Privacy Policy

1. Data controller

ASTEO LUXEMBOURG S.A., an investment firm authorised by the Commission de Surveillance du Secteur Financier (CSSF) under firm number P00000438, with registered office at 120 Boulevard de la Pétrusse, L-2330 Luxembourg, Grand Duchy of Luxembourg, LEI 222100L7BX1XCBJHH958, acts as data controller for the personal data described in this policy.

We have appointed a Data Protection Officer who may be contacted at any time at dpo@asteo.eu.

2. Categories of personal data we process

Depending on your relationship with us, we may process the following categories of data:

• Identification data: name, date and place of birth, nationality, identity document details, photograph of identity documents, tax identification number.
• Contact data: postal address, email address, telephone number.
• Financial and economic data: source of wealth and source of funds, income, net worth, bank account details, transaction and payment history.
• Knowledge and experience data: appropriateness and suitability questionnaire responses, investment objectives, risk tolerance, investment horizon.
• Contractual and account data: account numbers, mandates, order and execution records, portfolio positions, statements.
• Communication data: recordings of telephone conversations and electronic communications relating to orders, as required by MiFID II.
• Technical data: IP address, device and browser information, log data, cookie identifiers where you have consented.
• Compliance data: sanctions, PEP and adverse media screening results, AML/CTF risk classification, records of suspicious activity assessments.

3. Purposes and legal bases

We process personal data only where a lawful basis applies:

• Performance of a contract (Art. 6(1)(b) GDPR): opening and administering accounts, receiving and transmitting orders, portfolio management, investment advice, reporting and settlement.
• Compliance with legal obligations (Art. 6(1)(c) GDPR): client identification and verification under the Luxembourg AML/CTF law of 12 November 2004 as amended, MiFID II record-keeping and transaction reporting, EMIR and SFTR reporting where applicable, FATCA and CRS tax reporting, responses to lawful requests from supervisory, tax and judicial authorities.
• Legitimate interests (Art. 6(1)(f) GDPR): risk management, fraud prevention, information security, internal audit, business continuity, defence of legal claims, and improvement of our services.
• Consent (Art. 6(1)(a) GDPR): non-essential cookies, market commentary and marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

4. Recording of communications

In accordance with Article 16(7) of Directive 2014/65/EU (MiFID II) and Commission Delegated Regulation (EU) 2017/565, telephone conversations and electronic communications that relate to the reception, transmission and execution of orders are recorded. Copies of such records are available on request for a period of five years, or up to seven years where required by the CSSF.

5. Recipients and disclosures

Personal data may be disclosed, strictly on a need-to-know basis, to:

• Executing brokers, liquidity providers, custodians, depositaries and settlement agents involved in the execution of your instructions.
• Payment service providers and credit institutions holding client money.
• IT, cloud hosting, archiving, communication-recording and cybersecurity providers acting as processors under a written agreement compliant with Article 28 GDPR.
• External auditors, legal advisers and the réviseur d'entreprises agréé.
• Competent authorities including the CSSF, CONSOB, tax administrations and judicial authorities, where legally required.

We do not sell personal data, and we do not disclose it for third-party marketing purposes.

6. International transfers

Personal data is processed primarily within the European Economic Area. Where a transfer to a third country is necessary, it is carried out on the basis of an adequacy decision of the European Commission or, failing that, of the Standard Contractual Clauses adopted by Decision (EU) 2021/914, complemented by a transfer impact assessment and appropriate supplementary technical and organisational measures.

7. Retention

We retain personal data for the duration of the client relationship and thereafter for the periods required by law: ten years from the end of the relationship for AML/CTF documentation and accounting records, five to seven years for order and communication records under MiFID II, and for the duration of any applicable limitation period for the defence of legal claims. Data no longer required is deleted or irreversibly anonymised.

8. Your rights

Subject to the conditions and exceptions set out in the GDPR, you may exercise the following rights:

• Right of access to your personal data and to obtain a copy.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure, where no legal retention obligation applies.
• Right to restriction of processing.
• Right to data portability for data processed on the basis of consent or contract.
• Right to object to processing based on our legitimate interests.
• Right to withdraw consent at any time.
• Right not to be subject to a decision based solely on automated processing producing legal effects.

Requests should be addressed to dpo@asteo.eu and will be answered within one month, extendable by two further months for complex requests. You may lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15 Boulevard du Jazz, L-4370 Belvaux, Luxembourg, or with the supervisory authority of your habitual residence.

9. Automated processing and profiling

We use rule-based automated screening for anti-money-laundering, sanctions and fraud detection purposes, and automated scoring to assess the appropriateness and suitability of services. No decision producing legal effects concerning you is taken on the basis of automated processing alone without human review; you may request human intervention and contest the outcome.

10. Cookies and similar technologies

Our corporate website uses strictly necessary cookies for security and session integrity. Analytics or preference cookies, where used, are deployed only after your consent, which you may modify or withdraw at any time. Details of each cookie, its purpose and its lifetime are available on request.

11. Data security

We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, segregated environments, role-based access control, multi-factor authentication, logging and monitoring, periodic penetration testing, staff confidentiality undertakings and a documented incident response procedure. Personal data breaches are notified to the CNPD within 72 hours where required, and to affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

12. Changes to this policy

This policy may be updated to reflect legal, regulatory or operational developments. The version in force is the one published on this page, together with its date of last update. Material changes affecting clients are communicated through the client area or by email.