Data protection policy

1. Purpose, scope and legal framework

The protection of personal data forms part of SQUARREL’s professional and confidentiality obligations.

This policy applies to the processing of data relating to natural persons carried out by SQUARREL in connection with:

• access to and browsing of the firm’s website;
• requests sent by email, telephone or contact form;
• pre-contractual steps, the acceptance of an engagement and the client relationship;
• accounting, tax and advisory engagements and related services;
• relationships with suppliers, service providers, business partners and authorities;
• SQUARREL’s administration and security and the defence of its rights.

This policy has been drawn up primarily with regard to Regulation (EU) 2016/679 of 27 April 2016 (the ‘GDPR’), the applicable Luxembourg data protection legislation, the rules on electronic communications and cookies, and the legal and professional obligations specific to chartered accountants.

2. Identity and contact details of the data controller

For the processing described in this policy, the data controller is:

• SQUARREL S.à r.l.-S, a simplified private limited liability company (société à responsabilité limitée simplifiée);
• Registered office: 5, Loumillewee, L-9175 Niederfeulen, Luxembourg;
• Luxembourg Trade and Companies Register (RCS): B299185;
• VAT number: LU 36857728;
• Chartered accountancy firm, member of the Ordre des Experts-Comptables (OEC) of the Grand Duchy of Luxembourg;
• Contact email address: h.peschon@squarrel.eu;
• Telephone: +352 661 189 203.

SQUARREL has not appointed a data protection officer. Any question concerning this policy or the exercise of rights may be sent to the contact indicated above.

3. Data subjects

Depending on the nature of the relationship or engagement, processing may concern, in particular:

• Website visitors and persons using the contact form;
• Prospective clients and persons requesting information, an appointment or a proposal;
• Clients who are natural persons and co-signatories of an engagement letter;
• Representatives, executives, directors, managers, partners, shareholders and beneficial owners of clients that are legal persons;
• Employees, workers, consultants, customers, suppliers and other counterparties of a client where their data are necessary for the engagement;
• Spouses, partners, children, dependants, heirs or other household members whose information is relevant to a tax return or a specific engagement;
• Suppliers, service providers, subcontractors, partners, advisers and their representatives;
• Contacts at public administrations, public bodies, banks, insurers or other institutions.

Where a client provides SQUARREL with data concerning a third party, it is the client’s responsibility, where required by law, to inform that person that their data have been provided and to make this policy accessible to them.

4. Categories of data processed

SQUARREL processes only data that are adequate, relevant and necessary in relation to the purposes pursued. Depending on the circumstances, the following categories may be processed:

Certain engagements may make it necessary to process, on an occasional basis, special categories of data, for example data concerning health, trade union membership or religious beliefs where they appear in tax, social security or payroll documents. Data relating to criminal convictions, offences or public functions may also be processed where required by law, in particular in the context of due diligence obligations. Such data are processed only where an appropriate legal basis exists and to the extent strictly necessary.

5. Sources of data

Data are obtained:

• Directly from the data subject;
• From the client, its representatives or persons it has authorised;
• From a previous chartered accountant, a lawyer, notary, employer, financial institution or other adviser, with the required authorisation;
• From public administrations and public bodies, in particular the Direct Tax Administration (Administration des contributions directes), the Registration Duties, Estates and VAT Authority (Administration de l’enregistrement, des domaines et de la TVA), the Joint Social Security Centre (Centre commun de la sécurité sociale), the Trade and Companies Register (Registre de commerce et des sociétés) and the Register of Beneficial Owners (Registre des bénéficiaires effectifs);
• From public or lawfully accessible sources, in particular registers, official publications, sanctions lists and databases used for compliance checks;
• Automatically when the website is used, by means of technical logs, cookies or similar technologies.

6. Purposes and legal bases

Data are processed for the following purposes and on the following legal bases:

Where several legal bases may apply to the same set of data, SQUARREL identifies the relevant basis according to the specific purpose of the processing. Consent is not used as a legal basis where the processing is necessary for the performance of an engagement or for compliance with a legal obligation.

7. Due diligence obligations and compliance checks

As a chartered accountant, SQUARREL is subject to obligations relating to the fight against money laundering and terrorist financing. These obligations may, in particular, lead SQUARREL to:

• Identify and verify the identity of the client, its representatives and its beneficial owners;
• Understand the client’s activity and the purpose and nature of the business relationship;
• Request information on the source of funds or of wealth;
• Carry out checks in public registers, sanctions lists and compliance sources;
• Update information and carry out monitoring appropriate to the level of risk;
• Request additional explanations or documents;
• Refuse, suspend or terminate a relationship where it is not possible to comply with the applicable obligations;
• Disclose information to the competent authorities where required by law, without necessarily being permitted to inform the data subject.

