Privacy Policy

LuxConstellation S.A.
Last updated: March 2026

1. Introduction

LuxConstellation S.A. (hereinafter the “Company”, “we”, “us”, “our”), a public limited company incorporated under the laws of the Grand Duchy of Luxembourg and registered with the Luxembourg Trade and Companies Register (RCS) under number B282444, with its registered office at 17, rue Aldringen, L – 1118 Luxembourg.

LuxConstellation S.A. is duly authorised by the Commission de Surveillance du Secteur Financier (“CSSF”), pursuant to the law of 5 April 1993 on the financial sector, to act as a support professional of the financial sector (support PFS), under CSSF registration number I00000141.

By this Privacy Policy, we wish to inform any person (“you”, “your”, “data subject”, “user”) whose personal data, meaning any information relating to an identified or identifiable natural person (“personal data”), is collected, protected, stored or otherwise processed by us when you use our website or contact us by email.

All terms used in this Privacy Policy have the meaning assigned to them by the General Data Protection Regulation (EU 2016/679 of 27 April 2016, “GDPR”).

2. Data Controller and Contact Details

We are committed to ensuring the confidentiality, integrity and security of personal data in accordance with the GDPR and the regulations applicable to Luxembourg’s financial sector, including those issued by the CSSF.

The Company acts as data controller for the processing of personal data related to the use of our website.

If you have any questions or concerns regarding this Privacy Policy, or if you would like further information about the Company’s data-processing activities, you may contact us by email or post at the following address:

LuxConstellation S.A.
17, rue Aldringen, L – 1118 Luxembourg
Email: info@bancomat.lu

If you are not satisfied with the response received or the measures taken, you have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD) (Luxembourg’s data protection authority), located at 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg.

3. Data Subject

For the purposes of this Privacy Policy, a data subject means any natural person whose personal data is collected, processed or stored by us in connection with our activities.

This may include, without limitation:

  • users of our website;
  • any other person who contacts us.

4. Personal Data Collected and Processed

Our website uses cookies and similar technologies to ensure the proper functioning of the site and, where applicable, to improve the user experience. For more information about the cookies we use, the purposes for which they are used, and how you can manage or withdraw your consent, please refer to our Cookie Policy.

We may collect personal data when you use our website, contact us or submit a request for information by email.

The information we may collect includes, in particular:

  • your first and last name;
  • your telephone number;
  • your email address;
  • any other information you choose to provide in your message (when you contact us by email);
  • the content or messages you send or provide directly to us, such as requests for information, questions, comments or responses to our questions.

The categories of personal data we collect and process depend on the specific context of each situation. The above list should therefore not be regarded as exhaustive.

5. Purposes of Processing Personal Data

We collect and process your personal data solely to respond to your emails and requests for information and to communicate with you in relation to your request, whether it concerns our services or any other matter.

6. Legal Basis for Processing Personal Data

We collect and process your personal data in accordance with applicable laws and only for specific purposes. In all cases, we ensure that personal data is processed only where necessary for the purposes pursued.

Each processing operation involving personal data that we carry out is based on at least one of the following legal grounds:

Consent (Article 6(1)(a) GDPR)

We process your personal data on the basis of your explicit consent when you contact us. This means that by contacting us, you agree to the collection and processing of your personal data in order for us to respond to your request. Before sending your message, you must confirm your consent through a clear statement in your message or communication, such as: “I consent to the processing of the personal data provided in this message for the purpose of receiving a response to my request.” We retain evidence of consent to demonstrate compliance with GDPR requirements. You may withdraw your consent at any time by contacting us at info@bancomat.lu. In this case, your data will be deleted unless its retention is required by law (see section 12 below).

Legitimate Interest (Article 6(1)(f) GDPR)

We may also process your personal data when you contact us by email on the basis of our legitimate interest in responding to requests, maintaining communication and improving our services.

This processing does not adversely affect your fundamental rights and freedoms. If you object to this processing, you may contact us to exercise your right to object (see below).

In certain situations, you may have indicated that you do not wish your personal data to be used. However, we may be required to continue processing and/or retaining such data for certain reasons. In such cases, we may continue to do so where:

  • this is required by law or regulation (Article 6(1)(c) GDPR);
  • this is necessary for the performance of a contract (Article 6(1)(b) GDPR); or
  • we have a legitimate interest in retaining this data (Article 6(1)(f) GDPR).

7. Data Retention

Without prejudice to our right to subsequently process your personal data for purposes compatible with the original purpose, and subject to our legal and regulatory obligations, we retain your personal data only for as long as necessary to achieve the processing purposes described in this Privacy Policy and in accordance with the requirements of applicable Luxembourg law.

As a general rule, once your request has been handled, we will delete or anonymise your data within 12 months after your request has been resolved, unless the law requires us to retain it for a longer period.

The retention period for your data may vary depending on its nature, the purposes for which it is processed and the applicable legal or regulatory obligations.

In certain cases, and where permitted by law, we may retain your data for a longer period for legitimate reasons, depending on the circumstances.

