Processing of personal data

The processing operations are as follows:

• Documents and requisitions filed with the RCS are published online for remote consultation by the public on the RCS website and by government agencies on a dedicated portal.
  
  
• Publishing information entered in the RBE online, for remote consultation by the persons referred to in Article 11 of the amended law of 13 January 2019 establishing a Register of Beneficiaries.
  
  
• Electronic publication of information and documents in the RESA, the publication of which is required by law.

The natural persons concerned are:

• Those required to be registered with the RCS in accordance with the amended law of 19 December 2002 on the trade and company register and the accounting and annual accounts of companies.
  
  
• Those to be registered in the RBE in application of the amended law of 13 January 2019 introducing a Register of Beneficial Owners.
  
  
• Mentioned in documents or information that must be published in the RESA, as required by law (e.g. authorised representatives, associates, proxy holders, etc.).

The data concerning these persons is communicated to the LBR by the registered person or entity concerned, their authorised agent or even the certifying notary at the time of the formalities of filing with the RCS or declaration with the RBE.

Personal data processed:

LBR collects:

• Personal data, the exhaustive list of which is defined by the aforementioned amended law of 19 December 2002 (surname, first names, date and place of birth, gender, nationality, country of residence, private or professional address, national identification number of any natural person registered with the RCS, in any capacity whatsoever).
  
  
• Personal data, the exhaustive list of which is defined by the aforementioned amended law of 13 January 2019 (surname, first names, date, month and year of birth, place of birth, nationality (ies), country of residence, private or professional address, national identification number of beneficial owners).
  
  
• Documents or information to be published in RESA, for which the law determines the method of publication (by extract, in full or by reference to the filing) and which may include personal data. In the case of publications by extract, only the data required by law is included. On the other hand, in the case of full publications, the content depends in practice on the drafter of the document, while the law does not always define precisely what data should be included.

Legal basis for processing:

These processing operations are carried out in accordance with the legal and regulatory provisions that require them (Art. 6 para. 1, c GDPR).

The purposes of the processing are as follows:

• Guaranteeing the public nature of information defined as such by the legislator.
• Make certain acts and information enforceable against third parties.
• Ensuring transparency to promote confidence in commercial transactions and, at European level, in the internal market.
• Ensuring that information on companies and merchants is easily available to third parties, in particular investors, interested parties, business partners and the authorities.
• Participate in the fight against money laundering and terrorist financing.
• Enable the sharing of information and documents relating to companies on the e-Justice portal of the European Commission.

Recipient of the processed data:

• The data and documents collected by the RCS and RESA are accessible to the public, to any interested third party, whether or not they are resident in Luxembourg, and to the authorities.
  
  
• With regard to the RBE, the data is accessible to national authorities, professionals belonging to one of the professional categories described in Article 2 of the amended law of 12 November 2004 on the fight against money laundering and terrorist financing, national self-regulatory bodies in the exercise of their supervisory functions in the fight against money laundering and terrorist financing, persons with a legitimate interest in the fight against money laundering and terrorist financing, government departments and public administrations for which such access is provided for by law in the context of the tasks defined by law. The aforementioned amended law of 13 January 2019 specifies which data is accessible (Articles 11 and 12).
  
  LBR may authorize the transmission of statistical data from the Beneficial Owners Register (RBE) to third parties, upon written request stating the purpose and intended use, provided that such data does not allow the identification of the registered persons or entities and is used for statistical or scientific purposes. The third party must guarantee the non-disclosure of confidential data when such data is provided.

Storage period:

• The data collected in accordance with the amended law of 19 December 2002 on the trade and company register and the accounting and annual financial statements of companies will be stored in accordance with the applicable legal and administrative provisions for a period of 20 years from the deletion of the registered entity's file. After that, they will be transferred to the National Archives in accordance with the law of 25 June 2004 reorganising the State's cultural institutions and the law of 17 August 2018 on archiving.
  
