Privacy Notice
Palana Privacy Notice
How we collect, use, share and retain personal data — and the rights you hold in respect of it.
Introduction
1.1Who we are
This Privacy Notice (the “Notice”) is issued by:
- Palana S.A., a public limited liability company (société anonyme) incorporated in the Grand Duchy of Luxembourg, registered office at 33, rue du Puits Romain, L-8070 Bertrange, registered with the Luxembourg Trade and Companies Register under number B270360; and
- Palana Limited, a private company limited by shares incorporated in England and Wales, registered office at Highdown House, 11 Highdown Road, CV31 1XT, Leamington Spa, Warwickshire, United Kingdom, registered with Companies House under number 03282151.
Each is referred to as “Palana”, “we”, “us” or “our”. Each is a separate legal entity and each is a separate controller of the personal data it processes for its own purposes.
Palana is an advisory, technology and services firm serving the financial services sector.
1.2What this Notice covers
This Notice explains how we collect, use, share and retain personal data, and what rights you have. It contains the information required by articles 13 and 14 of the General Data Protection Regulation, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”), and by any applicable national data protection law, including but not limited to the Luxembourg law of 1 August 2018 organising the National Commission for Data Protection and the general data protection framework, as amended from time to time (together, the “Data Protection Laws”). It also reflects current regulatory guidance, including guidance issued by the European Data Protection Board, and takes into account emerging technologies such as secure artificial intelligence tools.
This Notice applies to website visitors, prospective clients and clients and the individuals connected with them, suppliers and business partners, users of our platforms and services, event and training participants, subscribers to our communications, candidates, employees and contractors, and anyone else whose personal data we process.
It does not cover third-party websites to which we link. Cookies are dealt with in our Cookie Policy at www.palana.lu/cookie-policy.
Processing by Palana Limited for its own purposes is governed by United Kingdom data protection law. Where Palana Limited processes personal data of individuals in the European Economic Area in connection with offering services to them, the GDPR also applies.
1.3Key terms
“Personal data” means any information relating to an identified or identifiable individual. A “controller” determines the purposes and means of processing. A “processor” processes personal data on behalf of, and on the documented instructions of, a controller. “Processing” means any operation performed on personal data.
Our role
Except where the next paragraph applies, Palana is the controller of the personal data described in this Notice, and section 4 sets out the purposes and the lawful basis for each.
Where we deliver services on a client’s documented instructions, the client is the controller and we act as processor. This includes the name screening, client due diligence and adviser review work we carry out for clients. In that case the client determines the purposes and the lawful basis, and questions about that processing should be addressed to the client. The commitments we give to clients as processor, including those required by article 28(3) of the GDPR, are set out in the data processing agreement concluded with each client.
The personal data we process
3.1Categories
What we hold about you depends on our relationship with you. We do not process every category below in respect of every individual. The categories are:
- Identification and contact data: name, title, date and place of birth, nationality, identity document details, postal address, electronic mail address and telephone number;
- Business and professional data: job function and title, employer, qualifications, professional memberships and career history;
- Relationship and engagement data: correspondence, meeting records, instructions given to us, records of services delivered, and the personal data contained in the documents and files entrusted to us for an engagement;
- Financial data: bank account and payment details, invoicing and payment history and, where relevant to an engagement, tax status and source of wealth;
- Due diligence data: identity verification records, beneficial ownership information and screening results;
- Platform and technical data: account and profile data, access rights, access and activity logs, support requests, internet protocol address, device and browser information and usage history;
- Event, training and communication data: registration and attendance records, assessment results and certificates, subscriptions, consents and objections;
- Audiovisual data: photographs and recordings made at our events, and recordings of calls and online meetings where a recording is made; and
- Human resources data: the data described at section 13.
3.2Special categories of personal data
Special categories of personal data are those listed in article 9(1) of the GDPR. Their processing is prohibited unless a condition in article 9(2) applies in addition to a lawful basis under article 6(1).
We process them only where necessary for the performance of obligations under employment and social security law, in particular in relation to sickness absence, fitness for work, workplace accidents and staff representation (article 9(2)(b)); where necessary for the establishment, exercise or defence of legal claims (article 9(2)(f)); and, on your explicit consent, where you provide dietary, accessibility or medical requirements for an event (article 9(2)(a)). Where such data forms part of a file entrusted to us by a client, we act as processor and the client determines the condition relied on.
We do not seek special categories of personal data outside these cases, and we ask you not to provide them to us. We do not use biometric data to identify anyone, and we do not process genetic data in the field of labour law or insurance, which article 66 of the Luxembourg law of 1 August 2018 prohibits.
3.3Personal data relating to criminal convictions and offences
Article 10 of the GDPR permits the processing of personal data relating to criminal convictions and offences only under the control of official authority or where authorised by Union or Member State law providing appropriate safeguards. We do not intentionally collect, search for or retain such data unless a specific authorisation applies, and we maintain no register of criminal convictions.
Recruitment. Where we make you an offer of employment, we may ask you to provide a criminal record extract in order to complete your personnel file. We request it in writing and only in accordance with article 8-5 of the amended Luxembourg law of 29 March 2013. Where you are not engaged, the extract is destroyed without delay; where you are engaged, it is kept for no longer than one month from the conclusion of your employment contract, after which neither the extract nor the information it contains is kept in any form.
Screening. We screen clients, their beneficial owners, our counterparties and our own personnel against official sanctions lists and politically exposed person lists.
Investigations and claims. A file relating to an internal investigation or a legal claim may contain information about a suspected offence. We process it only for that purpose, only for as long as the matter requires and only under controlled access.
