Data Privacy

The confidentiality, and thus the security, of your data is of great importance to Creutz & Partners. We have therefore implemented appropriate technical and organisational measures to ensure the security of your data and to protect them from unlawful processing.

Creutz & Partners The Art of Asset Management S.A. Privacy Policy for using our websites, the CP NVST app and our social media presences

The confidentiality and therefore also the security of your personal data is very important to Creutz & Partners The Art of Asset Management S.A. (hereinafter "Creutz & Partners" or "we"). Pursuant to Article 4, point 1 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the "General Data Protection Regulation, GDPR"), personal data means any information relating to an identified or identifiable natural person ("data subject"). We have therefore taken suitable technical and organisational measures to guarantee the security of your personal data and to protect these against unlawful processing.

1. Where does this Privacy Policy apply?

This Privacy Policy applies to the processing of personal data of users of this and other websites managed by Creutz & Partners (e.g. www.creutz-partners.com and www.cp-nvst.com), users of the CP NVST app and visitors to the social media profile of Creutz & Partners, Creutz (&) Friends, CP NVST and employees acting on behalf of Creutz & Partners.

It explicitly does not apply to any processing of personal data that is performed when you visit third-party websites which this or other websites of Creutz & Partners may direct you to.

2. Who is the data controller and who can I contact?

The data controller responsible for the processing and storage of your personal data is:

Creutz & Partners The Art of Asset Management S.A.

18, Duarrefstrooss

L-9944 Beiler

Tel.: +352 978 22 11

E-mail: info@creutz-partners.com

Website: www.creutz-partners.com

3. What are the different data processing activities?

Below, we explain what data processing activities are performed whenever you use our websites, the CP NVST app or social media. We also clarify which personal data are collected and processed in this context, the legal basis for this processing, the purpose of the processing, how long your data are stored for and who has or will gain access to your data.

3.1 Visiting our website(s)/Log files

Every time a user accesses our websites, general information about this process is generated automatically and stored temporarily in a so-called server log file. We use this information in anonymous, aggregated or pseudonymised form such that it is not possible for us to identify you as a user.

We may collect the following information, in particular:

Your IP address (anonymised);
Information about the websites you have visited before visiting our website;
Information on the browser, network or device you are using (e.g. browser type and version, operating system, internet provider, device ID);
Information on interactions with our websites (e.g. clicks, scrolling, length of visit, page loading time or any issues such as errors when loading pages).

The legal basis for the temporary storage of these data and the log files is our legitimate interest pursuant to Article 6(1), point (f) GDPR. Temporary storage of your IP address is necessary in order that we can make our website available on your device. To do this, the user's IP address must be stored for the duration of the session. The storage of data in log files ensures the functionality of the website. We also use the data to optimise our websites and to guarantee the security of our systems. These purposes are also based on our legitimate interest in data processing pursuant to Article 6(1), point (f) GPDR. Data are not evaluated for marketing purposes in this context.

Users may not object to data processing insofar as it is absolutely necessary to collect data in order to make the websites available and to store data in log files in order to run the websites securely.

Data are erased as soon as they are no longer necessary for the purposes, for which they were collected. Where data are collected in order to make the website available, these data are erased once the session in question ends. Data that are stored in log files are generally stored for no longer than 7 or 14 days. Data may also be stored in log files for a longer period of time in some cases, e.g. in the event of a cyber-attack, in order to retain evidence, or where this is legally required.

3.2 Use of cookies

Our websites use cookies. Cookies are small text files which allow us to store certain information on your end device (e.g. PC, smartphone, tablet) concerning you and your use of our websites. Cookies cannot execute programs or transfer viruses to your computer. Cookies cannot run programs or transmit viruses to your computer. They are used to make our internet presence overall more effective and user-friendly.

In their basic configurations, our websites only use technically necessary cookies. Necessary cookies help use make our websites usable by facilitating basic functions like page navigation and access to secure areas of the website. For this reason, necessary cookies cannot be deactivated by changing the cookie settings for our website.

Our websites also use marketing cookies, provided you consent to and activate these. The purpose of marketing cookies is to help us better adapt our offering to user needs by tracking user behaviour.

More detailed information on the processing of personal data through the use of cookies on our websites, including necessary cookies, can be found in the corresponding Cookie Policy on the website.

Please note that as a user, you have full control over the use of cookies (including necessary cookies). You can change the settings in your internet browser to allow, disable or restrict the use of cookies. You can also delete previously used cookies at any time.

3.3 Use of Matomo analysis tool (formerly Piwik)

We use the open-source software tool Matomo (https://matomo.org) on www.creutz-partners.com and www.cp-nvst.com. Matomo is a web analysis service that allows us to analyse the browsing behaviour of users of our websites with the help of statistics generated using data collected through cookies. We use the findings of these statistical analyses solely for the purposes of improving our websites and making them more interesting for you as a user.

More information on the cookies used by Matomo can be found in our Cookie Policy for the websites www.creutz-partners.com and www.cp-nvst.com at the following link:

https://www.creutz-partners.com/en/creutz-und-partners/privacy-statement and https://cp-nvst.com/en/creutz-und-partners/privacy-statement

a) What personal data do we process?

The following personal data are processed as a result of our use of Matomo:

Information on user location (country, region, city);
IP address, whereby this is anonymised, meaning we are not permitted to identify you as a user;
Information on which web browser you are using;
Information on the end device and operating system you are using;
Information on the pages accessed (URL, plus screen resolution and time zone used);
URL of previously visited pages;
Date and time of visit;
Clicks on links to an external domain;
Information on which files are clicked on and downloaded.

b) What is the legal basis for the data processing?

The legal basis for processing data as a result of using Matomo is your consent pursuant to Article 6(1), point (a) GDPR because you must explicitly consent via our cookie banner or must explicitly activate Matomo via your cookie settings.

You can withdraw your consent at any time by changing your cookie settings to prohibit and thus disable the use of statistical cookies.

c) Who receives my data?

Only relevant employees of Creutz & Partners have access to data collected and processed through the use of Matomo.

d) How long are my data stored for?