  
• The data collected in relation to the aforementioned amended law of 13 January 2019 will be stored in accordance with the applicable legal and regulatory provisions for a period of 5 years from the date of deletion of the registered entity's file with the RCS.
  
  
• Publications included in the RESA are kept for an indefinite period (since they are published in an official journal).

The processing operations are as follows:

• Authentication and identification of the natural person who made the filing with the RCS on behalf of a registered person or entity and for which he or she is responsible.
  
  
• Authentication and identification of the natural person who made a declaration with the RBE on behalf of a registered person or entity and for which he or she is responsible.

The natural persons concerned are:

• The person who has made a filing with the RCS (applicant).
• The person who has made a declaration with the RBE (declarant).

Personal data processed:

LBR collects the first and last name provided by the applicant or declarant when the user account is created, the internal identification number assigned to that account and the unique eIDAS identification number of the electronic certificate used for the process.

Legal basis for processing:

These processing operations are carried out in the exercise of the public interest mission entrusted to LBR (Article 6 paragraph 1, e GDPR), as well as on the basis of the amended laws of 19 December 2002 and 13 January 2019 referred to above.

The purposes of the processing are as follows:

• Securing the filings with the RCS and the declarations with the RBE by identifying the person who completed the formalities, in particular in the event of a dispute.
  
  
• Track intervention on the RCS and RBE databases.
  
  
• Implementation of the principle enshrined in the aforementioned amended laws of 19 December 2002 and 13 January 2019 respectively, according to which the applicant/declarant is responsible for the filing/declaration made by him.

Recipient of the processed data:

The data is only available to LBR employees who need it to fulfil their tasks and, where applicable, to external employees tasked with providing technical support and to the “Centre des technologies de l'information de l'Etat” (CTIE) for support purposes. The data will not be passed on to third parties, unless LBR receives a request from the judicial authorities to identify the person who has made a filing or declaration.

Storage period:

• In the specific context of the filing application services with the RCS, the data identifying the applicant and relating to the filing made are kept for the legally required period as stipulated in the applicable laws and regulations, i.e. 20 years from the date of deletion of the registered entity's file in which the filing was made.
  
  
• In the specific context of declarations with the RBE, the data identifying the declarant and linked to the declaration made are kept for the legally required period as stipulated in the applicable laws and regulations, i.e. five years from the date of deletion of the registered entity's file in which the declaration was made, from the RCS.

The processing operations are as follows:

Creation of a user account on the LBR website for completing the formalities for filing with the RCS and making declarations with the RBE, consulting the RBE and tracing RBE consultations.

The natural persons concerned are:

• Natural persons required to make filings with the RCS or declarations with the RBE.
• Natural persons authorized to consult the RBE.
• Natural persons who wish to create a user account on the LBR website.

Personal data processed:

A certain amount of personal data is collected when creating a user account linked to the use of a Luxtrust certificate when connecting to the LBR website. The user account is created via the government platform dedicated to connecting to an online service of the Luxembourg government.

The data are as follows:

• user name,
• first and last name,
• email address,
• unique eIDAS identifier,
• internal identification number assigned when the account is created.

All this data can be seen in the personal area “My account” of the registered user.
Consultations of the RBE are logged by LBR, as prescribed by the amended law of 13 January 2019 establishing a Register of Beneficial Owners.

Legal basis for processing:

This processing is carried out in the context of legal and regulatory provisions requiring it and in the exercise of the public interest mission entrusted to LBR (Article 6 paragraph 1, c and e GDPR).

The purposes of the processing are as follows:

• Access to the formalities for filing with the RCS and declaring with the RBE.
• Enable access to the RBE.
• Track current filing and declaration applications.

Recipient of the processed data:

The data is only available to LBR employees who need it to fulfil their tasks and, where applicable, to external employees tasked with providing technical support and to the “Centre des technologies de l'information de l'Etat” (CTIE) for support purposes. The data will not be passed on to third parties.

