Data protection means above all protecting the trust you place in our company. For this reason we only process data relating to you when this is necessary. At the same time, we exercise the necessary diligence, not least in order to protect you from possible abuse.

With this Privacy Statement we wish to provide you with an overview of the processing of your data and your rights in accordance with the provisions of the General Data Protection Regulation (hereinafter called “GDPR”) and the Liechtenstein Data Protection Act (Datenschutzgesetz, hereinafter called “DSG”):

1. Name and address of the data controller

The data controller within the meaning of the GDPR is Consilia Anstalt, Pflugstrasse 20, 9490 Vaduz, Liechtenstein, info@gantengroup.com, Tel.: +423 388 28 88.

Our Data Protection Officer can be contacted under datenschutz@gantengroup.com using the subject line “Data Protection” or under our postal address with the supplement „The Data Protection Officer”.

2. Collection and saving of personal data as well as the nature and purpose of its use, legal principles

We process only the necessary data, which may differ depending on the group of persons concerned.

If you contact or commission us, we collect in particular the following information:

• Client name and address data (name, date of birth, private and business address, nationality, occupation, telephone number, e-mail address);
• Legitimation data (identification documents, including copies of passports or ID cards, utility bills, tax numbers, authentication data, including specimen signatures);
• Relevant due diligence data (contracting partners, identification of the beneficial owners, profile of the business relationship with information about the professional and personal background such as occupation and hobbies, World-Check data, investigations pursuant to SPG);
• Client information (company documents, bank documents, correspondence, SPG documents, tax data, governing body resolutions);
• Accountancy data (transaction and accounting information);
• Correspondence;
• Legal entity data (articles, bylaws, certificates, mandate agreements, signatory authorisations);
• Tax reporting data (FATCA, AEOI, LDF reports).

The purpose of the collection of this data is:

• to enable us to identify you as our client;
• to conduct correspondence with you;
• to enable us to advise you appropriately, to provide our services or to fulfil our mandate with you or third parties (mandate management, auditing function, fulfilment of statutory and voluntary accounting obligations);
• to fulfil legal obligations (in particular those arising out of the Liechtenstein Persons and Companies Act, the Law Governing the Professional Trustees and Fiduciaries, the Due Diligence Act, tax laws and treaties);
• for invoicing purposes.

The data processing is performed on the grounds of your enquiry, and pursuant to Art 6 Para. 1 lit b GDPR is required for the aforementioned purposes (fulfilment of a legal agreement or to conduct pre-contractual measures) for the reasonable handling of our commission and for the reciprocal fulfilment of obligations arising out of the client relationship.

Your data is also processed in order to fulfil legal obligations (Art. 6 Para. 1 lit. c GDPR) or in the public interest (Art. 6 Para. 1 lit. e GDPR), in particular in order to adhere to statutory and supervisory requirements (e.g. DSG, the Law Governing the Professional Trustees and Fiduciaries, due diligence, money laundering and market abuse provisions, tax laws and tax treaties).

In addition, your data is processed to safeguard legitimate interests of us or of third parties (Art. 6 Para. 1 lit. f GDPR) for specific defined purposes, in particular processing for internal administrative purposes, to fulfil a contract with a third party, to ensure IT security and operation and, if necessary, building and plant security and to defend against unjustified claims.

We also reserve the right to continue processing personal data that was collected for one of the aforementioned purposes for the other purposes, if this is compatible with the original purpose or is permitted or required by statutory provisions (e.g. any possible reporting obligations).

3. Recipients or categories of recipients of the personal data

Within our company, employees may process your data only insofar as they require this to fulfil our contractual, statutory and supervisory obligations as well as to protect legitimate interests. For these purposes, third parties may also receive personal data, including banks, asset managers, insurance companies, lawyers, auditors, traders, transport companies or other cooperation partners or also processors, for example in the field of IT services.

Your personal data will be transferred to third parties solely insofar as this is necessary to render our services.

If we have to fulfil legal or supervisory obligations, the following bodies in particular may receive personal data:

• Official agencies and public bodies (e.g. supervisory authorities, courts);
• Tax authorities;
• Third country authorities or international organisations.

4. Transfer of personal data to third party states

When we transfer the personal data of clients to another country, this is protected and transferred in accordance with the statutory provisions. A transfer of data outside the European Economic Area shall be performed with the following guarantees:

• The country to which we send personal data provides an adequate level of protection for personal data, according to the European Commission;
• The transfer is necessary to carry out pre-contractual measures or to fulfil a contract, or you have given us your express consent (e.g. within the context of special services), or the transfer is necessary for important reasons of public interest or is required by law;

5. Origin of the data

The data is collected directly (for example during meetings or in the course of correspondence with clients; internal background and due diligence checks) and in some cases by third party service providers (e.g. banks), from publicly available sources or from other data subjects.

6. Storage period for personal data

The personal data collected by us for the commission shall essentially be processed until the expiry of the statutory retention obligation (usually 10 years) and then deleted, unless we are required to store the data for a longer period pursuant to Art. 6 Para. 1 lit. c GDPR, we deem it necessary to store the data for a longer period of time due to tax, company or supervisory retention and documentation obligations (in particular those arising out of PGR, SPG or SteG/MwStG), or you have consented to storage beyond this period pursuant to Art. 6 Para. 1 lit. a GDPR. Further processing and retention may also be extended for evidential reasons, such as for example throughout the duration of applicable statutory limitation regulations.

7. Automated decision-making

No automated decision-making takes place with the personal data of clients. If such procedures are used in individual cases, we shall inform you to the extent provided for by law.

8. Necessity of the data (Art. 13 Para. 2 Letter e GDPR)

We absolutely need the data listed under Fig. 2 in order to be able to offer you our services to the extent you have requested and in compliance with the statutory obligations. In addition to any statutory reporting obligations to the competent supervisory authorities, failure to provide such information shall result in the non-establishment or termination of the business relationship.

9. Your data protection rights

In your capacity as a client or in general as a data subject, you are entitled at any time – while the fiduciary’s duty of confidentiality continues to be safeguarded – to be informed about your personal data, in particular its origin and recipients as well as the purpose of the data processing. You also have the right to rectification, data portability, to object, to restrict the processing or to erase incorrect or improperly processed data.

We kindly ask you to inform us in the event of changes to your personal data.

You have the right to revoke any issued consent to use your personal data at any time. The assertion of your right to access, erasure, rectification, objection and/or data portability may be submitted to the address listed under Fig. 1 of this Statement.

If you believe that the processing of your personal data by us is in breach of applicable data protection law or your data protection rights have been infringed in any other way, you have the right to lodge a complaint with a supervisory authority, in particular in the EEA state of your place of residence, place of work or the place of the alleged infringement. The Data Protection Authority in Liechtenstein is responsible for this.

10. Valid version

This Privacy Statement is currently valid and its version is April 2022.

Due to the continued development of our website and associated services or organisational changes within the fiduciary company, or on the grounds of amended statutory or official provisions, it may be necessary to amend this Privacy Statement. You can access and print out the respective current Privacy Statement from the website at any time.

Valid version of April 2022