6 Monks (6M) – Privacy Policy

This Privacy Policy will inform you as to how we process your personal data when you visit our website Website www.6m.lu (hereinafter the “Website”) regardless of where you visit it from and through any channel, and tell you about your privacy rights and how you are protected.

This privacy policy aims to give you information on how 6 Monks (6M) collects and processes your personal data through your use of this Website, including any data you may provide through this Website.

This Privacy Policy is intended for and applies to clients and prospects of 6 Monks (6M), potential business relations, and users of the Website.

This Website is not intended for children, and we do not knowingly collect data relating to children.

As data controller, 6 Monks (6M) (hereinafter “6M/we/our”) hereby informs you about the types of data collected, how and for what reasons this data is processed by 6 Monks (6M), as well as your rights and recourse and the communication channels available to you.

We have written this to be as user friendly as possible and have labelled sections to make it easy for you to find the information that may be most relevant to you and to allow you to click on a topic to find out more. It is important that you read this privacy policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements the other policies and is not intended to override them.

Please read this Privacy Policy carefully. This Privacy Policy is intended to articulate the types of personal data we may collect, what your data may be used for, what the legal bases for those collections and uses are, and how we protect it. This Privacy Policy is not intended to override the terms of any contract that you may have with us (for example, the terms and conditions you agreed when you apply to use our payment and account management services) or any rights you might have under data protection laws applicable to you.

We may make changes to this Privacy Policy from time to time to keep it up to date or to comply with legal requirements or changes in the way we operate our business. We will notify you about significant changes through our Website. We encourage you to regularly check and review this Policy so that you will always know what information we collect, how we use it, and who we share it with.

GDPR means EU Regulation n°2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Data Laws means GDPR and any other data protection law applicable to the Grand Duchy of Luxembourg.

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where identifying information has been removed (anonymous data).

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the DPO using the details set out above or this email address: dpo@6m.lu

You have the right to make a complaint at any time to the Commission Nationale pour la Protection des Données (CNPD) which is the Luxembourg supervisory authority for data protection issues (https://cnpd.public.lu/en.html). However, we would appreciate the chance to deal directly with your concerns. Therefore, before you approach the CNPD please contact us first.

6 Monks (6M) collects data from you directly (when you visit and complete a form and/or questionnaire on the 6 Monks (6M) Website, ask to be contacted, take part in a survey, attend an event organised by 6 Monks (6M), interact with 6 Monks (6M) on social media). You may be provided with further information when you enter into relations with 6 Monks (6M).

6 Monks (6M) also collects data concerning other people whom you may have brought to us because they have ties to you. When you pass on third parties’ data, you undertake to inform the person to whom this data relates that 6 Monks (6M) is processing their personal data. In this case, you assure us that you have received the necessary authorisation and consent from these Data Subjects for any uses described in this policy.

6 Monks (6M) will never ask you to provide sensitive data such as details of your race or ethnicity, your political opinions, your religious or philosophical beliefs, any union membership, your genetic information, your private life, or your sexual orientation, unless we are legally required to do so.

It is possible to browse the Website without providing your personal data. However, to access certain parts of the Website, for example, to contact 6 Monks (6M), download certain documents, or use the Website in some other specific way, 6 Monks (6M) may have to ask you for personal data. Such disclosure of personal data is voluntary. If you do not provide this personal data, you will not be able to use the relevant services proposed on the Website, such as booking an appointment, receiving newsletters, and downloading documents.

Personal data includes any information making it possible to directly identify (e.g. first name, surname) or indirectly identify (e.g. combination of data) an individual.

The personal data that 6 Monks (6M) processes may include:

This recording is made to meet legal and regulatory requirements applicable to financial markets, to secure transactions carried out, and to obtain proof of instructions given or procedures carried out.

We may have to share your personal data with the parties set out below for the purposes set out above:

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

In addition, we may have to share your personal data if subject to a judicial request by the competent authorities.

