Privacy policy

On this page you will find our general privacy policy. Click here to access our specific privacy policy for video conferencing and other collaborative solutions.

Statement regarding our handling of personal data and your rights as a data subject under the General Data Protection Regulation EU 2016/679 (“GDPR”).

The Association of the Luxembourg Fund Industry (hereafter “ALFI”, “the association”, “the organisation”, „we“), the representative body for the Luxembourg investment fund community, was founded in 1988. Today it represents more than 1,400 members. Luxembourg is the largest fund domicile in Europe and its investment fund industry is a worldwide leader in cross-border fund distribution. Luxembourg-domiciled investment structures are distributed in more than 70 countries around the globe. ALFI defines its mission as to “Lead industry efforts to make Luxembourg the most attractive international investment fund centre”. Its main objectives are to help members capitalise on industry trends, shape regulation, foster dedication to professional standards, integrity and quality and promote the Luxembourg investment fund industry.

The cautious processing and the protection of your personal data is very important to us as an organisation. In line with the GDPR, we would like to inform you about the usage of your data within our organisation and your personal rights as a data subject. For employees of ALFI, more specific information may be included in internal policies. This privacy policy may be subject to changes.

Responsible and point of contact for the processing of your data is:

P.O. Box 206, L-2012 Luxembourg
12, rue Erasme
L-1468 Luxembourg
Tel: +352 22 30 26 1
Contact us.

Data categories and sources of data

ALFI processes data that is acquired directly from yourself, for example via the exchange of business cards at events, or within the professional relationship you have with the organisation, i.e. as a business partner, a member, event attendant or an employee. It is possible that public sources (like websites) or other sources (business networks like LinkedIn) are used to obtain (updated) data.

We currently process the following information:

  • Personal identification data, such as name, date of birth, gender and contact details, photos and biographies;
  • Electronic identification data;
  • Professional data, such as information in regards to your employment, educational background, title or qualification,
  • Intellectual data, i.e. from your involvement into our working groups, forums or your speeches at our events;
  • Visual and audio material, such as pictures or recordings from events;
  • Employees’ banking and financial data, i.e. bank account information.

ALFI does not collect any personal information from users accessing its website. The public areas of the website can be accessed anonymously. Only aggregate data, such as the number of hits per page, are collected and used for internal statistical purposes only. They do not allow personal identification.

If you use the contact form on our website, your type of request may be extracted for us to monitor the type and frequency of requests we receive. You have the option to choose your fields of interest and whether or not you would like to receive further information in this regard automatically in the future. You have the right to opt out again at all times via the unsubscribe function.

Provision of data

Most data obtained from data subjects, such as members, employees, event participants, business partners and their employees is acquired directly from the respective people on a voluntary basis.

Certain data, such as identification data and contact details must be provided to enable ALFI to enter into, carry out or end the business relationship with you.

Lawful basis and purpose of the processing

We process your personal data purpose-related and based on the legal grounds listed as follows:

  • To fulfil contractual or pre-contractual obligations (Art. 6, Par. 1b GDPR);

Your data will be processed to provide services to you within the framework of our business contract. An example for such services is the processing of member registrations in a member data base. The purpose of the processing is linked to the contractual agreements between yourself and ALFI, alongside related documentation, where additional information can be found.

  • Legitimate interest (Art. 6, Par. 1f GDPR).

Processing activities are partly also based on a legitimate interest of our association or a third party. Where applicable, we follow a process to carefully measure our interest against yours in a detailed legitimate interest assessment. As far as the purpose of the processing allows, your data is processed pseudonymised or anonymised.

We may also process your data:

  • Based on your consent (Art. 6, Par. 1a GDPR);

To the extent you have explicitly consented to the processing of your data such consent constitutes a lawful basis for the data processing in accordance with Art. 6, Par. 1a until you withdraw your consent. You have the right to withdraw your consent at all times, without affecting the lawfulness of processing based on consent before the withdrawal.

  • Based on legal and/or regulatory requirements (Art. 6, Par. 1c GDPR);
  • Based on public interest (Art. 6, Par. 1e GDPR);
  • Based on protecting a vital interest of the data subject or another natural person (Art. 6, Par. 1d GDPR);
  • Based on obligations and specific rights of ALFI or you in the field of employment and social security and social protection law (Art. 9, Par. 2b GDPR).