3.4Where we obtain personal data
We obtain personal data directly from you; from your employer or the organisation you represent; from our clients, where it forms part of an engagement file; from publicly accessible sources such as trade and companies registers, official sanctions lists, professional networking platforms, company websites and press publications; from registers of beneficial owners where we are granted access on the conditions they impose; from identity verification, screening and recruitment providers; and automatically when you use our website or platforms.
3.5Whether you are obliged to provide personal data
Where we ask for personal data in order to enter into or perform an engagement, or to carry out client acceptance and due diligence, providing it is a contractual requirement and, where the amended Luxembourg law of 12 November 2004 applies to the relationship, a statutory one; if it is not provided we are unable to accept or continue the engagement. Where we ask for it to comply with a legal obligation, providing it is a statutory requirement. In recruitment and employment, providing it is necessary in order for us to assess your application or to administer the relationship. Marketing subscriptions, event registrations and general enquiries are voluntary, and there is no consequence to declining.
Why we process personal data and on what basis
4.1Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and requests for proposals, and issuing proposals | Article 6(1)(b), steps taken at your request before entering into a contract; or article 6(1)(f), our legitimate interest in responding to business enquiries |
| Client acceptance, ongoing monitoring, due diligence and screening | Article 6(1)(c) where a legal obligation applies to us in respect of the relationship, in particular under the amended Luxembourg law of 12 November 2004 and for screening against restrictive measures binding on us; otherwise article 6(1)(f), our legitimate interest in knowing with whom we contract and in protecting against financial crime and reputational risk |
| Negotiating, administering and performing engagements, and providing and supporting our platforms and managed services | Article 6(1)(b) where you are the contracting party; otherwise article 6(1)(f), our legitimate interest in performing the contract with the organisation you represent |
| Invoicing, collection of fees and recovery of debts | Articles 6(1)(b) and 6(1)(f), our legitimate interest in being paid |
| Accounting, tax and corporate reporting obligations, and reporting under the Luxembourg law of 25 March 2020 on reportable cross-border arrangements | Article 6(1)(c) |
| Organising events and delivering training and certification | Article 6(1)(b) where you register in your own name; otherwise article 6(1)(f) |
| Marketing communications and preference management (section 5) | Article 6(1)(a), your consent; or article 6(1)(f) for the limited case described at section 5 |
| Operating our website, and measuring its use and the use of our communications (section 6) | Article 6(1)(f) for operating a functioning and secure website; article 6(1)(a) for analytics and measurement |
| Recording calls and online meetings, where a recording is made | Article 6(1)(a), your consent, given before the recording begins; article 6(1)(f) where the participant is a member of Palana personnel |
| Security of our premises, personnel, systems and information, and the detection and investigation of incidents and misuse | Article 6(1)(f) |
| Managing supplier and business partner relationships | Articles 6(1)(b) and 6(1)(f) |
| Establishing, exercising and defending legal claims, managing disputes and investigations, audit and insurance | Article 6(1)(f); article 9(2)(f) where special categories of personal data are involved |
| Responding to a binding request from a competent authority or a court, and other statutory obligations | Article 6(1)(c) |
| Managing a merger, acquisition, reorganisation or transfer of our business | Article 6(1)(f) |
| Recruitment, employment and the management of contractors | As set out at section 13 |
4.2Legitimate interests
Where we rely on article 6(1)(f), we assess whether our interest is overridden by your interests or fundamental rights and freedoms. The interests we pursue are conducting and developing our business, knowing with whom we contract, performing our contracts, being paid, keeping accurate records, promoting our services to professional audiences, securing our premises, personnel, systems and information, protecting our legal position and managing our corporate structure.
4.3Consent
Where we rely on your consent we ask for it separately, by a clear affirmative act, and we do not make access to our website, services or events conditional on it. You may withdraw it at any time, using the unsubscribe link when included in any communication or by contacting us as set out at section 16. Withdrawal does not affect the lawfulness of processing carried out beforehand.
4.4Use for a new purpose
If we intend to process your personal data for a purpose other than that for which it was collected, we will inform you of that purpose beforehand, together with the further information required by article 13(3) of the GDPR.
Marketing communications
We send newsletters, invitations and other marketing communications by electronic mail on one of two bases. Where you subscribe, we send them on the basis of your consent, given by a separate act.
Where you are an existing client and we obtained your electronic contact details from you in the context of the sale of our services, we may send you communications about similar services on the basis of our legitimate interest, as article 11 of the amended Luxembourg law of 30 May 2005 permits. You are given the opportunity to object when your details are collected and in every message we send.
You may object at any time to the processing of your personal data for direct marketing, including any related profiling, without giving a reason. We will stop immediately. Under articles 21(2) and 21(3) of the GDPR this right is absolute and is not subject to any assessment on our part.
We do not sell, let or rent personal data to third parties.
Our website and cookies
We use cookies to collect data on how you use our website and view our marketing emails. This may include, for example, information on which of Palana’s website pages you have visited, how long you stayed on them or which items you clicked on. Full details are in our Cookie Policy at www.palana.lu/cookie-policy.
Where we operate a page on a third-party platform such as LinkedIn, the platform provides us with aggregated audience statistics. In respect of that processing the platform and Palana are joint controllers. The platform determines the means by which the underlying data is collected and processes it under its own privacy notice, which we ask you to read; the essence of the arrangement between us is set out in the terms the platform publishes for page administrators. You may exercise your rights against either the platform or Palana.
