Personal data protection policy

Who are we ?

The Association Professionnelle des Courtiers en Assurance au Luxembourg a.s.b.l. (“APCAL” or “we”) collects your personal data on its own behalf, as data controller.

You can reach us via the following contact details:

3, rue des Foyers
L-1537 Luxembourg
Tel. : 00 352 621 17 26 76
E-mail :

Personal data is any information about an identified or identifiable natural person (e.g. a person’s name, photo, telephone number, contract number, password, etc.).

The data controller, in the sense of the European privacy regulation, is the person who determines the purposes and means of processing personal data.

What personal data do we collect?

Only personal data that is strictly necessary for the purposes described below will be processed. Within the framework of our activities and depending on your particular situation, we may process the following data.

  • your identification and contact details;
  • your login on our website;
  • your bank account number ;
  • your annual turnover and membership level

if this information can be linked to a single person; information relating to any training courses you may register for with APCAL; and any other information you provide to us voluntarily.

In some cases, we may use personal data relating to persons other than you, for example, data relating to your employees, legal representatives, shareholders/partners. If you provide us with such data, you undertake to inform the persons concerned and, if the data is data relating to the health of these persons, you undertake to obtain their explicit consent.

Under no circumstances do we process sensitive data.

For what purposes and on what legal basis do we use personal data?

We use your personal information on the basis of our legitimate interest to :

  • to ensure the administrative management of our members;
  • to manage membership fees;
  • to manage our website;
  • to manage our contact list;
  • to manage the training courses we offer;
  • to manage the accounting of our association.

Do we use your personal data to make automated decisions?

We do not use your data for profiling purposes or for making automated decisions. If we decide to do so in the future, we will inform you in advance and explain the logic behind such a decision and the significance and intended consequences of such processing.

Why is it necessary to provide us with your personal data?

If you refuse to provide us with the data requested for certain services (such as membership applications, training, etc.), we may not be able to fulfil your requests.

Who has access to your personal data and to whom is it transferred?

In order to protect your privacy, the persons who are authorised to access your data are precisely determined according to their tasks.

Under no circumstances will we sell your personal data to third parties.

Where do we transfer your personal data?

Under no circumstances will we transfer your personal data outside the European Economic Area (“EEA”).

How long will your personal data be kept?

We will keep your data for as long as :

  • necessary for the achievement of the purposes detailed above, or that ;
  • a legal obligation imposes such retention (e.g. retention of accounting records);
  • the applicable limitation periods will not have expired, in order to ensure that we have the necessary information to protect us from legal action.

What are your rights and how can you exercise them?

As a data subject, you have various rights. Below is a brief description of these rights and how you can exercise them.

Right to information – You can ask us any questions about the storage and processing of your data.

Right of access – You may, at any time, obtain confirmation as to whether or not personal data relating to you are being processed and, if so, access to such data and a free copy thereof. Any additional copies will be provided to you upon prior payment of an administrative fee.

Right to rectification – You may, at any time, by sending us a written request, obtain the rectification of any personal data concerning you that are inaccurate. You can also request that incomplete data be completed.

Right to erasure – You may, at any time, by sending us a written request, obtain the erasure of your personal data, provided one of the following reasons applies:
the data are no longer necessary for the purposes for which they were collected and processed;
you have withdrawn your consent on which the processing was based;
you object to the processing and there is no compelling legitimate reason for it;
the data have been processed unlawfully ;
data must be deleted to comply with a legal obligation.

Right to restriction of processing – Where restriction of processing is granted, personal data may only be processed with the consent of the data subject, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or on important public interest grounds.

You may request the restriction of processing for one of the following reasons:

  • you dispute the accuracy of the personal data;
  • in case of unlawful treatment ;
  • we no longer need your personal data for the purposes of processing, but they are still necessary for the establishment, exercise or defence of legal claims;
  • you have objected to the processing (the processing will be limited for the period necessary to verify the existence of legitimate reasons on our part which would prevail over yours).

Right to object – You have the right to object, at any time by sending us a written request, on grounds relating to your particular situation, to the processing of your personal data for the performance of a task carried out in the public interest or necessary for the purposes of our legitimate interests.
We will no longer process such personal data unless it can be demonstrated that there are compelling legitimate grounds for the processing which override your interests and rights and freedoms, or for the establishment, exercise or defence of legal claims.
Where your personal data is processed for the purpose of prospection, you have the right to object to this processing at any time.

Right to portability – You have the right, by sending us a written request, to receive your personal data provided to us in a structured, commonly used and machine-readable format, and to pass this data on to another controller without us interfering, where:
the processing is based on your consent or on a contract; and
processing is carried out using automated processes.

Right to withdraw consent– Where processing is based on your consent, you have the right to withdraw your consent at any time by sending us a written request. Withdrawal of your consent will not affect the lawfulness of the processing based on consent carried out prior to the withdrawal of consent.

Right to complain – We will use our best endeavours to ensure that we comply with our legal obligations in relation to data protection and to respond as quickly as possible to any complaints made to us in this regard. If you are not satisfied with the response you receive, you have the right to lodge a complaint with the Data Protection Authority.

Commission nationale pour la protection des données
1, avenue du Rock’n’Roll
L-4361 Esch-sur-Alzette
Tel.: +352 26 10 60 -1