General terms and conditions

1. Forword

This document governs the relationship between the economic interest grouping LUXEMBOURG BUSINESS REGISTERS (LBR), hereinafter “the administrator”, and the user of the services offered online by LBR, hereinafter “the user”.

These general terms and conditions apply to all the services set out in the legal and regulatory texts applicable to the Trade and Company Register (hereinafter “RCS”), the “Receuil électronique des sociétés et associations” (hereinafter “RESA”) and the Register of Beneficial Owners (hereinafter “RBE”) which are provided by the administrator.

They also apply by law to all new services provided by the administrator that arise from an amendment of these texts or from new applicable legislation.

In accordance with the legal and regulatory provisions relating to the RCS, the RESA and the RBE, the administrator provides users with various services on its website “www.lbr.lu”. The user can, by electronic means:

Complete the RCS filing and RBE declaration formalities online.
Consult the documents filed in the RCS file of a registered person and accessible to the public.
Consult information entered in the RBE.
Order RCS or RBE company profiles for registered persons.
Order certificates of non-registration in the RBE.
Apply for a certificate of availability of a trade name.
Order certificates of non-registration of a judicial decision in the RCS („negative certification”).
Access the online subscription service for a file held in the RCS.
Consult certain statistics concerning the RCS and the RBE.
Access the monthly statement of court decisions.
Consult the RESA.

The purpose of these general terms and conditions is to define the conditions under which the administrator offers the user the services set out above.

The user acknowledges having read the access protocol and the technical conditions for using the services described in the user manual available on the LBR website, as well as these general terms and conditions. He also acknowledges that he has received all the information he considers necessary regarding the content of the services described in these general terms and conditions, their characteristics, their functionalities and the technical and payment methods for accessing them. Finally, he acknowledges that he has received the information on the processing of personal data that LBR must carry out in the context of the use of its website and that is listed in these general terms and conditions under point 9.

The user also declares that he/she has full legal capacity to take note of all the terms and conditions.

2. Warning

The user is hereby informed that:

Online access to certain services offered by the administrator on its website is provided either by authentication via a product issued by LuxTrust S.A. or a Luxembourg eID card or eIDAS electronic certificate, offering at least a substantial level of security, or by an anonymous connection, which does not involve the creation of a user account.
Applications made electronically do not require an electronic signature from the user. Authentication on the LBR website constitutes proof of the user's commitment to the administrator. The user expressly acknowledges that the authentication procedure replaces the absence of an electronic signature on these applications.
For customers who do not have regular customer authorisation, all payments for the provision of chargeable services by the administrator are made through the operator Worldline Financial Services (Europe) S.A. LBR does not intervene in any way in the payment process and is not liable for any malfunction of the operator's application. The user is subject to the general terms and conditions of Worldline Financial Services (Europe) S.A. in the context of payment.
For customers with regular customer authorisation, the terms of payment are set out in a special agreement between the user and the administrator.

3. Description of services

LBR offers various services related to the activities of the RCS, the RBE and the maintenance of the RESA.

3.1. Services related to the activities of the RCS

3.1.1. Electronic filing

To access the online filing formalities, users must authenticate themselves on the administrator's website either by a product issued by LuxTrust S.A. or a Luxembourg eID card or by an eIDAS electronic certificate offering at least a substantial level of security.

Filing receipts for services provided online are issued electronically.

The administrator may limit the number of services that may be processed simultaneously by a user.
As part of the services relating to amendments to existing entries in the RCS, the administrator provides applicants with pre-filled electronic forms that list the status of the entries to be amended as held by the RCS. This information is provided to applicants to facilitate the completion of the forms and does not replace the legal information contained in the company profiles issued by the administrator. The information provided on the pre-filled forms reflects the situation of the registered person as it appears from the information filed with the RCS only at the time the pre-filled form is made available.
If a filing application, involving the filing of a requisition form, has already been submitted to the administrator’s verification, a new filing application, concerning the same entity registered with the RCS, may only be submitted to the administrator after the first application has been processed.
Filing applications in preparation that have not yet been forwarded to the administrator usually expire within 168 hours. After this period has expired, the applicant must prepare a new application.
Electronic filings are subject to a fee.

3.1.2. Online consultation of files held at the RCS

To view the publicly available documents contained in the files held at the RCS, the user must log in to the administrator's website, either by authenticating themselves using a product issued by LuxTrust S.A. or a Luxembourg eID card or an eIDAS electronic certificate offering at least an essential level of security, or by connecting anonymously.
Searches can be made by registration number or by the trade name of the registered entity.
The consultation is free of charge.
It should be noted that when the user applies for the document consulted electronically to be certified as compliant by the administrator, such requests are subject to a fee.

