When visiting the website, accessing or viewing any of the files stored on the website this will be logged. This information is logged in order to pursue our legitimate interest (under Art. 6 (1) (f) of the General Data Protection Regulation (GDPR)) in guaranteeing a smooth connection and in optimising our websites and to ensure that the system is robust. The data will not be used to draw conclusions about you as an individual.

The following information will be logged:

• name of the accessed file,
• date and time of access,
• amount of data transferred,
• confirmation that the file has been accessed successfully,
• web browser and requesting domain,
• anonymised IP addresses of the device sending the request.

the steps necessary to initiate a contract in response to your enquiry (Art. 6 (1) (b) of the GDPR). Typical purposes are responding to queries about our products in the areas of financial portfolio management, investment and acquisition brokerage and to give investment advice / initiate contact with clients and to conclude contracts / process applications / maintain business relationships.

The following data may be collected:

• Surname, first name and salutation
• Contact details
• Information which you share with us about your interests and wishes

When you register for our newsletter online, we will ask you to provide your explicit consent for us to use your email address to send our newsletter to you on a regular basis. Once you have registered, you will receive an initial email to confirm your email address.

You can revoke your consent with effect for the future at any time. You also have the right to object to your personal data being processed for marketing purposes at any time and free of charge.

The legitimacy with which your data has been processed until the point at which you revoke your consent will not be affected by this. With every subsequent newsletter, you have the option to use the corresponding link to unsubscribe from this newsletter.

Please note that our newsletter contains promotional content, as we use it to advertise our products and services. Your consent to the use of your email address is given on a completely voluntary basis and, should you not wish to give your consent, this will have no wider implications on other aspects of the business relationship.

The use of your email address to send our newsletter is based on your consent (Art. 6 (1) (a) of the GDPR).

There is an option to register for private areas of our website. If a user registers for private areas of our website, this is done on a voluntary basis for the purpose of direct communication and the execution of orders between the contractual parties.

As part of this process, your personal information will be processed in order to fulfil an agreement to which you are a party or to initiate additional agreements in accordance with the terms of use of the distributor portal (Art. 6 (1) (b) of the GDPR).

There is also an option to register for the Flossbach von Storch Postbox online platform. If a user registers with the Flossbach von Storch Postbox online platform, this will be on a voluntary basis for the purpose of securely sharing confidential documents, particularly the regular asset reports. When the portal is used, data of this kind is recorded to track error statuses guaranteeing comprehensive customer service when troubleshooting during the log-in process.

The following data ‒ and the following data only ‒ are stored for this purpose: 

• session data,
• system events.
• log-in data.

Your personal data will be processed in order to safeguard legitimate interests and fulfil an agreement to which you are a party or to initiate additional agreements in accordance with the Postbox terms of use of (Art. 6 (1) (b) and (f) of the GDPR).

We also offer the option of registering for teleconferences, web conferences and livestreams. Participation is on a voluntary basis for the purpose of communicating directly and holding conferences.

Your personal information will be processed to safeguard legitimate interests in the holding of conferences in the best possible way and to fulfil an agreement to which you are a party or to initiate additional agreements in accordance with the terms of use of the telephone and web conferences (Art. 6 (1) (b) and (f) of the GDPR).

4.6.1 GoToMeeting/LogMeIn

We use GoToMeeting/LogMeIn software for online meetings, video conference and web conferences. This may involve transferring data to the USA. The current standard EU contractual clauses have therefore been concluded with the provider in order to guarantee a suitable level of data protection.

The "LogMeIn International Privacy Policy" can be found at https://www.logmein.com/trust/privacy.

Our Cookie Guideline provides information about how personal data is processed using cookies and similar technologies on our website.

Within Flossbach von Storch, only people in positions who need access to your personal data to fulfil our contractual or statutory obligations or to safeguard our legitimate interests will have access to it.

In order to offer you the best possible level of service, we occasionally share data with Flossbach von Storch AG, Germany, and Flossbach von Storch AG, Switzerland. As part of data processing subject to instructions on behalf of Flossbach von Storch AG, Germany, and Flossbach von Storch AG, Switzerland, we collect data which is recorded via the respective country websites. This data is then provided to the corresponding companies in order to pursue the stated purposes.

We thereby ensure that the applicable statutory data protection regulations are adhered to and that your personal data is protected to an appropriate extent at all times.

For this reason, we have taken corresponding measures with Flossbach von Storch AG, Germany, and Flossbach von Storch AG, Switzerland, to ensure that data protection regulations are adhered to.

We have concluded corresponding agreements with the individual companies to ensure that the personal data shared within the Group always remains protected.

In accordance with these agreements and applicable data protection law, we will only share personal data with other companies in the group of companies for the purposes set out in this privacy statement.

In doing so, we support these companies both in their operations as well as with respect to their adherence to the technical and organisational measures which we also employ to ensure that your personal data is secure. Where possible, we use pseudonymisation and anonymisation measures to protect your data. An adequacy resolution of the EU Commission is in place with regard to the transfer of data to Switzerland to ensure that the personal data processed there is protected to the same extent as within the EEA.

