Where a BDO entity in Luxembourg acts as a processor on behalf of a client, it may engage subprocessors to perform parts of the services, subject to the client’s prior specific or general written authorisation in accordance with the applicable contractual arrangements.

A list of subprocessors used by BDO entities in Luxembourg at the time of the conclusion of the contract will be included in the engagement letter(s) signed by the parties.

DURING THE PERFORMANCE OF THE SERVICES:

• Where general written authorisation has been granted, BDO entities in Luxembourg inform the client in advance of intended additions or replacements of subprocessors and allow the client 15 working days to object, in accordance with the applicable contractual arrangements. The treatment of a lack of response is governed by those arrangements.
• In case of a specific authorisation, BDO entities in Luxembourg request the client's consent in writing.

WHAT PROCEDURE DO BDO ENTITIES IN LUXEMBOURG FOLLOW WHEN ENGAGING SUBPROCESSORS?

BDO entities in Luxembourg require subprocessors to undertake data protection obligations equivalent to those applicable to the relevant BDO entity as processor under the applicable engagement letter and contractual terms, including:

• to process personal data in accordance with the documented instructions of the data controller (the client),
• to provide sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of the GDPR and ensure the protection of the rights of the data subject,
• to use only personnel who are under a contractual obligation to respect the confidentiality and security of the data,
• inform BDO entities in Luxembourg without delay of any security breach, andcooperate with BDO entities in Luxembourg in responding to requests from data controllers, data subjects or data protection authorities, as appropriate.

BDO entities in Luxembourg remain fully liable to the client for the performance of the subprocessor's obligations.


WHAT DATA ARE SHARED?

The categories of personal data disclosed to a subprocessor depend on the services provided to the client and the specific processing activities entrusted to that subprocessor.

BDO entities in Luxembourg disclose to subprocessors only the personal data necessary for the relevant subcontracted processing activities.
 

BDO entities in Luxembourg are composed of several distinct entities with common means, among which:

• BDO Advisory S.A,
• BDO Tax & Accounting S.A,
• BDO Technology S.A,
• BDO Audit S.A,
• BDO Services Luxembourg S.A,
• CF Corporate Services S.A,
• Audiex S.A,
• CF Fund Services S.A.

All these entities are domiciled at the following address: 1,-1A rue Jean Piret L-2350 LUXEMBOURG.

In order to provide the most effective and efficient service for its clients, any entity of BDO entities in Luxembourg may subprocess part of the services to any other entity of BDO entities in Luxembourg mentioned above, depending on the specific needs of each service provision. This subprocessing does not imply data transfers outside Luxembourg.

In addition, BDO entities in Luxembourg may also subprocess part of the services to CF Luxembourg Services, a fully owned subsidiary in Marrakech, Morocco.

WHAT APPROPRIATE SAFEGUARDS FOR THE TRANSFER OF PERSONAL DATA?
Any transfer of personal data is subject to appropriate safeguards. GDPR regulation is fully applicable for any transfer of data to the entities of BDO entities in Luxembourg domiciled in Luxembourg. If a transfer is made to CF Luxembourg Services for carrying out specific processing activities, the transfer of personal data outside the European union is based on the EU-approved safeguard, being the BDO’s Binding Corporate Rules for Controllers and Processors available here: https://www.bdo.lu/en-gb/bcrs. For any request you may have regarding international transfer of data, please send an email to the following address : dpo@bdo.lu.

BDO entities in Luxembourg are a member of BDO International Limited and forms part of the international BDO network of independent member firms.

BDO entities in Luxembourg may share personal data with member firms of the BDO network where it is necessary for providing effective and efficient services for its clients.

An exhaustive list of the BDO network is available here: https://www.bdo.global/en-gb/locations

WHAT APPROPRIATE SAFEGUARDS FOR THE TRANSFER OF PERSONAL DATA?
When the subprocessing to a member firm of the BDO network implies a transfer of personal data to a third country which does not ensure an adequate level of protection, the transfer is based on EU-approved safeguard: the Binding Corporate Rules (BCRs) of BDO which set out the data privacy principles with which BDO firms must comply when using and sharing personal data within the BDO network.

BDO’s BCRs are available here: https://www.bdo.lu/en-gb/legal-privacy-en/bcrs