We store personal data collected through Matomo for a period of no more than 10 years.

3.4 Contact requests

The websites www.creutz-partners.com and www.cp-nvst.com give you the option of getting in touch with us via a contact form. You can also get in touch via our e-mail address (info@creutz-partners.com), postal address or by phone (+352 978 22 11). We require your contact details in order to respond to your enquiry.

a) What personal data do we process?

We may collect and process the following personal data in this context:

Surname and first name;
Address;
E-mail address;
Telephone no;
Any other personal information you provide us with.

b) What is the legal basis for the data processing?

Processing of data provided in the context of a contact request is performed on the basis of the legitimate interest of Creutz & Partners in processing your request (Article 6(1), point (f) GDPR) and, insofar as you have given us your consent to use your contact details to respond to you (in particular if you use the contact form), on the basis of your consent (Article 6(1), point (a) GDPR). You may withdraw your consent at any time. However, if you do this it may not be possible for us to process your request and respond to you. For more information, please see Sec. 6(c).

If you are contacting us with a view to concluding a contract with us, data processing is also based on Article 6(1), point (b) GDPR.

c) Who receives my data?

Those employees of Creutz & Partners who are responsible for responding to your request have access to the personal data you transmit to us within your contact request.

d) How long are my data stored for?

Personal data which you transmit to us within your contact request are generally used solely with respect to processing your request and are not stored beyond this.

Your personal data will only be stored and processed further if we establish a business relationship with you following your contact request. In this case, our general Privacy Policy applies.

3.5 Registering with the CP NVST app

Investors in C&P Funds sub-funds can set up log-in details for the CP NVST app. The CP NVST app allows investors to view their current portfolios at any time and to receive notifications and confidential documents to their e-mail inbox.

a) What personal data do we process?

When you use the CP NVST app, the following personal data may be collected and processed:

Log-in details (username and password);
First name and surname;
E-mail address;
Mobile number;
CP NVST registration number;
Data on fund holding (number of shares and purchase prices);
Session data.

b) What is the legal basis for the data processing?

Data are processed on the basis of your consent and in order to execute a contract which you are a party to (Article 6(1), points (a) and (b) GPDR).

You may withdraw your consent at any time. However, if you do this you will no longer be able to use the CP NVST app. For more information, please see Sec. 6(c).

c) Who receives my data?

Employees of Creutz & Partners, in particular, have access to your personal data.

The host of the CP NVST app, "Computer Task Group Luxembourg PSF S.A." with registered office at L-8070 Bertrange, Zone Industrielle de Bourmicht 10A, registered with the Registre de commerce et des sociétés under no. B56109, also has access to the data indicated under a).

Furthermore, your personal data may be passed on to third parties if this is necessary in order to fulfil our contractual obligations or if we are legally required to do so. Subject to these conditions, recipients of personal data may include:

Public bodies and institutions (in particular the CSSF, the CRF or tax and financial authorities);
Other credit and financial services institutions (in particular Edmond de Rothschild (Europe) and Edmond de Rothschild Asset Management).

d) How long are my data stored for?

In accordance with statutory retention obligations, your personal data are erased 10 years after the ending of our business relationship. In exceptional cases, e.g. in the case of a legal dispute or with respect to retaining evidence, personal data may be stored for a longer period of time, up to a maximum of 30 years.

3.6 Data processing in the context of social media

We maintain online presences on social networks in order to provide information about ourselves or to communicate with social network users, in particular.

Please remember that, generally speaking, your use of our social media pages and their functions is under your own responsibility. This applies in particular to the use of interactive functions (e.g. commenting, sharing, rating).

Below you will find information on the processing of personal data in the context of visiting or interacting with our social network pages.

3.6.1 Facebook

Facebook is a social network operated by the American internet group Meta Platforms Inc., with registered office in California, which is intended to allow users to engage with other people and share content with them.

Meta Platforms Ireland Limited (hereinafter "Meta") is responsible for the processing of personal data concerning persons in the EU, the European Economic Area or Switzerland. Information on how to contact Meta can be found in the Meta Privacy Policy via the following link: https://www.facebook.com/privacy/policy?section_id=13-HowToContactMeta.

A. Data processing when interacting with our Facebook page

Our Facebook page (https://www.facebook.com/creutzpartners/) gives you the option of reacting to and commenting on our posts or sending us a private message.

Within this context, we have access not only to the information you send us but also to personal data which – depending on your profile's privacy settings – may also be available to other Facebook users. However, we primarily use these data exclusively for interacting with you or responding to your concern. Furthermore, we may also process these data insofar as we may share or comment on your posts or publish our own posts which make reference to your profile. In this way, information which you freely publish and disseminate on Facebook is made available to our followers as well.

The controller responsible for data processing in this context is Creutz & Partners exclusively.

Generally speaking, we do not store or process data any further.

a) What personal data do we process?

We may process the following personal data in this context:

Name and surname, or name used on your Facebook profile;
Your reactions to our posts (e.g. likes, comments or shared content);
Any other personal information which you make freely available on your profile (e.g. information on friends, pages you follow or groups you are a member of) or which you share with us (e.g. address, e-mail address or telephone number).

b) What is the legal basis for the data processing?

The permissibility of data processing is based on Article 6(1), point (f) GDPR, according to which processing is lawful if it is necessary in order to preserve the legitimate interests of Creutz & Partners except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. Our legitimate interest consists in providing you with a platform where we can show you the latest information and communicate with you.

c) Who receives my data?

Only those employees of Creutz & Partners who also have access to our Facebook page have access to your personal data.

We do not pass on data to third parties.

d) How long are my data stored for?

Your data are used exclusively in the context of interactions with you via the social network or with a view to responding to your query. We do not store or process data any further.

B. Data processing for statistical purposes (Facebook Insights data)

Facebook processes a number of pieces of personal data concerning page visitors for its own purposes as part of its so-called Page Insights. This processing occurs regardless of whether or not visitors to a page are logged in to Facebook and whether or not visitors to a page are members of the Facebook network.