Use of artificial intelligence
We use artificial intelligence tools to support the work of our personnel: in the preparation of our deliverables, in our internal processes, and in client acceptance and screening, where such a tool assists us in reading and filing the documents provided to us. Only tools approved by Palana may be used, on terms which prohibit the provider from using the data submitted to them to train any model or for the provider’s own purposes. Our personnel may not use publicly available or consumer artificial intelligence services, or personal accounts, for any Palana purpose.
These tools support our personnel; they do not replace them. Output is reviewed by a suitably qualified person, who considers the underlying information and may depart from it, and Palana remains responsible for its deliverables and assessments. We take no decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, within the meaning of article 22 of the GDPR. Should that change, we will update this Notice before the change takes effect.
Where the use of these tools involves personal data, we assess the processing before it begins and carry out a data protection impact assessment where article 35 of the GDPR requires one. Transfers of personal data to providers established outside the European Economic Area are governed by section 9.
Who we share personal data with
We disclose personal data only where necessary for a purpose described at section 4, and only to the following categories of recipient:
- Service providers acting as our processors: providers of information technology, hosting and cloud infrastructure, communications and collaboration platforms, artificial intelligence tools, identity verification and screening, document management, marketing and event management, recruitment, payroll and human resources administration. They act only on our documented instructions and under written contracts containing the stipulations required by article 28(3) of the GDPR;
- Another Palana entity, where necessary for an engagement or for the management of our business;
- Professional advisers and auditors: our lawyers, accountants, auditors, tax advisers and insurers, acting as separate controllers;
- Banks, payment service providers and financial intermediaries, for invoicing, payment and the recovery of debts;
- Social security institutions, in particular the Caisse nationale de santé and the Centre commun de la sécurité sociale, acting as separate controllers;
- Public authorities, courts and regulators, where we are required to disclose by law or by order, or where disclosure is necessary for the establishment, exercise or defence of legal claims;
- Our clients, where you are their representative or authorised user, or where your personal data forms part of a deliverable prepared for them;
- Subcontractors, where we subcontract part of an engagement;
- An acquirer or successor, in the context of a merger, acquisition, reorganisation or transfer of our business; and
- Any other recipient you ask us to disclose to.
Our recipients may, under their own responsibility, disclose personal data to their own agents and delegates, which process it solely in order to assist the recipient in providing its services to Palana or in meeting its own legal obligations. Recipients may be located inside or outside the European Economic Area.
Where a recipient acts as a controller in its own right, it processes the personal data under its own responsibility and its own privacy notice. We do not sell, let or rent personal data.
Transfers outside the European Economic Area
Where personal data is transferred outside the European Economic Area to a country which the European Commission has not recognised as providing an adequate level of protection, we ensure that the transfer is carried out in accordance with Chapter V of the GDPR. In particular, we rely on the standard contractual clauses adopted by the European Commission, accompanied where necessary by a transfer impact assessment and by additional technical, organisational and contractual safeguards intended to ensure a level of protection essentially equivalent to that guaranteed within the European Union. Those measures may include encryption, access controls, pseudonymisation, and contractual commitments by the recipient not to disclose the data further and to notify us of any request for access by a public authority. Where the Commission has adopted an adequacy decision covering the recipient, as it has in respect of the United Kingdom, the transfer is made on the basis of that decision. Exceptionally, and only where neither route is available, we may rely on a derogation under article 49(1) of the GDPR.
Transfers made by Palana Limited out of the United Kingdom are governed by the equivalent provisions of United Kingdom law.
You may obtain further information about the safeguards applied to a transfer, and a copy of the relevant instrument, by contacting us as set out at section 16.
Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, alteration, disclosure or access, and we impose equivalent obligations on the processors we engage. No transmission over the internet and no system of storage can be guaranteed to be entirely secure. Where you hold credentials giving access to one of our platforms, you are responsible for keeping them confidential.
How long we keep personal data
We keep personal data only for as long as is necessary for the purposes for which it was collected, and thereafter for as long as is required by law or is necessary for the establishment, exercise or defence of legal claims. Where more than one period applies to the same data, the longest applies; by way of exception, special categories of personal data and personal data relating to criminal convictions and offences are removed at the end of their own period even where the file containing them is kept for longer. When we no longer require personal data we securely destroy or anonymise it.
The criteria by which we determine the period are the duration of the relationship, the period for which a statute requires the record to be kept, the limitation period applicable to a claim arising from the relationship, and, where none of these applies, the period for which the record remains necessary for the purpose. Applying those criteria:
| Personal data | Period |
|---|---|
| Accounting records and the documents supporting them, including invoices and payroll records | Ten years, as Luxembourg accounting and tax legislation requires |
| Client and supplier engagement files, contracts, and the contact and correspondence data relating to them | For the duration of the relationship and for the limitation period applicable to claims arising from it |
| Client acceptance, due diligence and screening records | Five years from the end of the relationship or from an occasional transaction |
| Personnel and recruitment records | For the duration of the relationship and thereafter for the periods required by Luxembourg employment, social security and accounting law, and for the applicable limitation periods. A criminal record extract is dealt with at section 3.3, and is not kept beyond the periods stated there |
| Records of prospective clients and candidates where no relationship follows, marketing subscriptions, and event and training records | For a limited period after the last interaction, the event or the withdrawal of a subscription |
| Website, platform, access and security logs, visitor records and recordings of calls and meetings | For a limited period determined by reference to the security or operational purpose concerned |
| Records kept to demonstrate compliance, including records of data protection requests | For the period over which compliance may be reviewed |
The individual periods are held in our internal retention register, which is the master record. A copy of the entry relevant to you is available on request.