Storage period:

• Data relating to a user's account is stored until the account is deleted.
  
  
• Any request by the user to close the account should be sent by email to the LBR Helpdesk via our contact form. Following such a request, LBR will lock the account so that it can no longer be used and will forward the request for closure to the “Centre des technologies de l'information de l'État” (CTIE).
  
  
• Any account that is inactive for a consecutive period of 12 months will be automatically closed by LBR, without prior notification to the user.
  
  
• When a user account is closed (at the user's request or automatically by LBR), the associated data is stored by LBR for a period of 12 months for administrative purposes, before being permanently deleted.
  
  
• Data collected for the purpose of keeping track of consultations and requests for extracts or certificates of non-existence are kept for a period of five years from the date of the consultation or the date of issue of the extract or certificate.

The processing operations are as follows:

Compare data on natural persons registered with the RCS and the RBE with data from public sanctions lists issued by the EU, the United Nations and, where applicable, Luxembourg, which list persons subject to financial restrictive measures.

The natural persons concerned are:

Who are currently registered with the RCS or the RBE, in whatever capacity.

Processed data:

The processed data are as follows:

• first and last Name(s),
• date of birth,
• country of birth,
• nationality(ies),
• country of address,
• if necessary, documentary evidence that allows the exact identification of the natural person registered with the RCS or RBE may be added in order to confirm or refute a possible match with a person on a financial sanctions list.
• personal data from public sanctions lists issued by the EU, the UN and, where applicable, Luxembourg.

Legal basis for processing:

LBR carries out this processing in the exercise of the public interest mission entrusted to it, in compliance with legal provisions (Law of 19 December 2020 on the implementation of restrictive measures in financial matters) and in order to pursue the legitimate interest of the data controller (art. 6.1, c), e) and f) GDPR).

The purposes of the processing are as follows:

• ensure the identification of persons registered in the RCS or RBE database who appear on the sanctions lists,
• ensure participation in the fight against money laundering and terrorist financing,
• ensure the involvement in the implementation of financial restriction measures and
• ensure the disclosure of actual or potential matches to the relevant authorities.

Recipient of the processed data:

The data is only available to authorised LBR employees for the purpose of performing their tasks.

In the event of the identification of a proven correspondence between a person registered with the RCS or RBE and a person subject to sanctions, and for all questions relating to potential cases of homonymy, the data concerned are transmitted to the competent national authority (the Ministry of Finance).

Storage period:

• All potential correspondence, together with associated comments and decisions, will be kept for 5 years from the date of processing.
  
  
• Communications to the competent authorities in the event of an actual or potential match are kept for 5 years. After 5 years, the data is anonymised.

The processing operations are as follows:

Provision of the ordered services, which LBR must issue.

The persons concerned are:

Any person who places an order on the LBR website.

Personal data processed:

• details on applications and orders,
  
  
• for users who have been authorized by LBR, the user's authorization number,
  
  
• bank details of users with authorization and who have provided a direct debit mandate,
  
  
• for users who have pre-registered a credit card with the operator SIX Payment Services (Europe) S.A., which supports secure credit card payments on the Internet (please note that the information entered via this process is not forwarded via the LBR website), the type of payment card, the last 4 digits of said card and its expiry date,
  
  
• the electronic mail address that was entered as part of an anonymous connection through which a service was ordered,
  
  
• and all postal addresses provided when ordering documents to be delivered by the LBR in paper form.

Legal basis for processing:

This processing is carried out by LBR as part of the proper performance of the services it offers on its website (art. 6, paragraph 1, b and f GPDR).

The purposes of the processing are as follows:

• the execution of the contractual relationship between the user and LBR (delivery and tracking of orders),
• the protection of LBR's legitimate interests by enabling it to retain proof of transactions.