Page Insights are collated statistics which are generated during certain "Events" which are logged by the Facebook servers whenever people interact with pages and associated content.

As the owner of a page, we have no influence over the collection of such page statistics and cannot prevent such from being generated in the context of running our Facebook page. In particular, we do not set any parameters or otherwise issue any instructions to Meta to process personal data in a certain way in order to generate page statistics.

Because you trigger the processing of your personal data by Facebook Insights simply by accessing our Facebook page, the controller responsible for data processing within the meaning of Article 26 GDPR is Creutz & Partners and Facebook/Meta Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4 Ireland jointly.

Creutz & Partners has therefore concluded an agreement with Meta which sets out, among other things, the duties of each controller (https://www.facebook.com/legal/terms/page_controller_addendum). It has been determined in this regard that only Meta may make and implement decisions regarding the processing of Insights data. Creutz & Partners' contribution to decisions on the means and purposes of processing of Insights data is therefore limited to the aims of managing or promoting our activities in relation to the running of our Facebook page, for the purposes of which we may evaluate the page statistics provided to us by Meta based on Insights data.

a) What personal data do we process?

To find out what information exactly is contained in the statistics available to us regarding our Facebook page, please refer to the information provided by Meta via the following link: https://www.facebook.com/business/pages/manage#page_insights.

Information includes data on reach, page visits, length of visit, likes, shared and commented content, and demographic information on age, gender and location. In principle, the data used by Meta are provided to us in anonymised form only. This means that we are unable to use these statistics to identify those persons who have triggered these events. However, if your "Like" settings are configured to be public, we may be able to attribute this information to your profile.

Information on the data which Meta uses to generate the page statistics we use can be found via the following link: https://www.facebook.com/legal/terms/information_about_page_insights_data.

Please note that Meta processes data in order to generate page statistics when you visit our Facebook page even if you do not have a Facebook profile or are not logged in. The data Meta processes here may include your IP address, the type of browser used, your operating system or your location.

b) What is the legal basis for the data processing?

The permissibility of processing Insights data is based on Article 6(1), point (f) GDPR, according to which processing is lawful if it is necessary in order to preserve the legitimate interests of Creutz & Partners except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. Our legitimate interest consists in evaluating the anonymised Insights data in order to track user behaviour on our Facebook page and consequently optimise the offering of this page.

With respect to Meta's processing of Insights data, we assume that such processing is performed for reasons relating to the fulfilment of contractual services relating to the contract concluded between you and Meta concerning the terms of use of the Facebook platform. The legal basis is consequently Article 6(1), point (b) GDPR.

In the event that you are not logged in to Facebook or are not a member of the Facebook network, we assume that Meta is permitted to process your data on the basis of a legitimate interest pursuant to Article 6(1), point (f) GDPR.

More information on the legal basis for Meta's data processing can be found via the following links: https://www.facebook.com/privacy/policy?section_id=7-WhatIsOurLegal and https://www.facebook.com/about/privacy/legal_bases.

c) Who receives my data?

Only those employees of Creutz & Partners who also have access to our Facebook page have access to your personal data.

We do not pass on data to third parties.

As the platform provider, Facebook/Meta also has access to your personal data and transmits these to third parties. More information can be found in the Facebook Privacy Policy via the following link: https://www.facebook.com/privacy/policy?section_id=4-HowDoWeShare.

Furthermore, Facebook may transfer your data to third countries, i.e. countries which are not Member States of the European Union or Contracting Parties of the EEA Agreement, in particular the USA where Meta Platforms Inc. has its registered office. The transfer of data to the USA is based on the adequacy decision of the EU Commission (Implementing Decision (EU) 2023/1795 of 10 July 2023) since Meta is a member of the EU-U.S. Data Privacy Framework and is certified accordingly. More information on when Facebook transfers data to third countries can be found in the Facebook Privacy Policy via the following link: https://www.facebook.com/privacy/policy?section_id=9-HowDoWeTransfer.

d) How long are my data stored for?

The page statistics provided to us by Meta are based on Insights data for a period of two years. We do not store or process these data outside of Facebook.

Insofar as Meta stores the data, on which the Page Insights are based, this storage is in line with the provisions of the Facebook Privacy Policy and the Facebook Terms of Use. More information can be found via the following link: https://www.facebook.com/privacy/policy?section_id=8-HowLongDoWe.

C. General information on data processing at Meta

Please note that whenever you use Facebook, Meta processes other data concerning you in addition to the personal data described here in order to generate page statistics.

Generally speaking, Meta collects and processes in particular that data which you have provided to Meta via the information in your Facebook profile, e.g. date of birth, e-mail address, telephone number etc. Furthermore, Meta also processes information on how you interact with our Facebook profile, e.g. what you click on or what you "Like".

When you visit our Facebook profile, Meta may process data such as your IP address, the browser type you are using, your operating system or your location, even if you have not set up a Facebook profile or you are not logged in.

Creutz & Partners has no influence over this data processing and this processing is the sole responsibility of Facebook/Meta.

Information on Meta's general data processing can be found in the Facebook Privacy Policy via the following link: https://www.facebook.com/privacy/policy.

This Privacy Policy contains information on the categories of personal data which are processed when you use Facebook, the purposes of processing, the legal basis, the categories of recipients who your data may be provided to, your rights and the duration of processing.

D. Information on use of cookies by Meta

If your browser allows the storage of cookies, we would like to also make you aware that Meta will place cookies in your browser's cache any time you visit our Facebook page, meaning that Meta is able to access personal data when you visit the Facebook platform or a website where Meta technologies have been embedded.

Meta can use these cookies to track your behaviour on other websites outside of the Facebook platform. This applies to both registered and non-registered users of the Facebook platform.

Creutz & Partners has no influence over the use of cookies and Meta's processing of data in this regard. Consequently, the sole controller responsible for data processing is Meta.

A detailed overview of the cookies which Meta uses and further information on the purpose of this and what options you have for limiting this can be found in the Facebook Cookie Policy via the following link: https://www.facebook.com/privacy/policies/cookies/.