Tools may assist with certain checks. Any significant decision regarding the acceptance or continuation of a relationship is subject to human assessment. SQUARREL does not take decisions producing legal effects based solely on automated processing.

8. SQUARREL as a processor

In certain engagements, SQUARREL may process data on behalf of the client and on the client’s documented instructions, in particular where data relating to the client’s employees, customers, suppliers or other third parties are processed in order to carry out specific accounting, tax or administrative operations.

In such cases:

• The client remains the data controller for the purposes it determines;
• SQUARREL processes the data solely in accordance with the agreed instructions, subject to its own legal and professional obligations;
• The characteristics of the processing, the security measures, assistance, sub-processing and the return or deletion of the data are specified in the contractual documentation;
• SQUARREL may itself become a data controller again for the operations it must carry out in order to comply with a legal, professional or security obligation or to defend its rights.

9. Recipients and access to data

Data are accessible only to persons who need them to perform their duties or obligations. Depending on the circumstances, they may be disclosed:

• To SQUARREL’s manager (gérant), staff and other authorised persons involved in its work;
• To IT, hosting, email, backup, electronic signature, document management, accounting or tax service providers, acting in accordance with their contractual role;
• To professional advisers, lawyers, insurers, auditors or experts where necessary;
• To tax authorities, social security bodies, registers, judicial, police or supervisory authorities, the Financial Intelligence Unit (Cellule de renseignement financier), the CNPD (Commission nationale pour la protection des données) and the Ordre des Experts-Comptables (OEC) where required by law or professional rules;
• To banks, notaries, employers, public administrations or other third parties expressly designated or authorised by the client;
• To the successor professional, within the limits of the client’s instructions and professional obligations.

SQUARREL does not sell personal data and does not make them available to third parties for use in their own direct marketing without an appropriate legal basis.

The main technical providers used for the website and communications may include, in particular, a hosting provider established in the European Union for the website server, and Microsoft for email and collaboration services. This list may change depending on needs and the solutions selected.

10. Transfers of data outside the European Economic Area

SQUARREL gives preference to processing and hosting within the European Economic Area (EEA). Certain service providers or their sub-processors may nevertheless process data from a third country or make certain data accessible there.

Where this occurs, SQUARREL ensures that the transfer is based on an authorised mechanism, in particular:

• An adequacy decision of the European Commission;
• Standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures;
• Another appropriate safeguard provided for by the GDPR;
• A derogation provided for by law and applicable to a specific situation.

Further information on the applicable safeguards may be requested from SQUARREL, subject to the protection of confidential information and the rights of third parties.

11. Retention periods

SQUARREL does not retain data for longer than necessary. Retention periods are determined according to the purpose, legal and professional obligations, limitation periods and the need to establish, exercise or defend rights. The main criteria are as follows:

On expiry of the applicable period, data are deleted, anonymised or placed in intermediate archiving with restricted access, unless a retention obligation provides otherwise.

12. Security, confidentiality and data breaches

SQUARREL implements technical and organisational measures proportionate to the nature of the data and to the risks, which may include, in particular:

• Access controls and restriction of access rights;
• Strong authentication where the service allows it;
• Encryption or protection of communications and media, as appropriate;
• Backups and restoration procedures;
• Updating of systems, protection against malware and security logging;
• Confidentiality obligations and internal procedures;
• Selection of service providers and contractual oversight of them;
• Incident management and business continuity procedures.

No system can guarantee absolute security. Anyone who becomes aware of the loss of a document, a compromised account, a fraudulent communication or any other incident likely to affect data must inform SQUARREL immediately.

Where a personal data breach is likely to result in a risk to the rights and freedoms of the data subjects, SQUARREL makes the required notifications to the CNPD and, where the level of risk so warrants, to the data subjects.

13. Automation and artificial intelligence

SQUARREL may use automation tools or assistance tools based on artificial intelligence in order to structure documents, facilitate checks, search for information, prepare analyses or improve the efficiency of its work.

These tools are used under professional supervision. In particular, SQUARREL ensures that it:

• transmits only the data necessary for the purpose pursued;
• selects solutions offering appropriate contractual, confidentiality and security safeguards;
• verifies the results before they are used in a professional service;
• does not base a decision producing legal effects solely on automated processing;
• does not knowingly use confidential client data to train a public model without an appropriate legal basis and without providing appropriate information.

