Privacy notice

1. Scope of this notice

Cresvia Capital Fund Management S.A. (“CCFM”, “we”, “us”) is an alternative investment fund manager authorised and supervised by the Commission de Surveillance du Secteur Financier (CSSF). This notice explains how we process personal data of our business contacts, prospective and existing partners and counterparties, service providers, investors and visitors of this website, and the rights you have under Regulation (EU) 2016/679 (the “GDPR”) and the Luxembourg Law of 1 August 2018 on the organisation of the National Commission for Data Protection and the general data protection framework. Processing carried out by our German branch is also subject to the German Federal Data Protection Act (BDSG).

This notice also applies to investors, prospective investors and counterparties of the funds we manage, whose onboarding forms refer to it, and to their directors, representatives and beneficial owners. Where the documentation of a fund contains additional data protection provisions, those apply in addition.

2. Name and contact details of the controller

The entity responsible for data processing is:

Cresvia Capital Fund Management S.A.
2, rue Jean Monnet
L-2180 Luxembourg
RCS Luxembourg B179983
German branch: Mainzer Landstraße 1, 60329 Frankfurt am Main, Germany

3. Data protection contact

For any question or request concerning your personal data, please contact:

Email: compliance@cresvia-capital.com
Post: Cresvia Capital Fund Management S.A., 2, rue Jean Monnet, L-2180 Luxembourg (marked “Data protection”)

4. Personal data we process

4.1 Categories of personal data

Depending on your relationship with us, we process the following categories of personal data:

• Identification and contact data: name, title, business address, email address, telephone number
• Professional data: employer, position, function and professional background where relevant to a mandate or transaction
• Communication data: correspondence, meeting notes and other information you provide to us
• Contract and payment data of partners and service providers: contract details, bank details, invoices
• Investor and counterparty data: identification and verification documents of investors, counterparties and their beneficial owners and representatives, source of funds and wealth, tax status (FATCA/CRS), subscription and transaction data
• Website data: see section 8

4.2 Sources of personal data

We obtain data from:

• You directly, for example when you contact us, meet us at an event or enter into an agreement with us
• The company you represent or your employer
• Other companies of the Cresvia Capital Group, where you are already in contact with them
• Publicly accessible sources such as company websites, commercial registers and professional networks (e.g. LinkedIn)
• For investors and counterparties: onboarding and subscription documents, distributors and intermediaries, and screening databases used for anti-money laundering purposes. Where you are a director, representative or beneficial owner of an investor or counterparty, we receive your data from that entity

4.3 Service providers acting on our behalf

We use service providers who process personal data on our behalf and on our instructions under data processing agreements (Article 28 GDPR), in particular for customer relationship management (Salesforce), IT and cloud infrastructure (Microsoft 365), website hosting and email services, and for screening databases used to meet our anti-money laundering obligations.

5. Purposes and legal bases of processing

We process personal data for the following purposes and on the following legal bases:

• Business relationships: managing relationships with partners, sponsors, counterparties and service providers, including preparing, performing and terminating agreements - Article 6(1)(b) and (f) GDPR
• Investor and counterparty due diligence: identifying and verifying investors, counterparties and their beneficial owners, screening for anti-money laundering and counter-terrorist financing purposes, FATCA/CRS and other regulatory reporting, and administering subscriptions - Article 6(1)(c) GDPR (in particular the Law of 12 November 2004 on the fight against money laundering and terrorist financing, the Law of 12 July 2013 on alternative investment fund managers and applicable CSSF regulations) and Article 6(1)(b) GDPR
• Legal and regulatory obligations: record-keeping, reporting to and cooperating with supervisory, tax and judicial authorities - Article 6(1)(c) GDPR
• Intra-group administration: sharing personal data with companies of the Cresvia Capital Group for internal administrative purposes - Article 6(1)(f) GDPR
• Business development and communication: informing you about our services, funds and events, including newsletters - Article 6(1)(f) GDPR; electronic direct marketing where your consent is required - Article 6(1)(a) GDPR
• Website: operating, securing and improving this website - Article 6(1)(f) GDPR; cookies and similar technologies requiring consent - Article 6(1)(a) GDPR (see section 8)
• Protection of our rights and systems: establishing, exercising or defending legal claims, preventing fraud and securing our IT systems - Article 6(1)(f) GDPR

Where we rely on legitimate interests, these consist in conducting and developing our fund management business, communicating with professional contacts, and protecting our systems and legal position. You may object to such processing as described in section 10.

