Privacy Notice
Serge Hoffmann S.à r.l.
We, Serge Hoffmann S.à r.l., collect and process personal data on you where you or your company (which you represent or for which you act as a contact person) is an actual, former or prospective client of ours. We act as the controller of such processing and are committed to respecting your privacy and protecting your personal data in accordance with the law, in particular the EU General Data Protection Regulation 2016/679 (GDPR).
Processing Purposes
The processing of your data is based on the following grounds:
| Purpose of Processing | GDPR Legal Basis |
|---|---|
| To manage the onboarding process | In order to take steps prior to entering into a contract with you or your company, and for purposes of legitimate interests pursued by us (client/prospect management) |
| To manage legal services provided at your request, as well as for billing, accounting and administrative management purposes | For the performance of a contract with you, and to comply with legal obligations to which we are subject |
| To evaluate and manage risks, fight against fraud, manage disputes and litigation | For purposes of legitimate interests pursued by us (risk and dispute management) and, where special categories of data are processed, as necessary for the establishment, exercise or defence of legal claims |
| To better know you as required by law (in particular anti-money laundering and terrorism financing rules) | To comply with legal obligations to which we are subject |
| For marketing purposes (contact management, CRM, directory and rankings, events, newsletter, publications and other commercial communications) | For purposes of legitimate interests pursued by us (commercial prospection) |
| Website functioning | For purposes of legitimate interests pursued by us (operation and security of our website) |
In exceptional cases, we may need your consent for certain processing operations (which is not the case for the processing purposes detailed above). In such case, we will ask for your consent separately.
Data Categories
In addition to information you have communicated to us directly, we may collect and process the following categories of personal data:
- Identity and contact details, legal services ordered or delivered, financial data (amounts, bank details, rates, hours), credit control;
- Personal identification data (including copy of passport or ID, proof of residence);
- For regulatory checks (including conflicts of interest, AML/CTF): customer due diligence data, counterparty details, identity verifications, financial data, corporate data, sanctions checks, KYC/AML risk assessments;
- Marketing-related information (LinkedIn/social media profile, interests, relationship history, events attendance, photos/videos from events, newsletter subscriptions); and
Cookies
This website does not use cookies, tracking technologies or analytics tools, and does not load third-party resources. All website assets, including fonts, are served directly from our own hosting. Should this change in the future, this notice will be updated and, where legally required, your consent will be requested.
Data Recipients
Without prejudice to our professional secrecy obligations, we may share your data with our affiliated entities or law firms, your company's own providers (intermediaries, advisors, banks, notaries, lawyers, domiciliation companies), administrative or judicial authorities (e.g., CRF, Bar), and service providers (e.g., event organisers).
Data Transfers Outside the EU/EEA
We do not transfer your personal data outside the EU/EEA for our own internal purposes. However, where the legal services we provide require so (e.g., if we assist you on a matter, dispute or litigation taking place outside of the EU/EEA), we may transfer your data in the relevant jurisdiction. In such cases, and in accordance with GDPR, data transfers will be:
- Limited to what is necessary to perform our engagement with you, or conclude arrangements with third parties in your interest; or
- Justified by the establishment, exercise or defence of legal claims; or
- Covered by appropriate safeguards, such as EC-approved standard contractual clauses; or
- In exceptional cases, made with your consent.
Data Retention
We will retain your personal data for as long as required to deliver the services you have requested, and then for the mandatory retention duration set forth by applicable law (typically 10 years after the termination of our relation).
Your Statutory Rights
You have certain rights concerning your personal data under GDPR, and can exercise them by contacting us at privacy@hoffmann.lu:
- Right to information. If you are a client-related third party, you can find updated information on our processing of your data at any time on our website, or by contacting us at privacy@hoffmann.lu.
- Access right. You have the right to access your personal data. We may ask you to specify the information or processing activities to which your request relates before the information is delivered.
- Right to rectification. You can ask us to rectify, correct or update inaccurate or incorrect data.
- Other rights. In certain limited cases, you may object to or request the limitation of the processing of your personal data, or request the erasure or portability of your personal data. You also have the right to withdraw consent where granted. You may also contact the Luxembourg data protection authority (Commission nationale pour la protection des données) to introduce a claim.