When processing of your personal data will involve a transfer of data outside the European Economic Area (EEA). Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is available. You have the right to ask us for more information about the safeguards we have put in place. You may also contact us for more information (please see the “Your legal rights” section below for our contact details) if you would like further information.

In the event that your data is transferred to a country where the level of protection of your data has not been recognised as adequate by the European Commission, 6 Monks (6M) will put in place one of the following guarantees to ensure the protection of your personal data: standard contractual clauses approved by the European Commission.

“Automated decision making” refers to a decision which is taken through the automated processing of your personal information alone. This means processing using, for example, software code or an algorithm, which does not involve human intervention. As profiling uses automated processing, it is sometimes connected with automated decision making. Though not all profiling results in automated decision making, there is a possibility that it can.

We may use profiling to ensure that marketing materials are tailored to your preferences and to what we think you will be interested in. This does not have any significant effect (legal or otherwise) on you. In certain circumstances it may be possible to infer certain information about you from the result of profiling, which may include special categories of data. We will not however conduct profiling based on your special categories of data unless we have obtained your explicit consent to do so.

Please note that you have certain rights in respect of automated decision making, including profiling where that decision has legal or similarly significant effects on you. You may find more information in “Your legal rights” section below.

We will only retain your personal data as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data, and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances, you can ask us to delete your data, please see Your Legal Rights part, below for further information.

In some circumstances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

Under certain circumstances, you have the right, to the fullest extent permitted by Data Laws, upon request:

(a) Access: you can ask us to provide details of what personal information (if any) we process about you, what we use it for, who we disclose it to, whether we transfer it abroad and how we protect it, how long we keep it for, how you can make a complaint, where we got your data from, you can also ask us to provide a copy of it;

(b) Rectification: you can ask us to rectify inaccurate personal information;

(c) Erasure: you can ask us to erase your personal information in certain circumstances (for example if it is no longer needed for the purposes for which it was collected or you have withdrawn your consent if the data processing was based on consent) absent an overriding legitimate interest;

(d) Restriction: you can ask us to restrict (i.e. keep but not use) your personal information in certain circumstances (for example where its accuracy is contested or where it ceases to be useful for the purposes we are using it for);

(e) Portability: in certain circumstances you can ask us to provide your personal information to you in a structured, commonly used, machine-readable format, or you can ask to have it ‘ported’ directly to another data controller;

(f) Objection: you can object to any processing of your personal information which has our ‘legitimate interests’ as its lawful basis if you believe your fundamental rights and freedoms outweigh our legitimate interests; and

(g) Automated Decision Making: you can ask for certain automated decisions to be reconsidered by us using human intervention.

(h) Withdrawal of Consent: if you have consented to our processing of your personal information, you have the right to withdraw your consent at any time, free of charge. This includes cases where you with to opt out from marketing messages your receive from us.

(i) Lodging a Complaint: you have a right to lodge a complaint with your national data protection supervisory authority at any time if you believe that we have not complied with applicable data protection laws. Please click here for a list of national data protection authorities in the EEA countries.

If you withdraw your consent, we may not be able to provide certain communication or services to you.

The above rights can be exercised by sending an email to dpo@6m.lu -.

If you provide personal data to 6 Monks (6M) about someone else you must ensure that you are entitled to disclose that Personal data to 6 Monks (6M) and that, without our taking any further steps, 6 Monks (6M) may collect, use and disclose that personal data as described in this privacy policy. In particular, you must ensure that the data subject is aware of the various matters detailed in this privacy policy, as these matters relate to that data subject, including 6 Monks (6M) ‘s identity, how to contact 6 Monks (6M), 6 Monks (6M)’s purposes of collection, 6 Monks (6M)’s personal data disclosure practices (including disclosure to overseas recipients), the data subject’s right to obtain access to Personal Data and make complaints about the handling of that Personal Data, and be informed of the consequences if the Personal Data is not provided (such as 6 Monks (6M) ’s inability to provide services).

You will not have to pay a fee to access your personal data (or to exercise any of your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or, excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or if you have made a number of requests. In this case, we will notify you and keep you updated on the status of your request.