Privacy policy

Last updated: 22 January 2026

1. Purpose and Scope

The purpose of this Privacy Policy is to inform, in a clear, transparent and comprehensive manner, any data subject about how C.K. S.A. (“CK”, “we”, or “our company”) collects, uses, stores, shares, and protects personal data in the context of its professional activities, contractual relationships, and the use of its websites. This Policy applies to all personal data processing activities carried out by CK.

2. Legal Basis and Processing Principles

In accordance with Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation – GDPR) and the Luxembourg Law of 1 August 2018, CK undertakes to ensure that all processing of personal data is :

• Lawful: based on one or more of the legal grounds set out in Article 6 of the GDPR (consent, performance of a contract, legal obligation, legitimate interest, etc.);
• Fair and transparent: ensuring that data subjects are informed of the purposes and modalities of the processing of their personal data ;
• Proportionate: limited to what is strictly necessary for the purposes pursued ;
• Accurate and up to date: ensuring that inaccurate data are rectified or deleted ;
• Secure: guaranteeing the confidentiality, integrity, and availability of the personal data collected.

3. Collection and Categories of Personal Data

CK collects only the data necessary for the performance of its business activities and internal organisation. Such data may include, but are not limited to, the following categories:

• Identification and contact data: name, first name, address, email address, telephone number, job title, company ;
• Contractual and commercial data: information relating to subscribed products and services, history of exchanges ;
• Browsing data: IP address, cookies (see our Cookie Policy), connection logs, user behaviour on the website ;
• Application data: CV, cover letter, professional background ;
• Data required for regulatory compliance, in particular within the framework of anti-money laundering and counter-terrorist financing (AML/CFT) obligations.

4. Recipients and Processors

Personal data are processed by authorised personnel of CK and may be disclosed to processors acting on behalf of CK, strictly within the scope of the purposes defined. All CK processors are bound by strict contractual clauses ensuring compliance with the GDPR and providing adequate guarantees in terms of security and confidentiality.

5. International Transfers

CK does not transfer personal data outside the European Economic Area (EEA).

6. Data Retention Period

Personal data are retained for no longer than is necessary for the purposes for which they were collected.

7. Data Breach Management

Any personal data breach or incident must be reported without undue delay to CK’s GDPR responsible at the following address: gdpr@ck.lu.

Incidents are managed in accordance with CK’s internal incident management procedures and, where applicable, notified to the Commission Nationale pour la Protection des Données (CNPD) and to the data subjects within the statutory time limits. Any person has the right to lodge a complaint with the CNPD: https://cnpd.public.lu.

8. Policy Updates

CK reserves the right to amend this Policy at any time. Any updates will be published with the corresponding date of revision.