Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how CGPH SAS, trading as CGPH Banque d’affaires, processes the personal data of natural persons. CGPH SAS is a société par actions simplifiée with share capital of EUR 5,000,010.00 fully paid-up, registered under RCS Paris 980 746 341, with its registered office at Tour Ariane, 5 Place de la Pyramide, Paris La Défense, 92800 Puteaux, France. CGPH SAS acts as data controller for the processing described here.

For any question, request or complaint concerning this policy, write to privacy@cgphbanquedaffaires.com or to the registered office above, marked for the attention of the Data Protection contact.

We process personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation, and with the French Data Protection Act of 6 January 1978 as amended.

In this policy, “we” and “us” refer to CGPH SAS and the companies of CGPH Group. “You” refers to clients, prospective clients, investors, counterparties, agents, beneficial owners, representatives and visitors to this website.

2. Categories of personal data we process

Identification data. Name, civil status, identity and travel documents, nationality, place and date of birth, signature, and the photograph appearing on an identity document.

Contact and professional data. Email address, telephone number, postal address, employer, job title and professional background.

Corporate and legal data. Powers of attorney, directorships, shareholdings, beneficial ownership positions and corporate representation.

Compliance data. Politically exposed person status, sanctions and adverse media screening results, source of funds and source of wealth information, certificates of incorporation and publicly available records. We process these data exclusively to meet our legal obligations. Where any of this information falls within Article 9 or Article 10 of the GDPR, we process it on the basis of Article 9(2)(g) or Article 10 as applicable, in the substantial public interest of preventing money laundering and terrorist financing.

Financial and suitability data. Income range, estimated net worth, country of tax residence, investment experience and objectives, where you provide them through our investor profile questionnaires.

Technical data. IP address, browser and device information, pages viewed and interaction data collected through cookies and similar technologies, as described in our Cookie Policy.

3. Purposes and legal bases

Performance of a contract or pre-contractual steps, Article 6(1)(b) GDPR. Onboarding, client and investor relationship management, delivery of the advisory services agreed with you, and management of our correspondence.

Compliance with legal obligations, Article 6(1)(c) GDPR. Customer due diligence and ongoing monitoring, screening against international sanctions lists, record keeping, responses to requests from competent authorities, and accounting and tax obligations.

Legitimate interests, Article 6(1)(f) GDPR. Improving our services, conflict-of-interest checks, producing anonymous statistics, securing our systems and premises, defending legal claims, and operating our internal reporting channels. Where we rely on legitimate interests we carry out a balancing assessment, and you may object at any time as described in Section 7.

Consent, Article 6(1)(a) GDPR. Marketing communications and non-essential cookies. We collect consent separately from the acceptance of this policy, through an affirmative opt-in, and you may withdraw it at any time with the same ease with which you gave it.

4. Retention periods

We keep personal data for as long as it serves the purpose for which it was collected, and then for the period required by law.

Accounting records and supporting documents. Ten years from the close of the financial year, in accordance with Article L.123-22 of the French Commercial Code.

Customer due diligence files and transaction records. Five years from the end of the business relationship or from the date of the transaction, in accordance with Article L.561-12 of the French Monetary and Financial Code.

Contractual documentation. Five years from the end of the relationship, extended where a limitation period or a pending proceeding requires it.

Prospect and marketing data. Three years from your last contact with us, after which we ask you to confirm whether you wish to continue receiving our communications.

Video surveillance images, where our premises are equipped. One month from recording, in line with guidance from the French data protection authority.

Internal reports received through our whistleblowing channel. Two months from the close of verification, and until their resolution where proceedings are open.

Website and cookie data. As set out in our Cookie Policy, and in any event thirteen months at most for consent records and fourteen months at most for audience measurement data.

5. Recipients and international transfers

We share personal data within CGPH Group so that you receive coordinated access to the group’s services, and with service providers acting on our instructions under a written agreement compliant with Article 28 of the GDPR. Our categories of providers are website hosting and infrastructure, customer relationship management, email delivery and marketing automation, audience measurement, payment processing, identity verification and compliance screening, and professional advisers.

We also disclose personal data to competent authorities, courts, auditors and correspondent institutions where a legal obligation or the legitimate defence of our rights requires it.

Some of these providers are established outside the European Economic Area, principally in the United States. In that case the transfer takes place on the basis of an adequacy decision, including the EU-US Data Privacy Framework where the provider is certified under it, or on the basis of the Standard Contractual Clauses adopted by the European Commission together with supplementary technical and organisational measures. You may request a copy of the safeguards in place by writing to privacy@cgphbanquedaffaires.com.

6. Security

We apply technical and organisational measures proportionate to the risk. These include encryption of data in transit, multi-factor authentication on our business systems, role-based access limited to personnel whose duties require the data, contractual confidentiality obligations, activity logging, and periodic review of supplier security.

7. Your rights

You have the right to obtain access to your personal data, to request rectification of inaccurate or incomplete data, to request erasure where a legal retention obligation permits it, to request restriction of processing, to receive the data you provided in a structured, commonly used and machine-readable format, to object to processing based on our legitimate interests, and to object at any time to direct marketing including any profiling connected to it. Where processing rests on consent, you may withdraw it at any time, and the lawfulness of the processing carried out beforehand remains unaffected. You may also give directives on the fate of your data after your death, in accordance with Article 85 of the French Data Protection Act.

To exercise these rights, write to privacy@cgphbanquedaffaires.com or to our registered office. We respond within one month, extendable by two further months for complex requests, and we may ask for additional information in order to confirm your identity.

If you consider that your request has not received an adequate response, you have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or with the supervisory authority of your country of residence.

8. Marketing communications

With your prior consent, we send newsletters, market commentary, event invitations and information on our services, and we measure the engagement generated by those communications in order to make them more relevant. Every message includes a one-click unsubscribe link, and you may also write to privacy@cgphbanquedaffaires.com. Where you are an existing client, we may send you information on services similar to those already provided, in accordance with Article L.34-5 of the French Postal and Electronic Communications Code, and you may object at any time.

9. Cookies

Our use of cookies and similar technologies, and the choices available to you, are described in our Cookie Policy.

10. Changes to this policy

We update this policy when our practices or the applicable law change. The version in force carries the effective date shown at the top of this page, and previous versions remain available on request.