Furthermore, it is still possible to visit our Facebook page even if you have configured your browser not to accept any cookies from the Facebook platform. Information on how to change the cookie settings in your browser can usually be found in the Help section or in the settings of the browser you are using.

If you are registered with the Facebook platform or are logged in and do not want Meta to be able to link your visit to our Facebook page to your user account, you should log out of Facebook or disable the "Stay signed in/Remember me" function, delete the cookies stored on your device and then close and relaunch your browser.

3.6.2 Instagram

Instagram is a social network focused on sharing photos and videos which is operated by the American internet group Meta Platforms Inc., with registered office in California.

A. Data processing when interacting with our Instagram page

Our Instagram page (https://www.instagram.com/creutz_partners/) gives you the option of reacting to and commenting on our posts or sending us a private message.

Within this context, we have access not only to the information you send us but also to personal data which – depending on your profile's privacy settings – may also be available to other Instagram users. However, we primarily use these data exclusively for interacting with you or responding to your concern. Furthermore, we may also process these data insofar as we may share or comment on your posts or publish our own posts which make reference to your profile. In this way, information which you freely publish and disseminate on Instagram is made available to our followers as well.

The controller responsible for data processing in this context is Creutz & Partners exclusively.

Generally speaking, we do not store or process data any further.

a) What personal data do we process?

We may process the following personal data in this context:

Name and surname, or name used on your Instagram profile;
Your reactions to our posts (e.g. likes, comments or shared content);
Any other personal information which you make freely available on your profile (e.g. information on pages or people you follow) or which you share with us (e.g. address, e-mail address or telephone number).

b) What is the legal basis for the data processing?

c) Who receives my data?

Only those employees of Creutz & Partners who also have access to our Instagram page have access to your personal data.

We do not pass on data to third parties.

d) How long are my data stored for?

Your data are used exclusively in the context of interactions with you via the social network or with a view to responding to your query. We do not store or process data any further.

B. Data processing for statistical purposes (Instagram Page Insights)

Instagram processes a number of pieces of personal data concerning page visitors for its own purposes as part of its so-called Page Insights. This processing occurs regardless of whether or not visitors to a page are logged in to Instagram and whether or not visitors to a page are members of the Instagram network.

Page Insights are collated statistics which are generated during certain "Events" which are logged by the Instagram/Meta servers whenever people interact with pages and associated content.

As the owner of a page, we have no influence over the collection of such page statistics and cannot prevent such from being generated in the context of running our Instagram page. In particular, we do not set any parameters or otherwise issue any instructions to Meta to process personal data in a certain way in order to generate page statistics.

Because you trigger the processing of your personal data by Page Insights simply by accessing our Instagram page, the controller responsible for data processing within the meaning of Article 26 GDPR is Creutz & Partners and Instagram/Meta Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4 Ireland jointly.

Creutz & Partners has therefore concluded an agreement with Meta which sets out, among other things, the duties of each controller (https://www.facebook.com/legal/terms/page_controller_addendum). It has been determined in this regard that only Meta may make and implement decisions regarding the processing of Insights data. Creutz & Partners' contribution to decisions on the means and purposes of processing of Insights data is therefore limited to the aims of managing or promoting our activities in relation to the running of our Instagram page, for the purposes of which we may evaluate the page statistics provided to us by Meta based on Insights data.

a) What personal data do we process?

To find out what information exactly is contained in the statistics available to us regarding our Instagram page, please refer to the information provided by Meta via the following link: https://help.instagram.com/788388387972460.

Information on the data which Meta uses to generate the page statistics we use can be found via the following link: https://privacycenter.instagram.com/policy/?section_id=1-WhatInformationDoWe.

Please note that Meta processes data in order to generate page statistics when you visit our Instagram page even if you do not have an Instagram profile or are not logged in. The data Meta processes here may include your IP address, the type of browser used, your operating system or your location.

b) What is the legal basis for the data processing?

The permissibility of processing Insights data is based on Article 6(1), point (f) GDPR, according to which processing is lawful if it is necessary in order to preserve the legitimate interests of Creutz & Partners except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. Our legitimate interest consists in evaluating the anonymised Insights data in order to track user behaviour on our Instagram page and consequently optimise the offering of this page.

With respect to Meta's processing of Insights data, we assume that such processing is performed for reasons relating to the fulfilment of contractual services relating to the contract concluded between you and Meta concerning the terms of use of the Instagram platform. The legal basis is consequently Article 6(1), point (b) GDPR.

In the event that you are not logged in to Instagram or are not a member of the Instagram network, we assume that Meta is permitted to process your data on the basis of a legitimate interest pursuant to Article 6(1), point (f) GDPR.

More information on the legal basis for Meta's data processing can be found via the following link: https://privacycenter.instagram.com/policy/?section_id=7-WhatIsOurLegal.

c) Who receives my data?

Only those employees of Creutz & Partners who also have access to our Instagram page have access to your personal data.

We do not pass on data to third parties.

As the platform provider, Instagram/Meta also has access to your personal data and transmits these to third parties. More information can be found in the Instagram Privacy Policy via the following link: https://privacycenter.instagram.com/policy/?section_id=4-HowDoWeShare.

Furthermore, Instagram may transfer your data to third countries, i.e. countries which are not Member States of the European Union or Contracting Parties of the EEA Agreement, in particular the USA where Meta Platforms Inc. has its registered office. The transfer of data to the USA is based on the adequacy decision of the EU Commission (Implementing Decision (EU) 2023/1795 of 10 July 2023) since Meta is a member of the EU-U.S. Data Privacy Framework and is certified accordingly. More information on when Instagram/Meta transfers data to third countries can be found in the Instagram Privacy Policy via the following link: https://privacycenter.instagram.com/policy/?section_id=9-HowDoWeTransfer.

d) How long are my data stored for?

The page statistics provided to us by Meta are based on Insights data for a period of 90 days. We do not store or process these data outside of Instagram.

Insofar as Meta stores the data, on which the Page Insights are based, this storage is in line with the provisions of the Instagram Privacy Policy and the Instagram Terms of Use. More information on this can be found via the following link: https://privacycenter.instagram.com/policy/?section_id=8-HowLongDoWe und https://help.instagram.com/581066165581870/?helpref=hc_fnav.

