GDPR

Gdpr

Version: 2.1 Effective Date: September 1, 2026

OREA Capital S.A. attaches particular importance to the protection of personal data and undertakes to process it in accordance with Regulation (EU) 2016/679 on the protection of personal data ("GDPR") as well as the applicable Luxembourg regulations.

The purpose of this Notice is to inform you of the way in which OREA Capital S.A. collects, uses, stores, protects and shares personal data in the context of its activities.

DATA CONTROLLER

OREA Capital SA
126 Route d'Arlon
L-8311 Capellen
Grand Duchy of Luxembourg

If you have any questions about the protection of personal data or to exercise your rights, you can contact us at the following address: info@oreacapital.com

OREA Capital has appointed an internal referent responsible for monitoring issues relating to the protection of personal data.

SCOPE

This Notice applies in particular to personal data concerning:

  • Customers and former customers;
  • Prospects
  • The beneficial owners;
  • Legal representatives;
  • The representatives;
  • Contact persons of legal persons;
  • Professional suppliers and partners;
  • Visitors to the website;
  • Visitors to the premises of OREA Capital S.A.

WHAT DATA DO WE COLLECT?

Depending on the nature of our relationship with you, we may collect and process the following categories of data:

Identification data

  • Surname(s) and first name(s)
  • Date and place of birth
  • Nationality(ies)
  • Identification documents
  • Signature
  • Information on legal representatives or beneficial owners

Contact Information

  • Mailing address
  • Email address
  • Phone Number
  • Other contact details.

Financial and patrimonial data

  • Bank details
  • Asset situation
  • Professional situation
  • Financial position
  • Revenues
  • Source of funds
  • Source of wealth 
  • Investment objectives 
  • Risk profile 
  • Investment horizon 
  • Ability to withstand losses 
  • Liquidity needs 
  • Sustainability preferences

Regulatory Compliance Data

  • Informations KYC
  • Beneficial ownership information
  • Information on Politically Exposed Persons (PEPs)
  • Information on international sanctions
  • Anti-Money Laundering and Countering the Financing of Terrorism Information 

Communication data

  • Letters 
  • Emails 
  • Meeting Minutes 
  • Professional exchanges carried out within the framework of the business relationship 
  • Records of communications where warranted by applicable regulations or legitimate security and compliance needs

Safety data

  • Access Control Data 
  • Visitor log data 
  • Computer connection logs 
  • Images from video surveillance devices when they are present on our premises

HOW DO WE COLLECT YOUR DATA?

Personal data may be collected:

Directly from you

  • When making contact
  • When entering into a relationship
  • When providing services
  • When signing documents
  • During written or verbal exchanges
  • Through forms or questionnaires
  • When using the website

From third parties

Where regulations or circumstances permit, certain information may be obtained from:

  • Public registries
  • Of administrations and public authorities
  • Financial institutions
  • Suppliers specializing in regulatory compliance
  • Databases on international sanctions
  • Databases of politically exposed persons
  • From any other legally accessible source

PURPOSES OF THE PROCESSING

OREA Capital S.A. processes personal data for the following purposes:

  • Connecting with its customers
  • Manage and monitor the business relationship
  • Provide portfolio management services
  • Assess the adequacy of investment services and strategies
  • Establish the investor profile
  • Comply with regulatory requirements applicable to investment services
  • Meet anti-money laundering and countering the financing of terrorism obligations
  • Carry out international financial sanctions checks
  • Meet applicable tax obligations, including FATCA and CRS
  • Ensure the safety of people, premises, systems and information
  • Prevent fraud and abuse
  • Ensure the administrative, accounting and operational management of activities
  • Defend the rights and legitimate interests of OREA Capital S.A.
  • Respond to requests from the competent authorities.

LEGAL BASES FOR PROCESSING

The processing implemented by OREA Capital is based, depending on the case, on one or more of the following legal bases:

  • The performance of a contract or pre-contractual measures
  • Compliance with a legal or regulatory obligation
  • The pursuit of a legitimate interest of OREA capital
  • The consent of the data subject when required

SPECIAL CATEGORIES OF DATA

OREA Capital is not intended to collect or process special categories of data within the meaning of the GDPR.