3.1.3. Requests for extracts

The user may order extracts, in electronic format or on paper, of registered entities, by submitting a request exclusively via the administrator's website.
In order to access this service, the user has to connect to the administrator's website either by authentication via a product issued by Luxtrust S.A. or a Luxembourg eID card or an eIDAS electronic certificate offering at least a substantial level of assurance, or by anonymous connection.
The administrator guarantees that the extracts reflect the situation of the entity as it appears from the data filed with the RCS on the date of issue of the extract.
Extracts in electronic format are issued and signed by a qualified electronic signature.
The request for an extract is subject to a fee.

3.1.4. Certificates of trade name availability

Users may order a certificate of trade name availability in electronic or paper format, by submitting an application exclusively via the administrator's website.
To access this service, the user must log in to the administrator's website, either by authenticating themselves using a product issued by LuxTrust S.A. or a Luxembourg eID card or an eIDAS electronic certificate offering at least a substantial level of security, or by connecting anonymously.
The issued certificate of availability is valid from the moment of its issue by the administrator until the company's trade name is registered. This registration may be carried out by a person other than the one for whom the certificate was issued. The certificate of trade name availability does not in any way give the recipient the right to reserve the trade name that is the subject of the certificate.
The certificates of trade name availability in electronic form are created and signed with a qualified electronic signature.
The application for a certificate of trade name availability is subject to a fee.

3.1.4. Certificates of non-existence of a legal ruling (“Negative certificate”)

Users may order a certificate of non-existence of a legal ruling in electronic format or on paper by submitting a request exclusively via the administrator's website.
To access this service, the user must log in to the administrator's website, either by authenticating themselves using a product issued by LuxTrust S.A. or a Luxembourg eID card or an eIDAS electronic certificate offering at least a substantial level of security, or by connecting anonymously.
A certificate of non-existence of a legal ruling in relation to a person registered with the RCS consists of the administrator issuing a document certifying that no legal ruling has been registered with the RCS in relation to that person.
Certifications in electronic form are issued and signed with a qualified electronic signature.
The request for the issuance of a certificate of non-existence of a legal ruling is subject to a fee.

3.1.6. The subscription service

The administrator provides a subscription service, whereby a user is informed of each filing made concerning entities registered with the RCS, previously selected by the user, via automatic notification by email.
To access this service, the user must log in to the administrator's website, either by authenticating themselves using a LuxTrust S.A.-issued product or a Luxembourg eID card or an eIDAS electronic certificate offering at least an essential level of security.
The user defines the entities registered with the RCS for which they wish to use this service in a system provided by the administrator on their website.
Each registered entity for which this service is requested is subject to a fee-based annual subscription.

3.1.7. Consultation of statistics regarding the RCS and RBE

The user can freely consult certain monthly or quarterly statistics on filings or declarations.
For the list of filings, deletions and judicial rulings filed with the RCS over a one-month period, only the lists for the last 12 months are available.
This service is free of charge.

3.1.8. Monthly summary of judicial rulings

The monthly list of judicial rulings is available to the user free of charge.
A list of the various judicial rulings filed with the RCS over a one-month period is made available to the user.
This service is free of charge.

3.2. Services related to the activities of the RBE

3.2.1. The electronic declaration

To access the online declaration formalities, the user must authenticate themselves on the administrator's website either through a product issued by LuxTrust S.A. or a Luxembourg eID card or through an electronic eIDAS certificate offering at least a substantial level of security.

Declaration receipts are issued electronically.

The administrator can limit the number of declarations that can be submitted simultaneously by a user.
In the context of declarations modifying existing registrations with the RBE, the user has to indicate, once connected to the website, the access code of the entity concerned by the modification to be made, a code that the latter has previously received from the administrator.

The administrator provides applicants with pre-filled forms, which show the status of the registrations to be modified, as they appear with the RBE, with the exception of information relating to the national identification number, date of birth, address, as well as that concerning beneficiaries whose access to consultation is limited on the basis of Article 15 of the amended law of 13 January 2019 establishing a Beneficial Owners Register. These forms include the information as it was entered in the RBE at the time they were made available.
If a declaration in the RBE is already subject to the verification purposes of the administrator, a new declaration concerning the same registered entity can only be submitted to the administrator after the first declaration has been processed.
As a general rule, applications for registration or modification in preparation, which have not yet been submitted to the administrator, expire within 168 hours. After this time, the applicant has to prepare a new application.
The service for electronic declarations is subject to a fee.