14. Website, cookies and similar technologies

The firm’s website is an application developed for SQUARREL and hosted on a server located in the European Union. Fonts, images and scripts are served by the website itself, with the exception of the audience measurement tool described below, which is hosted in the European Union by the website’s technical service provider. When the website is visited, technical data may be processed to ensure its display and security, the handling of the form and the diagnosis of errors.

Two categories of cookies or similar technologies may be used:

• Strictly necessary cookies: essential for the transmission of communications, for security, for the operation of the website, for storing the user’s choice or for providing a service expressly requested. They do not require prior consent, but users are informed of them.
• Non-essential cookies: in particular certain audience measurement tools, embedded content, third-party features or tracking technologies. They may only be activated after the user’s prior consent, where such consent is required.

At present, the website uses only one strictly necessary cookie, set only on the written request and appointment request pages, and in the administration area. It protects the forms against fraudulent submissions and expires after two hours. The website uses neither advertising cookies nor embedded third-party content.

Website traffic is measured with Umami, a cookieless audience measurement tool hosted in the European Union by the website’s technical service provider. It sets no cookies, does not store IP addresses and does not make it possible to identify visitors: it produces only aggregate statistics (pages viewed, origin of visits, device type, country). Information entered in the forms is never transmitted to it. The browser’s ‘Do Not Track’ setting is respected.

Where non-essential cookies are used, the user may accept, refuse or customise their choice. Withdrawing consent must be as easy as giving it. The choices available and the duration of each cookie are presented in the website’s cookie management tool when it is enabled.

Refusing non-essential cookies does not prevent access to the main content of the website. However, disabling certain strictly necessary cookies in the browser may impair the operation of the form or of certain features.

The website may contain links to external websites. SQUARREL is not responsible for the processing of data carried out by those websites, which apply their own policies.

15. Professional communications and direct marketing

SQUARREL may send professional information, invitations or communications relating to its services where a legal basis permits it. Where consent is required, no communication is sent before it has been obtained.

Any person may object at any time and free of charge to the use of their contact details for direct marketing purposes by writing to h.peschon@squarrel.eu. The withdrawal of consent or an objection does not affect communications necessary for the performance of an engagement, compliance with a legal obligation or the handling of an ongoing matter.

16. Rights of data subjects

Subject to the conditions and limitations laid down by the GDPR and applicable laws, the data subject may exercise the following rights:

Right of access

to obtain confirmation as to whether processing is being carried out, to access the data and to receive the information provided for by the GDPR.

Right to rectification

to have inaccurate data corrected or incomplete data completed.

Right to erasure

to request erasure where the conditions are met, subject in particular to retention obligations and the defence of rights.

Right to restriction of processing

to request the temporary freezing of certain processing in the cases provided for by the GDPR.

Right to data portability

to receive or transmit certain data provided to SQUARREL where the automated processing is based on consent or on a contract.

Right to object

to object, on grounds relating to their particular situation, to processing based on legitimate interest; objection to direct marketing may be exercised without giving reasons.

Withdrawal of consent

to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

Right not to be subject to a decision based solely on automated processing

to benefit from the safeguards provided for should such processing be implemented.

These rights are not absolute. SQUARREL may, in particular, retain certain data where this is necessary for compliance with a legal or professional obligation or for the establishment, exercise or defence of legal claims, or where the request would adversely affect the rights and freedoms of others.

17. How to exercise your rights

A request may be sent:

• by email to h.peschon@squarrel.eu;
• by post to SQUARREL S.à r.l.-S, 5, Loumillewee, L-9175 Niederfeulen, Luxembourg.

The request must make it possible to identify the person and to understand precisely which right is being exercised. A copy of an identity document is not systematically required. SQUARREL may request additional information where there are reasonable doubts as to the identity of the requester, limiting verification to what is necessary.

SQUARREL responds, in principle, within one month of receipt of a complete request. This period may be extended by two months where the complexity or number of requests so warrants; the person is then informed of this within the initial period.

Exercising rights is free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, SQUARREL may charge a reasonable fee or refuse to act on it, giving reasons for its decision.

18. Complaint to the CNPD

Any person who considers that the processing of their data infringes the applicable rules may lodge a complaint with the Luxembourg supervisory authority:

Commission nationale pour la protection des données (CNPD)
15, boulevard du Jazz
L-4370 Belvaux
Luxembourg
Website: cnpd.public.lu

SQUARREL nevertheless recommends contacting the firm first in order to try to resolve any difficulty directly.

19. Updates to this policy

This policy may be amended to take account of legal, regulatory, professional, technical or organisational developments. The current version is published on the website www.squarrel.lu and states its effective date.

Where an amendment substantially affects processing already being carried out, SQUARREL provides, where required, additional information by appropriate means.