However, in certain exceptional situations related to legal or regulatory obligations or the management of a specific file, such data may be received or processed. In this case, they benefit from an enhanced level of protection in accordance with the applicable regulations.

ANTI-MONEY LAUNDERING AND REGULATORY COMPLIANCE

As a professional in the financial sector subject to the supervision of the Commission de Surveillance du Secteur Financier (CSSF), OREA Capital S.A. is required to collect, verify, analyse and store certain information relating to its clients.

As such, we are required to carry out:

  • Identity checks
  • Identification and verification of beneficial owners
  • Analyses relating to the origin of funds and the origin of wealth
  • PEP controls
  • International sanctions controls
  • Risk assessments
  • Ongoing monitoring of the business relationship

This processing is carried out in strict compliance with the legal obligations to which OREA Capital is subject.

REGISTRATIONS AND SECURITY

OREA Capital S.A. implements technical and organisational measures to ensure a level of security appropriate to the risks.

Depending on the case, these measures may include:

  • Controlling access to the premises 
  • Logging access to information systems 
  • Secure document archiving 
  • The preservation of professional exchanges 
  • The recording of certain communications when required by applicable regulations 
  • The use of video surveillance devices to protect people, property and information

DATA RECIPIENTS

To the extent necessary for the fulfilment of the purposes described above, personal data may be disclosed:

  • Authorized employees of OREA Capital S.A.
  • Custodian Bank
  • The financial institutions concerned
  • Service providers acting on behalf of OREA Capital S.A.
  • Auditors and auditors
  • Legal, tax or regulatory advisors
  • To the competent administrative, judicial or regulatory authorities
  • To any other person or entity as required or permitted by law

All recipients are subject to appropriate confidentiality and security obligations.

INTERNATIONAL TRANSFERS

In the context of certain services or technological solutions used by OREA Capital, personal data may be transferred outside the European Economic Area.

When such transfers take place, OREA Capital ensures the implementation of the appropriate guarantees provided for by the applicable regulations, in particular when they are based on Standard Contractual Clauses approved by the European Commission. 

DATA RETENTION

Personal data is kept for the necessary time:

  • Business relationship management
  • The fulfilment of contractual obligations
  • Compliance with legal and regulatory obligations
  • The management of possible disputes
  • To the protection of the legitimate interests of OREA Capital S.A.

Some data may be retained for periods imposed by applicable anti-money laundering, investment services, taxation, or other regulatory requirements.

After the applicable retention periods, the data will be deleted, anonymised or archived in accordance with legal requirements.

YOUR RIGHTS

Subject to the conditions and limitations provided for by the applicable regulations available on the website of the competent authority, you have the following rights:

  • Right to information
  • Right of access
  • Right to rectification
  • Right to erasure
  • Right to restriction of processing
  • Right to object
  • Right to data portability
  • right to withdraw your consent where the processing is based on it

To exercise these rights, you can send your request to: info@oreacapital.com

In order to protect the confidentiality of the data, OREA Capital may request any information reasonably necessary to verify the identity of the applicant.

AUTOMATED DECISION

OREA Capital does not take a decision producing legal effects based exclusively on automated processing within the meaning of Article 22 of the GDPR.

COMPLAINT TO AN AUTHORITY

If you believe that the processing of your personal data does not comply with the applicable regulations, you have the right to lodge a complaint with the competent authority.

Luxembourg: National Commission for Data Protection (CNPD)

https://cnpd.public.lu/ 

Belgium: Data Protection Authority (DPA)

https://www.dataprotectionauthority.be/ 

THIS UPDATE

OREA Capital S.A. reserves the right to modify this Notice in order to take into account legal, regulatory, organizational or technical developments.

The most recent version of this Notice is available on the website of OREA Capital S.A. and can be obtained on request.