3.2.2. Consultation of information declared with the RBE

The modified law of 13 January 2019 establishing a Beneficial Owners Register draws up the list of persons and entities having the right to consult the RBE, the information that can be consulted and the conditions governing this consultation.
To be able to consult the information entered in the RBE, the user has to be a professional belonging to one of the professional categories described in article 2 of the modified law of 12 November 2004 relating to the fight against money laundering and terrorist financing, a national self-regulatory organisation in the context of its monitoring duties in the fight against money laundering and terrorist financing, a person with a legitimate interest in the fight against money laundering and terrorist financing, a government department, public authority or public entity, for which such access is provided for by law in the context of the duties defined by law.
Access to the RBE:
- For professionals falling under one of the professional categories described in Article 2 of the modified law of 12 November 2004 relating to the fight against money laundering and terrorist financing, access to the RBE requires the prior signature of an agreement between the applicant and LBR, entitled ‘Agreement on access to the consultation of the Beneficial Owners Register’. This agreement and its technical appendix are available on the LBR website.
- For persons and entities other than professionals as defined above, a request for access to the RBE has to be sent in advance to LBR, which will assess its merits.
- The user has to connect to the administrator's website either by authentication via a product issued by LuxTrust S.A. or a Luxembourg eID card.
- Searches can be made by register number or by the trade name/name of the registered entity.
- The data that can be accessed is specified in Article 3, paragraph 1, points 1° to 8°, 12° and 13° of the amended law of 13 January 2019 establishing a
  register of beneficial owners.
- The consultation is free of charge.
Consultation of the RBE is tracked by electronic means in accordance with the provisions of Article 13, paragraph 2bis of the aforementioned modified law of 13 January 2019.

3.2.3. Requests for an extract

Users who have access to the RBE may order extracts of registered entities, in electronic form or on paper, by means of a request submitted exclusively via the administrator's website.
Similarly, any person belonging to one of the professional categories described in article 2 of the amended law of 12 November 2004 on the fight against money laundering and terrorist financing and needing to access the information in the RBE on a one-off basis for a specific file, may order an extract, in electronic or paper format, from a registered entity, by submitting a request exclusively via the administrator's website. This request is made by completing a request form and attaching the documents justifying access to the information contained in the RBE for a specific file.
To access this service, the user must log in to the administrator's website, either by authenticating themselves using a LuxTrust S.A.-issued product or a Luxembourg eID card.
The administrator ensures that the extracts include the list of the entity's beneficial owners as recorded in the RBE on the date the extract is issued. If the details of a beneficial owner are not accessible in accordance with Article 15 of the modified law of 13 January 2019 establishing the Register of Beneficial Owners, they will not appear on the extract.
The extracts in electronic form are issued and signed with a qualified electronic signature.
A request for an extract is subject to a fee.

3.2.4. Certificates of non-existence

Users who have access to the RBE can order a certificate of non-existence in the RBE, certifying that the entity for which the certificate is requested for does not currently have any beneficial owners registered in the RBE. This certificate can be issued electronically or on paper, subject to a request submitted exclusively via the administrator's website.
Similarly, any person belonging to one of the professional categories described in article 2 of the amended law of 12 November 2004 on the fight against money laundering and terrorist financing and who need access to information in the RBE on an ad hoc basis, for a specific file, may order a non-existence certificate, in electronic or paper format, from a registered entity, by means of a request made exclusively via the administrator's website. This request is made by completing a request form and attaching the documents justifying access to the information contained in the RBE for a specific file.
To access this service, the user must log in to the administrator's website, either by authenticating themselves using a LuxTrust S.A.-issued product or a Luxembourg eID card.
Certificates of non-existence in the RBE in electronic format are issued and signed by a qualified electronic signature.
The request for a certificate of non-existence in the RBE is subject to a fee.

3.3. Services related to the management of the "Recueil électronique des sociétés et associations" (RESA)

3.3.1. Free access to the RESA

RESA publications can be viewed:
- in the “PDF” version of the publications journal, published daily (except when no publications have been made), which lists the publications made over a full day and includes links to each document published in PDF format,
- in the “ZIP” version of the publications journal, which lists all the publications made over a full day and which is generated in the form of a ZIP file,
- in the “XML” version of the publications journal, which lists all the publications made over a full day and which is generated in the form of an XML file,
- in the “Online” version of the journal of publications, which provides real-time access to a dynamic list of the day's publications and allows you to search for a specific journal.
A search module is also available to users:
- the search can be based on the registration number or the trade name of the registered entity,
- only publications in the RESA are available via this search module.
Consultation of the RESA is free of charge.