Your data may be stored and processed by our email service provider located in Luxembourg. If data is transferred outside the European Union / European Economic Area (EU/EEA), we ensure that appropriate safeguards are in place in accordance with GDPR requirements. This may notably include:

  • verifying that the country concerned benefits from an adequacy decision by the European Commission;
  • implementing Standard Contractual Clauses (SCCs) approved by the European Commission;
  • using Binding Corporate Rules (BCRs) for intra-group transfers;
  • implementing technical measures such as encryption and pseudonymisation of data.

You may request further information regarding international data transfers by contacting us at info@bancomat.lu.

8. Data Sharing and Transfers

We do not share, sell or distribute your personal data to third parties, except where required by law or necessary to protect our legitimate interests.

9. Data Security Measures

The Company protects your personal data through appropriate administrative, technical and organisational security measures designed to reduce the risks of loss, theft, misuse, unauthorised access, disclosure, destruction or alteration. However, please note that no processing, transmission or storage of data – regardless of the security measures in place – can guarantee absolute protection and may remain vulnerable to cyberattacks or data breaches.

We implement physical, technical, organisational and procedural safeguards to protect personal data, including:

  • the application of anonymisation and pseudonymisation techniques to personal data, where relevant;
  • the encryption of personal data during transmission and storage, where applicable;
  • ensuring the confidentiality, integrity, availability and resilience of processing systems, services and IT infrastructure;
  • the prompt restoration of availability and access to personal data in the event of a physical or technical incident;
  • the implementation of incident response plans and data-breach notification protocols to address security incidents effectively;
  • limiting employee access to personal data to what is strictly necessary;
  • conducting regular security audits and vulnerability assessments.

All of these measures are reviewed and updated regularly.

If you suspect that your personal data is no longer secure, please notify the Company immediately by contacting us.

10. Personal Data Breach

In the event of a personal data breach (i.e. a breach of security leading, accidentally or unlawfully, to the destruction, loss, alteration, unauthorised disclosure of personal data transmitted, stored or otherwise processed, or unauthorised access to such data), we, in our capacity as data controller, will notify the breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it, to Luxembourg’s data protection authority, namely the Commission Nationale pour la Protection des Données (CNPD).

Where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the data controller will also communicate the personal data breach to the data subject without undue delay.

11. Rights of Data Subjects

As a data subject, you have the following rights in relation to your personal data:

  • the right to access your personal data and, where applicable, obtain a copy;
  • the right to rectification, allowing you to request the correction or updating of your personal data if you believe it is incomplete or inaccurate;
  • the right to erasure of your personal data, unless there is a legitimate reason for retaining it;
  • the right to object, at any time, to the processing of your personal data, unless compelling legitimate grounds override your interests, rights and freedoms or the processing is necessary for the establishment, exercise or defence of legal claims;
  • the right to restriction of the processing of your personal data;
  • the right to data portability, i.e. the right to receive certain personal data in a structured, commonly used and machine-readable format so that you can transmit it to another data controller;
  • the right to withdraw your consent, where processing is based on consent;
  • the right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD) via the website: https://cnpd.public.lu.

To exercise the rights mentioned above, you may contact us by email or post at the following address:

LuxConstellation S.A.
17, rue Aldringen, L – 1118 Luxembourg
Email: info@bancomat.lu

Please provide proof of your identity and clearly specify in your request which personal data you wish to access, rectify, restrict the processing of or erase.

Please note that your data protection rights are not absolute and that, in accordance with applicable data protection laws, the exercise of your rights may sometimes be restricted. In such cases, we will inform you of the reasons for refusing to act on your request.

We endeavour to handle your request as soon as reasonably possible and to inform you of the action taken without undue delay and, in any event, within one month of receiving the request.

This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. In that case, we will inform you of the extension within one month of receiving the request, explaining the reasons for the delay.

Where the data subject submits a request electronically, the information will be provided electronically where possible, unless otherwise requested by the data subject.

If we decide not to act on your request or if we do not process it within the time limits mentioned above, you have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (as indicated above) and to seek a judicial remedy against our decision.

12. Conditions Applicable to Your Consent

By sending us an email, you acknowledge and agree that we may collect, store and process the personal data included in your message in order to respond to your request and provide the information or assistance requested. We do not collect any personal data about you unless you provide it voluntarily by contacting us by email.

You have the right to withdraw your consent at any time by contacting us at info@bancomat.lu.

Withdrawal of consent will not affect the lawfulness of processing carried out before its withdrawal.

13. Automated Decision-Making

As a general rule, we do not use decision-making processes based exclusively on automated processing within the meaning of Article 22 of the GDPR.

14. Review of the Privacy Policy

We may update this Privacy Policy from time to time to reflect regulatory developments, improvements in data-protection practices or technological advances.

We invite you to review this document regularly on our website to ensure that you are aware of the most recent version.

15. Contact Us

If you have any questions or concerns regarding this Privacy Policy or how we process your data, please contact us at info@bancomat.lu.