Personal Data Protection Policy (GDPR)

Last update : december 2025

1. Data controller

ATLAS FIDUCIAIRE LUXEMBOURG SARL (hereinafter “the Firm”)

9–11 rue Louvigny, 1946 Luxembourg

Email : info@atlasfiduciaire.lu

GDPR Contact / Data Protection Officer (DPO) : info@atlasfiduciaire.lu

2. Categories of personal data processed

Within the scope of its activities, the Firm may process the following categories of personal data:

• Identification data (e.g., name, address, email, telephone)
• Professional data
• Contractual and billing information
• Accounting, tax and financial data
• Social data (payroll, social declarations, CCSS affiliation)
• Data related to anti-money laundering and counter-terrorism financing (KYC/LBC-FT)
• Correspondence, communications and meeting summaries
• Recruitment-related data (CVs, cover letters, interview notes)

3. Purposes of processing and legal bases

The Firm processes personal data on the following legal bases under Article 6 of the GDPR:

1. Performance of a contract – to manage accounting, tax, social and administrative services, client relationships and billing;

2. Legal obligations – to comply with tax, social, accounting, KYC/LBC-FT and record-keeping laws;

3. Legitimate interests – internal management, IT security, fraud prevention, debt collection and service improvement;

4. Consent – for commercial communications when no contract exists, and for non-essential cookies (where applicable).

4. Recipients of data

Data may be shared, strictly in accordance with professional confidentiality obligations, with:

• Competent authorities and public administrations (e.g., tax authorities, social security, financial intelligence units)
• Banks and financial institutions
• Legal representatives (such as lawyers and bailiffs) when necessary for service delivery
• Technical service providers (e.g., hosting, software, cloud services) under GDPR-compliant agreements.
•  

5. International data transfers

Where personal data is transferred outside the European Union (EU) or European Economic Area (EEA), the Firm ensures appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, or binding corporate rules.

6. Data retention periods

Unless specific legal provisions require otherwise, personal data is retained for the following periods:

• Accounting and tax files: 10 years
• Social files: 10 years
• KYC/LBC-FT data: 5 years after the end of the business relationship (unless extended by law)
• Unsuccessful candidate data: 2 months after notification.

7. Data subject rights

In accordance with the GDPR, you have the following rights :

• Right of access
• Right to rectification
• Right to erasure (“right to be forgotten”)
• Right to restriction of processing
• Right to data portability
• Right to object

You may exercise these rights by email (dpo@fiduciaire-expert.lu) or by post to the registered office address.
Proof of identity may be required.

Complaints

You may lodge a complaint with the:

National Commission for Data Protection (CNPD)
15, boulevard du Jazz, L-4370 Belvaux
www.cnpd.public.lu

Limitations

The exercise of certain rights may be restricted due to legal obligations, in particular those relating to anti-money laundering and counter-terrorism financing, or statutory accounting record-keeping requirements.

8. Data security

The Firm implements appropriate technical and organizational measures to ensure the confidentiality, integrity, availability and security of personal data, including internal procedures for incident management and data breach notification, in line with GDPR requirements.

9. Sources of personal data

Personal data may originate from:

• You or your authorized representatives
• Public or professional registers

• Authorized third parties (such as banks or advisors), strictly for the purposes of service delivery.

10. Policy updates

This privacy policy may be updated at any time to reflect legal, regulatory or technical developments. The latest update date is indicated at the top of this document.