3.3.2. Free access to the archives of the “Mémorial C”

The administrator's website provides a direct link to the Legilux-“Mémorial C” archives, as well as to the “Mémorial C” search module available at www.legilux.lu

4. How the services work

The way the application works is described in a user guide available on the administrator's website.
The user can access the various services offered and described above through the administrator's website.
For services that incur administrative fees, the fees are set by Grand Ducal regulation and can be viewed on the administrator's website.
Once the order has been confirmed, it is deemed to be firm and definitive and may not be modified in any way, particularly with regard to the information that must be provided. Acceptance of the order by the administrator results either from the payment made online by the user, using an electronic payment method for occasional customers, or from the use of the payment code for regular customers.
The administrator makes every effort to ensure that applications are processed promptly during office opening hours. Processing is not necessarily instantaneous. In addition, the administrator reserves the right to postpone the execution of a service due to technical constraints, administrative processing or data verification in order to ensure data quality.
In the absence of any special agreement between the user and the administrator, the total amount of the application costs will be debited by the operator Worldline Financial Services (Europe) S.A. in a single instalment once the administrator has provided the last requested service.

If the administrator is unable to execute the entire order within 7 calendar days, the operator Worldline Financial Services (Europe) S.A. will debit the total amount of the application costs, less the amount for any filing applications for which a regularisation application has been made, one day before this deadline. Unprocessed requests will be refunded to the user by crediting the overpayment to their payment card. The user will receive a receipt for the refund.
The ordered service is made available to the user from the time of delivery and for a period of 20 calendar days.
Users who place their order via an anonymous connection have 20 days in which to print out a payment receipt.

For customers who have placed their various orders by authenticating themselves on the LBR website using a product issued by LuxTrust S.A. or a Luxembourg eID card or an eIDAS electronic certificate offering at least an essential level of security, it is possible to print out a receipt of payment (for occasional customers) or confirmed or summary purchase orders (for users linked to the administrator by a special agreement) for a period of 6 months from delivery and effective payment for all the services making up the order.
The order is cancelled when 20 calendar days have elapsed after the administrator has provided the last service requested.
The administrator reserves the right to cancel any order from a user with whom there is a dispute regarding payment for a previous order.

5. Management of the application

The technical management of the application is carried out by the „Centre des technologies de l'information de l'Etat“ (CTIE).
The administrator reserves the right to delete, modify or add functionalities, or to impose both specific and general restrictions on the various functionalities of the application.

6. Telephone assistance

During office hours, the administrator offers users a telephone assistance service (Helpdesk) to resolve, by telephone only, any difficulties encountered by the user in using the services.
The Helpdesk's role is not to provide legal support of any kind, but to assist users with the administrative formalities they need to complete with LBR.
A follow-up ticket is opened for each call or email sent to the Helpdesk, containing the background of the request and the response provided.
In addition, the telephone conversation may be recorded by the LBR Helpdesk consultant, if necessary. The user will be informed of this beforehand, firstly when he/she accesses the telephone exchange and then, if necessary, by the LBR Helpdesk consultant.

7. Intellectual property rights

The amended law of 18 April 2001 on copyright related rights and databases is applicable to the administrator's website. All elements of the “www.lbr.lu” website are the exclusive intellectual property of the administrator.

8. Liability

The user acknowledges that the administrator has fulfilled all his obligations to provide advice and information regarding the essential characteristics of the services and the minimum configuration of the IT and telecommunications resources required to access and use the services.
The administrator's provision of telephone assistance is only an obligation of means and not of result.
Neither the administrator nor the CTIE may be held liable in the event of the application being unavailable or in the event of Internet network malfunction or service disruption linked to technical elements over which they have no control.
The administrator is subject to a best endeavours obligation with regard to the proper performance of its services.
The administrator shall do everything in its power to prevent harmful programs from penetrating and spreading within its infrastructure. The administrator is subject to a best endeavours obligation with regard to the security of its infrastructure.
The user shall make every effort to prevent malicious programmes from entering and spreading within its infrastructure.
Under no circumstances may the administrator or the CTIE be held liable for indirect damages, and they are not required to compensate for indirect damages, such as, in particular, financial or commercial damages, loss of customers or market share, business disruptions of any kind, increases in costs and other overheads, loss of profit, loss of brand image, loss of data, files or computer programmes of any kind, which may arise from difficulties in performing the service or from the use of the information transmitted, over which they have no control. Indirect damage is deemed to be any action brought by a third party against the user, and consequently there is no right to compensation.
The further use by the user of the documents and information available on the LBR website must not violate public order and must be in accordance with the applicable legal provisions, in particular those relating to the protection of personal data.
In all cases, the user is solely responsible for the further use of the documents and information that LBR makes available to the public within the framework of the legislation and regulations governing the RCS, RESA and RBE. LBR cannot be held liable for any damages resulting from this further use.
The administrator is not liable for the consequences of theft, loss or fraudulent use of a username and password that allow access to the services described above.
The administrator points out that the products issued by LuxTrust SA are personal and that their use is subject to the general terms and conditions set out by LuxTrust SA.
The administrator declines all responsibility for any fraudulent use by a third party of a LuxTrust SA product or an eIDAS electronic certificate.
The administrator reserves the right to block access to its various services for any user found to be making fraudulent or abusive use of them.
The administrator is only bound by an obligation of means for the automatic notification of filings as part of the subscription services, as described in section 3.1.6. The administrator cannot be held liable if a filing is not notified.

