V1.0 August 2023
Updates to this Privacy Notice
This Privacy Notice is updated from time to time, all versions are dated and numbered at the top of this notice.
Third Party Websites
Links to and from other websites, which are independent of Xantis S.A., are maintained by third parties. Xantis S.A. is not responsible for the content or privacy practices of any third-party websites and shall not be liable for any damages or harm arising from the content and use of such websites. Any links to other websites are provided as a convenience to you as a user, and do not imply our endorsement of the linked websites or association with their operators.
Xantis S.A. is compliant with data protection legislation within all of the jurisdictions in which it operates.
How Xantis S.A. Collects Personal Data from You
Xantis S.A. collects your personal data when you:
Complete an online contact form or survey
Visit our website (see Cookie Notice)
Register to receive our email newsletter(s) or other communications
Enter a competition or promotion
Request, contract and use a service from us
Communicate with us via phone calls, chat, email, web forms, social media and other methods of communication
Attend our events
Provide services to us.
Personal Data Xantis S.A. Collects from Others
Xantis S.A. works with a number of third parties and may receive your personal data from them. The third parties include, but are not limited to:
Clients and prospective clients
Where another party (such as a company or a partnership or any third parties acting on you or your behalf) provides your personal information to us, they must also comply with their obligations under the relevant privacy laws and regulations. If you believe that the entity for whom you work or a third party has not provided you with details of the personal information that it holds about you and/or has not obtained your authority to provide us with that personal information for processing as described in this Privacy Notice, then please contact such entity directly.
Types of Data Xantis S.A. Collects
Identity Data; this includes but is not limited to first name, last name, date of birth, place of birth, nationality, passport details, national identity card number or social security number
Contact Data; this includes email address, telephone number(s) and postal address
Financial Data; this includes banking details, income details, tax information, source of wealth
Employment Details; this includes job titles, employment history
Technical Data; subject to your cookie settings this may include internet protocol (IP) address, browser type and version, operating system
Any personal data about you included in free text boxes; including in relation to enquiries or comments submitted to us
Other User Profile Data such as feedback and survey response.
Legal Basis for Xantis S.A. To Process Personal Data
Data Protection law only permits Xantis S.A. to process personal data where we have a valid legal basis to do so.
We must have one of the following legal basis to process your personal data, unless local law dictates specific exceptions:
To enter into, or for the performance of a contract
Where Xantis S.A. has a legal duty or obligation
Where it is in the public interest
Where we need to protect your vital interests
Where it is in our legitimate interest
Where you consent to it.
Sharing Your Personal Data
When necessary, Xantis S.A. shares your personal data with:
Vendors and administrative support, infrastructure, and other service providers handling your information on our behalf, such as AML/KYC providers; in each case, such vendors and service providers will be contractually bound by confidentiality and privacy obligations consistent with the obligations in this Privacy Statement
Tax, government and any relevant regulatory authorities
Prosecuting authorities and courts, and/or other relevant third parties connected with legal proceedings or claims
Fraud prevention and/or law enforcement agencies
Third parties where Xantis S.A. is required to do so by law
Third parties to whom we disclose information in the course of providing services to you or to the entity that has engaged us to provide the services.
Security of Personal Data
Security of all personal data is extremely important to Xantis S.A.
We have implemented technical, administrative and physical security measures to help protect your personal data from unauthorised access and improper use. Xantis S.A. uses a number of safeguards to protect your personal data. Xantis S.A. has adopted data protection legislation compliant contracts and data sharing agreements with clients, between Xantis S.A. affiliates and with suppliers.
Furthermore, Xantis S.A. enforces security technical and procedural measures across its offices and operations.
Examples of such measures include:
Physical security of access to our offices and floors
Restricted access control to your personal data on our systems, frequently reviewed and revised
Your data is stored on servers in controlled, secure environments
A range of data flow detection and prevention methods
Restrictions on connecting non-approved devices to the Xantis S.A. network
Restrictions and safeguards related to the transmission of data externally
Regular training of our employees on data protection and privacy matters.
How We Use Personal Data
Please note where we collect personal data for a statutory or contractual requirement, or a requirement necessary to enter into a contract you are obliged to provide the personal data. Failure to do so may mean that we are unable to provide our services to you.
The primary purpose categories for which Xantis S.A. may process your personal data are listed below, along with representative types of data.
International Data Transfers
Your personal data may be transferred internationally to trusted service providers and other third parties when necessary. When doing so Xantis S.A. transfers personal data pursuant to established safeguards such as the use of [UK/EU] clauses.
Retaining Personal Data
Xantis S.A. retains your personal data only for as long as is necessary for our purposes.
We keep personal data for as long as it is required to meet legal or regulatory obligations and for the exercise and/or defence of any legal claims.
Automated Decision Making
Xantis S.A. does not use any automated processes to make decisions about you without human intervention.
What are your Data Protection Rights?
Numerous national and international regulations include measures to safeguard and enforce data subject rights. Xantis S.A. supports the rights described below except where doing so would contravene the requirements of local law or regulations.
You have the right to be informed about what, how and why we process your personal data, as outlined in this Privacy Notice.
Furthermore, you have the following rights (subject to your jurisdiction):
Right of Information and Access – The right to obtain from the controller confirmation of whether personal data is being processed, information in clear and transparent language on how it is used and by whom, why, and with what safeguards, and to receive a copy of this data.
Rectification – The right to have personal data corrected where it is inaccurate or incomplete.
Erasure (right to be forgotten) – The right to have personal data erased.
Data portability – The right to receive personally or have data sent to a third party in a common and machine-readable electronic format.
Object – The right to complain and to object to processing to a relevant supervisory authority and/or claim compensation for damages or distress.
Restriction of processing (purpose limitation) – The right to limit the extent of the processing of personal data.
Automated decision-making and profiling – The right not to be subject to decision making without human involvement.
Xantis S.A. does not sell or otherwise share your personal data with third parties for their direct marketing purposes; accordingly, we do not maintain such a list of third parties.
How to Complain
If you have a complaint in regard to the way in which Xantis S.A. processes your personal data please get in touch using the details found in the ‘Contact Us’ section of this notice.
You also have the right to lodge a complaint with a supervisory authority. Xantis S.A. main establishment is based in Luxembourg. The Commission Nationale pour la Protection des Données (CNPD) is the supervisory authority in Luxembourg.
The CNPD can be contacted through their online complaint form available here, or by post:
Commission Nationale pour la Protection des Données (CNPD)
1, Avenue du Rock n’ Roll