V1.0 August 2023

​

Updates to this Privacy Notice

This Privacy Notice is updated from time to time, all versions are dated and numbered at the top of this notice.

 

Third Party Websites

Links to and from other websites, which are independent of Xantis S.A., are maintained by third parties. Xantis S.A. is not responsible for the content or privacy practices of any third-party websites and shall not be liable for any damages or harm arising from the content and use of such websites. Any links to other websites are provided as a convenience to you as a user, and do not imply our endorsement of the linked websites or association with their operators.

 

Privacy Laws

Xantis S.A. is compliant with data protection legislation within all of the jurisdictions in which it operates. 

 

Cookies

As a website visitor, Xantis S.A. collects personal data from you to administer the site, to improve your browsing experience, and to enable visitors to be better informed of the services available through Xantis S.A. Such data is obtained through the use of cookies and similar technologies.

​

For further information on our use of cookies please see the Xantis S.A. Cookie Notice.

 

How Xantis S.A. Collects Personal Data from You

Xantis S.A. collects your personal data when you:

• Complete an online contact form or survey

• Visit our website (see Cookie Notice)

• Register to receive our email newsletter(s) or other communications

• Enter a competition or promotion

• Request, contract and use a service from us

• Communicate with us via phone calls, chat, email, web forms, social media and other methods of communication

• Attend our events

• Provide services to us.

 

Personal Data Xantis S.A. Collects from Others

Xantis S.A. works with a number of third parties and may receive your personal data from them. The third parties include, but are not limited to:

• Business partners

• Clients and prospective clients

• Suppliers

• Sub-contractors

• Advertisers

• Referrers.

​

Where another party (such as a company or a partnership or any third parties acting on you or your behalf) provides your personal information to us, they must also comply with their obligations under the relevant privacy laws and regulations. If you believe that the entity for whom you work or a third party has not provided you with details of the personal information that it holds about you and/or has not obtained your authority to provide us with that personal information for processing as described in this Privacy Notice, then please contact such entity directly.

​

Types of Data Xantis S.A. Collects

• Identity Data; this includes but is not limited to first name, last name, date of birth, place of birth, nationality, passport details, national identity card number or social security number

• Contact Data; this includes email address, telephone number(s) and postal address

• Financial Data; this includes banking details, income details, tax information, source of wealth

• Employment Details; this includes job titles, employment history

• Technical Data; subject to your cookie settings this may include internet protocol (IP) address, browser type and version, operating system

• Any personal data about you included in free text boxes; including in relation to enquiries or comments submitted to us

• Other User Profile Data such as feedback and survey response.

​

Legal Basis for Xantis S.A. To Process Personal Data

Data Protection law only permits Xantis S.A. to process personal data where we have a valid legal basis to do so. 

 

We must have one of the following legal basis to process your personal data, unless local law dictates specific exceptions:

• To enter into, or for the performance of a contract

• Where Xantis S.A. has a legal duty or obligation

• Where it is in the public interest

• Where we need to protect your vital interests

• Where it is in our legitimate interest

• Where you consent to it.

​

Sharing Your Personal Data

When necessary, Xantis S.A. shares your personal data with:

• Vendors and administrative support, infrastructure, and other service providers handling your information on our behalf, such as AML/KYC providers; in each case, such vendors and service providers will be contractually bound by confidentiality and privacy obligations consistent with the obligations in this Privacy Statement

• Tax, government and any relevant regulatory authorities

• Prosecuting authorities and courts, and/or other relevant third parties connected with legal proceedings or claims

• Fraud prevention and/or law enforcement agencies

• Third parties where Xantis S.A. is required to do so by law

• Third parties to whom we disclose information in the course of providing services to you or to the entity that has engaged us to provide the services.

 

Security of Personal Data

Security of all personal data is extremely important to Xantis S.A.

 

We have implemented technical, administrative and physical security measures to help protect your personal data from unauthorised access and improper use. Xantis S.A. uses a number of safeguards to protect your personal data. Xantis S.A. has adopted data protection legislation compliant contracts and data sharing agreements with clients, between Xantis S.A. affiliates and with suppliers.

 

Furthermore, Xantis S.A. enforces security technical and procedural measures across its offices and operations.

 

Examples of such measures include:

• Physical security of access to our offices and floors

• Restricted access control to your personal data on our systems, frequently reviewed and revised

• Your data is stored on servers in controlled, secure environments

• A range of data flow detection and prevention methods

• Restrictions on connecting non-approved devices to the Xantis S.A. network

• Restrictions and safeguards related to the transmission of data externally

•  Regular training of our employees on data protection and privacy matters.

 

How We Use Personal Data

Please note where we collect personal data for a statutory or contractual requirement, or a requirement necessary to enter into a contract you are obliged to provide the personal data. Failure to do so may mean that we are unable to provide our services to you.

 

The primary purpose categories for which Xantis S.A. may process your personal data are listed below, along with representative types of data. 

​

​

International Data Transfers

Your personal data may be transferred internationally to trusted service providers and other third parties when necessary. When doing so Xantis S.A. transfers personal data pursuant to established safeguards such as the use of [UK/EU] clauses.

 

Retaining Personal Data

Xantis S.A. retains your personal data only for as long as is necessary for our purposes.

 

We keep personal data for as long as it is required to meet legal or regulatory obligations and for the exercise and/or defence of any legal claims.

 

Automated Decision Making

Xantis S.A. does not use any automated processes to make decisions about you without human intervention. 

 

What are your Data Protection Rights?

Numerous national and international regulations include measures to safeguard and enforce data subject rights.  Xantis S.A. supports the rights described below except where doing so would contravene the requirements of local law or regulations.

 

You have the right to be informed about what, how and why we process your personal data, as outlined in this Privacy Notice. 

 

Furthermore, you have the following rights (subject to your jurisdiction):

 

Right of Information and Access – The right to obtain from the controller confirmation of whether personal data is being processed, information in clear and transparent language on how it is used and by whom, why, and with what safeguards, and to receive a copy of this data.

 

Rectification – The right to have personal data corrected where it is inaccurate or incomplete.

 

Erasure (right to be forgotten) – The right to have personal data erased.

 

Data portability – The right to receive personally or have data sent to a third party in a common and machine-readable electronic format.

 

Object – The right to complain and to object to processing to a relevant supervisory authority and/or claim compensation for damages or distress.

 

Restriction of processing (purpose limitation) – The right to limit the extent of the processing of personal data.

 

Automated decision-making and profiling – The right not to be subject to decision making without human involvement.

 

Xantis S.A. does not sell or otherwise share your personal data with third parties for their direct marketing purposes; accordingly, we do not maintain such a list of third parties.

 

How to Complain

If you have a complaint in regard to the way in which Xantis S.A. processes your personal data please get in touch using the details found in the ‘Contact Us’ section of this notice.

 

You also have the right to lodge a complaint with a supervisory authority. Xantis S.A. main establishment is based in Luxembourg. The Commission Nationale pour la Protection des Données (CNPD) is the supervisory authority in Luxembourg.

 

The CNPD can be contacted through their online complaint form available here, or by post:

Commission Nationale pour la Protection des Données (CNPD)
1, Avenue du Rock n’ Roll
L-4361 Esch-sur-Alzette

Luxembourg