1. Data and rights
This section explains what data we collect, why we collect it, and what rights you have regarding your information.
Data controller
The data controller is The BOARD Luxembourg S.à r.l., registered under RCS B284770, having its registered office at 70 Route d’Esch, L-1470 Luxembourg, with a share capital of €12,000, and VAT number LU35576936.
Data collected
We collect and process only data necessary for our professional and legal activities, including:
- Identification and contact data (name, address, email, phone number)
- Professional data (position, company, sector)
- Business relationship data (financial details, contractual information)
- Technical and browsing data (IP address, browser type, pages visited, cookies).
Purpose and legal basis
Data is processed for the following purposes:
- Providing fiduciary, accounting, and administrative services
- Responding to client inquiries and maintaining client relationships
- Fulfilling AML/KYC obligations under the Law of 12 November 2004
- Registering and maintaining information on beneficial owners (UBOs) under the Law of 10 July 2020
- Complying with legal and regulatory reporting duties
- Enhancing client experience, website functionality, and communication
- Ensuring system security and fraud prevention.
Legal basis and retention
Processing is based on:
- The performance of a contract or pre-contractual measures
- Legal obligations (AML/KYC, fiduciary and accounting laws)
- Legitimate interest of the company (client service, compliance, and security)
- Consent (for marketing or communications where applicable)
Personal data is retained for the duration of the contractual relationship and for at least five years following its termination, in line with Luxembourg fiduciary, accounting, and AML requirements.
User rights
Under Regulation (EU) 2016/679 (GDPR) and the Luxembourg Data Protection Act of 1 August 2018, you have the right to:
- Access your data
- Request rectification or erasure
- Restrict or object to processing
- Exercise data portability
- Withdraw your consent at any time
You may exercise these rights by contacting contact@theboardluxembourg.com
or by post at 70 Route d’Esch, L-1470 Luxembourg.
If you believe your rights have been infringed, you may file a complaint with the CNPD (Commission Nationale pour la Protection des Données).
2. Security, sharing and cookies
This section outlines how data is protected, when it may be shared, and how cookies are managed.
Data sharing and disclosure
Personal data may be shared with:
- Authorised staff of The BOARD Luxembourg S.à r.l.
- Trusted technical service providers (hosting, IT maintenance, secure accounting systems)
- Regulatory authorities and financial intelligence units (e.g., CSSF, CRF, CNPD) when legally required
- Business partners or subcontractors, subject to strict confidentiality and data protection clauses
Data transfers outside the European Economic Area (EEA) occur only where adequate safeguards are in place, in accordance with GDPR Articles 44–49 (e.g., Standard Contractual Clauses)..
Security measures
We implement technical and organisational measures to protect data integrity and confidentiality, including:
- HTTPS encryption and secure authentication
- Role-based access control for staff
- Encrypted data storage and regular backups
- Continuous monitoring and logging of system activity
- Incident management and data breach response procedures
- Ongoing staff training in data protection and AML compliance.
Cookies
Our website uses cookies to ensure its proper functioning and, with your consent, to analyse traffic and improve user experience. You may manage your preferences at any time through the cookie settings available on the site.
Updates to this policy
This Privacy Policy may be updated periodically to reflect legal, regulatory, or operational changes. The latest version and effective date are always displayed on this page.