9. Protection of personal data

In the context of the use of its website, LBR, which operates under the authority of the Minister of Justice, carries out processing of personal data, in compliance with the Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”).

The party responsible for this processing is the economic interest group LUXEMBOURG BUSINESS REGISTERS, registered with the RCS under the number C24 and with its headquarters at 31, Avenue de la Gare L-1611 Luxembourg.

9.1. Description of processing carried out by LBR

9.1.1. Processing related to the contractual and commercial relationship between the user and LBR

Collected data

Data resulting from the contractual and commercial relationship between the user and LBR and collected by LBR concerns:

details on applications and orders,
for users who have been authorized by LBR, the user's authorization number,
bank details of users with authorization and who have provided a direct debit mandate,
for users who have pre-registered a credit card with the operator Worldline Financial Services (Europe) S.A., which supports secure credit card payments on the Internet (please note that the information entered via this process is not forwarded via the LBR website), the type of payment card, the last 4 digits of said card and its expiry date,
for users who have created a user account, the user's telephone number if this has been provided,
the electronic mail address that was entered as part of an anonymous connection through which a service was ordered,
and all postal addresses provided when ordering documents to be delivered by the LBR in paper form.

Purpose and legal basis of the processing

This processing is carried out by LBR as part of the proper performance of the services it offers on its website (art. 6, paragraph 1, b and f GPDR). In this sense, the processing is necessary for:

the execution of the contractual relationship between the user and LBR (delivery and tracking of orders),
the protection of LBR's legitimate interests by enabling it to retain proof of transactions.

Category of recipient of the processed data

Data relating to the contractual and commercial relationship between LBR and the user is only available to LBR employees who require it to fulfil their tasks and, where applicable, to its external employees tasked with technical support and the “Centre des technologies de l'information de l'État” (CTIE), for support purposes. The data will not be passed on to third parties.

Storage period

The history of the user's requests and orders is kept for 12 months. Payment receipts and monthly statements issued by the LBR are kept for 10 years before being permanently deleted.

9.1.2. Processing in connection with the use of the telephone assistance service

Collected data

LBR collects and records data in follow-up tickets about who has contacted the LBR Helpdesk and the content of the request during the call. The data processed are:

the user's first name and last name as provided at the time of the telephone call, their telephone number or, where applicable, their email address or authorization number, if the user has one,
the context of the request,
and, where applicable, the content of the telephone conversation as recorded.

Purpose and legal basis of the processing of personal data

This processing is carried out by the LBR because it is necessary for the purposes of the legitimate interests pursued by the LBR (Art. 6, paragraph 1 f GDPR). LBR's legitimate interests include, among other things, protecting the LBR in the event of legal disputes and improving its services.

Its purpose is to:

provide LBR with evidence in the event of a possible legal dispute,
improve the assistance service and the quality of calls,
enable LBR to improve the presentation and operation of its website.

Category of recipient of the processed data

The data is only available to LBR employees who need it to fulfil their tasks and, if applicable, to external employees who are tasked with providing technical support. Data will not be passed on to third parties, except in the event of a legal dispute in which LBR is a party.

Storage period

Follow-up tickets are kept for 12 months following their creation. Any recordings made are kept for 6 months following recording, except in the event of a legal dispute.

9.1.3. Processing carried out as part of the connection to the LBR website

Collected data

A certain amount of personal data is collected when creating a user account associated with the use of a LuxTrust certificate when logging in to the LBR website. The user account is created via the government platform dedicated to connecting to an electronic service of the Luxembourg state.

The data are as follows:

username,
first and last name,
email address,
unique eIDAS identifier,
internal identification number assigned when the account is created.

All this data can be seen in the personal area “My account” of the registered user.

Purpose and legal basis of the processing

The purpose of this processing is to create a user account enabling the user to access the services offered on the website, which require authentication (filing application, RBE declaration). It is carried out in compliance with the legal and regulatory provisions requiring it (legislation applicable to the RCS and the RBE).