We take the protection of your personal data very seriously and will only pass on information about you where statutory provisions require us to do so, when you have consented to this or in order to fulfil contractual obligations.

5.3.1 Disclosure due to a statutory obligation

For the following recipients, there may be a statutory obligation to disclose your personal data:

• public bodies or supervisory authorities such as the German Federal Financial Supervisory Authority (BaFin), tax authorities, customs authorities;
• judicial and law enforcement authorities such as the police, courts, public prosecutor;
• lawyers or notaries, such as in legal disputes;
• auditors.

5.3.2 Disclosure in order to fulfil an agreement

We collaborate with other companies to enable us to fulfil our contractual obligations. This includes:

• transportation service providers and hauliers;
• event organisers and training providers if you have registered with us for specific trade fairs or events;
• banks and financial service providers for handling all financial affairs.

5.3.3 Sharing data with our own service providers

In order to run our business efficiently, ensure that everything runs smoothly and improve our IT security, we use the services of external service providers which may receive personal information from you in order to fulfil the purposes described above, including

• IT service providers, particularly in the area of firewall/IT security, website hosting,
• Cloud providers,
• print and telecommunications service providers, particularly for sending publications or the newsletter by post,
• debt collection, consultancy or sales companies,
• service providers assisting with our Customer Relationship Management.

We have concluded corresponding subcontractor agreements to ensure that the service providers adhere to the same data protection standards as we do in-house. Some of the aspects governed by these agreements are as follows:

• third parties only have access to the data that they need to fulfil the tasks assigned to them;
• the only employees of the service providers who have access to your data are those who have explicitly undertaken to adhere to data protection regulations;
• the service providers adhere to technical and organisational measures which ensure that data is secure and protected;
• the servers on which data is processed for these purposes are hosted in the EU;
• what happens to the data when the business relationship between the service provider and us has come to an end.

With service providers based outside of the European Economic Area (EEA), we take special security measures (such as the use of special clauses to the agreement) to ensure that the data is handled with the same level of care as in the EEA. We audit all of our service providers on a regular basis to ensure that they are adhering to our specifications.

We will never sell your personal data to third parties!

You have the right to receive information from us concerning which of your personal data we are processing.

In the event that this information is not (or no longer) correct, you can demand that we rectify the data and that missing information be added.

Under the following circumstances, you can demand that your personal data be immediately deleted:

• if your personal data is no longer required for the purposes for which they were collected;
• if you have revoked your consent and there are no other legal grounds for processing the data;
• if you revoke your consent to processing and there are no overriding legitimate reasons for processing the data;
• if your data is being processed on an illegitimate basis;
• if your personal data needs to be deleted in fulfilment of statutory obligations.

Please note that, before your data is deleted, we will need to check whether there is any legitimate reason for processing your personal data.

You can demand that the processing of your personal data be restricted for any of the following reasons:

• if you dispute the accuracy of the data until we have the chance to verify that the data is accurate;
• if the data is being processed unlawfully and you merely demand that the use of your personal data be restricted instead of deleted;
• if we no longer need your personal data for the purposes of processing, but you still require it for the purposes of asserting, exercising or defending legal claims;
• if you have objected to processing and it has not yet been verified whether your legitimate interests override ours.

6.4.1   Case-by-case right to object

To the extent that processing is carried out in the public interest or on the basis of the balancing of interests, you have the right to object to processing on grounds relating to your particular situation. If you lodge an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing your data which override your interests, rights and freedoms or if your personal data is used to assert, exercise or defend legal claims. The objection shall not contradict the legitimacy with which your data was processed prior to the objection.

6.4.2   Objection to advertising

In cases in which your personal data is used for promotional purposes, you will be able to object to this form of processing at any time. We will then no longer process your personal information for these purposes.

You have the right to receive the personal data that you have provided to us for the purposes of processing in a portable and machine-readable format upon request.

We will always endeavour to process your queries and claims as quickly as possible in order to safeguard your rights accordingly. However, depending on the number of queries we receive, it may take up to 30 days before we can respond to your concerns. If there is a delay, we will inform you in a timely manner about the reasons for the delay and will discuss further steps with you.

In some cases, we may not be allowed or able to provide you with information. Where permitted by law, we will inform you of the reason why we are refusing to provide the information.

If you are still not satisfied with our answers and response or if you believe we are violating applicable data protection law, you have the right to lodge a complaint with our data protection officer and the responsible supervisory authority. The supervisory authority responsible for us is:

Commission de Surveillance du Secteur Financier (CSSF)
283, route d’Arlon
1150 Luxembourg, Luxembourg

Tel.: +352 26 25 1 - 1
Fax: +352 26 25 1 - 2601
E-Mail: direction@cssf.lu
Webseite: www.cssf.lu