Your rights
12.1The rights you have
Subject to the conditions and exceptions provided for in the Data Protection Laws, you have the following rights.
| Right | What it means |
|---|---|
| Access | To obtain confirmation whether we process personal data concerning you and, where we do, a copy of it together with the information listed in article 15 of the GDPR. The first copy is free; we may charge a reasonable fee based on administrative costs for further copies |
| Rectification | To have inaccurate personal data corrected and incomplete data completed |
| Erasure | To have your personal data erased where a ground in article 17(1) applies. The right is not absolute and does not apply where the processing is necessary for compliance with a legal obligation or for legal claims |
| Restriction | To have processing restricted in the circumstances set out in article 18 |
| Portability | To receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible. This applies only where the processing is based on consent or on a contract and is carried out by automated means |
| Objection | To object, on grounds relating to your particular situation, to processing based on our legitimate interests. Where you object to direct marketing we stop immediately and without assessment: see section 5 |
| Withdrawal of consent | To withdraw consent at any time where the processing is based on it |
| Automated decisions | Not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. We take no such decision: see section 7 |
| Complaint | To lodge a complaint with a supervisory authority: see section 12.3 |
12.2How to exercise them
Please address your request to our Data Protection Contact, using the details at section 16. Where we have reasonable doubts as to your identity we will ask for the additional information necessary to confirm it.
We respond without undue delay and in any event within one month of receipt. Where the request is complex, or where you have made a number of requests, we may extend that period by up to two further months, and will inform you of the extension and the reasons for it within the first month. Where we do not act on your request we will tell you why within one month, and of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy.
Where the personal data concerned is held by us as processor on behalf of a client, we are not permitted to act on the request ourselves. We forward it to the client without undue delay and tell you that we have done so, so that you can address the controller directly.
12.3Complaints
If you are not satisfied with the way we have handled your personal data or your request, please contact us first so that we may try to resolve the matter. You also have the right at any time to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. Where your complaint concerns processing by Palana Limited, you may also complain to it directly using the details at section 16.
15, Boulevard du Jazz
L-4370 Belvaux, Grand Duchy of Luxembourg
Telephone (+352) 26 10 60-1
www.cnpd.lu
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF, United Kingdom
Telephone (+44) 0303 123 1113
www.ico.org.uk
Candidates, employees and contractors
13.1Recruitment
When you apply for a position we process your name and contact details, the content of your curriculum vitae and covering letter, your educational and professional background, qualifications and skills, your right to work, the results of interviews and assessments, and references where you have authorised us to take them. We do so in order to assess your application, to communicate with you and to prepare the documents connected with a possible engagement. The lawful bases are article 6(1)(b), being steps taken at your request before entering into a contract, and article 6(1)(f), our legitimate interest in assessing candidates and keeping a record of our decisions. Consent is not the basis on which we assess your application; we use it only where you ask us to keep your application on file so that we may contact you about future opportunities, and you may withdraw it at any time.
13.2Employees and contractors
For employees and contractors we also process identification and civil status data, national identification and social security numbers, home address and private contact details, bank account details, emergency contact details, remuneration and benefits data, working time and absence records, performance, career and training records, disciplinary and grievance records, and data relating to professional tools, access rights and system logs.
The lawful bases are article 6(1)(b), for the performance of the employment or services contract; article 6(1)(c), for compliance with our legal obligations, including those relating to tax, social security, health and safety, working time, right to work, mandatory registers and staff representation; and article 6(1)(f), for our legitimate interests in the security of our premises, personnel, systems and information, in screening our personnel against official sanctions lists and politically exposed person lists, in managing operations, in investigating disciplinary matters and grievances, in legal claims and audits and in ensuring compliance with our internal policies. Health data is processed on the conditions set out at section 3.2.
Where personal data is processed for the purpose of monitoring employees within the meaning of article L.261-1 of the Luxembourg Labour Code, we inform in advance the joint committee (comité mixte) or, failing that, the staff delegation (délégation du personnel) or, failing that, the Inspection du Travail et des Mines, in the order that article requires, and we provide the information it prescribes. Within fifteen days of that information, the body informed or, failing that, the employees concerned may ask the Commission nationale pour la protection des données for a prior opinion; the request suspends implementation until the opinion is given. Operational logging which is not carried out for a monitoring purpose is outside that article.
Further information is set out in our Personal Data Privacy and Retention Policy, which is made available to our personnel.
Personal data you provide about other individuals
You will sometimes give us personal data relating to someone else such as a colleague, your organisation’s representatives or beneficial owners, a referee, or an emergency contact.
Where we obtain personal data indirectly and act as controller, we provide the information required by article 14 of the GDPR within the applicable period, unless one of the exceptions in article 14(5) applies. Where we process the data solely on a client’s documented instructions, the client remains responsible for transparency as controller and we assist it in accordance with article 28(3)(e) of the GDPR.
We ask you to tell the individual that you have provided their personal data to us and to draw this Notice to their attention, and to obtain their consent where you require it in order to disclose their data to us. Please also tell us of any change to the information you have given us, so that we may keep it accurate.
Changes to this Notice
We reserve the right to amend this Notice from time to time to reflect changes in the law, in regulatory guidance or in our processing. Each version carries a version reference, and the current version is published at all times on our website. You are advised to check this Notice from time to time.
How to contact us
If you have a question about this Notice or about the way we process your personal data, or if you wish to exercise any of your rights, please contact our Data Protection Contact. The same contact details apply to Palana Limited.
