Privacy Policy

Table of content

Purpose and Content

This privacy policy (the “ Policy ”) applies within BROAD STREET LUXEMBOURG S.À R.L. (“ BSL ”) or (“ We ”).

As part of its activities, BSL needs to collect and further process personal data about its employees, interns, consultants, candidates, directors/managers, shareholders, proxy holders, ultimate beneficial owners, clients, suppliers, services providers, sub-contractors, users of its website and should the later be legal entities, their legal representatives, employees, agents (the “ Contact Persons ”).

BSL’s processing of personal data is conducted in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“ GDPR ”) that aims to protect individuals’ privacy in connection with processing of personal data.

BSL is the data controller of your data which means that we are responsible for how your data is collected and used.

BSL respects your privacy and will protect any of your personal data that it processes.

All personal data are processed in accordance with applicable data protection laws.

The purpose of this document is to provide information regarding how BSL collects, processes and shares personal data about you during and after your relationship with BSL, in accordance with articles 13 and 14 of the GDPR.

This document also provides information about your rights in relation to the processing of your personal data (articles 15 to 21 of the GDPR).

Definitions

The term “vendor” typically refers to an entity/individual that is paid for goods and/or services; a vendor can take various forms:

  • suppliers.
  • service providers.
  • sub-contractors.
  • entities domiciliated at BSL through which payments (in- and outflows) can be made (client).

The term “BSL group” refers to BSL and entities domiciliated at BSL.

Types of personal data we collect

BSL processes the following types of personal data about its employees:

  • Identification data – such as name, surname, gender, pictures, date of birth, staff member IDs;
  • Contact details – such as home and business address, telephone/email addresses, emergency contact details;
  • Employment details – such as job title/position, office location, employment contract, performance and disciplinary records, grievance procedures, sickness/holiday records;
  • Background information – such as academic/professional qualifications, education, CV/résumé, criminal records data (for vetting purposes, where permissible and in accordance with applicable law);
  • National identifiers – such as national ID/passport, driving license, immigration/visa status, residence and work permits, social security numbers;
  • Family information – such as spouse & dependents information, marital status;
  • Financial information – such as banking details, tax information, withholdings, salary, benefits, expenses, company allowances, stock and equity grants;
  • IT information – information required to provide access to company IT systems and networks such as IP addresses, log files and login information.
  • Any other information provided for by the concerned individual to communicate in the framework of his/her demand or application.

BSL processes the following types of personal data about its interns and consultants:

  • Identification data – such as name, surname, gender, pictures, date of birth, staff member IDs;
  • Contact details – such as home and business address, telephone/email addresses, emergency contact details;
  • Employment details – such as job title/position, office location, employment contract, performance and disciplinary records, grievance procedures, sickness/holiday records;
  • Background information – such as academic/professional qualifications, education, CV/résumé, criminal records data (for vetting purposes, where permissible and in accordance with applicable law);
  • National identifiers – such as national ID/passport, driving license, immigration/visa status, residence and work permits, social security numbers;
  • Financial information – such as banking details, tax information, withholdings, salary, benefits, expenses, company allowances, stock and equity grants;
  • IT information – information required to provide access to company IT systems and networks such as IP addresses, log files and login information.
  • Any other information provided for by the concerned individual to communicate in the framework of his/her demand or application.

BSL processes the following types of personal data about its candidates:

  • Identification data – such as name, surname, gender, pictures, date of birth, staff member IDs;
  • Contact details – such as home and business address, telephone/email addresses, emergency contact details;
  • Background information – such as academic/professional qualifications, education, CV/résumé, criminal records data (for vetting purposes, where permissible and in accordance with applicable law).

BSL processes the following types of personal data about its directors/managers, shareholders and ultimate beneficial owners:

  • Identification data – such as name, surname, gender, pictures, date of birth, staff member IDs;
  • Contact details – such as home and business address, telephone/email addresses, emergency contact details;
  • Background information – such as academic/professional qualifications, education, CV/résumé, criminal records data (for vetting purposes, where permissible and in accordance with applicable law);
  • National identifiers – such as national ID/passport, driving license, immigration/visa status, residence and work permits, social security numbers;
  • Financial information – such as banking details, tax information, withholdings, salary, benefits, expenses, company allowances, stock and equity grants;
  • IT information – information required to provide access to company IT systems and networks such as IP addresses, log files and login information.
  • Any other information provided for by the concerned individual to communicate in the framework of his/her demand or application.

BSL processes the following types of personal data about its proxy holders:

  • Identification data – such as name, surname, gender, pictures, date of birth, staff member IDs.
  • Contact details – such as home and business address, telephone/email addresses, emergency contact details;
  • Any other information provided for by the concerned individual to communicate in the framework of his/her demand or application.

