Privacy policy
This policy explains what personal data Fund XP collects through this website and through the services we provide, why we collect it, how long we keep it, and what you can do about it.
Who is responsible
The controller of your personal data is:
Fund XP
7, Boulevard John F. Kennedy
L-1855 Luxembourg
Email: info@fund-xp.lu
The DORA Register of Information validator
Our register validator is built so that your register never reaches us.
Your file is not uploaded. The report package you select is opened and checked inside your own browser. None of its contents are transmitted to Fund XP: no provider names, no contract reference numbers, no LEIs from the register, no financial figures.
Three items are sent to us when you run a check, and only after you tick the consent box:
- the email address you enter;
- the name of the file you selected — note that file names in this submission format normally begin with your LEI, so the name itself can identify your entity;
- the number of problems the check found, or the fact that the package could not be read.
We also record the IP address the request came from and the page you came from, as part of the technical record of the submission.
Why: to tell you the check has run, and to contact you about the result and about our DORA register solution.
Legal basis: your consent, given by ticking the box before the check runs (Article 6(1)(a) GDPR). You can withdraw it at any time by writing to info@fund-xp.lu; withdrawal does not affect anything done before you withdrew.
Retention: [TO CONFIRM: how long these notification emails are kept in the info@fund-xp.lu mailbox, and whether the addresses are copied into a CRM or mailing list. A defensible default is 24 months from last contact, but state what you will actually do.]
Checks against the GLEIF database
To verify that the Legal Entity Identifiers in your register exist and are still active, the validator queries the public GLEIF database at api.gleif.org. This request is made by your browser, directly, and does not pass through our servers.
This means GLEIF, not Fund XP, receives your IP address and the LEIs concerned. LEIs are public identifiers by design. GLEIF’s own privacy notice governs what it does with that request.
Contact forms and enquiries
When you write to us, fill in a form on this site, or ask about a service, we process the identification and contact details you give us and the content of your message.
Why: to answer you, prepare a quotation, and manage the relationship that follows.
Legal basis: performance of a contract or steps taken at your request before entering one (Article 6(1)(b) GDPR), and our legitimate interest in responding to business enquiries (Article 6(1)(f)).
Retention: [TO CONFIRM: retention for enquiry correspondence, and separately for client records, which in Luxembourg are typically subject to a ten-year commercial retention obligation.]
Your GIIN registration service, which files with the IRS on a client’s behalf, plainly involves personal data and a transfer outside the EU. Your Excel-based reporting tools, which run on the client’s own machine, may involve none at all. Those two cases need different wording.]
Website analytics and advertising
This site uses Google Analytics to understand how visitors use it, and Google advertising services. These set cookies and transmit data, including your IP address, to Google.
Legal basis: your consent, collected through the cookie banner before these services are loaded.
Hosting, delivery and security
To operate this site securely we process technical data, including your IP address, browser and operating system, the pages you request, and the time of each request.
Our service providers for this are:
- Cloudflare — content delivery, protection against attacks, and serving web fonts from our own domain so that no request is made to third-party font servers;
- OVH — outgoing email for notifications and replies;
- WP Cerber — protection against intrusion attempts, which sets a technical cookie necessary for that purpose;
Legal basis: our legitimate interest in keeping the site available and secure (Article 6(1)(f) GDPR).
Retention: log retention at host and at Cloudflare.
Cookies
The following are set on this site:
pll_language— remembers the language you chose. Necessary for the site to work in your language.cerber_grooveand related — security. Necessary.- Cloudflare technical cookies — security and performance. Necessary.
- Google Analytics and Google advertising cookies — set only after consent.
You can change or withdraw your cookie choices at any time through [TO CONFIRM: how — name the banner’s “manage preferences” link and make sure it is reachable from every page].
Who else sees your data
We do not sell personal data. We share it only with the service providers named above, acting on our instructions, and with our professional advisers or public authorities where we are legally required to.
Transfers outside the European Union
Google is established in the United States. Where data is transferred there, the transfer relies on the European Commission’s adequacy decision for the EU–US Data Privacy Framework and, where applicable, on standard contractual clauses.
Your rights
Under the GDPR you may ask us to give you access to your data, correct it, erase it, restrict how we use it, or transfer it to another provider. You may object to processing based on our legitimate interest, and withdraw consent where consent is the basis. Where you have given consent, withdrawing it is as easy as giving it.
Write to info@fund-xp.lu. We answer within one month.
If you are not satisfied with our answer, you may lodge a complaint with the Luxembourg supervisory authority:
Commission nationale pour la protection des données (CNPD)
15, Boulevard du Jazz
L-4370 Belvaux, Luxembourg
cnpd.public.lu
Security
We take appropriate technical and organisational measures to protect personal data. The validator’s design is part of this: by checking your register in your browser rather than on our servers, the data that would be most sensitive to lose is never in our custody.
Automated decision-making
We do not make decisions about you by purely automated means, and we do not profile you.
Children
This site addresses professionals. We do not knowingly collect data about children.
Changes to this policy
We may update this policy. The date at the top tells you when it last changed. Where a change materially affects how we use data you have already given us, we will tell you directly.