Recipient of the processed data:

Data relating to the contractual and commercial relationship between LBR and the user is only available to LBR employees who require it to fulfil their tasks and, where applicable, to its external employees tasked with technical support and the “Centre des technologies de l'information de l'État” (CTIE), for support purposes. The data will not be passed on to third parties.

Storage period:

The history of the user's requests and orders is kept for 12 months. Payment receipts and monthly statements issued by the LBR are kept for 10 years before being permanently deleted.

Information on the contractual nature of the provision of personal data in the context of processing:

• the requirement to provide personal data is of a contractual nature;
  
  
• the provision of personal data by the user, insofar as it is necessary for the delivery of the services and/or documents ordered, is a prerequisite for the conclusion of this contractual relationship;
  
  
• in this context, the user is obliged to provide their personal data if they wish to order and/or use services and/or documents from the LBR and via its website;
  
  
• failure to provide this personal data will make it impossible to order services and/or documents from the LBR.

The processing operations are as follows:

Management of the support requests sent to the LBR Helpdesk and the responses provided.

The persons concerned are:

Every person who has contacted the LBR Helpdesk (by phone or email).

Personal data processed:

• the user's first name and last name as provided at the time of the telephone call, their telephone number or, where applicable, their email address or authorization number, if the user has one,
• the context of the request,
• and, where applicable, the content of the telephone conversation as recorded.

Legal basis for processing:

This processing is carried out by the LBR because it is necessary for the purposes of the legitimate interests pursued by the LBR (Art. 6, paragraph 1 f GDPR). LBR's legitimate interests include, among other things, protecting the LBR in the event of legal disputes and improving its services.

The purposes of the processing are as follows:

• provide LBR with evidence in the event of a possible legal dispute,
• improve the assistance service and the quality of calls,
• enable LBR to improve the presentation and operation of its website.

Recipient of the processed data:

The data is only available to LBR employees who need it to fulfil their tasks and, if applicable, to external employees who are tasked with providing technical support. Data will not be passed on to third parties, except in the event of a legal dispute in which LBR is a party.

Storage period:

Follow-up tickets are kept for 12 months following their creation. Any recordings made are kept for 6 months following recording, except in the event of a legal dispute.

The processing operations are as follows:

Direct viewing and recording of images upon access by any person, including visitors, workers, service providers, subcontractors and suppliers, to the physical premises of LBR. Cameras are installed inside the building and cover the following areas:

• building entrances and exists,
• access to staircases,
• emergency exists,
• lift access,
• access to terraces,
• hallways accessible to visitors and leading to the reception area,
• the visitor reception area on the first floor,
• Technical or non-publicly accessible areas, in particular access points to the freight lift, technical rooms (including the waste disposal room) and service access areas.

The persons concerned are:

Any person accessing LBR premises on an occasional or regular basis.

Personal data processed:

The processed data are the images captured by all the cameras.

Legal basis for processing:

This processing is carried out by LBR because it is necessary for the purposes of the legitimate interests pursued by LBR, in this case ensuring the safety of its property and persons (art. 6, paragraph 1 f GDPR).

The purposes of the processing are as follows:

• provide secure access to the LBR building,
• ensure the safety of its employees and visitors,
• detect any intrusion or unauthorized access,
• pinpoint the origin of an incident,
• detect and identify potentially suspicious or dangerous behaviour likely to cause accidents or incidents,
• protect LBR’s property (building, installation, equipment),
• alert emergency services, fire brigade or law enforcement in good time and facilitating their intervention.

It is expressly specified that this processing neither aims nor has the effect of monitoring the activity of workers or employees.

Recipient of the processed data:

Access to this data is secure. Images are only accessible to authorized LBR employees who require them to fulfil their duties.

They are not passed on to third parties, except in the event of an incident or crime, in which case they are forwarded to the judicial authorities or the police.

Storage period:

Data is stored for seven days and automatically destroyed on the eighth day. In the event of an incident or criminal offence, the images may be kept beyond this period.