BSL processes the following types of personal data about its vendors and should the later be legal entities, their legal representatives, employees, agents:

  • Identification data – such as name, surname, gender, date of birth;
  • Contact details – such as business address, telephone/email addresses;
  • Employment details – such as job function, identity of employee, job title, department, organization name, size and location;
  • Business license;
  • Financial information – such as banking details, tax information.
  • Any other information provided for by the concerned individual to communicate in the framework of his/her contractual relationship with BSL.

BSL processes the following types of personal data about the individuals using its website via contact forms:

  • Identification data – such as name;
  • Contact details – email addresses;
  • Any other information provided by the concerned individual to communicate in the framework of his/her demand or application.

BSL processes the following types of personal data about individuals using its website via cookie consent:

  • Technical Data: IP addresses, browser type, operating system, and usage of information
  • Any other information provided by the concerned individual to communicate in the framework of his/her demand or application

How we collect personal data

BSL collects personal data:

  • directly from the Contact Persons orally or in writing (e-mail, telephone, website, meetings) during the recruitment or contractual process (pre-contractual phase) and during the contractual relationship.
  • from other sources, such as business partners or other third-party sources provided that they are legally permitted to share such data with BSL.

The provision of this personal data by the Contact Person is voluntary and is a prerequisite for the processing of his/her request, the conclusion of a contract or the possible provision of a service to him/her.

How we use the personal data and the basis on which we use it

Purpose of processing

BSL processes personal data about its employees, interns, consultants and candidates for the following purposes:

  • managing the recruitment process;
  • managing the employment relationship between BSL and the employees;
  • managing the staff, human resources, health insurance policy, organization of working time, investigation of acts or breaches (alleged or suspected) in which the employee may be involved,
  • ensuring the security and effective functioning of BSL’s IT systems, networks and communications devices;
  • complying with legal obligations, including tax and social security obligations and health and safety obligations;
  • dealing with legal dispute.

BSL processes personal data about its directors/managers, shareholders and ultimate beneficial owners for the following purposes:

  • managing the relationship between BSL and the directors/managers, shareholders and ultimate beneficial owners;
  • complying with legal obligations, including tax and social security obligations;
  • dealing with legal dispute.

BSL processes personal data about its vendors for the following purposes:

  • managing the relationship between BSL and its vendors (performance of contract, provision of service, invoicing, management of commercial relations);
  • complying with legal obligations;
  • conducting regular business activity that is advising investment funds which invest in and support portfolio companies;
  • sending newsletter and invitations to events organized and/or sponsored by BSL;
  • maintaining the list of business contacts;
  • dealing with legal dispute.

BSL processes personal data about the individuals using its website for the following purposes:

  • dealing with communications received from the concerned individual via phone or email, and responding to his/her queries, complaints;
  • maintaining and updating BSL’s list of contacts and job applicant database;
  • supporting and progressing applications for employment with BSL;
  • administering BSL’s website and for internal operational purposes to make user experience more efficient (including troubleshooting) and to analyze how the systems are used.

Legal grounds

BSL processes personal data about its Contact Persons based on the following legal grounds:

  • processing is necessary for the performance of a contract to which the data subject is party (commercial or employment contract) or for pre-contractual steps;
  • processing is necessary for compliance with a legal obligation to which the data controller is subject;
  • processing is necessary for the purposes of the legitimate interests pursued by the data controller (e.g. to assess suitability for a position, for managing commercial relationships, for managing human resources);
  • the data subject has given consent to the processing of his or her personal data.

Who we share your personal data with

BSL may have to share the personal data of its Contact Persons with third parties, including third-party service providers, other entities in the group or other third parties.

Whenever BSL share your personal data to a third-party, BSL implements appropriate measures to ensure the personal data is used in a manner consistent with this Policy and that the security and confidentiality of the personal data is maintained.

As detailed below, BSL may transfer your personal data outside the EU.

Transfers to third-party service providers

BSL will share your personal data with third-party service providers where required by law, where it is necessary to administer the relationship with you or where it has another legitimate interest in doing so.

Personal data will be shared with the third-party service providers listed in Appendix I.

When sharing your personal data, BSL will ensure that the third-party service providers provide sufficient guarantees regarding the confidentiality and security of your data.

BSL does not allow its third-party service providers to use your personal data for their own purposes.

BSL only permits them to process your personal data for specified purposes and in accordance with its instructions.

When appointing a third-party data processor, BSL will enter into a written agreement with that processor which specifies (i) the subject matter and duration of the processing, (ii) the nature and purpose of the processing, (iii) the type of personal data and categories of data subjects and (iv) the obligations and rights of BSL as data controller.

The agreement must also impose certain obligations prescribed by the GDPR.

Transfers to other group companies

Personal data will only be shared across the BSL Group in certain circumstances and where lawful to do so, e.g. with limited members of the human resources department, the finance department, and the IT department.

Staff members of the group companies may access and otherwise process your personal data in connection with their job responsibilities.

BSL takes appropriate steps to ensure that such personnel are bound to duties of confidentiality with respect to your personal data.

