RSM collects and processes personal data (i.e. information relating to an identified or identifiable natural person) relating to its customers in accordance with the applicable legislation, i.e. the Regulation EU 2016/679 of the European Parliament and of the Council of 27th April 2016, (the “GDPR”).
RSM only collects and/or processes the information required by applicable laws, respectively useful for the execution of its mission, as “Data Processor” or “Data Controller” in the meaning of the GDPR.
RSM’s clients are data controllers and determine the purposes and means of the personal data processing. As subcontractor in charge of services to be provided to them (e.g. domiciliation, accounting and tax services for RSM Tax & Accounting Luxembourg, central administration services to funds clients for RSM Financial Services Luxembourg or AIFM services for RSM Fund Management Luxembourg, or salary calculation for RSM Cosal), RSM is data processor and processes personal data on behalf of, on instructions from and under the authority of its clients.
When RSM acts as Data Processor, an agreement regulating the personal data processing is concluded with its customers.
In this regard, please find below a description of this specific legal data processing:
1. What are the Personal Data processed?
RSM may process the following categories of Personal Data:
- Contact information such as address, email address, phone number;
- Data relating to civil status such as last and first names, nationality, tax residence;
- Data relating to the professional situation of natural persons such as job title, professional background and skills; and
- Financial data such as financial participations in the share capital of companies.
2. Why are the Personal Data Processed?
The Personal Data are processed by RSM to meet its regulatory obligations (including conducting due diligence and cooperating with competent authorities, but also preventing and detecting any financial fraud, corruption and financing of terrorism activities) and to be in a position to execute its engagement.
RSM informs its clients of those requirements before processing, unless that laws, regulations or circulars prohibit such information on important grounds of public interest.
3. Who may access the Personal Data?
The Personal Data are processed by RSM employees in the framework of the objectives above described.
Furthermore, RSM may share the Personal Data with:
- within all Luxembourg RSM companies (i.e. RSM Tax & Accounting Luxembourg, RSM Financial Services Luxembourg, RSM Fund Management Luxembourg, RSM Audit Luxembourg and RSM Cosal Luxembourg,);
- relevant regulators and, more generally any competent authority, when RSM is required to do so; and
- third party service providers (e.g. for IT purposes and storage systems).
The Company hereby grants a generic written authorisation to RSM to use Data Processors for processing personal data:
- to the extent necessary for RSM to fulfil its contractual obligations under the Agreement and the Addendum; and
- as far as RSM remains responsible for any act or omission of its Data Processors.
As a consequence, RSM is allowed to engage Data Processors for carrying out specific processing activities.
4. How long are the Personal Data stored?
RSM retains the Personal Data in accordance with the legal retention periods applicable in Luxembourg or where required for RSM to assert or defend against legal claims until the end of the relevant retention period or until the claim in question have been settled.
- the AML/KYC obligations related documents will be kept for five (5) years from the end of the contractual relationship with the Company or any other longer period required by the law; and
- RSM may in addition retain the Personal Data for legitimate interest for specific purpose for a period of ten (10) years.
Moreover, the Personal Data will be deleted when:
- they are no longer reasonably required for the purpose they were initially collected for; or/and
- RSM is not legally required or otherwise permitted to continue storing them.
5. What are your rights?
Pursuant to the GDPR, you (i.e. each client or client’s staff or representatives, to the extent applicable to each relevant natural person) have the following rights with respect to the processing of the Personal Data:
- To access and, where applicable to obtain copies of the Personal Data;
- To request the rectification or correction of the Personal Data if they are incomplete or incorrect;
- To require deletion of the Personal Data, unless whether there is a legitimate reason for RSM to justify storing them;
- To require that the processing of the Personal Data be limited, if applicable; and
- To object at any time to the processing of the Personal Data, if applicable.
Treatment device of claims relating to our services
RSM has a procedure for the effective consideration and proper handling of complaints.
Your contact persons
For any claim, please contact:
- primarily your usual contact person,
- or directly the relevant RSM company (i.e. RSM Financial Services Luxembourg or RSM Fund Management Luxembourg or RSM Tax & Accounting Luxembourg or RSM Audit Luxembourg or RSM Cosal Luxembourg), to the attention of the Management.