C. General information on data processing at Meta

Please note that whenever you use Instagram, Meta processes other data concerning you in addition to the personal data described here in order to generate page statistics.

Generally speaking, Meta collects and processes in particular that data which you have provided to Meta via the information in your Instagram profile, e.g. date of birth, e-mail address, telephone number etc. Furthermore, Meta also processes information on how you interact with our Instagram profile, e.g. what you click on or what you "Like".

When you visit our Instagram profile, Meta may process data such as your IP address, the browser type you are using, your operating system or your location, even if you have not set up an Instagram profile or you are not logged in.

Creutz & Partners has no influence over this data processing and this processing is the sole responsibility of Meta.

Information on Meta's general data processing can be found in the Instagram Privacy Policy via the following link: https://privacycenter.instagram.com/policy/.

This Privacy Policy contains information on the categories of personal data which are processed when you use Instagram, the purposes of processing, the legal basis, the categories of recipients who your data may be provided to, your rights and the duration of processing.

D. Information on use of cookies by Meta

If your browser allows the storage of cookies, we would like to also make you aware that Meta will place cookies in your browser's cache any time you visit our Instagram page, meaning it is able to access personal data when you visit the Instagram platform or a website where Meta technologies have been embedded.

Meta can use these cookies to track your behaviour on other websites outside of the Instagram platform. This applies to both registered and non-registered users of the Instagram platform.

Creutz & Partners has no influence over the use of cookies and Meta's processing of data in this regard. Consequently, the sole controller responsible for data processing is Meta.

A detailed overview of the cookies which Meta uses and further information on the purpose of this and what options you have for limiting this can be found in the Instagram Cookie Policy via the following link: https://privacycenter.instagram.com/policy/cookies/.

Furthermore, it is still possible to visit our Instagram page even if you have configured your browser not to accept any cookies from the Instagram platform. Information on how to change the cookie settings in your browser can usually be found in the Help section or in the settings of the browser you are using.

If you are registered with the Instagram platform or are logged in and do not want Meta to be able to link your visit to our Instagram page to your user account, you should log out of Instagram or disable the "Stay signed in/Remember me" function, delete the cookies stored on your device and then close and relaunch your browser.

3.6.3 LinkedIn

LinkedIn is a digital professional network that allows its users to network with other users and increase their own visibility. LinkedIn is operated by the US company LinkedIn Corporation with registered office in California.

LinkedIn Ireland Unlimited Company (hereinafter "LinkedIn") is responsible for the processing of personal data concerning persons in the EU, the European Economic Area or Switzerland. Information on how to contact LinkedIn can be found via the following link: https://www.linkedin.com/legal/privacy-policy?#others

A. Data processing when interacting with our LinkedIn page

Our LinkedIn page (https://linkedin.com/company/creutzpartners) gives you the option of networking with us, reacting to and commenting on our posts or sending us a private message.

Within this context, we have access not only to the information you send us but also to personal data which – depending on your profile's privacy settings – may also be available to other LinkedIn users. However, we primarily use these data exclusively for interacting with you or responding to your concern. Furthermore, we may also process these data insofar as we may share or comment on your posts or publish our own posts which make reference to your account. In this way, information which you freely publish and disseminate on LinkedIn is made available to our subscribers as well.

The controller responsible for data processing in this context is Creutz & Partners exclusively.

Generally speaking, we do not store or process data any further.

a) What personal data do we process?

We may process the following personal data in this context:

Name and surname, or name used on your LinkedIn profile;
Your reactions to our posts (e.g. likes, comments or shared content);
Information concerning your profession, career or education;
Any other personal information which you make freely available on your profile (e.g. information on connections or pages you follow) or which you share with us (e.g. address, e-mail address or telephone number).

b) What is the legal basis for the data processing?

c) Who receives my data?

Only those employees of Creutz & Partners who also have access to our LinkedIn page have access to your personal data.

We do not pass on data to third parties.

d) How long are my data stored for?

Your data are used exclusively in the context of interactions with you via the social network or with a view to responding to your query. We do not store or process data any further.

B. Data processing for statistical purposes (Page Insights)

LinkedIn processes a number of pieces of personal data concerning page visitors for its own purposes as part of its so-called Page Insights. This processing occurs regardless of whether or not visitors to a page are logged in to LinkedIn and whether or not visitors to a page are members of the LinkedIn network.

Page Insights are collated statistics which are generated during certain "Events" which are logged by the LinkedIn servers whenever people interact with pages and associated content.

As the owner of a page, we have no influence over the collection of such page statistics and cannot prevent such from being generated in the context of running our LinkedIn page. In particular, we do not set any parameters or otherwise issue any instructions to LinkedIn to process personal data in a certain way in order to generate page statistics.

Because you trigger the processing of your personal data by Page Insights simply by accessing our LinkedIn page, the controller responsible for data processing within the meaning of Article 26 GDPR is Creutz & Partners and LinkedIn jointly.

Creutz & Partners has therefore concluded an agreement with LinkedIn which sets out, among other things, the duties of each controller (https://legal.linkedin.com/pages-joint-controller-addendum). It has been determined in this regard that only LinkedIn may make and implement decisions regarding the processing of Insights data. Creutz & Partners' contribution to decisions on the means and purposes of processing of Insights data is therefore limited to the aims of managing or promoting our activities in relation to the running of our LinkedIn page, for the purposes of which we may evaluate the page statistics provided to us by LinkedIn based on Insights data.

a) What personal data do we process?

To find out what information exactly is contained in the statistics available to us regarding our LinkedIn page, please refer to the information provided by LinkedIn via the following link: https://www.linkedin.com/help/linkedin/answer/a547077?lang=en-US.

Information includes data on reach, page visits, length of visit, likes, shared and commented content, and demographic information on role, area of responsibility, professional experience or location of followers and users. We can only access the summarised Page Insights in the form of statistics. We are not able to draw conclusions regarding individual followers or users of our LinkedIn page based on these Page Insights.

