1. Introduction

KCP Konrad is an independent Luxembourg business law firm providing legal advice and assistance to international law firms, investment funds, asset managers, private equity houses, corporates, family offices, institutional clients and high-net-worth individuals.

KCP Konrad is committed to protecting personal data and respecting the privacy of individuals who visit its website, contact the firm, apply for a position or otherwise interact with the firm.

This Privacy Notice explains how KCP Konrad collects, uses, stores and discloses personal data in connection with its website and related communications, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation, or “GDPR”) and applicable Luxembourg data protection legislation.

This Notice should be read together with any specific privacy information provided in connection with a particular legal engagement or other processing activity.

2. Data Controller and Contact Details

For the purposes of this Privacy Notice, the data controller is:

KCP Konrad
Villa Mühlenbach
127, rue de Mühlenbach
L-2163 Luxembourg
Grand Duchy of Luxembourg

Email: office@kcpkonrad.legal
Telephone: +352 26 84 66

For any question concerning the processing of personal data or to exercise your rights under applicable data protection legislation, please contact us using the details above.

Where a specific processing activity is carried out by another entity acting as an independent controller, the relevant entity is responsible for providing the applicable privacy information.

3. Categories of Personal Data We Collect

Depending on how you interact with us, we may process the following categories of personal data.

3.1. Website visitors

When you visit our website, certain technical information may be collected automatically by our website infrastructure, including:

• IP address;

• date and time of access;

• pages and resources requested;

• referring website or URL, where available;

• browser type, operating system and device information;

• technical information concerning the status and security of the connection.

The information actually collected depends on the website's hosting, configuration and security systems.

3.2. Persons contacting the firm

When you contact us by email, telephone or through a contact form, if available, we may process your name, professional title, employer, business contact details and the content of your communication, including any information you choose to provide.

3.3. Clients, prospective clients and business contacts

In the context of prospective or existing professional relationships, we may process identification and contact details, professional information, correspondence, engagement-related information and other data necessary to assess, establish or maintain a professional relationship.

Where relevant, this may include information concerning beneficial ownership, corporate structures, source of funds, source of wealth, transactions and other information required to comply with applicable anti-money laundering, counter-terrorist financing, sanctions or other legal and regulatory obligations.

3.4. Recruitment

Where you submit an application or otherwise express an interest in working with KCP Konrad, we may process your contact details, CV, professional experience, qualifications, references and other information relevant to the recruitment process.

3.5. Information obtained from third parties

Where lawful and necessary, we may obtain personal data from publicly available sources, professional directories, corporate registers, counterparties, clients, other professional advisers, service providers and relevant authorities.

Such information may be processed to verify information provided to us, assess conflicts of interest, establish professional relationships, perform legal services or comply with applicable legal obligations.

4. Purposes and Legal Bases of Processing

We process personal data only where an applicable legal basis exists under the GDPR.

Depending on the circumstances, processing may be necessary for one or more of the following purposes.

4.1. Operating and securing the website

We process relevant technical information to operate the website, maintain its availability, diagnose technical issues, prevent unauthorised access, protect against malicious activity and ensure information security.

The legal basis is our legitimate interest in operating a secure and functional website, pursuant to Article 6(1)(f) GDPR, subject to the applicable balancing requirements.

4.2. Responding to enquiries

We process personal data to respond to enquiries, communicate with prospective clients and assess requests for legal assistance.

The legal basis is, as applicable, the taking of steps at the request of the data subject prior to entering into a contract, the performance of a contract, or our legitimate interest in managing professional communications, pursuant to Article 6(1)(b) or Article 6(1)(f) GDPR.

4.3. Providing legal services

Where we are instructed to provide legal services, we process personal data to advise and represent clients, manage legal matters, conduct legal research, prepare documentation, communicate with clients and other advisers, manage transactions, and establish, exercise or defend legal claims.

The legal basis depends on the nature of the processing and may include contractual necessity, compliance with legal obligations and legitimate interests, pursuant to Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR, as applicable.

Where special categories of personal data or other specially protected information are involved, we will rely on an applicable additional legal basis where required by the GDPR.

4.4. Compliance with legal and regulatory obligations

We may process personal data to comply with applicable laws and regulations, including, where relevant, anti-money laundering and counter-terrorist financing requirements, sanctions obligations, professional obligations and requirements imposed by competent authorities.

The legal basis is Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation to which the firm is subject.

4.5. Conflict checks and professional obligations

We may process limited personal data to identify and manage conflicts of interest, protect client interests, comply with applicable professional rules and preserve the integrity of our legal services.

Depending on the circumstances, the legal basis may be compliance with a legal obligation or our legitimate interests in complying with professional requirements and managing legal risks.

4.6. Recruitment and business administration

We process personal data to assess applications, communicate with candidates, manage business relationships and perform administrative, accounting and organisational functions.

The applicable legal basis may be contractual necessity, compliance with legal obligations or legitimate interests, as appropriate.

We do not use personal data for purposes incompatible with those for which it was collected, unless otherwise permitted by applicable law.

5. Professional Secrecy and Confidentiality

As a Luxembourg law firm, KCP Konrad is subject to applicable professional secrecy, confidentiality and professional conduct obligations.

Personal data and confidential information received in connection with legal engagements are handled in accordance with those obligations and applicable law.