Attention: Data Protection
33, rue du Puits Romain
L-8070 Bertrange
Grand Duchy of Luxembourg
Palana Privacy Notice
How we collect, use, share and retain personal data — and the rights you hold in respect of it.
Introduction
1.1Who we are
This Privacy Notice (the “Notice”) is issued by:
- Palana S.A., a public limited liability company (société anonyme) incorporated in the Grand Duchy of Luxembourg, registered office at 33, rue du Puits Romain, L-8070 Bertrange, registered with the Luxembourg Trade and Companies Register under number B270360; and
- Palana Limited, a private company limited by shares incorporated in England and Wales, registered office at Highdown House, 11 Highdown Road, CV31 1XT, Leamington Spa, Warwickshire, United Kingdom, registered with Companies House under number 03282151.
Each is referred to as “Palana”, “we”, “us” or “our”. Each is a separate legal entity and each is a separate controller of the personal data it processes for its own purposes.
Palana is an advisory, technology and services firm serving the financial services sector.
1.2What this Notice covers
This Notice explains how we collect, use, share and retain personal data, and what rights you have. It contains the information required by articles 13 and 14 of the General Data Protection Regulation, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”), and by any applicable national data protection law, including but not limited to the Luxembourg law of 1 August 2018 organising the National Commission for Data Protection and the general data protection framework, as amended from time to time (together, the “Data Protection Laws”). It also reflects current regulatory guidance, including guidance issued by the European Data Protection Board, and takes into account emerging technologies such as secure artificial intelligence tools.
This Notice applies to website visitors, prospective clients and clients and the individuals connected with them, suppliers and business partners, users of our platforms and services, event and training participants, subscribers to our communications, candidates, employees and contractors, and anyone else whose personal data we process.
It does not cover third-party websites to which we link. Cookies are dealt with in our Cookie Policy at www.palana.lu/cookie-policy.
Processing by Palana Limited for its own purposes is governed by United Kingdom data protection law. Where Palana Limited processes personal data of individuals in the European Economic Area in connection with offering services to them, the GDPR also applies.
1.3Key terms
“Personal data” means any information relating to an identified or identifiable individual. A “controller” determines the purposes and means of processing. A “processor” processes personal data on behalf of, and on the documented instructions of, a controller. “Processing” means any operation performed on personal data.
Our role
Except where the next paragraph applies, Palana is the controller of the personal data described in this Notice, and section 4 sets out the purposes and the lawful basis for each.
Where we deliver services on a client’s documented instructions, the client is the controller and we act as processor. This includes the name screening, client due diligence and adviser review work we carry out for clients. In that case the client determines the purposes and the lawful basis, and questions about that processing should be addressed to the client. The commitments we give to clients as processor, including those required by article 28(3) of the GDPR, are set out in the data processing agreement concluded with each client.
The personal data we process
3.1Categories
What we hold about you depends on our relationship with you. We do not process every category below in respect of every individual. The categories are:
- Identification and contact data: name, title, date and place of birth, nationality, identity document details, postal address, electronic mail address and telephone number;
- Business and professional data: job function and title, employer, qualifications, professional memberships and career history;
- Relationship and engagement data: correspondence, meeting records, instructions given to us, records of services delivered, and the personal data contained in the documents and files entrusted to us for an engagement;
- Financial data: bank account and payment details, invoicing and payment history and, where relevant to an engagement, tax status and source of wealth;
- Due diligence data: identity verification records, beneficial ownership information and screening results;
- Platform and technical data: account and profile data, access rights, access and activity logs, support requests, internet protocol address, device and browser information and usage history;
- Event, training and communication data: registration and attendance records, assessment results and certificates, subscriptions, consents and objections;
- Audiovisual data: photographs and recordings made at our events, and recordings of calls and online meetings where a recording is made; and
- Human resources data: the data described at section 13.
3.2Special categories of personal data
Special categories of personal data are those listed in article 9(1) of the GDPR. Their processing is prohibited unless a condition in article 9(2) applies in addition to a lawful basis under article 6(1).
We process them only where necessary for the performance of obligations under employment and social security law, in particular in relation to sickness absence, fitness for work, workplace accidents and staff representation (article 9(2)(b)); where necessary for the establishment, exercise or defence of legal claims (article 9(2)(f)); and, on your explicit consent, where you provide dietary, accessibility or medical requirements for an event (article 9(2)(a)). Where such data forms part of a file entrusted to us by a client, we act as processor and the client determines the condition relied on.
We do not seek special categories of personal data outside these cases, and we ask you not to provide them to us. We do not use biometric data to identify anyone, and we do not process genetic data in the field of labour law or insurance, which article 66 of the Luxembourg law of 1 August 2018 prohibits.
3.3Personal data relating to criminal convictions and offences
Article 10 of the GDPR permits the processing of personal data relating to criminal convictions and offences only under the control of official authority or where authorised by Union or Member State law providing appropriate safeguards. We do not intentionally collect, search for or retain such data unless a specific authorisation applies, and we maintain no register of criminal convictions.
Recruitment. Where we make you an offer of employment, we may ask you to provide a criminal record extract in order to complete your personnel file. We request it in writing and only in accordance with article 8-5 of the amended Luxembourg law of 29 March 2013. Where you are not engaged, the extract is destroyed without delay; where you are engaged, it is kept for no longer than one month from the conclusion of your employment contract, after which neither the extract nor the information it contains is kept in any form.
Screening. We screen clients, their beneficial owners, our counterparties and our own personnel against official sanctions lists and politically exposed person lists.
Investigations and claims. A file relating to an internal investigation or a legal claim may contain information about a suspected offence. We process it only for that purpose, only for as long as the matter requires and only under controlled access.
