1. Who are we?
AFC Luxembourg is a public limited company (société anonyme) under Luxembourg law, offering services in technical fields (accounting, tax, corporate legal secretarial services, social secretarial services, and financial engineering) to clients active in Belgium and Luxembourg.
Address: 1, Grand-Rue, L-8372 Hobscheid
RCS number: B 267908
2. What data do we collect?
We primarily process:
- Identification data (name, contact details, registration number, etc.);
- Professional data (position, employer, VAT number, etc.);
- Accounting, tax and social data related to our engagements;
- Data provided via our website or during contact with us (email, forms, etc.).
3. Why do we use your data?
The purposes for collecting your data are as follows:
- Performance of our engagements (contract, tax and accounting obligations);
- Compliance with legal obligations (anti-money laundering, record-keeping);
- Consent for marketing communications;
- Legitimate interest in security, internal management and fraud prevention.
We rely on the legal bases provided for under the GDPR: legal obligation, contract, legitimate interest, or consent.
Video surveillance
For the security of its premises, staff and property, AFC Luxembourg has implemented a video surveillance system.
This processing is based on AFC Luxembourg’s legitimate interest within the meaning of the GDPR, consisting of ensuring the physical protection of its premises, staff and property.
Cameras are installed only in the areas necessary for this purpose (in particular entrances and exits (access to buildings)). No cameras are installed in areas used for private purposes.
Persons who may enter the monitored areas are informed of the presence of cameras by on-site signage. A visible notice at the entrance to each relevant area refers to this policy for full information.
The images captured may allow identification of persons entering or moving within the monitored areas. They are kept for a maximum period of 30 days, except in the event of an incident requiring their retention for the handling of the matter concerned.
Access to the images is strictly limited to authorised persons within AFC Luxembourg. They may be shared with the competent authorities where necessary.
You have the rights provided for under the GDPR (access, objection, restriction, etc.). The procedures for exercising these rights are detailed in the “Your rights” section above.
4. What are your rights?
In accordance with the GDPR, you have the following rights:
- Right of access: you may ask what personal data we hold about you and obtain a copy of it;
- Right to rectification: if certain data is inaccurate or incomplete, you may ask us to correct or complete it;
- Right to erasure (“right to be forgotten”): in certain cases, you may request the deletion of your personal data, for example if it is no longer necessary or if you withdraw your consent;
- Right to data portability: you may receive your data in a readable format and transmit it to another organisation if you wish;
- Right to object: you may refuse to have your data used in certain situations;
- Right to information: you have the right to be informed clearly and transparently about how your data is collected and used.
To ensure your request is handled efficiently and securely, we invite you to make it clearly and precisely, indicating in particular the right you wish to exercise, the data concerned and, where applicable, the period involved.
If you no longer wish to receive our electronic communications (newsletters), or for any other question relating to your personal data or the exercise of your rights, you may contact our Data Protection Officer (DPO) at dpo@afc.lu.
5. Who may your personal data be shared with?
Your personal data may be shared with:
- Our service providers: hosting providers, IT service providers responsible for the support, maintenance and security of our systems;
- The publishers of software used for our engagements, as well as external providers involved in delivering services to our clients or in our communication and marketing activities;
- Our/your professional advisors (e.g. lawyers);
- Any competent administrative, judicial or regulatory authority;
- Your employer and/or their advisors;
- Any other third party with a legitimate need to access your data as part of one or more processing activities necessary to carry out our engagements (e.g. notary, bank, statutory auditor).
6. How long do we keep your data?
Your personal data will be kept in our systems for the longest of the following periods:
- The time necessary to achieve the purposes for which it was collected;
- The period imposed by legal or regulatory obligations regarding retention, archiving or limitation periods;
- Until the expiry of the applicable limitation periods in the event of litigation or investigation relating to any of our offers, proposals or services.
7. How do we manage cookies on our website?
Our website uses various types of cookies (essential and non-essential):
- Cookies strictly necessary for the website to function;
- Audience measurement cookies (e.g. Google Analytics);
- Marketing or social media cookies (where applicable).
When you visit our website, a banner lets you manage your preferences and accept or refuse non-essential cookies. You can change your choices at any time via your browser settings or our cookie management tool.
8. How do we secure your data?
We apply technical and organisational security measures to protect your data against loss, unauthorised access or misuse.
As part of improving its services and optimising its internal processes, AFC Luxembourg may use certain artificial intelligence (AI) tools. These tools may be used, for example, to assist in drafting or processing letters or emails. AI is used exclusively to assist our staff in their tasks.
No automated decision having legal or significant effects on individuals is taken solely on the basis of automated processing or AI. All important decisions involve human intervention.
If an external AI tool is used, we ensure that it complies with GDPR requirements, in particular regarding data location and security.
9. What to do in case of a question or complaint?
You may exercise the above-mentioned rights by writing to AFC Luxembourg at the following email address:
AFC Luxembourg SA
1 Grand-Rue, L-8372 Hobscheid, Luxembourg
dpo@afc.lu
We will do everything possible to ensure careful and lawful processing of the personal data of our clients and third parties, in accordance with applicable regulations. However, if you believe that your rights have not been respected, you are free to lodge a complaint with the competent supervisory authority:
Commission nationale pour la protection des données (CNPD)
+352 26 10 60 -1
https://cnpd.public.lu/fr.html