article banner

Privacy notice for external stakeholders

This Privacy Notice explains how Grant Thornton Luxembourg (“Grant Thornton Luxembourg”, “we”, “us” or “our”) collects, uses, shares and otherwise processes your personal data in connection with your relationship with us as a Grant Thornton Luxembourg’s supplier, partner, visitor, event participant, client, or third party acting for a client or being generally interested in our services and our publications in accordance with applicable data privacy laws and regulations, which include the General Data Protection Regulation 2016/679 (“GDPR”).

We control the ways your personal data are collected and the purposes for which we use your personal data acting as “data controller” in the context of the GDPR.

Grant Thornton Luxembourg includes the following companies: Grant Thornton Tax & Accounting S.A.; Grant Thornton Audit & Assurance S.A.; Grant Thornton Financial Services S.A.; Grant Thornton Recovery & Reorganisation S.A.; Grant Thornton Advisory S.A.; Grant Thornton Vectis S.A. ; Grant Thornton Technology S.A.; Abax Trust; Immobilière Bitbourg; Tax Consult.

This Privacy Notice also applies to external experts who are assigned in-house to support specific projects or functions at Grant Thornton Luxembourg and which are provided with an access to the Company’s premises, systems, and a professional email address.

 

1. Personal data we collect about you

When using the term “personal data” in our Privacy Notice, we mean information that relates to you and allows us to identify you, either directly or in combination with other information that we may hold.

We may collect personal information from you in the course of our business, including through your use of our website, when you contact or request information from us, when you engage our services or as a result of your relationship with one or more of our staff and clients or when you visit our company premises.

Depending on the purposes pursued, we may collect the following information:

 

Data category

Type

Personal identification information
  • Name
  • Title (Mr / Ms)
  • Postal and/or e-mail address
  • Phone number
  • Reason, date and time of visit
  • Identification number
  • Date of birth
  • Publicly available information (such as LinkedIn profile etc.)
  • KYC documents (including a copy of your passport or national identity card)
  • The plate number personal motor vehicle you are using to access Grant Thornton Luxembourg’s parking facilities

Professional information
  • Job title
  • Department and name of organisation
  • Professional contact details

Financial Information
  • Payment related information
  • Information relating to your assets

Tax information

Tax domicile and other tax related documents and information

Technical information

Information in relation to materials and communication we send to you electronically

 

If relevant to the products and services we provide to you, we will also collect information about your business partners (including other shareholders or beneficial owners), dependents or family members, representatives, and agents.

Additionally, where you are a corporate client, we will also collect information about your directors, employees or shareholders. Before providing Grant Thornton Luxembourg with this information, you should provide a copy of this notice to those individuals.

 

2. How we use your personal data

We always process your personal data for a specific purpose and only process the personal data which is relevant to achieve that purpose. In particular, we process your personal data for the following purposes:

  • To establish, administer and implement a business relationship;
  • To provide our services to you and manage our relationship with you, including communicating with you in relation to the products and services you obtain from us;
  • To strengthen the existing business relationship or to develop a new business relationship or to approach interested parties including information on current legal developments and our range of services (Marketing);
  • To fulfil our administrative purposes and protect our business interests;
  • To ensure physical security of the people, items and confidential information located in or accessible from our premises;
  • To comply with our legal obligations (e.g., laws of the financial sector, anti-money-laundering and tax laws), including disclosures to tax authorities, financial service regulators and other regulatory and governmental bodies, and investigating or preventing crime.

When you attend a Grant Thornton organised event, please be aware that we may also take photographs. These photographs serve various purposes including for marketing and promotional activities.

According to applicable legislation, we differentiate between targeted and non-targeted photography. Targeted photos specifically focus on individuals and will only be taken with your consent.

Conversely, non-targeted photos, namely those capturing the general audience or atmosphere of the event, will be processed on the basis of Grant Thornton’s legitimate interest In line with applicable legislation.

We will only use your personal data for the purposes for which we collected it and which we informed you about, unless we reasonably consider that we need to use it for another reason which is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

 

3. Legal basis for processing your data

For the purposes explained under clause 2:

  • Performance of a contract or precontractual measures;
  • Consent;
  • Legitimate interest;
  • Legal obligation;
  • Vital interest.

Whenever we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time by contacting us as indicated below. Please, note that the withdrawal of your consent does not affect the lawfulness of the personal data processing based on consent prior to its withdrawal.

 

4. Sharing your Personal Data

Please note that we may use or disclose personal data if we are required by law to do so or if we reasonably believe that use or disclosure is necessary to protect our rights and/or to comply with judicial or regulatory proceedings, a court order or other legal process.

To achieve the purposes mentioned above, the data is transmitted to the following recipients:

  • Internal employees who have permissions, on a need-to-know basis;
  • IT, network and technology systems providers;
  • Member firms of the international Grant Thornton network;
  • Professional advisors, auditors and external lawyers;
  • Suppliers to whom we outsource certain support services such as word processing, translation, photocopying and document review;
  • Administrative authorities, courts, tribunals, government agencies, law enforcement agencies and notaries;
  • Public Accountants and tax advisors for auditing purposes;
  • Insurance companies by reason of the conclusion of an insurance contract over the benefits or occurrence of the insured event (e.g., liability insurance);
  • Cooperation partners and legal representatives acting on our behalf;
  • Other recipients as determined by the client (i.e., group companies of the client).