In all cases, your claim will be transmitted to the Director responsible for processing the claims of our company.
In order to ensure an efficient processing of your claim, please specify in your claim the following information:
- The exact nature of your claim,
- Your full civil status and address,
- Any other references or copies of documents that might be useful. We advise you to keep a copy of your requests and responses which will be sent to you.
The processing delays of your claim
The acknowledgment of receipt: 10 days
You will receive an acknowledgment of receipt of your request within a maximum of 10 working days from receipt thereof, unless the treatment can be achieved within that period, in which case you will receive a response to your claim within this period of 10 days.
The answer: one month
Within one month of the date of receipt of your claim, you will receive an answer. If additional information is required to process your claim, this period of one month will be suspended during the needed time to receive additional documents or information.
If the claim cannot be processed by us within this period of one month, we will contact you to explain the reasons for this delay and to give you an estimated date of answer.
The mailing address to send your claim to the relevant RSM Luxembourg entity
RSM Financial Services Luxembourg, or
RSM Fund Management Luxembourg, or
RSM Tax & Accounting Luxembourg, or
RSM Audit Luxembourg, or
RSM Cosal Luxembourg
Action before the Luxembourg Supervisory Authority of the Financial Sector (CSSF)
(Only applicable for RSM entities under the supervision or control of the CSSF, i.e. RSM Financial Services Luxembourg, RSM Fund Management Luxembourg and RSM Audit Luxembourg)
If a disagreement persists after our reply, you can, without renouncing to other judiciary action, seek the CSSF.
Please find with the following link, a presentation and the detailed applicable procedure in this context with the CSSF, as described in Regulation CSSF 16-07 and in the CSSF circular 17/671 on alternative dispute resolution for claims: http://www.cssf.lu/en/consumer/complaints/
Please find its main aspects as follows:
- First requirement: you must have sent your claim in writing to our company and not have received any reply or any satisfactory answer at the end of the period of one month abovementioned.
- The application must be submitted in writing either by post to the address of the CSSF (published on the website) or by fax sent to the CSSF (published on its website) or by email (at the address published on their website), or online via the website of the CSSF.
- In order to facilitate the introduction of an application, the CSSF provides an application form on its website (see link above); the request must be substantiated and accompanied by a set of documents listed in the Regulations CSSF 16/07 and also in the application form.
- The application shall be written in Luxembourgish, French, German or English.
- If the request is deemed non-admissible by the CSSF, a justification of non-admissibility is sent to the applicant within three weeks of receipt of the claim. Otherwise, the CSSF confirms in writing to the applicant that the file is admissible and complete, and forwards a copy to the professional to take position and give an answer within one month.
- The CSSF begins the analysis of the claim upon receiving the response from the professional. The CSSF may request additional documents / information. The parties keep their own original documents as evidence. The CSSF has 90 days to issue its opinion, from the date the claim file is complete. The period may be extended in cases of complex claims, provided that, in such case, the applicant and the professional are informed by the CSSF in writing before the end of the initial 90-days period.
- The procedure is essentially written. However the CSSF may suggest an interview involving the applicant, the professional, their respective lawyers and/or representatives and the CSSF.
- The CSSF sends a notice and its motivation in writing to both parties:
- If the request is wholly or partly based, the CSSF suggests an out-of-court settlement of the claim. Parties are not compelled to follow the opinion of the CSSF, but they must inform the CSSF of their decision in this context.
- Otherwise, if the parties maintain irreconcilable positions or if they refuse to follow the opinion of the CSSF, it is suggested to act before the courts.
9. The out of court procedure may close in advance, with information to the CSSF, in the following cases:
- The applicant waives his claim in writing.
- The applicant and the professional reach an agreement before the CSSF gives its opinion.
- The right that the applicant intends to defend is prescribed.
- A court, arbitrator or other extrajudicial body in Luxembourg or abroad is seized of the claim.
- The applicant has not submitted any evidence or required explanation to the CSSF within a maximum of 45 days.
10. To ensure the impartiality of the CSSF in the settlement of the claim, any agent of the CSSF who notices the existence of a conflict of interest in dealing with the claim must report it to his superiors in order to be withdrawn from the application if necessary.