Privacy Notice

1. Introduction

This privacy notice (the “Privacy Notice”) sets out, how Greenbridge S.A. (“Greenbridge”, “we”, “us”, or “our”) process your Personal Data. Greenbridge is committed to protecting your Personal Data and respecting your privacy. We may collect and process Personal Data when we interact with you, whether you are a visitor to our website or through correspondence with us via email, telephone or otherwise. All data that we may collect and process from time to time will be collected and processed in accordance with applicable laws, including without limitation, Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “General Data Protection Regulation” or “GDPR”) and any related legislation arising therefrom (“Applicable Laws“) and for the purposes defined below.

This Privacy Notice acts as a primary safeguard to inform you of your data rights. If we require additional Personal Data that is not outlined in this Privacy Notice, we will supply you with a supplementary privacy notice that will outline the use and purpose of such additional collection of Personal Data. 

2. Terminology

Personal Data: any information relating to an identified or identifiable living individual; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Data Controller: the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of Personal Data.

Greenbridge normally processes your Personal Data as a Data Controller.

3. Categories of Personal Data that Greenbridge may collect and process

(a) Identification Data. Includes first name, maiden name, last name, username or similar identifier, and tax identification numbers. 

(b) Administrative Data. Includes marital status, title, date of birth, gender, nationality and passport/ID card data.

(c) Contact Data. Including billing address, correspondence address, email address, and telephone numbers. 

(d) Professional Data. Includes job title/occupation, employer, positions and mandates held, and employment and education history, salary and information connected to performance reviews. 

(e) Financial Data. includes bank account details and bank statements as well as, wire transfer instructions and financial transaction data.

(f) Numeric Data. Includes internet protocol (IP) address and log-in data, browsing history, URL referral header information and online website tracking information, tracking pixels or web beacons.

(g) Marketing and Communications Data. Includes any preferences in receiving marketing from us

(h) Recruitment Data: Includes CV and other application forms, references, employment and education history, evidence of qualifications, interview notes, bank account details, picture, passport information, visa and/or immigration details, details regarding your criminal records.

4. How we collect Personal Data

We may collect Personal Data through direct interactions, automatic technologies or interactions and/or from third parties or publicly available sources, including without limitation:

  • through the Greenbridge website (https://www.greenbridge.lu)
  • through email, telephone and other communications in the course of our business relationship with you.
  • through physical meetings with our staff members (e.g. the exchange of business cards and presentations).
  • through parties acting on your behalf such as legal advisors, agents, consultants, accountants, and other service providers you engage.

5. Processing of your Personal Data (purposes of collecting of Personal Data)

Below is a list of situations where we may collect and process your personal data, for what purposes and on which legal ground. The legal ground applicable in each situation may depend on the Personal Data collected which is why we have listed more than one legal ground.

Activity: General correspondence

Categories of Personal Data normally collected: (a) Identification Data, (c) Contact Data.

Purpose of Processing: To respond to enquiries via e-mail or telephone.

Lawful basis for processing: Consent, performance of a contract or taking steps at your request prior to entering into a contract or legitimate interest.

Activity: Job applications

Categories of Personal Data normally collected: a) Identification Data, (b) Administrative Data, (c) Contact Data, (d) Professional Data, (h) Recruitment Data. We may also process any relevant health information in order to comply with our duty to make reasonable adjustments for each individual, provided that we comply with the specific requirements applicable to Special Categories of Data.

Purpose of Processing: To ensure that job applicants meet the requirements we have set out for each role and ensure that we can make suitable adjustments for each individual.

Lawful basis for processing: Necessary to comply with our legal obligations, legitimate interest or consent.

Activity: Employment with us

Categories of Personal Data normally collected: (a) Identification Data, (b) Administrative Data, (c) Contact Data, (d) Professional Data, (e) Financial Data, (h) Recruitment Data.

Purpose of Processing: to administer and manage all aspects of your employment with us.

Lawful basis for processing: Necessary to comply with our legal obligations, legitimate interest as well as performance of our contract with you.

