Privacy Policy

Data Controller: Fiduciaire Expert S.à r.l.

Luxembourg

Contact: contact@fiduciaire-expert.lu

GDPR Contact Point: dpo@fiduciaire-expert.lu

As part of our activities, we collect and process the following categories of data:

• Identification and contact data
• Professional data
• Contractual and billing data
• Accounting and tax documents
• Social data (payroll/declarations)
• KYC/AML data (know your customer and anti-money laundering)
• Communications, appointments and contact form enquiries, including the page from which the enquiry is sent
• Recruitment data (CV, cover letter, communications)

The originating page is the page of this website from which the enquiry is sent or, failing that, the domain of the referring site. It is transmitted with the message, without any cookie or tracker, to give the enquiry its context.

Contract performance (Art. 6-1-b GDPR):

Accounting and tax services, file management, invoicing, as well as the handling of contact enquiries and pre-contractual steps taken at the request of the data subject.

Legal obligations (Art. 6-1-c):

Tax and social security, anti-money laundering and counter-terrorist financing rules (AML/CFT), which require us to identify clients, understand the business relationship and monitor its transactions, and keeping and storing accounting documents.

Legitimate interests (Art. 6-1-f):

Internal management, IT security, fraud prevention, debt collection, service improvement.

Consent (Art. 6-1-a):

Email marketing to non-clients, where applicable. The website itself sets no cookies and performs no audience measurement. A query submitted through the search bar is sent to the site's hosting provider as a URL parameter, like any page request, and may appear in hosting technical logs.

The choice of light or dark mode is saved in the browser's local storage on this device until it is replaced or the website's data is cleared. This display preference is not transmitted to the firm. Without a saved choice, the display follows the system preference.

Your data may be shared with the following recipients, in strict compliance with professional secrecy:

• Competent authorities and organizations: the direct tax authority (ACD), the registration duties, estates and VAT authority (AED), the Joint Social Security Centre (CCSS) and the Financial Intelligence Unit (CRF)
• Banking institutions
• Legal professionals on mandate
• Technical processors: Netlify, Inc. (website hosting and receipt of contact form messages), Google Ireland Limited (Google Workspace business email) and other cloud and IT tools, bound by GDPR-compliant contracts

Disclosures are limited to the scope authorised by the mandate or required by applicable legal obligations, subject to professional secrecy.

The website is hosted by Netlify, Inc. (United States), which as such receives browsing data and messages sent through the contact form. This transfer is covered by Netlify's certification under the EU-U.S. Data Privacy Framework and, as a fallback, by the European Commission's standard contractual clauses.

A "Europe" data region policy is configured in Google Workspace for covered data at rest in the firm's business email. Any international transfers related to this service are covered by Google's applicable contractual safeguards, including standard contractual clauses.

A copy of the applicable safeguards can be obtained on request from dpo@fiduciaire-expert.lu.

• Accounting/tax files: 10 years
• Payroll and employment data: according to the document, purpose and applicable statutory period, with retention periods varying by document
• Customer due diligence data under AML/CFT rules (know your customer): 5 years after the end of the relationship (extendable if required by law)
• Unsuccessful applications: 2 months after notification
• Contact enquiries without follow-up: 12 months after the last exchange

In accordance with GDPR, you have the following rights:

• Right of access to your data
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object

To exercise your rights:

Contact us at dpo@fiduciaire-expert.lu or by mail to our registered office. Proof of identity may be required.

Complaints:

CNPD, 15 Boulevard du Jazz, L-4370 Belvaux – www.cnpd.public.lu

Limitations:

Certain rights may be restricted due to legal obligations, including AML/CFT and legal retention requirements.

We implement proportionate technical and organizational measures to ensure the confidentiality, integrity and availability of your data.

Incident management procedures are in place and we provide notifications required by law in case of data breach.

The data we process comes from:

• Data provided directly by you or your representatives
• Public/professional sources (registers, administrations)
• Mandated third parties (banks, advisors, technical partners) according to file needs

We may modify this privacy policy to remain compliant with regulations or improve the protection of your data.

The last update date appears at the top of the page.