3.4Where we obtain personal data
We obtain personal data directly from you; from your employer or the organisation you represent; from our clients, where it forms part of an engagement file; from publicly accessible sources such as trade and companies registers, official sanctions lists, professional networking platforms, company websites and press publications; from registers of beneficial owners where we are granted access on the conditions they impose; from identity verification, screening and recruitment providers; and automatically when you use our website or platforms.
3.5Whether you are obliged to provide personal data
Where we ask for personal data in order to enter into or perform an engagement, or to carry out client acceptance and due diligence, providing it is a contractual requirement and, where the amended Luxembourg law of 12 November 2004 applies to the relationship, a statutory one; if it is not provided we are unable to accept or continue the engagement. Where we ask for it to comply with a legal obligation, providing it is a statutory requirement. In recruitment and employment, providing it is necessary in order for us to assess your application or to administer the relationship. Marketing subscriptions, event registrations and general enquiries are voluntary, and there is no consequence to declining.
Why we process personal data and on what basis
4.1Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and requests for proposals, and issuing proposals | Article 6(1)(b), steps taken at your request before entering into a contract; or article 6(1)(f), our legitimate interest in responding to business enquiries |
| Client acceptance, ongoing monitoring, due diligence and screening | Article 6(1)(c) where a legal obligation applies to us in respect of the relationship, in particular under the amended Luxembourg law of 12 November 2004 and for screening against restrictive measures binding on us; otherwise article 6(1)(f), our legitimate interest in knowing with whom we contract and in protecting against financial crime and reputational risk |
| Negotiating, administering and performing engagements, and providing and supporting our platforms and managed services | Article 6(1)(b) where you are the contracting party; otherwise article 6(1)(f), our legitimate interest in performing the contract with the organisation you represent |
| Invoicing, collection of fees and recovery of debts | Articles 6(1)(b) and 6(1)(f), our legitimate interest in being paid |
| Accounting, tax and corporate reporting obligations, and reporting under the Luxembourg law of 25 March 2020 on reportable cross-border arrangements | Article 6(1)(c) |
| Organising events and delivering training and certification | Article 6(1)(b) where you register in your own name; otherwise article 6(1)(f) |
| Marketing communications and preference management (section 5) | Article 6(1)(a), your consent; or article 6(1)(f) for the limited case described at section 5 |
| Operating our website, and measuring its use and the use of our communications (section 6) | Article 6(1)(f) for operating a functioning and secure website; article 6(1)(a) for analytics and measurement |
| Recording calls and online meetings, where a recording is made | Article 6(1)(a), your consent, given before the recording begins; article 6(1)(f) where the participant is a member of Palana personnel |
| Security of our premises, personnel, systems and information, and the detection and investigation of incidents and misuse | Article 6(1)(f) |
| Managing supplier and business partner relationships | Articles 6(1)(b) and 6(1)(f) |
| Establishing, exercising and defending legal claims, managing disputes and investigations, audit and insurance | Article 6(1)(f); article 9(2)(f) where special categories of personal data are involved |
| Responding to a binding request from a competent authority or a court, and other statutory obligations | Article 6(1)(c) |
| Managing a merger, acquisition, reorganisation or transfer of our business | Article 6(1)(f) |
| Recruitment, employment and the management of contractors | As set out at section 13 |
4.2Legitimate interests
Where we rely on article 6(1)(f), we assess whether our interest is overridden by your interests or fundamental rights and freedoms. The interests we pursue are conducting and developing our business, knowing with whom we contract, performing our contracts, being paid, keeping accurate records, promoting our services to professional audiences, securing our premises, personnel, systems and information, protecting our legal position and managing our corporate structure.
4.3Consent
Where we rely on your consent we ask for it separately, by a clear affirmative act, and we do not make access to our website, services or events conditional on it. You may withdraw it at any time, using the unsubscribe link when included in any communication or by contacting us as set out at section 16. Withdrawal does not affect the lawfulness of processing carried out beforehand.
4.4Use for a new purpose
If we intend to process your personal data for a purpose other than that for which it was collected, we will inform you of that purpose beforehand, together with the further information required by article 13(3) of the GDPR.
Marketing communications
We send newsletters, invitations and other marketing communications by electronic mail on one of two bases. Where you subscribe, we send them on the basis of your consent, given by a separate act.
Where you are an existing client and we obtained your electronic contact details from you in the context of the sale of our services, we may send you communications about similar services on the basis of our legitimate interest, as article 11 of the amended Luxembourg law of 30 May 2005 permits. You are given the opportunity to object when your details are collected and in every message we send.
You may object at any time to the processing of your personal data for direct marketing, including any related profiling, without giving a reason. We will stop immediately. Under articles 21(2) and 21(3) of the GDPR this right is absolute and is not subject to any assessment on our part.
We do not sell, let or rent personal data to third parties.
Our website and cookies
We use cookies to collect data on how you use our website and view our marketing emails. This may include, for example, information on which of Palana’s website pages you have visited, how long you stayed on them or which items you clicked on. Full details are in our Cookie Policy at www.palana.lu/cookie-policy.
Where we operate a page on a third-party platform such as LinkedIn, the platform provides us with aggregated audience statistics. In respect of that processing the platform and Palana are joint controllers. The platform determines the means by which the underlying data is collected and processes it under its own privacy notice, which we ask you to read; the essence of the arrangement between us is set out in the terms the platform publishes for page administrators. You may exercise your rights against either the platform or Palana.
