Privacy policy
What data we collect, why, on what legal basis, how long we keep it, who receives it and how to exercise your rights.
Last revised:
Data controller
Financial Services Luxembourg SARL-S, 142 Boulevard de la Pétrusse, L-2330 Luxembourg, Luxembourg. RCS B213987 · TVA LU29299810.
For any question about your data and to exercise your rights: contact@financialservices.lu. No data protection officer has been appointed: the firm does not fall within the cases where Article 37 GDPR requires one.
Data collected and purposes
We only collect data you provide voluntarily, or data strictly necessary to operate and measure the site.
| What we collect | Why | Legal basis |
|---|---|---|
| Quote or contact form: name, email address, phone, country of residence, company type, subject of the request | Answering, quoting a retainer, preparing an engagement letter | Pre-contractual steps taken at your request (Art. 6(1)(b)) |
| Pricing page gate: email address, and phone for contractual templates | Sending you the requested fee schedule and contractual templates through personal links | Pre-contractual steps taken at your request (Art. 6(1)(b)) |
| During an engagement: identification data, identity documents, ownership structure, source of funds | Customer due diligence required by AML/CFT legislation; performance of the engagement | Legal obligation (Art. 6(1)(c)) and performance of the contract (Art. 6(1)(b)) |
| Application form: name, email address, phone, LinkedIn profile, message, CV | Reviewing your application and contacting you when a matching position is confirmed | Pre-contractual steps taken at your request (Art. 6(1)(b)) and, for keeping it in the talent pool, your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Audience measurement: local random identifier, page viewed, referring domain, screen width, reading depth, performance indicators | Understanding how the site is used and fixing what gets in the way of reading | Legitimate interest (Art. 6(1)(f)), under the conditions set out in the cookie policy |
What we do not do
- No sale, rental or transfer of your data to third parties.
- No targeted advertising, no advertising profiling, no cross-site linking of your browsing.
- No decision producing legal effects taken on a solely automated basis.
- No advertising cookies, no ad network, no social network pixel. Two measurement layers coexist, both free of advertising: ours, described in the cookie policy, and our host's, served from our own domain and storing nothing on your device.
Recipients
Your data is processed by the firm. Where the engagement requires it, it is transmitted to the competent authorities (ACD, AED, RCS, RBE, CCSS) and, where relevant, to the licensed professionals involved in your file, in particular the officiating notary or the partner licensed for domiciliation, Cerno Law Firm.
It is also processed by technical processors, contractually bound and limited to our instructions.
Transfers outside the European Union
Our infrastructure relies on two providers established in the United States. Data is therefore transferred outside the European Union, subject to the following safeguards.
| Processor | Role | Location | Transfer safeguard |
|---|---|---|---|
| Vercel Inc. (United States) | Website hosting, server function execution, and audience and performance measurement (Vercel Web Analytics and Speed Insights) | Functions executed in Frankfurt (fra1 region); company established in the United States | Standard contractual clauses and, where applicable, the EU–US Data Privacy Framework |
| Resend, Inc. (United States) | Transactional email delivery (acknowledgements, pricing documentation and PDF checklists from the diagnostic tools) and forwarding of job applications and their CVs to the firm's recruitment inbox | United States | Standard contractual clauses and, where applicable, the EU–US Data Privacy Framework |
Copy of the safeguards
You may obtain a copy of the safeguards governing these transfers on request to contact@financialservices.lu.
Retention periods
| Data | Period |
|---|---|
| Quote or documentation request with no follow-up | 3 years from the last contact |
| Unsuccessful application kept in the talent pool with your consent | Up to 2 years from receipt, or until you withdraw your consent |
| Active client file | Duration of the business relationship |
| AML/CFT due diligence file and identification documents | 5 years after the end of the business relationship, as required by law |
| Accounting records and books | 10 years, as required by the Commercial Code |
| Audience-measurement identifier | 13 months maximum, then renewed or deleted |
Your rights
You have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to give directions on the fate of your data after your death.
These rights are exercised at contact@financialservices.lu. We answer within one month, extendable by two months for complex requests. Proof of identity may be requested where there is reasonable doubt as to the identity of the requester.
The right to erasure cannot apply to records we are legally required to keep, in particular accounting and AML/CFT due diligence files, for as long as the legal period runs.
For audience measurement, you may object at any time, in one click, from the cookie policy. Your choice is stored on your device and honoured immediately.
Complaint
If you consider that the processing of your data does not comply, you may lodge a complaint with the Commission nationale pour la protection des données, the Luxembourg supervisory authority, 15 boulevard du Jazz, L-4370 Belvaux (cnpd.lu).
Security
The site is served exclusively over HTTPS, with a content security policy restricting resources to our own domain. Contractual templates are only reachable through signed, time-limited personal links sent to the email address verified by receipt of the message. Internal access to client files is individual.
Update
This policy was revised on 2026-10-22. Any substantial change will be flagged on this page, with a new revision date.