Activity: Administering the Shareholder’s portal

Categories of Personal Data normally collected: (a) Identification Data, (b) Administrative Data, (c) Contact Data, (d) Professional Data, (e) Financial Data, (f) Numeric Data.

Purpose of Processing: To provide our shareholders with information in a secure manner and to manage our web-based services and supporting infrastructure.

Lawful basis for processing: performance of a contract. Necessary to comply with our legal obligations, legitimate interests.

Activity: Investment evaluation

Categories of Personal Data normally collected: (a) Identification Data, (b) Administrative Data, (c) Contact Data, (d) Professional Data.

Purpose of Processing: To assess pre-investment opportunities and carry out primary due diligence.

Lawful basis for processing: Necessary to comply with legal obligations, legitimate interests or because it is necessary for us to fulfil our obligations under a contract or prior to entering into a contract.

Activity: Administration

Categories of Personal Data: (a) Identification Data, (b) Administrative Data, (c) Contact Data, (e) Financial Data, (g) Marketing and Communications Data.

Purpose of Processing: To maintain our administrative and business relationship management systems, including (but not limited to) on-going transactions monitoring, invoicing and invoice payments, complaints handling and quality assurance.

Lawful basis for processing: legitimate interest.

Activity: Cookies

Categories of Personal Data: (f) Numeric Data.

Purpose of Processing: To record the usage of our website and improve our services.

Lawful basis for processing: Consent

Activity: Marketing activities

Categories of Personal Data: (a) Identification Data, (c) Contact Data, (g) Marketing Data.

Purpose of Processing: To send you direct information and marketing concerning our business.

Lawful basis for processing: Consent.

If we request your explicit consent with respect to processing of Personal Data for the purposes described above, such request for consent will be addressed to you separately, in a clear manner and prior to the processing.

  • Sensitive Data

We may further need to collect special categories of Personal Data in relation to your employment, or potential employment with us, such data may include health information, (“Special Categories of Data”) or information relating to criminal records (alleged or actual) criminal offences or convictions (“Criminal Data”).

With respect to Special Categories of Data, we will only process these data if one of the following legal grounds applies:

  1. you provided us with your explicit consent (in such a case, a consent form will be addressed to you separately, clearly spelling out the reasons of the processing); or
  2. processing relates to personal data which were manifestly made public by you; or
  3. processing is necessary for the establishment, exercise or defence of a legal claim; or
  4. processing is necessary for reasons of substantial public interest as provided under EU or Member State law, such as in the context of our anti-money laundering and counter-terrorism obligations or for fraud prevention.

With respect to Criminal Data, we will only process such data where allowed by EU or Member State law or under the control of an official authority, and if one of the following legal bases applies:

  1. you provided us with your consent; or
  2. processing is necessary for the performance of the contract between you and us; or
  3. processing is necessary for compliance with our legal obligations under EU or Member State law; or
  4. processing is necessary for the purposes of our legitimate interests to prevent fraud and protect our reputation, activities or assets.

If we collect such data, it will be on the legal basis of fulfilling legal requirements provided under employment law or other regulatory obligations. Special Categories of Data and Criminal Data should be subject to appropriate security measures given their sensitive nature; we will implement such measures taking into account the risk of the processing.

7. Sharing of Personal Data with third parties

If you are contacting us on behalf of a potential portfolio company, or if you intend to engage with us in any other business transaction, we may need to transfer your Personal Data to a third party for processing where this is required to fulfil the purpose for which the Personal Data was collected. We may be legally, contractually or otherwise obligated to share your Personal Data with (a) other entities within our group, (b) professional advisers, including lawyers, bankers, auditors and insurers, (c) regulators and government bodies, (e) IT service providers, (f) any other third-party service providers where the transfer of information is required in connection with the purpose for which it was collected.

If we share your Personal Data with any third parties they will not be allowed to use your Personal Data for other purposes than the ones for which the data was collected by us, and they will further be contractually obliged to implement the technical standards necessary to keep your Personal Data safe.