Category of recipient of the processed data

The data relating to the user's account is only available to LBR employees who need it to fulfil their tasks and, where applicable, to external employees tasked with providing technical support and to the “Centre des technologies de l'information de l'Etat” (CTIE) for support purposes. The data will not be passed on to third parties.

Storage period

Data relating to a user's account will be kept until the account is closed.

Any request by the user to close the account should be sent by email to the LBR Helpdesk via our contact form. Following such a request, LBR will lock the account so that it can no longer be used and will forward the request for closure to the “Centre des technologies de l'information de l'État” (CTIE).

Any account that is inactive for a consecutive period of 12 months will be automatically closed by LBR, without prior notification to the user.

When a user account is closed (at the user's request or automatically by LBR), the associated data is stored by LBR for a period of 12 months for administrative purposes, before being permanently deleted.

9.1.4. Processing carried out by LBR in its capacity as administrator of the RCS and RBE

Processing in connection with the RCS

Collected data

LBR collects data pursuant to the amended law of 19 December 2002 concerning the trade and company register and the accounting and annual accounts of companies, which sets out an exhaustive list (surname, first names, date and place of birth, sex, nationality country of residence, private or professional address, national identification number of any natural person registered with the RCS in any capacity whatsoever).

It also keeps the following data relating to applicants: surname and first name communicated when the user account is created, the internal identification number associated with this account and the unique eIDAS identification number.

Purpose and legal basis of the processing

LBR carries out this processing in order to fulfil its public interest mission, which it is obliged to do, and in the context of legal and regulatory provisions that oblige it to do so (Art. 6 para. 1, c and e GPDR). In this context, the processing is necessary in order to:

ensure the implementation of legal provisions (amended law of 19 December 2002 on the trade and company register and the accounting and annual financial statements of companies and its implementing regulation),
ensure the authentication and identification of the applicants.

Category of recipient of the processed data

The data collected in accordance with the amended law of 19 December 2002 on the trade and company register and on the accounting and annual accounts of companies is public, with the exception of national identification numbers.

Data relating to applicants is only available to LBR employees who require it to fulfil their tasks and, where applicable, to external employees tasked with providing technical support and to the “Centre des technologies de l'information de l'Etat” (CTIE) for support purposes. It is not passed on to third parties unless LBR receives a request for identification from the judicial authorities.

Storage period

The data collected in accordance with the amended law of 19 December 2002 on the trade and company register and the accounting and annual accounts of companies are stored in accordance with the applicable legal and administrative provisions for a period of 20 years from the deletion of the registered entity's file. After that, they will be transferred to the National Archives in accordance with the law of 25 June 2004 reorganising the State's cultural institutes, as amended, and the law of 17 August 2018 on archives.

In the specific context of the filing application services with the RCS, the data identifying the applicant and relating to the filing made are kept for the legally required period as stipulated in the applicable laws and regulations, i.e. 20 years from the date of deletion of the registered entity's file in which the filing was made.

Processing in connection with the RBE

Collected data

LBR collects data in accordance with the law of 13 January 2019 establishing a Register of Beneficial Owners, which sets out an exhaustive list of these data (e.g. surname, first name, day, month and year of birth, place of birth, nationality(ies), country of residence, private or professional address, and national identification number of the beneficial owners).

It also stores the following information about the declarants: surname and first name, as provided when the user account was created, the internal identification number associated with that account and the unique eIDAS identification number.

Access to the RBE and the issuing of extracts or certificates of non-existence are tracked.

When requests for extracts are issued under Article 7 (3) of the Grand-Ducal Regulation of 15 February 2019 on the terms and conditions of registration, payment of filing fees and access to information entered in the Register of Beneficial Owners, the data relating to the LuxTrust certificate used, the reason given by the user and the reference number of the extract issued are stored by the LBR.

Purpose and legal basis of the processing

LBR carries out this processing in order to fulfil its public interest mission, which it is obliged to do, and in the context of legal and regulatory provisions that oblige it to do so (Art. 6 para. 1, c and e DSVGO). In this context, the processing is necessary in order to:

ensure compliance with legal requirements (modified law of 13 January 2019 establishing a Register of Beneficial Owners and its implementing regulation),
ensure the authentication and identification of the applicants.

Category of recipient of the processed data

The data collected in accordance with Article 3 of the modified law of 13 January 2019 establishing a Register of Beneficial Owners is made available to the national authorities defined in Article 1 of the aforementioned law.

