes.

You can exercise your rights by contacting the Data Protection Officer at the address shown below, or email dpo@lu.gt.com

Requests will be dealt with by the DPO and will be responded to within 1 month at the latest, starting from the moment of your identity confirmation. We may extend the time limit by a further 2 months if the request is complex or if we have received a high number of requests.

We may request additional information to help us confirm your identity, where deemed necessary, when you exercise any of your rights. This is a security measure to ensure the non-disclosure of your personal information to an unauthorised person.

You will in general not have to pay a fee to exercise any of your individual rights mentioned in this Privacy Notice. However, we may charge a reasonable fee if your request to exercise your individual rights is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

You also have the right to lodge a complaint at any time with the National Commission for Data Protection (“CNPD”), the Luxembourg supervisory authority for data protection issues, or any other competent supervisory authority of an EU member state.

8. Links

Our website contains links to Grant Thornton International member and correspondent firm websites, but this Privacy Notice applies only to personal data collected via the Grant Thornton Luxembourg website and to how Grant Thornton Luxembourg processes personal data. It does not apply to specific member or correspondent firms practicing under the Grant Thornton name. We are not responsible for the privacy practices of other websites.

9. Updates to the Privacy Notice

We keep this Privacy Notice under regular review, and we may change, modify, add, or remove portions from the Privacy Notice at any time. We will post any modifications or changes to this Privacy Notice on our website prior to such changes taking effect.

 

Last update: 16 February 2024