Profiling and automated decision-making

ALFI does not use profiling or automated decision-making as per Art. 22 and recital 71.

Joint controllership

Where ALFI determines the purposes and means of processing jointly with other data controllers within the meaning of Art. 26 GDPR, it enters into joint controllership agreements with those controllers to ensure a distribution of responsibilities for compliance. In essence, these agreements include clauses on the following aspects:

  • The joint controllers undertake to process personal data in line with the principles outlined in Article 5 GDPR;
  • The joint controllers determine in a transparent manner their respective responsibilities for compliance with the obligations under GDPR, in particular as regards the rights of data subjects;
  • The joint controllers implement technical and organisational measures to ensure the security and confidentiality of the personal data.
  • International data transfers can only be performed in compliance with Chapter V GDPR;
  • The joint controllers cooperate at all times with each other in order to perform a thorough investigation into incidents (including eventual data breaches), to formulate a correct response, and to take suitable further steps in respect of the incidents.

Data subjects may contact ALFI as indicated above (see point of contact) for any questions concerning joint controllerships.

Third-party data processing

The association may appoint service providers as data processors in order to perform certain tasks on behalf of the association. Examples for types of providers are in the IT or the HR sector.

It is possible that personal data has to be transmitted to third parties in the course of the outsourcing process, respecting legal requirements.

The transfer is always based on a legitimate legal ground (see paragraph 2) and respecting the requirements of the GDPR. We perform checks on the third parties we choose for the processing and assess the providers’ compliance with the GDPR.

Data is also being transferred to public authorities and audit firms when required.

Transfer to third countries

Your data may be transferred to countries outside the European Union, e.g. if the type of instruction (or a legal obligation) requires the association to do so. Examples for reasons for a transfer to a third country can be ALFI’s cooperation with a service provider or the organisation of an event. The association complies with the specific data protection requirements concerning data transfers to third countries.

Storage of personal data

Your information is securely stored.

All data related to the fulfilment of legal obligations will be stored as long as the law requires. The Luxembourg „Code civil” and the „Code de commerce” lay out legal limitation periods with a duration between three and thirty years. Those indications will also be taken into consideration when determining the data retention period.

For those processes where ALFI has a legitimate interest to process and store your data in its central database, you have the right to object to such processing at all times (please refer to section 8).

Personal data that is no longer needed and legally required to be retained is deleted or destructed.

Cookie policy and management of preferences

ALFI uses cookies on its website. Click here to read ALFI’s cookie policy that aims at informing you about what information we collect as a result of our use of cookies, how we process it, why we do so and when we share it with others. In order to manage your cookie preferences, please click on this link.

Your rights as a data subject

In the context of your rights under the GDPR with regards to the processing of your data you are welcome to contact us using the contact details stated at the beginning of this policy.

The most important rights you have in your relationship with ALFI are outlined in the following. You can find an exhaustive list of your rights and further explanations in Art.15-22 and Art. 77 of the GDPR (link to the regulation).

Right to access (Art. 15 GDPR)

Right to rectification (Art. 16 GDPR)

Right to erasure (Art. 17+19 GDPR)

Right to restriction of processing (Art. 18+19 GDPR)

Right to data portability (Art. 20 GDPR)

Right to object (Art. 21+22 GDPR)

You also have the right to object to the processing of your data if it is based on a legitimate interest assessment of the association (Art. 6 Par. 1f GDPR), if the processing is based on profiling (Art. 4 Par. 4) or public interest (Art. 6 Par. 1e GDPR).

If you object, the processing of your data must be stopped unless ALFI has compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject (you) or for the establishment, exercise or defence of legal claims.

Right to object to data processing for direct marketing purposes (Art. 21 GDPR)

You have the right at all times to object to the processing of your data for direct marketing purposes.

Right to complain (Art. 77 GDPR)

You have the right at all times to lodge a complaint with a data protection authority, such as the CNPD in Luxembourg (link to the website), with regards to the processing of your data.