PRIVACY POLICY
Privacy, Information Governance, and Responsible Data Use
1. Introduction
This Privacy Policy explains how Banque Tank Luxembourg (“we,” “us,” or “our”) may collect, use, store, disclose, and protect personal information in connection with this website and related communication channels.
Banque Tank Luxembourg is presented within the broader Tank Corporation and Tank MDLT Alliance ecosystem. Different services, technologies, websites, applications, and institutional activities may involve different legal entities and service providers. The entity responsible for a particular processing activity will depend on the relevant service, contractual relationship, website, application, or operating arrangement.
This Privacy Policy is intended to explain our general approach to privacy, personal data protection, information governance, and responsible data use.
Where the General Data Protection Regulation (EU) 2016/679 (“GDPR”) or other applicable data protection laws apply, personal information will be processed in accordance with the requirements applicable to the relevant processing activity.
2. Information We May Collect
Depending on how you interact with our website or services, we may process the following categories of information:
Information Provided Directly by You
- Full name & Contact details (email, telephone number)
- Organization, company, country, or jurisdiction
- Professional information & Inquiries
- Information provided when requesting institutional or private-client information
- Other voluntarily submitted data through our communication channels
Technical & Usage Information
- IP address & Device parameters
- Browser and operating-system information
- Date, time of access, and pages visited
- Referring website, technical logs, and security data
- Approximate location derived from technical parameters
Identity and Access Information
Where digital identity, authentication, onboarding, or access technologies are used, relevant information may be processed for authentication, verification, security, access management, and related purposes.
Where applicable, e-CIS ID may serve as a digital identity and verification layer within participating environments of the Tank MDLT ecosystem. Such processing may be subject to separate terms, privacy notices, consent mechanisms, and contractual arrangements applicable to the relevant service.
We seek to limit the collection of identity information to what is necessary for the relevant purpose and permitted under applicable law.
3. Purposes of Processing
Personal information may be processed for purposes including:
Communication & Relationships
- Responding to inquiries and communication requests
- Managing institutional and partnership discussions
- Providing requested information concerning our ecosystem and initiatives
- Managing private-client or institutional relationships where applicable
Security & Infrastructure
- Supporting onboarding, authentication, and authorized access
- Maintaining website and information-system security
- Preventing fraud, misuse, unauthorized access, or security incidents
- Operating, maintaining, and improving digital infrastructure
Governance & Statutory Duties
Supporting internal administration, governance, due diligence, compliance, risk-management processes, and meeting applicable legal, regulatory, accounting, and recordkeeping obligations while protecting our rights, property, and legitimate interests.
4. Legal Bases for Processing
Where the GDPR applies, personal information will be processed on an appropriate legal basis under applicable law. Depending on the circumstances, the legal basis may include:
- Performance of a contract: Or steps taken at an individual’s request before entering into a contract.
- Compliance with a legal obligation: Meeting statutory, regulatory, or legal mandates.
- Legitimate interests: Where applicable and where those interests are not overridden by individual rights and freedoms.
- Consent: Where consent is required or selected as the applicable legal basis.
- Protection of vital interests: Where legally applicable.
5. Data Sharing and Service Providers
We may share personal information with service providers, professional advisers, technology providers, and other counterparties where reasonably necessary for legitimate and documented purposes.
Personal information should be shared only to the extent reasonably necessary and, where required, subject to appropriate contractual, confidentiality, security, and data-protection requirements (such as Data Processing Agreements).
We do not intend to sell personal information to third parties. Information may also be disclosed where required by applicable law, court order, lawful governmental or regulatory request, or other legally binding obligation.
6. International Data Transfers
The Tank ecosystem may involve entities, professional advisers, technology providers, infrastructure, and service providers located in different jurisdictions. As a result, personal information may, where necessary and legally permitted, be processed or transferred outside the European Economic Area (“EEA”).
Where the GDPR applies, transfers of personal information outside the EEA will be conducted in accordance with applicable requirements under Chapter V of the GDPR using mechanisms such as:
Adequacy Decisions
Transfers to countries recognized by the European Commission as offering an adequate level of data protection.
Standard Contractual Clauses (SCCs)
Standardized data protection clauses adopted by the European Commission to secure international transfers.
BCRs & Statutory Derogations
Binding Corporate Rules or specific statutory derogations applicable to explicit operational circumstances.
7. Data Retention
Personal information will generally be retained only for as long as reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by applicable law. Retention periods depend on the nature of information, purpose of processing, contractual obligations, accounting standards, dispute-resolution needs, and fraud-prevention requirements.
8. Data Security
We seek to implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss, misuse, or destruction, including:
* No internet transmission or electronic storage system can be guaranteed to be completely secure. Users should exercise appropriate caution when transmitting sensitive information through digital channels.
9. e-CIS ID, Digital Identity, and Connected Services
Certain activities within the broader Tank MDLT ecosystem may incorporate e-CIS ID, a digital identity and verification infrastructure designed to support secure identity, authentication, credentials, and access across participating environments.
Where e-CIS ID is used, data processing may encompass identity verification, KYC/KYB checks, system access, credentials issuance, consent management, and institutional onboarding. The use of e-CIS ID does not eliminate the independent statutory compliance obligations of participating organizations.
10. Individual Rights
Depending on applicable law and circumstances (including under the GDPR), individuals may exercise specific rights regarding their personal data:
Right to Access & Information
The right to be informed about data processing and request copies of personal information held.
Rectification & Deletion
The right to correct inaccurate data or request deletion (“right to be forgotten”) where applicable.
Restriction, Objection & Portability
The right to restrict processing, object to specific processing activities, or request data portability.
Consent Withdrawal & Complaints
Withdraw consent at any time or lodge a complaint with a competent Supervisory Data Protection Authority.
11. Cookies, Third Parties & Data Governance
Cookies & Similar Technologies: This website may use cookies for essential functionality, security, user preferences, and analytics. Where required by law, appropriate consent mechanisms are provided.
Third-Party Links: We are not responsible for the privacy practices, content, or security of third-party platforms linked from our site. Users should review third-party privacy notices independently.
Data Governance: We maintain internal processes including privacy assessments, access controls, processor oversight, and cross-border assessments to ensure responsible information governance.
14. Changes to This Privacy Policy
This Privacy Policy may be updated periodically to reflect changes in our activities, technology, regulatory requirements, or organizational arrangements. Revised versions will be published on this website with an updated Last Updated date.
15. Contact Information
Responsible Entity & Privacy Channels
Entity: Banque Tank Luxembourg
Address: [REGISTERED ADDRESS]
Privacy Contact: [PRIVACY EMAIL ADDRESS]
Data Protection Officer (DPO): [IF APPLICABLE]
Requests concerning a specific financial, digital identity, technology, or other service may be directed to the legal entity responsible for that service.