For investors and contractual partners, providing certain personal data is required by law (in particular anti-money laundering legislation) or necessary to enter into an agreement. Without it, we may be unable to enter into or continue the relationship.

6. Recipients of personal data

Your personal data may be shared with:

• Service providers acting as processors (section 4.3)
• Companies of the Cresvia Capital Group, for internal administration, the coordination of mandates and the purposes described in this notice
• Fund service providers where the processing relates to investors: depositaries, administrators, transfer agents and registrars, distributors and auditors of the relevant fund
• Supervisory, tax and judicial authorities, in particular the CSSF, the Luxembourg Financial Intelligence Unit and tax authorities, where we are legally obliged or entitled to disclose data
• Banks and payment service providers for the execution of payments
• Legal, tax and other professional advisers bound by professional secrecy
• Counterparties and business partners where necessary for a transaction or mandate

7. Data transfers to third countries

We process personal data in the European Union or the European Economic Area. Where a service provider or a company of the Cresvia Capital Group processes data outside the EEA, for example in the United States, we rely on an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified providers) or on the Standard Contractual Clauses adopted by the European Commission, supplemented by additional measures where necessary. You may request a copy of the safeguards in place via the contact details above.

8. Website, cookies and analytics

When you visit this website, our hosting provider automatically records technical data in server log files, such as your IP address, date and time of access, pages viewed, browser type and the referring website. We use this data to deliver the website and ensure its security (Article 6(1)(f) GDPR). Log data is deleted after a short period unless it is needed to investigate a security incident.

If you contact us by email or through a contact form, we process the data you provide to handle your request (Article 6(1)(b) and (f) GDPR).

This website uses strictly necessary cookies. Other cookies and analytics or marketing tools are only used with your consent, which you can give and withdraw at any time through the cookie banner (Article 6(1)(a) GDPR). The providers used, the purposes, storage periods and your choices are described in our Cookie Notice.

9. Data retention period

We keep personal data only for as long as necessary for the purposes described in this notice and delete or anonymise it afterwards. The retention period depends on:

• The duration of our relationship with you or the company you represent
• Statutory retention periods, in particular ten years for accounting and commercial records under Luxembourg commercial law and five years after the end of the business relationship or the transaction for records kept under anti-money laundering legislation
• The limitation periods applicable to legal claims

Contact data of business contacts is deleted when the relationship has ended and no statutory retention period or legal claim requires us to keep it. Recruitment data is held for up to six months after the end of the recruitment process.

10. Rights of data subjects

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR): to obtain confirmation whether we process your personal data and a copy of it
• Right to rectification (Art. 16 GDPR): to have inaccurate or incomplete data corrected
• Right to erasure (Art. 17 GDPR): to have your data deleted where there is no longer a legal basis or obligation to keep it
• Right to restriction of processing (Art. 18 GDPR): to have the processing of your data restricted in the cases provided for by law
• Right to data portability (Art. 20 GDPR): to receive the data you provided to us in a structured, commonly used and machine-readable format where the processing is based on consent or contract and carried out by automated means
• Right to object (Art. 21 GDPR): to object, on grounds relating to your particular situation, to processing based on legitimate interests, and to object at any time to direct marketing

If you object to direct marketing, we will no longer process your data for that purpose. We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

To exercise your rights, please contact us at compliance@cresvia-capital.com. We may ask you to verify your identity before responding. You also have the right to lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD) or with the supervisory authority of your habitual residence, place of work or place of the alleged infringement:

Commission nationale pour la protection des données
15, Boulevard du Jazz
L-4370 Belvaux, Luxembourg
cnpd.public.lu
Email: info@cnpd.lu
Phone: +352 26 10 60-1

11. Right to withdraw consent

Where processing is based on your consent, you may withdraw it at any time, for example by using the unsubscribe link in our communications, by adjusting your cookie settings or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

12. Data breaches

If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay. We will notify the supervisory authority where required by GDPR, within 72 hours where feasible.

13. Updates to this notice

We may update this notice from time to time, in particular where our processing activities or the law change. The current version is published on this website.