The data collected pursuant to Article 3(1)(1) to (8), (12) and (13) of the aforementioned law shall be accessible to professionals falling within one of the categories described in Article 2 of the amended law of 12 November 2004 on the fight against money laundering and terrorist financing, national self-regulatory bodies in the exercise of their monitoring tasks in the fight against money laundering and terrorist financing, persons with a legitimate interest in the fight against money laundering and terrorist financing, , to government departments and public administrations and entities for which such access is provided for by law in the context of the tasks defined by law.

Data on declarants, RBE consultations and requests for an extract or a certificate of non-existence are only available to LBR employees who need them to fulfil their tasks and, where applicable, to external LBR employees tasked with technical support, as well as to the “Centre des technologies de l'information de l'État” (CTIE) for support purposes. They will not be communicated to third parties, except in the event that the LBR receives a request for identification from the judicial authorities.

LBR may authorize the transmission of statistical data from the RBE to third parties, upon written and reasoned request specifying the objective and intended use, provided that it does not allow the identification of registered persons or entities and that it is used for statistical or scientific purposes. The third party must guarantee the non-disclosure of confidential data when such data is issued.

Storage period

Data collected in the context of the law of 13 January 2019 establishing a register of beneficial owners is kept in accordance with the legal and regulatory provisions in force for a period of five years from the date of deletion of the registered entity's file with the RCS.

In the specific context of declarations with the RBE, the data identifying the declarant and linked to the declaration made are kept for the legally prescribed period as defined by the relevant legal and regulatory provisions, i.e. five years from the date of deletion of the registered entity's file in which the declaration was made, from the RCS.

The data collected for the purpose of keeping track of consultations and requests for extracts or certificates of non-existence are kept for a period of five years from the date of the consultation or the date of issue of the extract or certificate.

Processing in connection with the implementation of financial restrictive measures

The purpose of the planned processing is to compare data on natural persons registered with the RCS and the RBE with data from public sanctions lists issued by the EU, the United Nations and, where applicable, Luxembourg, which list persons subject to financial restrictive measures.

Collected data

The data of natural persons currently registered with the RCS or RBE (surname, first name(s), date of birth, country of birth, nationality(ies), country of address) is processed, as well as personal data from public sanctions lists published by the EU, the United Nations and, where applicable, Luxembourg.

If necessary, documentary evidence that allows the exact identification of the natural person registered with the RCS or RBE may be added in order to confirm or refute a possible match with a person on a financial sanctions list.

Purpose and legal basis of the processing

LBR carries out this processing in the exercise of the public interest mission entrusted to it, in compliance with legal provisions (Law of 19 December 2020 on the implementation of restrictive measures in financial matters) and in order to pursue the legitimate interest of the data controller (art. 6.1, c), e) and f) GDPR).

This processing is necessary in order to:

ensure the identification of persons registered in the RCS or RBE database who appear on the sanctions lists,
ensure participation in the fight against money laundering and terrorist financing,
ensure the involvement in the implementation of financial restriction measures and
ensure the disclosure of actual or potential matches to the relevant authorities.

Category of recipient of the processed data

The data is only available to authorised LBR employees for the purpose of performing their tasks.

In the event of the identification of a proven correspondence between a person registered with the RCS or RBE and a person subject to sanctions, and for all questions relating to potential cases of homonymy, the data concerned are transmitted to the competent national authority (the Ministry of Finance).

Storage period

All potential correspondence, together with associated comments and decisions, will be kept for 5 years from the date of processing.

Communications to the competent authorities in the event of an actual or potential match are kept for 5 years. After 5 years, the data is anonymised.

9.2. Rights of the user

Users have the right to request information (Article 15 GDPR), correction (Article 16 GDPR) and deletion (Article 17 GDPR) of data concerning him or her within the framework of the legal provisions that oblige LBR to store personal data. They may also object to the processing of their data under the conditions of Article 21 GDPR and achieve a limitation of the processing under the conditions of Article 18 GDPR.

The user has access to his data directly on the LBR website, in the secured area “My account”, "Tracking my requests" and "My invoices and receipts".

Requests for access, rectification, erasure, restriction or objection to processing carried out by LBR, in its capacity as data controller, should be sent to the following email address: dpo@lbr.lu or by post to G.I.E LUXEMBOURG BUSINESS REGISTERS, for the attention of the Data Protection Officer, 31, Avenue de la Gare, L-1611 Luxembourg.

The user's right of access, as provided for in Article 15 of the GDPR, may be exercised by addressing requests to LBR, in its capacity as data controller.

The right of access of any registered entity or any beneficial owner listed in the Beneficial Owners Register is deferred and limited in that it cannot obtain information on the consultations carried out by the entities and persons referred to in Article 13(3) of the aforementioned Act of 13 January 2019, or on the information transmitted to the administrator pursuant to Article 8, paragraph 1 of the aforementioned law. Access to this information has to be exercised through the intermediary of the National Commission for Data Protection, which, after having exercised this right, limits itself to confirming the exercise of this right without giving further details.