Finally, please note that we may also be obliged to share some of your Personal Data with a governmental or regulatory authority or agency, with whom we are required to cooperate with, or with whom it is appropriate to cooperate in relation to an investment, and which has jurisdiction over Greenbridge or one of the above-mentioned recipients. 

8. International transfers of Personal Data

We strive to process your Personal Data within the European Union (EU) or the European Economic Area (EEA). If your personal data would need to be transferred to a country outside the EU/EEA (Third Country), we will ensure that such data is stored and handled in a secure manner. We will further comply with all requirements that apply to transfers of personal data to countries outside the EU/EEA pursuant to applicable data protection legislation, by ensuring that the Third Country either benefits from an adequacy decision from the Commission or has appropriate safeguards in accordance with article 46 and 47 of the GDPR. 

In the absence of appropriate safeguards, we will not transfer personal data towards a Third Country, unless a specific derogation applies in the sense of article 49 of the GDPR. In particular, where appropriate, we may request your explicit consent with respect to the transfer of your Personal Data towards a Third Country. Such request for consent will be addressed to you separately, in a clear manner and prior to the transfer.

9. Retention of Personal Data

We will only retain your Personal Data for as long as necessary to achieve the purpose for which it was collected as described above, or for as long as we are required to keep your Personal Data under legal obligations (for example regarding tax, accounting or employment). More specifically, we will keep your Personal for an appropriate number of years after termination of our relation. When the lawful basis for processing is consent, we will retain your Personal Data for as long as your consent is valid. While retaining your Personal Data, we will do our best to ensure that it is secure from unauthorised use or disclosure.

Once your Personal Data is no longer required for the purposes for which it was collected, it will be securely destroyed or anonymised in accordance with applicable laws and regulations. 

In some circumstances we may anonymise your Personal Data (so that it can no longer be associated with you and considered as Personal Data) for research or statistical purposes. In such cases, we may use this information indefinitely without further notice to you. 

10. Your rights concerning your Personal Data

You have certain rights that you can exercise in connection with your Personal Data: These include the rights to:

  • Request access to your Personal Data through a data subject access request addressed to contact@greenbridge.lu. This enables you to receive a digital copy of the Personal Data we hold about you.
  • Request rectification of your Personal Data. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
  • Request erasure of your Personal Data. This enables you to ask us to delete Personal Data where :
    • the processing is no longer necessary for the purposes for which we collected the Personal Data,
    • you have successfully exercised your right to object to processing (see below),
    • we may have processed your information unlawfully, or
    • we are required to erase your Personal Data to comply with applicable law.

Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

  • You may object to processing of your Personal Data where we are relying on a legitimate interest (or those of a third party). You also have the right to object when we are processing your Personal Data for the performance of a task carried out in the public interest or in the exercise of official authority or for direct marketing purposes.
  • Request restriction of processing of your Personal Data. This enables you to ask us to suspend the processing of your Personal Data in the following scenarios:
    • If you want us to establish the data’s accuracy.
    • Where our use of the data is unlawful, but you do not want us to erase it.
    • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
    • You have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
  • Request the transfer of your Personal Data to you or to a third party in a machine-readable format. This is only possible when we process your Personal Data in an automated format, based on your consent or to perform a contract with you. It is also only applicable to such Personal Data that you have provided to us.
  • Withdraw consent at any time where we are relying on consent to process your Personal Data. However, this will not affect the lawfulness of any processing carried out before you withdrew your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

11. Automated Decision Making

Greenbridge will not use any automated decision making to make decisions that will have legal or material effects on you.

12. Changes

This Privacy Notice aims to be accurate and clearly reflective of our current practices with respect to how we process your Personal Data. If any changes to our website or changes to legislation require a change to our Privacy Notice, we will make these changes clearly visible on our website. Please do check this Privacy Notice often to confirm any changes.

13. Contact

If you require any additional details or information or would like to exercise any of your data privacy rights, please contact us using the following contact details: contact@greenbridge.lu

We would also like to inform you that you can always report any suspicions that someone is processing your Personal Data in a way that contravenes the GDPR to your national supervisory authority (in Luxembourg, the Commission Nationale pour la Protection des Données).