Information on which data LinkedIn uses to generate the page statistics we use can be found in the detailed information on individual forms of analysis provided via the following link https://www.linkedin.com/help/linkedin/answer/a547077?lang=en-US or in the LinkedIn Privacy Policy https://www.linkedin.com/legal/privacy-policy?#data.

Generally speaking, LinkedIn collects and processes in particular that data which you have provided to LinkedIn via the information in your profile, e.g. data on role, country, industry, length of service, company size and employment status. LinkedIn will also process information on how you interact with our LinkedIn company page, e.g. whether you are a follower of our LinkedIn company page.

When you visit our LinkedIn page, data such as your IP address, the browser type you are using, your operating system, information on previously visited pages, your location, information on the end device you are using or on search terms may be processed by LinkedIn, even if you have not set up a LinkedIn account.

b) What is the legal basis for the data processing?

The permissibility of processing Insights data is based on Article 6(1), point (f) GDPR, according to which processing is lawful if it is necessary in order to preserve the legitimate interests of Creutz & Partners except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. Our legitimate interest consists in evaluating the anonymised Insights data in order to track user behaviour on our LinkedIn page and consequently optimise the offering of this page.

LinkedIn also uses the same legal basis of its legitimate interest when processing your personal data in order to generate page insights. More information can be found via the following link: https://www.linkedin.com/help/linkedin/answer/a1335592?lang=en-US.

c) Who receives my data?

Only those employees of Creutz & Partners who also have access to our LinkedIn page have access to your personal data.

We do not pass on data to third parties.

As the platform provider, LinkedIn also has access to your personal data and may transmit these to third parties. More information can be found via the following link: https://www.linkedin.com/legal/privacy-policy?#share.

Furthermore, LinkedIn transfers your data to third countries, i.e. countries which are not Member States of the European Union or Contracting Parties of the EEA Agreement, in particular the USA where the LinkedIn Corporation has its registered office. The transfer of data to the USA is based on the adequacy decision of the EU Commission (Implementing Decision (EU) 2023/1795 of 10 July 2023) since LinkedIn is a member of the EU-U.S. Data Privacy Framework and is certified accordingly. More information on when LinkedIn transfers data to third countries can be found via the following link: https://www.linkedin.com/help/linkedin/answer/a1343190?lang=en-US.

d) How long are my data stored for?

The length of time, for which page insights are available to us, depends on the type of analysis or the content of the statistic in question. For example, we can access statistics on the number of "Likes", comments and shares on our posts for the last 365 days. Data on number of visitors to our LinkedIn page relate to the last 30 days. More detailed information on the period of availability of individual statistics can be found in the comprehensive information provided on individual forms of analysis via the following link https://www.linkedin.com/help/linkedin/answer/a547077?lang=en-US.

We do not store or process the data provided to us via LinkedIn page insights outside of LinkedIn.

Insofar as LinkedIn stores the data, on which the page insights are based, this storage is in line with the provisions of the LinkedIn Privacy Policy and the LinkedIn Terms of Use. More information can be found via the following link: https://www.linkedin.com/legal/privacy-policy?#choices.

C. General information on data processing at LinkedIn

Please note that whenever you visit our LinkedIn page, LinkedIn processes other personal data in addition to the data used to generate page statistics.

Creutz & Partners has no influence over this data processing and this processing is the sole responsibility of LinkedIn.

Information on LinkedIn's general data processing can be found in the LinkedIn Privacy Policy via the following link: https://www.linkedin.com/legal/privacy-policy.

This Privacy Policy contains information on the categories of personal data which are processed when you use LinkedIn, the purposes of processing, the legal basis, the categories of recipients who your data may be provided to, your rights and the duration of processing.

D. Information on use of cookies by LinkedIn

If your browser allows the storage of cookies, we would like to also make you aware that LinkedIn will place cookies in your browser's cache any time you visit our LinkedIn page and therefore has access to personal data.

LinkedIn can use these cookies to track your behaviour on other websites outside of LinkedIn. This applies to both registered and non-registered users of LinkedIn.

Creutz & Partners has no influence over the use of cookies and LinkedIn's processing of data in this regard. Consequently, the sole data controller responsible for data processing is LinkedIn.

A detailed overview of the cookies which LinkedIn uses and further information on the purpose of this and what options you have for limiting this can be found in the LinkedIn Cookie Policy and Cookie Table via the following link: https://www.linkedin.com/legal/cookie-policy and https://www.linkedin.com/legal/l/cookie-table.

Furthermore, it is still possible to visit our LinkedIn page even if you have configured your browser not to accept any cookies from LinkedIn. Information on how to change the cookie settings in your browser can usually be found in the Help section or in the settings of the browser you are using.

If you are registered with LinkedIn or are logged in and do not want LinkedIn to be able to link your visit to our LinkedIn page to your user account, you should log out of LinkedIn or disable the "Stay signed in/Remember me" function, delete the cookies stored on your device and then close and relaunch your browser.

3.7 Use of social media plug-ins

We have embedded plug-ins from social networks on our websites. You can spot these plug-ins by the corresponding buttons with the logos of the social media platforms (Facebook, Instagram, LinkedIn).

We use the so-called double-click solution with our plug-ins. This means that, generally speaking, when you visit our website personal data is not initially passed on to the provider of the plug-in at first. It is only when you activate the respective plug-in by clicking on the corresponding button that a direct connection to the provider's server is established and this provider is notified that you have accessed the corresponding website of our online presence and informed of your IP address. This transfer of data occurs regardless of whether you have an account with the plug-in provider and are logged in with this provider. If you are logged in with the plug-in provider, the data we collect from you will be linked directly to your account with the plug-in provider. We recommend regularly logging out of social networks after use, in particular before pressing the button, so that you can prevent information from being linked to your profile with the plug-in provider.

We and the plug-in provider are joint controllers (Article 26 GDPR) with regards to the personal data collected through use of the plug-in and passed on to the plug-in provider. This joint responsibility is limited exclusively to the collection of data and the forwarding of these data to the plug-in provider. The legal basis for this data processing is your consent within the meaning of Article 6(1), point (a) GDPR since you gave your consent when you activated the plug-in button. You may withdraw your consent at any time. However, if you do this you will no longer be able to use the social media plug-in. For more information, please see Sec. 6(c).