9.3. Complaints

Users may file complaints about the above-mentioned processing operations with the National Commission for Data Protection, based at 15, Boulevard du Jazz, L-4370 Belvaux, or with the competent supervisory authority in their country of residence.

9.4. Information on the contractual nature of the provision of personal data

The user is provided with the following information:

the requirement to provide personal data is of a contractual nature (within the framework of the contractual relationship between the user and LBR, which consists in particular of the ordering of documents and services);
the provision of personal data by the user, insofar as it is necessary for the delivery of the services and/or documents ordered, is a prerequisite for the conclusion of this contractual relationship;
in this context, the user is obliged to provide their personal data if they wish to order and/or use services and/or documents from the LBR and via its website;
failure to provide this personal data will make it impossible to order services and/or documents from the LBR.

10. Processing in connection with website audience measurement

Certain data relating to the user's hardware and software, which are not of a nature to identify the user, are collected when the user visits the LBR site. This data is collected for the sole purpose of compiling visitor statistics (browser type, resolution, approximate location, etc.) in order to provide users with the best possible service.

The user's full IP address is never stored. Only part of the IP address is stored to obtain overall statistics, and in no case is it possible to identify a user.

This data is stored and hosted in Europe in a solution provided by a subcontractor who is subject to the same legal obligations concerning the protection of personal data in the event that such data is collected in the future.

The data is not stored for longer than is necessary to monitor audience development based on changes in browsers, resolutions used or other available statistical data.

11. Cookies

11.1. Internal cookies enabling the website to function properly

In order to ensure proper functioning, the website uses so-called “session cookies”. They are only stored for the duration of the session.

“Session cookies” should not be confused with persistent cookies, which are often used to store confidential information and can therefore pose a security and privacy risk, which explains their bad reputation.

Modern browsers such as Microsoft Edge and Mozilla offer the option of disabling persistent cookies while accepting session cookies, which are necessary for the website to function properly.

Use of the site with a browser configured to accept cookies constitutes acceptance of LBR's cookies and those of third parties.

Note: Persistent or session cookies are normally activated by default when the browser is installed.

11.2. External cookies in connection with services provided by third-party sites

Exceptionally, the LBR website may link to services offered by third-party websites in order to improve its interactivity, particularly with regard to videos broadcast on the website (YouTube). The purpose of cookies placed via video sharing services is to enable users to view multimedia content directly on the website.

Modern browsers such as Microsoft Edge and Mozilla allow you to disable persistent cookies.

Link to Google’s privacy policy.

12. Website security – Protection against automated access

As part of securing the website and in order to prevent abusive automated connections (by robots or scripts), LBR uses an automatic CAPTCHA verification system. The sole purpose of this device is to guarantee the security and integrity of the website.

The solution used complies with the requirements of the General Data Protection Regulation (GDPR).
It operates without cookies, does not collect or store any personal data, collects only information strictly necessary for the purpose of securing the website, and processes requests in a strictly anonymous manner.

No information that could directly or indirectly identify a user is stored in this context. Any attempt to circumvent this protection system may result in the suspension or removal of access to the services of the LBR website www.lbr.lu.

In accordance with the provisions of the Grand-Ducal Regulation of 23 January 2003 implementing the Law of 19 December 2002 on the Trade and Company Register and the accounting and annual accounts of companies and of the Law of 13 January 2019 establishing a Beneficial Owners Register, access to the website is strictly limited to manual and individual use.

Robotic access is therefore prohibited, as mass and automated connections to the website may result in a slowdown of the system or even its blockage.

An application programming interface (API) is available to enable automated access to data, subject to compliance with the conditions set out in particular in Article 22(2) of the aforementioned amended Grand-Ducal Regulation of 23 January 2003 and Article 7(3) of the Grand-Ducal Regulation of 15 February 2019 relating to the arrangements for registration, payment of administrative fees and access to the information entered in the Register of Beneficial Owners. Access to this API is subject to the submission of a duly reasoned and documented request and may be granted subject to the conclusion of a specific agreement with the administrator of the Trade and Company Register and the Beneficial Owners Register.

13. Applicable laws

These general terms and conditions are subject to Luxembourg law. In the event of a dispute, the Luxembourg courts shall have sole jurisdiction, unless otherwise stipulated by mandatory provisions.

14. Invalidity

If one or more provisions of these general terms and conditions are deemed or declared invalid by a law, a regulation or following a final decision of a competent court, the remaining provisions shall retain their full force and scope.