article banner

Privacy notice - MyGTexperience

This Privacy Notice explains how Grant Thornton Luxembourg [1] (“Grant Thornton Luxembourg”, “we”, “us” or “our”) collects, uses, shares, and otherwise processes your personal data when you browse and use MyGTexperience Portal (“Portal”) in accordance with applicable data privacy laws and regulations, which include the General Data Protection Regulation 2016/679 (“GDPR”) which is applicable as of 25 May 2018.

We control the ways your personal data are collected via the Grant Thornton Luxembourg website and the purposes for which we use your personal data acting as “data controller” in the context of the GDPR.

[1] Grant Thornton Luxembourg includes the following companies: Grant Thornton Tax & Accounting S.A.; Grant Thornton Audit & Assurance S.A.; Grant Thornton Financial Services S.A.; Grant Thornton Recovery & Reorganisation S.A.; Grant Thornton Advisory S.A.; Grant Thornton Vectis S.A; Grant Thornton Technology S.A.; Tax Consult S.A.; Abax Trust SàRL.

 

1. Personal data we collect about you

When using the term “personal data” in our Privacy Notice, we mean information that relates to you and allows us to identify you, either directly or in combination with other information that we may hold.

Personal data that you provide voluntarily

When you use our Portal, you may be asked to provide some personal data such as your first name, last name, professional e-mail address and your company name. Your login information, including your username and password, will be collected and processed as well.

Personal data that we collect automatically

Some of your information is collected automatically. Thus, when you access our Portal, we may automatically collect through log files certain information from your device, such as the IP address, the operating system of your device, the pages visited, and the requests made and the day and time of connection. The use of such files allows us to offer you a more consistent experience.  

Cookies

Our Portal uses cookies to ensure smooth and optimal navigation. A cookie is a small piece of data or message that is sent from an organisation's web server to your web browser and is then stored on the hard drive of your device (computer, tablet, mobile, etc.). We use strictly necessary cookies that enable our Portal to function properly such as session cookies that keep you logged in.

 

2. Purposes for processing and legal grounds

Grant Thornton Luxembourg processes your personal data for the following purposes.

 

Purpose

Legal basis

Creating and managing your account so that you can use and benefit from the services offered by the portal MyGTexperience

Performance of our contract with you (including your employement contract with Grant Thornton Luxembourg) and provision of the services requested by your company.

Contacting you about various events, news, and service updates as part of our contracual services

Contractual performance

Processing your requests for technical support in case of problem

Contractual performance

Maintening the Portal

Our legitimate interests or those of a third party, except where such interests are overridden by our own interests

 

We will only use your personal data for the purposes for which we collected it and which we informed you about, unless we reasonably consider that we need to use it for another reason which is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

 

3. To whom might we disclose your personal data?

To achieve the purposes listed in section 2, the data is transferred to external service providers such as network or web hosting providers acting as data processors and on instruction from Grant Thornton Luxembourg. In this case, a contract is drawn up between Grant Thornton Luxembourg and the data processor in question and appropriate technical and organisational measures are put in place in accordance with Articles 28 and 32 of the GDPR.

As a general rule, no personal data is transferred outside the EU/EEA. However, when your personal data is transferred (including in the case of remote access) to a country outside the EU/EEA that is not subject to an adequacy decision, appropriate safeguards in accordance with Chapter V of the GDPR are put in place, such as standard contractual clauses adopted and approved by the European Commission.

 

4. Data retention period

Your personal data is stored by Grant Thornton Luxembourg only for as long as is necessary for the purpose for which we obtained them. The retention period will depend upon several factors, such as the duration of the contract concluded with you, or legal requirements imposed to Grant Thornton Luxembourg.

Thus, the log files collected during interactions with the Portal are destroyed after 6 months after the moment of the collection. 

We may also keep and process your personal data after your account is deactivated, i.e., after the termination of our contractual, commercial or employment relationship for specific purposes such as the compliance with other legal obligations (as a rule, data must be kept for a period of 10 years for commercial matters) or the establishment, exercise, or defence of legal claims.

Upon expiry of the applicable retention period, we will securely destroy your personal data in accordance with applicable laws and regulations.

 

5. Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk so that the processing complies with the GDPR.

These measures must provide for a level of security considered appropriate considering the technical standards and the type of personal data processed but also:

  • The state of the art and implementation costs;
  • The nature, scope, context, and purposes of processing; and
  • The likelihood and severity of the risk to the rights and freedoms of natural persons.

Security requirements are continually evolving, and effective security requires frequent assessment and regular improvement of outdated security measures. We are committed to continuously evaluate, strengthen, and improve the measures we implement.

 

6. What are your rights regarding your data?

As a natural person, you have several rights regarding your personal data including:

  • The right of access: You can request access to the data concerning you at any time as well as a copy of the data;
  • The right to rectification: You can request at any time that inaccurate or incomplete data be rectified;
  • The right to erasure: You can request that your data be deleted when, for example, the data is no longer necessary for the purposes for which it was collected or processed;
  • The right to restrict processing: You can request that Grant Thornton Luxembourg restrict the processing of data if, for example, you question the accuracy of the data concerning you or if you object to the processing of data concerning you;
  • The right to data portability: You have the right to have your data transferred to another data controller in a structured, commonly used and machine-readable format, if the processing is carried out by automated means or if it is based on prior consent;
  • The right to object to processing: You can object to the processing of your data and can withdraw your consent if the processing is based on consent, for example if the data is used for commercial prospecting purposes.

You can exercise your rights by contacting the Data Protection Officer (DPO) at dpo@lu.gt.com

Requests will be dealt with by the DPO and will be responded to within 1 month at the latest, starting from the moment of your identity confirmation. We may extend the time limit by a further 2 months if the request is complex or if we have received a high number of requests.

We may request additional information to help us confirm your identity and to ensure that you respect your right to access the personal data (or to exercise any other of your rights). This is a security measure to ensure the non-disclosure of your personal information to an unauthorised person.

You will in general not have to pay a fee to exercise any of your individual rights mentioned in this Privacy Notice. However, we may charge a reasonable fee if your request to exercise your individual rights is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you are not satisfied with our response, you also have the right to lodge a complaint at any time with the National Commission for Data Protection (“CNPD”), the Luxembourg supervisory authority for data protection issues, or any other competent supervisory authority of an EU member state.

 

7. Links

The Portal contains links to other websites. This Privacy Notice applies only to personal data collected via the Portal. We are not responsible for the privacy practices of other websites.

 

8. Updates to the Privacy Notice

We keep this Privacy Notice under regular review, and we may change, modify, add, or remove portions from the Privacy Notice at any time. We will post any modifications or changes to this Privacy Notice on the Portal prior to such changes taking effect.

 

Last update: 25 April 2023