Furthermore, personal data of employees of our clients within the framework of payroll services may be shared with:

  • Creditors of the employee as well as potential other parties related within legal prosecution, also in voluntary cession of salaries for due receivables;
  • Organs of the workforce and legal representation;
  • Insurance companies within existing group- or individual insurance as well as employee pension funds;
  • Banks dealing with the payment to the employee or to third parties;
  • Company doctors and employee pension funds;
  • Co-insured persons.

Additionally in the field of financial and administrative accounting for clients, personal data may be shared with:

  • Collection agencies for debt collection;
  • Banks on behalf of the client;
  • Factoring-companies, assignees and leasing companies.

Some of the above-mentioned recipients may be based outside of Luxembourg and the EU/EEE and process your personal data outside of Luxembourg. Where this is the case, transfers will be undertaken in line with Chapter V of the GDPR. In case of an intra-group transfer to another member firm located in a country that do not offer adequate protections, we use the European Commission's standard contractual clauses to provide adequate protection.

You may request additional information in relation to such cross-border transfers and obtain a copy of the safeguards put in place Grant Thornton Luxembourg by contacting our Data Protection Officer (DPO) at dpo@lu.gt.com

An interfirm agreement between all Grant Thornton Luxembourg member firms that share and process personal data is in place. Where a third-party service providers process personal data outside the EEA in the course of providing services to us, our written agreement with them will include appropriate measures, usually in the form of standard contractual clauses.

 

5. Data retention period

Your personal data is stored by Grant Thornton Luxembourg only for as long as is necessary for the purpose for which we obtained them. The retention period will depend upon several factors, such as the duration of the contract concluded with you, or legal requirements imposed to Grant Thornton Luxembourg.

For example, data collected in the scope of client onboarding is held in line with applicable AML/CFT legislation, namely from five up to 10 years following the end of the business relationship, as provided for in Article 3(6) of the 2004 AML Law.

Administrative documents, including those for accounting and finance purposes, are kept for 10 years from the closure of the financial year they relate to (Art. 14 and 16 of the Commercial Code).

Data used for commercial prospecting purposes is kept for a period of 3 years from the end of the commercial relationship (i.e. from the expiry date of a contract, or of the last contact from the customer) in line with the CNIL recommendation n°2013-213.

Photos collected from events may be stored for up to 2 years for the purposes of internal publications (e.g. in our Sustainability Report) and external publications (e.g. on our website or LinkedIn page).

Whenever we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time by contacting us as indicated below or by clicking the unsubscribe link in the email communication we send you (e.g., Grant Thornton Luxembourg events, product updates, etc.). Please, note that the withdrawal of your consent does not affect the lawfulness of the personal data processing based on consent prior to its withdrawal.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case it is no longer considered as personal data. Upon expiry of the applicable retention period, we will securely destroy your personal data in accordance with applicable laws and regulations.

 

6. Security

Grant Thornton Luxembourg is ISO 27001 certified and implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk so that the processing complies with the GDPR.

These measures must provide for a level of security considered appropriate considering the technical standards and the type of personal data processed but also:

  • The state of the art and implementation costs;
  • The nature, scope, context, and purposes of processing; and
  • The likelihood and severity of the risk to the rights and freedoms of natural persons.

Security requirements are continually evolving, and effective security requires frequent assessment and regular improvement of outdated security measures. We are committed to continuously evaluate, strengthen, and improve the measures we implement.

 

 7. What are your rights regarding your data?

As a natural person, you have a number of rights regarding your personal data including:

  • The right of access: You can request access to the data concerning you at any time as well as a copy of the data;
  • The right to rectification: You can request at any time that inaccurate or incomplete data be rectified;
  • The right to request the erasure of data: You can request that your data be deleted when, for example, the data is no longer necessary for the purposes for which it was collected or processed;
  • The right to restriction of processing: You can request that Grant Thornton Luxembourg restrict the processing of data if, for example, you question the accuracy of the data concerning you or if you object to the processing of data concerning you;
  • The right to data portability: You have the right to have your data transferred to another data controller in a structured, commonly used and machine-readable format, if the processing is carried out by automated means or if it is based on prior consent;
  • The right to object to data processing: You can object to the processing of your data and can withdraw your consent if the processing is based on consent, for example if the data is used for commercial prospecting purposes.

These rights can be enforced within the limits defined by articles 15 to 23 of the RGPD.

For more information or if you wish to exercise your rights, please contact our Data Protection Officer (DPO) at dpo@lu.gt.com.

Requests will be dealt with by the DPO and will be responded to within 1 month at the latest, starting from the moment of your identity confirmation. We may extend the time limit by a further 2 months if the request is complex or if we have received a high number of requests.

We may request additional information to help us confirm your identity, where deemed necessary, when you exercise any other of your rights. This is a security measure to ensure the non-disclosure of your personal data to an unauthorised person.

You will in general not have to pay a fee to exercise any of your individual rights mentioned in this Privacy Notice. However, we may charge a reasonable fee if your request to exercise your individual rights is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

You also have the right to lodge a complaint at any time with the National Commission for Data Protection (CNPD), the Luxembourg supervisory authority for data protection issues, or, as the case may be, any other competent supervisory authority of an EU member state.

 

8. Updates to the Privacy Notice

We keep this Privacy Notice under regular review, and we may change, modify, add, or remove portions from the Privacy Notice at any time. We will inform you of any modifications or changes to this Privacy Notice prior to such changes taking effect.

 

Last update: 8 February 2024