Transfers to other third parties

BSL may share your personal data with other third parties, for example in the context of the possible sale or restructuring of the business.

BSL may also need to share your personal data with a regulator, public authorities or to otherwise comply with the law.

Transferring personal data outside the EU

BSL may transfer your personal data outside the European Union, when the third-party service providers, the other entities in the group or the other third parties are located outside the EU.

If BSL does, you can expect a similar degree of protection in respect of your personal data; either that the relevant country has been deemed by the European Commission to have adequate personal data protection procedures in place, or in situations where the country is not deemed adequate by the European Commission, that BSL has taken reasonable measures to ensure that your personal data is treated by those third parties in a way that is consistent with and which respects the GDPR and local laws on data protection.

Rights and Remedies

According to the GDPR, you benefit from certain rights which include (but are not limited to):

  • Right of access (Article 15): you have the right to obtain confirmation as to whether personal data concerning you are being processed, and, where that is the case, access to the personal data by obtaining a copy of the personal data that is being processed.
  • Right to rectification (Article 16): you have the right to obtain without undue delay the rectification of inaccurate personal data. Also, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
  • Right to erasure / “right to be forgotten” (Article 17): you have the right to obtain the erasure of personal data concerning you without undue delay.
  • Right to request the restriction of processing (Article 20): you have the right to request the restriction of processing or your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
  • Right to data portability (Article 20): you have the right to receive your personal data you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.
  • Right to object (Article 21): you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you.
  • Right to withdraw your consent to processing of your personal data at any time (Article 7): if you have given your consent to processing of your personal data for an explicit purpose you may always withdraw your consent. If you want to withdraw your consent, you may contact BSL through the contact information below.
  • Right to lodge a complaint with the supervisory authority (Article 77): if you think that your personal data is processed wrongly, you are entitled to lodge a complaint with the Finnish regulator for the processing of personal data (Office of the Data Protection Ombudsman).

Requests related to such rights or any other rights you may have under GDPR should be sent via email to [email protected].

Cookies

Navigating on the site https://www.broadstreet.lu/ may result in the installation of cookies on the user’s computer.

These are small files that a website saves on the user’s computer or mobile device when he/she visits the site.

It enables the website to remember the user actions and preferences (such as login, language, font size and other display preferences) over a period of time, so the user doesn’t have to keep re-entering them whenever he/she comes back to the site or browse from one page to another.

BSL uses session cookies to keep information about the user’s navigation on its website for different purposes, namely, to facilitate subsequent navigation on the website and to allow various visitor figures to be compiled.

Some cookies are essential to deliver a better experience on BSL website and to help BSL understand how people use its website.

Cookies present on the site are controlled by the website and are accessed only by the website owner or by people acting on its behalf.

Additionally, cookies will not be used for any purpose than the one stated.

The user can control and/or delete cookies as he/she wishes.

He/she can delete all cookies that are already on his/her computer, and he/she can set most browsers to prevent them from being placed.

If the user does this, however, he/she may have to manually adjust some preferences every time he/she visits a site, and some services and functionalities may not work.

Security Measures

BSL employs appropriate technical and organizational security measures to protect your personal data against loss, alteration, or unlawful destruction and to guard against access by unauthorized persons.

All BSL employees/suppliers/external contractors/partners and subcontractors who have access to your data in the course of their activities are bound by strict professional confidentiality obligations.

They access only the data they need to perform their duties and are regularly made aware of, or trained in, the security rules applying to your data.

BSL will notify the Luxembourg regulator for the processing of personal data (Commission Nationale pour la Protection des Données – CNPD) in case of breach of personal data no later than 72 hours after detecting the breach.

Pursuant to the provisions of GDPR, the Contact Persons will be notified of a personal data breach, without undue delay, only when the personal data breach is likely to result in a high risk to their rights and freedoms.

Retention Period

Personal data will be stored in accordance with applicable laws and kept as long as needed to carry out the purposes described in this Policy or as otherwise required by applicable law.

Depending on the type of data processed and the purposes for which it is used, BSL will store the data for a maximum of:

  • 1 year from the last contact with BSL, for data processed in connection with a job application;
  • 10 years from the end of the financial year in which the employment contract with BSL ended, for data processed in the context of an employment relationship;
  • 10 years from the end of the business relationship with BSL, for data related to contractual aspects (relation with directors, shareholders, ultimate beneficial owners, vendors) or accounting aspects (invoices).

Contact Information

BSL, located at 2, rue Henri M. Schnadt, L-2530 Luxembourg, is the data controller for the processing of your personal data.

In its capacity as data controller, BSL is responsible to ensure that the personal data is being processed in a correct manner and in accordance with applicable legislation.

If you would like further information about your data protection rights and how BSL processes your personal data, please contact feel free to send an email at [email protected].

Revisions to the Policy

BSL may decide, at its own discretion, to change this Policy from time to time by updating this page.

BSL encourages you to review this page periodically to remain informed about your rights and how we are processing your personal data.

Cookie Settings