Use of artificial intelligence
We use artificial intelligence tools to support the work of our personnel: in the preparation of our deliverables, in our internal processes, and in client acceptance and screening, where such a tool assists us in reading and filing the documents provided to us. Only tools approved by Palana may be used, on terms which prohibit the provider from using the data submitted to them to train any model or for the provider’s own purposes. Our personnel may not use publicly available or consumer artificial intelligence services, or personal accounts, for any Palana purpose.
These tools support our personnel; they do not replace them. Output is reviewed by a suitably qualified person, who considers the underlying information and may depart from it, and Palana remains responsible for its deliverables and assessments. We take no decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, within the meaning of article 22 of the GDPR. Should that change, we will update this Notice before the change takes effect.
Where the use of these tools involves personal data, we assess the processing before it begins and carry out a data protection impact assessment where article 35 of the GDPR requires one. Transfers of personal data to providers established outside the European Economic Area are governed by section 9.
Who we share personal data with
We disclose personal data only where necessary for a purpose described at section 4, and only to the following categories of recipient:
- Service providers acting as our processors: providers of information technology, hosting and cloud infrastructure, communications and collaboration platforms, artificial intelligence tools, identity verification and screening, document management, marketing and event management, recruitment, payroll and human resources administration. They act only on our documented instructions and under written contracts containing the stipulations required by article 28(3) of the GDPR;
- Another Palana entity, where necessary for an engagement or for the management of our business;
- Professional advisers and auditors: our lawyers, accountants, auditors, tax advisers and insurers, acting as separate controllers;
- Banks, payment service providers and financial intermediaries, for invoicing, payment and the recovery of debts;
- Social security institutions, in particular the Caisse nationale de santé and the Centre commun de la sécurité sociale, acting as separate controllers;
- Public authorities, courts and regulators, where we are required to disclose by law or by order, or where disclosure is necessary for the establishment, exercise or defence of legal claims;
- Our clients, where you are their representative or authorised user, or where your personal data forms part of a deliverable prepared for them;
- Subcontractors, where we subcontract part of an engagement;
- An acquirer or successor, in the context of a merger, acquisition, reorganisation or transfer of our business; and
- Any other recipient you ask us to disclose to.
Our recipients may, under their own responsibility, disclose personal data to their own agents and delegates, which process it solely in order to assist the recipient in providing its services to Palana or in meeting its own legal obligations. Recipients may be located inside or outside the European Economic Area.
Where a recipient acts as a controller in its own right, it processes the personal data under its own responsibility and its own privacy notice. We do not sell, let or rent personal data.
Transfers outside the European Economic Area
Where personal data is transferred outside the European Economic Area to a country which the European Commission has not recognised as providing an adequate level of protection, we ensure that the transfer is carried out in accordance with Chapter V of the GDPR. In particular, we rely on the standard contractual clauses adopted by the European Commission, accompanied where necessary by a transfer impact assessment and by additional technical, organisational and contractual safeguards intended to ensure a level of protection essentially equivalent to that guaranteed within the European Union. Those measures may include encryption, access controls, pseudonymisation, and contractual commitments by the recipient not to disclose the data further and to notify us of any request for access by a public authority. Where the Commission has adopted an adequacy decision covering the recipient, as it has in respect of the United Kingdom, the transfer is made on the basis of that decision. Exceptionally, and only where neither route is available, we may rely on a derogation under article 49(1) of the GDPR.
Transfers made by Palana Limited out of the United Kingdom are governed by the equivalent provisions of United Kingdom law.
You may obtain further information about the safeguards applied to a transfer, and a copy of the relevant instrument, by contacting us as set out at section 16.
Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, alteration, disclosure or access, and we impose equivalent obligations on the processors we engage. No transmission over the internet and no system of storage can be guaranteed to be entirely secure. Where you hold credentials giving access to one of our platforms, you are responsible for keeping them confidential.
How long we keep personal data
We keep personal data only for as long as is necessary for the purposes for which it was collected, and thereafter for as long as is required by law or is necessary for the establishment, exercise or defence of legal claims. Where more than one period applies to the same data, the longest applies; by way of exception, special categories of personal data and personal data relating to criminal convictions and offences are removed at the end of their own period even where the file containing them is kept for longer. When we no longer require personal data we securely destroy or anonymise it.
The criteria by which we determine the period are the duration of the relationship, the period for which a statute requires the record to be kept, the limitation period applicable to a claim arising from the relationship, and, where none of these applies, the period for which the record remains necessary for the purpose. Applying those criteria:
| Personal data | Period |
|---|---|
| Accounting records and the documents supporting them, including invoices and payroll records | Ten years, as Luxembourg accounting and tax legislation requires |
| Client and supplier engagement files, contracts, and the contact and correspondence data relating to them | For the duration of the relationship and for the limitation period applicable to claims arising from it |
| Client acceptance, due diligence and screening records | Five years from the end of the relationship or from an occasional transaction |
| Personnel and recruitment records | For the duration of the relationship and thereafter for the periods required by Luxembourg employment, social security and accounting law, and for the applicable limitation periods. A criminal record extract is dealt with at section 3.3, and is not kept beyond the periods stated there |
| Records of prospective clients and candidates where no relationship follows, marketing subscriptions, and event and training records | For a limited period after the last interaction, the event or the withdrawal of a subscription |
| Website, platform, access and security logs, visitor records and recordings of calls and meetings | For a limited period determined by reference to the security or operational purpose concerned |
| Records kept to demonstrate compliance, including records of data protection requests | For the period over which compliance may be reviewed |
The individual periods are held in our internal retention register, which is the master record. A copy of the entry relevant to you is available on request.
