Privacy notice


Privacy notice

The protection of your personal data is important to Banque de Commerce et de Placements S.A., (“BCP”, “we”, “our”, or “us”), which has adopted strong principles in respect to data protection, also to satisfy for our Branch in Luxembourg and as applicable for our Head Office, the requirements of the EU General Data Protection Regulation (EU) 2016/679, "GDPR").

The GDPR aims at harmonizing data protection law across EU Member States and introduces higher data protection standards as well as transparency of personal data collection and processing. From May 25, 2018, the GDPR will replace the current EU data protection regime established by the Data Protection Directive 95/46/EC, which was transposed in the Luxembourg legal environment by the law of August 02, 2002, as amended, relating to the protection of individuals with regard to the processing of personal data.

This Data Privacy Notice[1] (“Notice”) provides you with general information on what personal data (namely any information relating to an identified or identifiable natural person) BCP collects, what it does with that information, and what rights you have.

As part of our commitment to protect your personal data in a transparent manner, we want to inform you


1.     What types of personal data do we collect?

We, as data controller (namely an entity that determines the purposes and the means of processing of personal data), may collect and process, to the extent necessary in the framework of our activities and to provide you with a high standard of personalized products and services, personal data about you, including:

In certain circumstances, we may collect and use personal data of individuals with whom we could have or previously had a direct relationship, such as prospects.

We may also collect information about you where you do not have a direct relationship with us. This may happen, for instance, when your personal data are provided to us by one of our clients or third parties if you are, for example:

Before providing BCP with this information, our clients or third parties should provide a copy of this Notice to you.

We never ask for personal data related to your racial or ethnic origins, political opinions, religious or philosophical beliefs, trade union membership, genetic data, data concerning your sexual orientation or data relating to criminal convictions and offences, unless it is required through a legal obligation.

The data we use about you may be:


2.     On which legal basis and for which purposes do we process your personal data?

a)     To comply with our legal and regulatory obligations (art. 6, 1c GDPR)

We use your personal data to comply with various legal and regulatory obligations, including:



b)    To perform a contract with you or to take steps at your request before entering into a contract (art. 6, 1b GDPR)

We use your personal data to enter into and perform our contracts, including to:


c)     To fulfill our legitimate interest (art. 6, 1f GDPR)

We use your personal data in order to deploy and develop our products or services, to improve our risk management and to defend our legal rights, including:


d)    To respect your choice if we request your consent for specific processing (art. 6, 1a GDPR)

In limited cases, we might require your consent to process your personal data, in particular:

3.     Who has access to personal data and with whom are they shared?

In order to fulfill the aforementioned purposes, but subject to applicable law relating to information sharing, we only disclose your personal data to the following parties:

a)     Within BCP Group

Some of your non-identifying personal data may be disclosed to BCP Headquarters for reasons linked to IT support and processing, and risk control.

b)    Outside BCP Group

The following third parties may receive your personal data:

In accordance with legal and regulatory obligations concerning the automatic exchange of information with participating countries, BCP may have to disclose some personal data relating to the client's tax residence status to our local tax authorities. Such local tax authorities may disclose the data communicated by BCP to each competent foreign tax authority in accordance with applicable legal and regulatory requirements.


4.     Transfers of personal data outside Switzerland or the EEA

In principle,   we do not transfer your personal data outside Switzerland for the Headquarter and  the European Economic Area (“EEA”) for our Luxembourg Branch, as mentioned in section 3 a) hereof, and ii) as otherwise consented by you from time to time. Subject to the foregoing, BCP will only do so if required pursuant to a legal or regulatory obligation or by a duly empowered public authority or, more generally, within applicable legal limits.

In such cases, BCP will satisfy itself that an adequacy decision has been adopted by the European Commission or, where applicable, that suitable guarantees are in place (for example: the adoption of standard data protection clauses, adherence to a code of conduct or certification).


5.     How long do we store your data?

We will retain your personal data for the longer of:

(i)             the period required by applicable law; or

(ii)            such other period necessary for us to meet our operational obligations, such as: proper account maintenance, facilitating client relationship management, and responding to legal claims or regulatory requests.


We will retain your personal data for the longer of:

Most personal data collected in relation to a specified client is kept for the duration of the contractual relationship with such client plus a specified number of years after the end of the contractual relationship or as otherwise required by applicable law. If you would like further information on the period for which your personal data will be stored or the criteria used to determine that period, please contact us by e-mail at the following address:


6.     What are your rights and how can you exercise them?

You, as data subject, have the following rights:

·         to access: you can obtain information relating to the processing of your personal data and a copy of such personal data.

·         to rectify: where you consider that your personal data is inaccurate or incomplete, you can require that such personal data be modified accordingly.

·         to erase: you can require the deletion of your personal data, to the extent permitted by law.

·         to restrict: you can request the restriction of the processing of your personal data.

·         to object: you can object to the processing of your personal data, on grounds relating to your particular situation.

·         to withdraw your consent: where you have given your consent for the processing of your personal data, you have the right to withdraw your consent at any time.

·         to data portability: where legally applicable, you have the right to have the personal data you have provided to us be returned to you or, where technically feasible, transferred to a third party.


If you are a customer of our Luxembourg Branch and you wish to exercise the abovementioned rights, you may submit by post a written and signed request or an e-mail, in both cases with proof of your identity (please include a scan/copy of your identity card for identification purpose) to us, addressed to the Data Protection Officer (“DPO”) of BCP as follows:

-       by post, to Banque de Commerce et de Placements S.A., Luxembourg Branch, 140 Boulevard de la Pétrusse, L-2330 Luxembourg; or

-       by e-mail, at:

If you are not satisfied with the way in which BCP processes your personal data, you may refer the matter to the DPO (using the aforementioned contact details), which will examine the complaint. If you are not satisfied with BCP's reply, you may lodge a complaint with the Luxembourg National Commission for Data Protection (


7.     Security note

We have in place appropriate technical and organizational measures to prevent unauthorized or unlawful access to the personal data you have provided to us. As complete data security cannot be guaranteed for communication via e-mails and similar means of communication. In that respect, we would recommend sending any particularly confidential information by an alternative secure means.


8.     Changes to personal data

We are committed to keeping your personal data accurate and up to date. Therefore, if your personal data change, please inform us of the change as soon as possible. 


9.     How to contact us

If you are a customer of our Luxembourg Branch and you have any questions relating to our use of your personal data under this Notice, please contact our DPO

-       by post, to Banque de Commerce et de Placements S.A., Luxembourg Branch, 140 Boulevard de la Pétrusse, L-2330 Luxembourg; or

-       by e-mail, at:


10.  Status of this Notice

This Notice is a notice explaining what BCP does, rather than a document that binds BCP or any other party contractually. We reserve the right to amend it from time to time.

We invite you to review the latest version of this Notice online and we will inform you of any material changes through our website or through our other usual communication channels.

[1] This Data Privacy Notice is a notification to data subjects pursuant to articles 13 and 14 of the GDPR.