The data processing activities that are performed subsequently do not fall under this joint responsibility. Furthermore, we do not have influence over the data collected or the data processing activities, nor are we aware of the full scope of data collection, the purposes of the processing or the retention periods applied by the respective plug-in providers.

We also note that the data processed by the plug-in providers may be transferred to third countries, in particular the USA where Meta Platforms Inc. and the LinkedIn Corporation have their registered offices. The transfer of data to the USA is based on the adequacy decision of the EU Commission (Implementing Decision (EU) 2023/1795 of 10 July 2023) since the plug-in providers are members of the EU-U.S. Data Privacy Framework and are certified accordingly.

More information on the scope and purpose of data collection and processing by the plug-in provider and on your rights in this regard and how you can configure your settings to protect your privacy can be found in the privacy policy of the relevant provider.

Facebook: https://www.facebook.com/privacy/policy

Instagram: https://privacycenter.instagram.com/policy/cookies/

LinkedIn: https://www.linkedin.com/legal/privacy-policy

3.8 External links

Our websites may contain links to third-party websites or other websites which we are responsible for. In the event that you follow a link to a third-party website, please note that these websites have their own privacy policies. We do not assume any responsibility or liability for these external websites and their privacy policies. Please check whether you agree with the privacy policies that apply to each of these websites before using them.

External links can be identified by the fact that they have a different colour to the rest of the text or are underlined. Your cursor will display external links if you hover over one of these links. Your personal data can only be transmitted to the link destination when you click on an external link.

Please also note that individual links may result in a transfer of data outside of the European Economic Area. This means that you may not have any legal recourse against this transfer of data. If you do not want your personal data to be transmitted to the link destination and possibly transferred further to a country outside of the European Economic Area, then please do not click on any external links on our website.

4. Are my data transferred to third countries?

In principle, Creutz & Partners stores and processes your personal data in Luxembourg or within the European Economic Area ("EEA"). Generally speaking, we do not transfer your personal data to any third countries outside of the EEA unless this is a legal requirement (e.g. for reporting obligations under tax law) or you have given us your explicit consent.

Some recipients of personal data may be companies which have their registered office in a country outside of the EEA. Wherever your personal data are transferred to countries outside of the EEA, we ensure that we take the following security precautions:

The country which personal data are transferred to has an adequacy decision from the European Commission pursuant to Article 45 GDPR and the transfer falls under the scope of application of this adequacy decision. A list of European Commission adequacy decisions can be found at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en. This list is valid from 10 July 2023, in particular for the United States of America and the so-called "Data Privacy Framework", on the basis of which controllers and processors can transmit personal data to certified companies.
Creutz & Partners has concluded a contract with the recipient of the personal data which contains the standard contractual clauses on protection of personal data as adopted by the European Commission pursuant to Article 46 GDPR.
Outside of these approvals, Creutz & Partners may transfer personal data to a country outside of the EEA without an appropriate level of protection being guaranteed pursuant to Article 49 GDPR provided you have given us your explicit consent.

5. Do I have an obligation to provide data?

Generally speaking, there is no obligation for you to provide data. However, if you do not provide any data then in some cases it may not be possible for you to use our websites, the contact form, the CP NVST app, the social media plug-ins or our online presences on social networks or the functionality or availability of such will be restricted.

6. What rights do I have as a data subject?

a) Access to your personal data and data portability

You have the right to receive confirmation that personal data concerning you are being processed. If this is the case, you are entitled to receive information on this personal data, such as information on the purposes of the processing or where the data were obtained if you did not provide these data to us yourself (Article 15 GDPR). You may also receive a copy of this information free of charge upon request.

You furthermore have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format and you have the right to transmit those data directly to another controller insofar as processing of these data is based on consent or the fulfilment of a contract and is being carried out using automated means.

b) Rectification, update and/or erasure of your personal data

You can also contact Creutz & Partners if you wish to rectify, update or erase personal data concerning you. The corresponding contact details can be found in Sec. 6e. Please note that we may have to first verify your identity before you can make changes.

Once we have been instructed to erase data, your personal data will be erased (electronic data) or destroyed (data in physical form) by Creutz & Partners immediately, unless statutory retention periods/retention periods stipulated by supervisory law or other grounds indicated under Article 17(3) GDPR prohibit erasure.

c) Right to withdraw consent

Some processing activities performed by Creutz & Partners may be based on your consent. In such case, you have the right to withdraw your consent at any time without negative consequences. Withdrawing your consent does not have any effect on the lawfulness of data processing performed before your withdrawal. As soon as you withdraw your consent, Creutz & Partners and third parties involved in the data processing shall cease processing your personal data unless further processing or storage is permitted or necessary according to the legislation applicable to personal data or other applicable laws and regulations. Please note that as a result of your withdrawing your consent, Creutz & Partner may not be able to fulfil your requests or to continue providing you with services and/or information.

d) Right to restriction of processing and right to object

You have the right to restrict the processing of your personal data (i) if your personal data are not correct, (ii) if the processing is unlawful but you prefer to restrict the processing of your personal data rather than erase them, (iii) if Creutz & Partners no longer requires your personal data for processing purposes but you would like such data to be stored in order to establish, exercise or defend legal claims before a court of law, or (iv) if you have objected to the processing of your personal data for preserving the legitimate interests of Creutz & Partners but it has not yet been determined whether the legitimate interests of Creutz & Partners override your interests or fundamental rights and freedoms which require protection of personal data.

You have the right to object at any time to the processing of your personal data which were collected and processed for the purposes of the legitimate interest of Creutz & Partners or for the performance of a task carried out in the public interest. In such case, Creutz & Partners shall cease processing your personal data unless data are being processed in order to establish, exercise or defend legal claims of Creutz & Partners or data processing is justified by legitimate grounds which override your interests, rights and freedoms.