Your rights
12.1The rights you have
Subject to the conditions and exceptions provided for in the Data Protection Laws, you have the following rights.
| Right | What it means |
|---|---|
| Access | To obtain confirmation whether we process personal data concerning you and, where we do, a copy of it together with the information listed in article 15 of the GDPR. The first copy is free; we may charge a reasonable fee based on administrative costs for further copies |
| Rectification | To have inaccurate personal data corrected and incomplete data completed |
| Erasure | To have your personal data erased where a ground in article 17(1) applies. The right is not absolute and does not apply where the processing is necessary for compliance with a legal obligation or for legal claims |
| Restriction | To have processing restricted in the circumstances set out in article 18 |
| Portability | To receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible. This applies only where the processing is based on consent or on a contract and is carried out by automated means |
| Objection | To object, on grounds relating to your particular situation, to processing based on our legitimate interests. Where you object to direct marketing we stop immediately and without assessment: see section 5 |
| Withdrawal of consent | To withdraw consent at any time where the processing is based on it |
| Automated decisions | Not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. We take no such decision: see section 7 |
| Complaint | To lodge a complaint with a supervisory authority: see section 12.3 |
12.2How to exercise them
Please address your request to our Data Protection Contact, using the details at section 16. Where we have reasonable doubts as to your identity we will ask for the additional information necessary to confirm it.
We respond without undue delay and in any event within one month of receipt. Where the request is complex, or where you have made a number of requests, we may extend that period by up to two further months, and will inform you of the extension and the reasons for it within the first month. Where we do not act on your request we will tell you why within one month, and of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy.
Where the personal data concerned is held by us as processor on behalf of a client, we are not permitted to act on the request ourselves. We forward it to the client without undue delay and tell you that we have done so, so that you can address the controller directly.
12.3Complaints
If you are not satisfied with the way we have handled your personal data or your request, please contact us first so that we may try to resolve the matter. You also have the right at any time to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. Where your complaint concerns processing by Palana Limited, you may also complain to it directly using the details at section 16.
15, Boulevard du Jazz
L-4370 Belvaux, Grand Duchy of Luxembourg
Telephone (+352) 26 10 60-1
www.cnpd.lu
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF, United Kingdom
Telephone (+44) 0303 123 1113
www.ico.org.uk
Candidates, employees and contractors
13.1Recruitment
When you apply for a position we process your name and contact details, the content of your curriculum vitae and covering letter, your educational and professional background, qualifications and skills, your right to work, the results of interviews and assessments, and references where you have authorised us to take them. We do so in order to assess your application, to communicate with you and to prepare the documents connected with a possible engagement. The lawful bases are article 6(1)(b), being steps taken at your request before entering into a contract, and article 6(1)(f), our legitimate interest in assessing candidates and keeping a record of our decisions. Consent is not the basis on which we assess your application; we use it only where you ask us to keep your application on file so that we may contact you about future opportunities, and you may withdraw it at any time.
13.2Employees and contractors
For employees and contractors we also process identification and civil status data, national identification and social security numbers, home address and private contact details, bank account details, emergency contact details, remuneration and benefits data, working time and absence records, performance, career and training records, disciplinary and grievance records, and data relating to professional tools, access rights and system logs.
The lawful bases are article 6(1)(b), for the performance of the employment or services contract; article 6(1)(c), for compliance with our legal obligations, including those relating to tax, social security, health and safety, working time, right to work, mandatory registers and staff representation; and article 6(1)(f), for our legitimate interests in the security of our premises, personnel, systems and information, in screening our personnel against official sanctions lists and politically exposed person lists, in managing operations, in investigating disciplinary matters and grievances, in legal claims and audits and in ensuring compliance with our internal policies. Health data is processed on the conditions set out at section 3.2.
Where personal data is processed for the purpose of monitoring employees within the meaning of article L.261-1 of the Luxembourg Labour Code, we inform in advance the joint committee (comité mixte) or, failing that, the staff delegation (délégation du personnel) or, failing that, the Inspection du Travail et des Mines, in the order that article requires, and we provide the information it prescribes. Within fifteen days of that information, the body informed or, failing that, the employees concerned may ask the Commission nationale pour la protection des données for a prior opinion; the request suspends implementation until the opinion is given. Operational logging which is not carried out for a monitoring purpose is outside that article.
Further information is set out in our Personal Data Privacy and Retention Policy, which is made available to our personnel.
Personal data you provide about other individuals
You will sometimes give us personal data relating to someone else such as a colleague, your organisation’s representatives or beneficial owners, a referee, or an emergency contact.
Where we obtain personal data indirectly and act as controller, we provide the information required by article 14 of the GDPR within the applicable period, unless one of the exceptions in article 14(5) applies. Where we process the data solely on a client’s documented instructions, the client remains responsible for transparency as controller and we assist it in accordance with article 28(3)(e) of the GDPR.
We ask you to tell the individual that you have provided their personal data to us and to draw this Notice to their attention, and to obtain their consent where you require it in order to disclose their data to us. Please also tell us of any change to the information you have given us, so that we may keep it accurate.
Changes to this Notice
We reserve the right to amend this Notice from time to time to reflect changes in the law, in regulatory guidance or in our processing. Each version carries a version reference, and the current version is published at all times on our website. You are advised to check this Notice from time to time.
How to contact us
If you have a question about this Notice or about the way we process your personal data, or if you wish to exercise any of your rights, please contact our Data Protection Contact. The same contact details apply to Palana Limited.
Attention: Data Protection
33, rue du Puits Romain
L-8070 Bertrange
Grand Duchy of Luxembourg