Disclosure of information to courts, authorities, counterparties, other professional advisers or service providers will take place only where necessary and legally permissible, taking into account applicable professional secrecy and confidentiality requirements.

Nothing in this Privacy Notice is intended to waive or limit any applicable duty of professional secrecy or confidentiality.

6. Cookies and Similar Technologies

Our website may use cookies or similar technologies depending on its technical configuration.

Cookies are small files stored on your device that may be used to support website functionality, remember preferences, ensure security or measure website usage.

The categories of cookies used, their purposes and their retention periods depend on the technologies actually deployed on the website.

Where required by applicable law, non-essential cookies and similar technologies will be used only after obtaining the necessary consent. You may withdraw or modify your consent through the relevant cookie preference mechanism, where available.

You may also manage cookies through your browser settings. Disabling certain cookies may affect the functionality of the website.

Further information should be made available through the website's cookie banner or a dedicated cookie policy, where applicable.

 

7. Recipients of Personal Data

Personal data may be disclosed, where necessary and lawful, to the following categories of recipients:

• members of the firm's legal and administrative teams;

• clients, counterparties and their legal or other professional advisers, where relevant to a legal engagement;

• courts, tribunals, public authorities, regulators and law enforcement bodies where disclosure is legally required or otherwise permitted;

• external lawyers, notaries, experts, translators, auditors and other professional advisers;

• website hosting, IT, cybersecurity, communications and other technical service providers;

• accounting, administrative and other service providers supporting the firm's operations.

• Where a third party processes personal data on our behalf, we will implement the contractual and organisational safeguards required by applicable law.

• We do not sell personal data to third parties.

 

8. International Transfers of Personal Data

Given the international nature of our practice, personal data may, where necessary for a legal engagement or another legitimate purpose, be transferred to recipients located outside the European Economic Area (“EEA”).

Any such transfer will be subject to the requirements of the GDPR. Depending on the circumstances, the transfer may rely on an adequacy decision adopted by the European Commission, appropriate safeguards such as the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism.

Further information concerning applicable safeguards may be requested using the contact details set out in Section 2, subject to applicable confidentiality and professional secrecy obligations.

 

9. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected or otherwise processed.

Retention periods depend on the nature of the information, the purpose of processing, the duration of the relevant professional relationship, applicable statutory and regulatory requirements, professional obligations and the need to establish, exercise or defend legal claims.

Certain information may therefore need to be retained after the end of a professional relationship, including where required by applicable record-keeping, accounting, anti-money laundering or other legal obligations.

When personal data is no longer required, it will be deleted or anonymised, subject to applicable legal requirements and legitimate retention needs.

 

10. Data Security

We take appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Such measures are intended to reflect the nature of the information processed, the risks associated with processing and the obligations imposed by applicable law.

However, no method of electronic transmission or storage can be guaranteed to be completely secure. Individuals should avoid sending highly sensitive or confidential information through unsecured channels unless the relevant communication arrangements have been agreed with the firm.

 

11. Your Rights Under the GDPR

Subject to the conditions and limitations provided by applicable law, you may have the right to:

• Access: obtain confirmation as to whether we process your personal data and access the relevant information.

• Rectification: request correction of inaccurate or incomplete personal data.

• Erasure: request deletion of personal data where the applicable legal conditions are met.

• Restriction: request restriction of processing in the circumstances provided by the GDPR.

• Data portability: receive certain personal data in a structured, commonly used and machine-readable format, where the right applies.

• Object: object to processing based on our legitimate interests, on grounds relating to your particular situation.

• Withdraw consent: where processing is based on consent, withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

• Lodge a complaint: submit a complaint to the competent supervisory authority.

These rights are not absolute. Their exercise may be restricted where, for example, processing is necessary to comply with legal obligations, preserve evidence, establish, exercise or defend legal claims, or protect the rights of others.

In particular, requests concerning information protected by professional secrecy or relating to other clients, counterparties or confidential legal matters may be subject to applicable legal and professional restrictions.

To exercise your rights, please contact us using the details in Section 2. We may request additional information where reasonably necessary to verify your identity.

We will respond within the time limits prescribed by applicable data protection legislation.

 

12. Right to Lodge a Complaint

If you consider that the processing of your personal data infringes applicable data protection legislation, you may lodge a complaint with the competent supervisory authority.

In Luxembourg, the supervisory authority is:

Commission nationale pour la protection des données (CNPD)
15, boulevard du Jazz
L-4370 Belvaux
Grand Duchy of Luxembourg

Website: https://cnpd.public.lu/

You may also have the right to lodge a complaint with another competent supervisory authority in accordance with Article 77 GDPR.

Where appropriate, we encourage you to contact us first so that we may examine and address your concerns.

 

13. Links to Third-Party Websites

Our website may contain links to third-party websites or online resources.

KCP Konrad is not responsible for the privacy practices, content or security of websites operated by third parties. Visitors are encouraged to review the privacy notices applicable to those websites before providing personal data.

 

14. Updates to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, website functionality, legal requirements or regulatory guidance.

The latest version will be made available on our website, together with the date of the most recent update.

 

15. Contact

For any questions concerning this Privacy Notice or the processing of personal data by KCP Konrad, please contact:

KCP Konrad
Villa Mühlenbach
127, rue de Mühlenbach
L-2163 Luxembourg
Grand Duchy of Luxembourg

Email: office@kcpkonrad.legal
Telephone: +352 26 84 66