Furthermore, you have the right to object to the processing of your personal data for the purposes of direct marketing.

e) Right to lodge a complaint/Enforcing your rights as a data subject

If you would like to enforce the above rights as a data subject or if you do not agree with an aspect of the processing of your personal data and wish to lodge a complaint, we will be happy to discuss this with you so that we can respond to your request to your satisfaction as far as possible. Please use the following address to do this:

Creutz & Partners The Art of Asset Management S.A.

Datenschutzbeauftragter/Data Protection Officer

18, Duarrefstrooss

L-9944 Beiler

Tel.: +352 978 22 11

E-mail address: datenschutz@creutz-partners.com

We will confirm receipt of your concern within two (2) working days and will do our best to respond as quickly as possible and within one (1) month of receipt. Should it take longer than one (1) month to process your concern and respond to you, we will let you know and inform you of the reasons for this.

Should you be unhappy with our feedback or how we have handled your concern, you have the right to lodge a complaint with a data protection authority.

The data protection authority with jurisdiction in Luxembourg is the National Commission for Data Protection ("Commission nationale pour la protection des données"). You can contact the Luxembourgish data protection authority as follows:

Commission nationale pour la protection des données

15, Boulevard du Jazz

L-4370 Belvaux

Tel.: +352 261 06 01

E-mail address: info@cnpd.lu

Website: www.cnpd.lu

7. Automated decision-making / Profiling

Creutz & Partners does not use any automated decision-making, including profiling, in the processing of your personal data. This means that we do not make any decisions about you based on your personal data through automated means and without human intervention.

8. Security of processing

The confidentiality and therefore also the security of your personal data is very important to Creutz & Partners. We have therefore taken suitable technical (e.g. virus scanners, firewalls) and organisational (e.g. access controls/restrictions) measures pursuant to Article 32 GDPR in order to guarantee the security of your personal data and to protect these against unlawful processing, unlawful or unintentional modification or erasure and against unauthorised forwarding or unauthorised access.

All employees of Creutz & Partners who have access to personal data must comply with our internal guidelines and procedures for processing your personal data in order to protect these data and guarantee their confidentiality.

Cookie Policy

Cookie Policy of Creutz & Partners The Art of Asset Management S.A. (“Creutz & Partners”)

Our websites use cookies. Cookies are small text files which allow us to store certain information on your end device (e.g. PC, smartphone, tablet) concerning you and your use of our websites. While certain cookies are automatically deleted at the end of your session, others remain stored on your device for a certain period of time so that we can recognise your browser on your next visit. Cookies cannot run programs or transmit viruses to your computer. They are used to make our internet presence overall more effective and user-friendly. The law states that we can store cookies on your device if they are strictly necessary for the operation of this site. For all other types of cookies, we need your permission.

Our websites use different types of cookies. The cookies used on the website https://cp-nvst.com are categorised as follows:

Necessary cookies

Necessary cookies help make a website usable by enabling basic functions like page navigation an access to secure areas of the website. This website cannot function properly without these cookies. For this reason, necessary cookies cannot be deactivated.

Since they enable the usability and basic functions of the website, the processing of data based on the use of necessary cookies is carried out on the basis of the legitimate interests of Creutz & Partners. The legal basis is consequently Article 6(1), point (f) of the General Data Protection Regulation (hereinafter “GDPR”).

Cookie name	(Third-Party) Provider	Purpose	Expiry	Type
CookieConsent	https://www.cookiebot.com/en/privacy-policy/	Stores the user’s cookie consent state for the current domain.	1 year	HTTP Cookie
_cfuvid	https://vimeo.com/privacy	This cookie is a part of the services provided by Cloudflare – Including load-balancing, deliverance of website content and serving DNS connection for website operators.	Session	HTTP Cookie
app_target_group	www.creutz-partners.com	Stores the target group selected by user.	6 months	HTTP Cookie

Preference cookies

Preference cookies enable a website to remember information that changes the way the website behaves or looks, like your preferred language or the region that you are in.

Currently, we do not use cookies of this type.

Statistic cookies

Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

In the default settings of our websites, statistic cookies are deactivated. However, you can allow and activate the use of statistic cookies via the cookie settings. The legal basis for the related data processing is therefore your consent in accordance with Art. 6, para. 1, a) of the GDPR.

Cookie name	(Third-Party) Provider	Purpose	Expiry	Type
matomo.php	https://matomo.org/	Collects data on the user’s navigation and behaviour on the website. This is used to compile statistical reports and heatmaps for the website owner.	Session	Pixel
_pk_id#	https://matomo.org/	Collects statistics on the user’s visits to the website, such as the number of visits, average time spent on the website and what pages have been read.	1 year	HTTP Cookie
_pk_ses#	https://matomo.org/	Used by Piwik Analytics Platform to track page requests from the visitor during the session.	1 day	HTTP Cookie
mtm_cookie_consent	https://matomo.org/	Determines whether the user has accepted the cookie consent box	30 years	HTTP Cookie

Marketing cookies

Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third-party advertisers.

In the default settings of our websites, marketing cookies are deactivated. However, you can allow and activate the use of marketing cookies via the cookie settings. The legal basis for the related data processing is therefore your consent in accordance with Art. 6, para. 1, a) of the GDPR.

Cookie name	(Third-Party) Provider	Purpose	Expiry	Type
aka_debug	https://www.akamai.com/legal	Used by Vimeo to track usage of their embedded video player.	Session	HTTP Cookie
__cf_bm	https://vimeo.com/privacy	This cookie is used to distinguish between humans and bots. This is beneficial for the website, in order to make valid reports on its use.	1 day	HTTP Cookie

Unclassified cookies

Unclassified cookies are cookies that we are in the process of classifying, together with the providers of individual cookies.

Currently, we do not use cookies of this type.

Learn more about who we are, how you can contact us and how we process personal date in our Privacy Policy.

Data Privacy

Cookie name

(Third-Party) Provider

Purpose

Expiry

Type

Cookie name

(Third-Party) Provider

Purpose

Expiry

Type

Cookie name

(Third-Party) Provider

Purpose

Expiry

Type