Privacy Notice

Capital-Hill Securities S.à r.l. ("Capital-Hill", "we", "us", "our") is a company incorporated under the laws of the Grand Duchy of Luxembourg, with registered office at 20 Rue des Peupliers, L-2328 Luxembourg, registered with the Luxembourg Trade and Companies Register under number B288440.

We are the data controller responsible for your personal data collected through this website and in connection with our services. This notice explains what data we collect, why we collect it, how long we keep it and what rights you have under Regulation (EU) 2016/679 (the "GDPR") and Luxembourg data protection law.

Data you provide. When you use our contact form, we collect your first name, last name, email address and the content of your message, together with your confirmation that you are a professional investor and the date and time of your consent. If you opt in to our newsletter, we store your email address for that purpose.

Data collected automatically. Subject to your consent given through the cookie banner, we process technical data such as your IP address, browser type and version, device type, pages visited, referring page and time spent on the site.

We do not knowingly collect personal data from persons under 18, and we do not process special categories of personal data within the meaning of Article 9 GDPR.

We use your personal data to respond to your enquiry and to communicate with you about our issuance and structuring services; to send you our newsletter where you have opted in; to understand how our website is used and improve it; and to comply with our legal, regulatory and anti-money-laundering obligations where a business relationship arises.

We do not sell your data, we do not use it for automated decision-making producing legal effects, and we do not profile you across other websites.

We rely on Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and Article 6(1)(f) GDPR (our legitimate interest in responding to enquiries and in operating and securing our website) for correspondence and site operation; on Article 6(1)(a) GDPR (your consent) for the newsletter; on Article 6(1)(f) GDPR (our legitimate interest in understanding how the website is used) for cookieless, aggregated audience measurement; and on Article 6(1)(c) GDPR (compliance with a legal obligation) where regulatory requirements apply.

Your data is accessed by our staff on a need-to-know basis and by service providers acting as processors on our behalf: our website hosting and form provider, our email provider and our analytics provider, Cloudflare, Inc. (United States), which provides Cloudflare Web Analytics. Each acts under a data processing agreement meeting the requirements of Article 28 GDPR.

We may also share data with our professional advisers (legal, audit, compliance) or with competent authorities where required by law. We do not sell or rent your data and we do not share it with third parties for their own marketing purposes.

Where personal data is transferred outside the European Economic Area, appropriate safeguards are in place, such as the European Commission’s Standard Contractual Clauses.

Contact enquiries are kept for as long as necessary to handle your request and any follow-up, and no longer than 24 months after our last contact, unless a business relationship arises, in which case retention periods under applicable commercial, tax and anti-money-laundering legislation apply.

Newsletter data is kept until you unsubscribe; every newsletter contains an unsubscribe link. Records of consent are retained for as long as necessary to demonstrate compliance.

Under the GDPR you have the right to request access to your personal data, to obtain its rectification or erasure, to request restriction of processing, to object to processing carried out on the basis of our legitimate interests, and to receive your data in a structured, commonly used and machine-readable format (data portability).

Where processing is based on consent, you may withdraw that consent at any time with effect for the future, without affecting the lawfulness of processing carried out before the withdrawal. We respond to requests within one month, as required by Article 12 GDPR.

To exercise your rights, contact us at info@capitalhill.lu. You also have the right to lodge a complaint with the Luxembourg supervisory authority, the Commission nationale pour la protection des données (CNPD, www.cnpd.lu).

Strictly necessary cookies allow the website to function and are set without consent. We do not use analytics cookies. Audience measurement is carried out with Cloudflare Web Analytics, which does not set cookies and does not store IP addresses or other personal data. It records only aggregated statistics, such as pages visited, referring sites, country and device type.

You may change or withdraw your cookie choices at any time through the banner, and you can delete existing cookies through your browser settings. We do not use advertising or profiling cookies that track you across other websites.

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or disclosure, including encryption of data in transit (HTTPS), access controls limiting internal access to those who need it, and the use of established providers subject to contractual security obligations.

We may update this notice to reflect changes in our practices or in applicable law. The version in force is the one published on this page, and the date shown above indicates when it was last updated.

If you have any questions about this Privacy Notice or how we handle your personal data, please contact us at:

Capital-Hill Securities S.à r.l.
20 Rue des Peupliers, L-2328 Luxembourg
info@capitalhill.lu