This Privacy Notice describes how WHITE OAK MANAGEMENT, a Luxembourg Professional of the Financial Sector, registered with the Luxembourg Trade and Companies Register under number B225159 and with registered office at 28, avenue Pasteur, L-2310 Luxembourg (the “Company”, “we”, “us” or “our”) collects, receives and otherwise processes personal data in the course of its business activity in order to perform services requested by existing and prospective Clients (together: “Clients”) in accordance with the applicable data protection legislation.
WHITE OAK MANAGEMENT, as provider of domiciliation, company management and family office services, usually acts as data controller, however, we perform analysis on a case-by-case basis before qualifying our position.
PERSONAL DATA, HOW DO WE OBTAIN AND PROCESS THEM
‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’). We may collect and process the following categories of personal data: personal contact details (name, title, address, telephone numbers, email address); identification data (nationality, birthdate, identification documents and numbers, such as ID, passport, driving license, etc.); professional information (such as occupation, position);
data relevant with regard to the fight against money laundering and terrorist financing
(such as results of name check, background check information from external sources, internet sources, PEP status, information on the source of funds); financial information (such as bank account details, shareholding). Please note that this list is not exhaustive. We may also collect and process other personal data which is adequate, relevant and limited to what is necessary in relation to the provision of our services.
The most of the data we obtain are provided by our Clients in paper form or by electronic means. However, we collect data from public and other sources, e.g. public trade and companies registers, subscription-based databases and other online sources. We may receive personal data from third parties (such as lawyers, accountants, other professional advisors, contractors,).
We cannot control the information provided by our Clients or third parties, therefore, it can happen that we receive documents containing personal data that we do not need and/or have not requested. In such cases we consider that the personal data have been provided with the intention to process it in the context of the business relationship concerned, assuming that the person providing the personal data acted in compliance with the applicable data protection legislation.
WHITE OAK MANAGEMENT collects, stores and otherwise processes personal data according to the applicable data protection legislation, nevertheless, we ask our Clients and third parties to provide us documents containing personal data which is adequate, relevant and limited to what is necessary in relation to the purpose for which they are provided.
THE LAWFUL BASIS FOR PROCESSING PERSONAL DATA
White Oak Management only processes personal data when the law allows it, mostly in the following cases:
- To perform a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (e.g. domiciliation agreement, quotation);
- To comply with legal obligations to which our Company is subject:
- the law on the financial sector;
- the law on governing the domiciliation of companies;
- the law on family office activity;
- the law on commercial companies;
- the commercial code;
- the labour code;
- other applicable legislation;
- For the performance of a task carried out in the public interest (e.g. for the purposes of the prevention of money laundering and terrorist financing) or in the exercise of official authority vested in the controller;
- For the purposes of the legitimate interests pursued by our Company or by a third party (e.g. internal audit procedures; maintenance and improvement of our IT system; fraud prevention).
- In case of a given consent to the processing of personal data for one or more specific purposes (e.g. recruitment). Consent can be withdrawn at any time.
- In order to protect the vital interest of the data subject or of another natural person.
SHARING OF DATA, DATA TRANSFER
White Oak Management may share/transfer personal data to third parties, e.g. administration, public authorities, auditors, notaries, advisors, banking institutions or other third-party service providers where required by law, where it is necessary to perform the services you requested or where we have legitimate interest in doing so.
In most cases, these third parties are located in the European Union or in countries subject to an adequacy decision by the European Commission. In those cases when we transfer personal data to countries outside the European Union and without adequacy decision, we take the necessary measures to provide an adequate level of protection of the personal data concerned.
In every case, we ensure that the transmission is adequate, relevant and limited to what is necessary for the purpose for which they are provided.
HOW LONG DO WE STORE PERSONAL DATA
As a principle, we retain data no longer than it is necessary for the fulfilment of the purposes for which they were collected and processed (e.g. legal or accounting requirements). At the end of the retention period, the personal data are deleted or anonymised. The storage period is subject to the provisions of the relevant legislation, if there is any. Inter alia:
- commercial agreements and related documents / agreements with Clients, suppliers for a period of ten years from the end of the contract / performance;
- corporate documents (shareholder register, minutes of board, etc …) for a period of ten years minimum from the striking from commercial register;
- accounting and finance documents for a period of ten years from the closure of the relevant accounting period;
- for the purposes of the prevention of money laundering and terrorist financing for a period of five years from the closure of the business relationship or after the performance of an occasional transaction;
- recruitment data not resulting in candidate’s hiring for the duration of the recruitment phase.
YOUR RIGHTS AS DATA SUBJECT
- You have the right to request confirmation as to whether or not personal data concerning you are being processed, and where that is the case, access to the personal data.
- You have the right to request the rectification of inaccurate personal data concerning you and to have incomplete personal data completed.
- You have the right to request the erasure ofthe personal data concerning you.
- You have the right to request the restriction of processing of the personal data concerning you.
- You have the right to receive the personal data concerning you, which you provided to us, and you have the right to request the transmission of those data to another controller.
- You have the right to object to processing of personal data concerning you.
These rights can be exercised under the conditions laid down by the GDPR.
CCTV
Personal data, how do we obtain and process them
We only collect images caught on camera, no sound or voice is recorded.
We collect data through the CCTV system for various reasons:
- to control access to the building and the offices and to ensure the security of the building, the safety of the personnel working at the office (“staff”), third parties and visitors, as well as property and information located or stored on the premises;
- to prevent, deter, and if necessary, investigate unauthorised physical access, including unauthorised access to secure premises and protected rooms, IT infrastructure, or operational information;
- to prevent, detect and investigate a theft of equipment or assets owned by the Company, visitors or staff, or threats to the safety of personnel working at the office (e.g. fire, physical assault).
The CCTV system is not used for any other purpose, such as to monitor staff and visitors. The location and the positioning of the video cameras are such that they are not intended to cover the surrounding public space.
The CCTV cameras are installed
- at the building entrances (front door to the street, back doors to the garden)
- inside the building, in the stairwell, and
are placed and focused in a way that only people who want to access the building and the offices are filmed.
The video images and streaming can be accessed only by Managing Director and Office Manager.
The lawful basis
We use video surveillance equipment for the legitimate interest of the Company for security and access control purposes, which is necessary for the management and functioning of the Company.
Sharing of data, data transfer
Only government officials (police, fire department, judicial department, data protection authority, etc.) can – only when required by law – request and receive access to the data footage.
How long do we store CCTV footage?
The recorded data are erased automatically after seven (7) days. In the event of an incident or infringement, the images may be kept beyond this period and, if necessary, be communicated to the competent police or judicial authorities. After the expiry of the retention period, the images are automatically deleted.
Your rights as data subject
You have the same rights as indicated under section V, as applicable.
At the main entrance, we placed a sign with the contact information of the data controller, the data protection officer and a reference to the link leading to our Privacy Notice.
Security
We are committed to protecting the security of personal data from unauthorized access, use or disclosure. We keep the personal data on computer system with limited access.
HOW TO CONTACT US
If you have any question about how we process personal data, or you would like to exercise your rights detailed above, please contact us by using the following e-mail address:
HOW TO CONTACT THE LUXEMBOURG SUPERVISORY AUTHORITY
As data subject, you also have the right to contact the National Commission for
Data Protection and submit a complaint by using their online form which is available on their webpage www.cnpd.lu, or you can send it to the following address:
Commission nationale pour la protection des données
Service des plaintes
15, Boulevard du Jazz
L-4370 Belvaux
CHANGES TO THIS PRIVACY NOTICE
White Oak Management reserves the right to update its privacy notice at any time and makes available the updated version on its website.
