HQLAX S.à r.l. is committed to protecting and respecting the privacy of any natural person with whom HQLAX S.à r.l., interacts, including customers, prospects, our customers’ representatives and all the recipients of our services (referred to collectively as the "Customers" or individually as "you").
Personal data provided to HQLAX S.à r.l. will always be processed in compliance with the requirements of the relevant data protection legislation, in particular EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR"), UK General Data Protection Regulation (“UK GDPR”), Federal Act on Data Protection (“FADP”) and other local data protection legislation (hereinafter referred to as “Data Protection Legislation”), and processing systems will be designed to ensure the highest level of protection for the personal data.
This data protection notice ("Notice") includes information regarding how HQLAX S.à r.l., will process (which term includes processing operations like recording, organizing, structuring, storing, adapting, altering, retrieving, consulting, using, disclosing, aligning, combining, restricting, erasing and destroying) your personal data.
For the purpose of this Notice:
• the terms "controller", "personal data", "data subject" and any other term expressly defined in the GDPR, UK GDPR and FADP shall have the meaning given to these terms in the respective regulations;
• any reference to "we" and "us" shall refer to HQLAX S.à r.l.
We would like to inform that this Notice can be updated from time to time. In case any changes will be made, we will notify you by e-mail or by placing a visible notice on our website.
Please read the information below carefully. It explains how and why personal data is processed by HQLAX S.à r.l. and with whom it will be shared, and it contains information about your rights in relation to your personal data.
For the purposes of this Privacy Notice, the data controller is either HQLAX S.à r.l. Luxembourg, HQLAX S.à r.l. UK Establishment or HQLAX S.à r.l. Zug Branch, depending on which branch have you established your relationship with. The above listed HQLAX S.à r.l. entities may carry out the data processing activities either as independent controllers or joint controllers (“Controller”). In simple terms, this means that we decide on the purpose and the means for processing the personal data that you provide to us – including making sure that it is kept secure.
HQLAX S.à r.l. collects information about you to achieve the purposes identified by us. Most of the personal data we process is initially provided directly by you when entering into a relationship with us. We also collect personal data from third-parties such as consultants, suppliers, operators, providers, advisors, public authorities, and other.
The personal data we collect about you may include:
- Contact and identification data, such as first name(s) and surname, date of birth / age, place of birth, residence address, registered address, business and personal contact information.
- National identification number or other identifiers, such as social security number, identity card number, tax identification number, signature, also other detailed information/identity documents that are processed in order to perform our legal obligations (e.g., driver's license or passport);
- Image data, such as photograph from your identity documents in order to perform our legal obligations (ID or passport photos for KYC screenings).
- Professional and private life information, such as job title, work history, schools attended, references, social status (PEP), civil or marital status, family composition, sources of income.
We use your personal data for:
i. compliance with a legal obligation to which we are subject,
ii. our legitimate interests (i.e., legitimate business or KYC purposes), and
iii. to perform our obligations under our contract with you;
Generally, we do not rely on the consent to collect, use or otherwise process personal data, with the exception of specific cases in which making certain information available to us and the processing of such data by us are indeed optional; in such an event we may ask for your consent on a case-by-case basis. In such cases, we will notify you that the provision of information about you or your next of kin that you have been asked to provide is entirely voluntary, in which case you can decline to provide the information without any consequences for your contractual relationship.
Depending on the nature of your position with HQLAX S.à r.l., certain personal data (your name and business contact details and relevant information about your involvement in our business) may be disclosed to customers, suppliers and other business contacts, and where appropriate made publicly available, in the ordinary course of our business.
In addition, we may disclose your personal data, where legitimate interests, regulatory, legal or contractual provisions require or allow such disclosure, to:
- other HQLAX S.à r.l. entities;
- third party services providers such as payroll administrators, auditors, accountants, outside legal counsel and other service providers processing personal data on our behalf in the course of supporting our business and operations;
- third parties to whom HQLAX S.à r.l. is required to disclose information by law or regulatory requirement (including litigation counterparties or social security entities); and
- competent regulatory and prosecuting authorities.
The disclosures of your personal data described in paragraph 4 may involve transfers of your personal data to other HQLAX S.à r.l. entities that may be located outside the European Economic Area (such as Switzerland), where data protection laws may not be as strict as those in your home country. In these situations, we will seek to put in place appropriate safeguards.
Please contact us at the address or email detailed in Section 7 below if you would like to know more about the safeguards in place or to receive a copy of them.
As a rule, we will process your personal data for a period of 10 years from the termination of the contractual relationship (unless deleted in accordance with applicable law). We will retain your personal data for a longer period only under the circumstances that require us to perform our contractual obligations, or as required by law or regulation. As a general principle, we do not retain personal data for longer than necessary in relation to its purpose.
For each processing activity (including personal data processed as a result of that activity), we have considered carefully:
- how long we will need to process the relevant personal data for the intended processing activity; and
- whether any legal and/or regulatory requirements stipulate a mandatory minimum retention period for the relevant information, documentation and records (including personal data) to be retained.
Pursuant to the Data Protection Legislation you are entitled to exercise the following rights:
- the right to access your personal data, including the right to ask for a copy of your personal data where it does not adversely affect the rights and freedoms of others (please note that if you request any further hard copies later on, we may charge you a reasonable fee based on administrative costs);
- the right to have your incomplete or inaccurate personal data completed or corrected without undue delay (including by means of providing a supplementary statement);
In some limited circumstances:
- the right to object to the use of your personal data (where processing is based on HQLAX S.à r.l. legitimate interest)
- the right to restrict the use of your personal data.
- the right to require us to erase / delete your personal data without undue delay, and
- the right to receive personal data which you have provided to HQLAX S.à r.l, in a structured, commonly used and machine-readable format and the right to transmit those data to another data controller. Please note that this right to data portability only arises where:
• the processing is based on consent or on a contract,
• the processing is carried out by automated means, and
• the processing does not adversely affect the rights and freedoms of others.
If you wish to exercise any of these rights, or if you would like to see copies of any of the agreements referred to or have other questions about our information processing or related policies, please contact or submit a request to the office of the branch with which you have established your relationship (please see below):
You also have the right, at any time, to lodge a complaint about our processing of your personal data with the relevant supervisory authority. You can complain in the EU member state where you live or work, or in the place where the alleged breach of data protection law has taken place. You can also submit your complaint in writing directly to the National Data Protection Authority of the entity you established your relationship with:
