General Personal Data Protection Policy

VINCEO SOLUTIONS is committed to respecting your privacy and protecting your personal data. 

In the interests of transparency, VINCEO SOLUTIONS has adopted a ‘General Personal Data Protection Policy’ (hereafter ‘General Policy’) in accordance with the applicable regulations in this area and, in particular, with European (EU) Regulation 2016/679 of 27 April 2016 (*) and the Luxembourg law of 1 August 2018 (**) (hereafter ‘Regulation’).

The purpose of this General Policy is to inform you about VINCEO SOLUTIONS’ commitment to ensuring the protection of your personal data.

Please note that certain specific processing may be the subject of a separate and more appropriate Policy.

(*) (EU) Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

(**) Law of 1 August 2018 on the organisation of the National Data Protection Commission (“Commission Nationale pour la Protection des Données”) and implementation of (EU) Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing directive 95/46/EC (General Data Protection Regulation), amending the Labour Code and the law of 25 March 2015 stipulating the rules of remuneration and the terms and conditions for the promotion of State civil servants.

Definitions 

Consent: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Recipient: the natural or legal person, public authority, agency or other body which receives personal data, whether or not it is a third party.

Personal data: any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Purpose: objective of the data processing. Personal data shall be collected for clear, explicit and legitimate purposes.

Profiling: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Data controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

You: any natural person interacting with VINCEO SOLUTIONS (e.g. a user of our website, a consultant, representatives and/or employees of one of our customers, prospects, service providers, business partners or suppliers, a candidate, an associate of VINCEO SOLUTIONS, a visitor at VINCEO SOLUTIONS’ premises) and whose personal data VINCEO SOLUTIONS may collect directly or indirectly.

Who is the data controller?

In the processing of personal data that concerns you and which VINCEO SOLUTIONS collected directly or indirectly, the Data Controller is VINCEO SOLUTIONS. 

You will find below the contact details you can use to contact us:

What categories of personal data are collected and processed by VINCEO SOLUTIONS?

In the course of our activities, we may collect different categories of personal data about you depending on the nature and purpose of the processing carried out.

In any case, we undertake to collect and process only the data that is strictly necessary for the purposes of the data processing we carry out, as specified in this General Policy. 

We may collect the following information in particular:

• Identification data: title, surname, first name;
• Contact data: postal address, e-mail address, telephone number;
• Data relating to your professional activity: sector of activity, areas of expertise, years of experience, remuneration;
• Data relating to the processing of your application: all information on your CV, covering letter, level of experience, personality test results, any information freely accessible on the Internet, including professional public profiles (LinkedIn, etc.), information on the last position held (name, position, sector of activity, salary and dates) and information on the training completed (title of diploma, level of education, skills and languages spoken).

Please note that if you fail to provide certain information, VINCEO SOLUTIONS may not be able to fulfil all or part of the objectives described in this General Policy (e.g. you will not be able to use certain tools or services; we will be unable to process your request; in the case of recruitment, your application may not be accepted; …).

Personal data collected is not used for profiling purposes.

In the course of our business, no final decision is made solely on the basis of automated processing, rather on the basis of human analysis.

What are the purposes of processing your personal data?

There is a legitimate, explicit and specific purpose to any processing of your personal data.

VINCEO SOLUTIONS collects and uses your data for several purposes:

• Replying to your requests for information, complaints and questions;
• Communicating with you in the context of the assignments entrusted to us or for drafting business proposals, issuing requests for proposals, concluding agreements (consultancy agreements, service agreements, business provider agreements, etc.).
• Sending you newsletters, articles, theme-based surveys, regulatory watch, information regarding training initiatives, invitations linked to our service offering, legal or economic news, satisfaction surveys;
• Managing applications for an offer of employment, collaboration or internship;
• Managing spontaneous applications;
• Meeting our legal, regulatory, professional and/or contractual obligations;
• Managing and improving our website and our service offering;
• Organising events.

In any case, the personal data collected is appropriate, relevant and not excessive in relation to the stated purposes.

In the event your personal data is processed for other purposes, VINCEO SOLUTIONS will inform you of this and, when the Regulation so requires, will obtain your express prior consent.

What are the applicable legal bases for processing your personal data?

Generally speaking, we collect only the personal data that are necessary for the implementation of the purposes described in the section ‘WHAT ARE THE PURPOSES OF PROCESSING YOUR PERSONAL DATA?’

Within the framework of processing your personal data in accordance with the purposes described above, we will rely on one of the following legal bases:

• Performance of a contract: when the processing of your personal data is necessary for fulfilling our obligations under a contract to which you are a party/a representative or an employee of the party;
• Obligation imposed by the Regulation: when we are required to process your personal data in order to comply with a legal obligation or to provide information to a public authority, tax authority, supervisory authority or judicial authority;
• Legitimate interests: we will process your personal data if it is in our legitimate interest to do so, in order to best manage our company’s affairs in accordance with the Regulation, and to the extent that this interest does not outweigh your own interests;
• Your consent: in certain cases, we will ask you for specific permission to process some of your personal data, and we will only process it for the purposes to which you have given your consent.

In what context are your personal data collected?

Primarily, VINCEO SOLUTIONS is most likely to collect your data:

• Via the website https://www.vinceosolutions.lu, when you subscribe to newsletters;
• Via social media, using the buttons on pages such as LinkedIn, as you can follow and/or ‘like’ VINCEO SOLUTIONS’ posts;
• Through our clients, prospects, service providers, business partners;
• Via websites/social media pages containing information that you have made public (e.g. your own website or social media profile);
• Through our interactions with you, by postal mail, emails, telephone, interviews, training initiatives.

For how long can your personal data be kept?

The length of time the data can be retained depends on both the nature of the data and the specific circumstances that led us to collect it.

We will keep your personal data in our systems for the longest of the following periods: (i) as long as necessary for the operations and processing purposes concerned, (ii) for the retention, archiving and prescription periods authorised by the Regulation, (iii) the end of the applicable prescription period following a legal dispute or investigation regarding one of our offers or proposals, or one of our services.

What are your rights concerning your personal data?

Subject to the limits provided under the applicable Regulation, you have several rights regarding the processing of your personal data:

• The right of information: the right to obtain confirmation as to whether or not personal data concerning you is being processed;
• The right of access: the right to access personal data that we hold about you;
• The right of rectification: the right to request the correction of your personal data when they are inaccurate, incomplete, ambiguous or out of date; 
• The right of erasure (‘right to be forgotten’): the right to request that your personal data be deleted, to the extent allowed by the Regulation (e.g. when the personal data is no longer necessary for the purposes for which it was collected or processed);
• The right of limitation: the right to request to restrict the way your personal data is processed, in the cases defined in the Regulation (e.g. when you dispute the accuracy of your personal data. In this case, the processing of the data shall be limited to the period necessary for verifying the accuracy of such data);
• The right to withdraw your consent: if you have given your consent for the processing of your personal data, you may withdraw such consent at any time, without prejudice to the processing carried out on the basis of your consent prior to its withdrawal‐;
• the right of data portability: the right to request that we pass your data back to you or transfer it to a third party, where this is technically possible;
• The right to file a complaint with the supervisory authority in charge of personal data protection.

You also have the right of opposition, which allows you to object to the processing of your personal data for reasons relating to your particular situation. Furthermore, you have the right to object at any time to the processing of your personal data for the purposes of commercial prospecting or profiling if such profiling is linked to commercial prospecting. 

If you have requested specific services or communications from VINCEO SOLUTIONS, (e.g. newsletters, communications, invitations to events and/or training initiatives), you may unsubscribe at any time by following the instructions provided in each communication. 

Should you wish to exercise your rights over your personal data, you may send your request to the following addresses:

• Either by email: contact@vinceosolutions.lu
• Or by post: VINCEO SOLUTIONS, 16 rue de Nassau, L-2213 Luxembourg.

Your request must be dated and signed and accompanied by a copy of your valid identity document.

We will reply to you as soon as possible and, in any event, within one (1) month of receipt of your request, provided that it complies with the applicable Regulation. If necessary, this period may be extended by two (2) months, depending on the complexity of the request and the number of requests.

How to file a complaint?

Despite our commitment and our best efforts to protect your personal data, if you feel that your rights regarding data confidentiality have been breached, we invite you to contact us using the postal or e-mail address indicated above.

You have the right to submit a complaint directly to the Commission Nationale pour la Protection des Données, which is Luxembourg’s supervisory authority in charge of data protection, at any time.

Commission Nationale pour la Protection des Données (CNPD)

Complaints Department

15, Boulevard du Jazz

L-4370 Belvaux

You may use the online form provided for this purpose. (https://cnpd.public.lu/fr/particuliers/fairevaloir/formulaire-plainte.html).

Who are the recipients of your personal data?

In principle, VINCEO SOLUTIONS will process your data with the utmost care. Furthermore, access to your personal data within VINCEO SOLUTIONS shall be limited to only those employees who need access to your information for the purposes described in this General Policy.

For any of the purposes mentioned under the heading ‘WHAT ARE THE PURPOSES OF PROCESSING YOUR PERSONAL DATA?’, we may need to transfer your personal data:

• To clearly identified third parties in order to meet our legal obligations (e.g. a public authority, tax authority, supervisory authority or judicial authority);
• To third parties for the purpose of conducting our business (e.g. service providers, clients, prospects, etc.), provided we have your express permission to do so;
• If necessary, to subcontractors who can provide sufficient guarantees that appropriate technical and organisational measures have been implemented.

In principle, we do not transfer any of your personal data outside the European Union.

In such a case, this transfer shall take place on the basis of a ruling handed down by the European Commission, where the latter has recognised that the country to which your data is transferred ensures a level of protection equivalent to that existing within the European Union.

In the event of a transfer to a country whose level of protection of your data is not recognised by the European Commission as being adequate, we will put in place standard contractual clauses approved by the European Commission to ensure the protection of your data.

How is your personal data protected? 

VINCEO SOLUTIONS takes every suitable precaution, as well as appropriate technical and organisational measures, to preserve the security of your personal data and, in particular, to prevent it from being misrepresented, damaged or destroyed or accessed by unauthorised third parties.

These measures include the following in particular:

• Awareness and training of VINCEO SOLUTIONS staff to ensure that they are aware of our obligations with regard to protecting privacy when processing personal data;
• Administrative and technical controls to ensure that we only have access to personal data if we need it;
• Technical means, particularly firewalls, encryption and anti-virus software, to ensure the confidentiality, integrity, availability and continuous resilience of our IT systems;
• Means to restore the availability and access to personal data within an appropriate timeframe in the event of a physical or technical incident;
• Physical security measures at our premises, particularly the use of access badges.

Despite every effort made by VINCEO SOLUTIONS, absolute protection against every threat cannot be provided. Nevertheless, in accordance with the Regulation, and in the event of a personal data breach that is liable to create a high risk for your rights and freedoms, VINCEO SOLUTIONS undertakes to contact you as soon as possible to inform you of this.