Your privacy is important to Victor Buck Services and maintaining your trust is paramount to us.
This Statement discloses how your Personal Data are processed when:

  • visiting Victor Buck Services’ website, from what type of information about our website users is gathered and tracked, to how the information is used, shared or otherwise processed offline;
  • collecting and gathering your Personal Data to initiate and maintain a commercial relationship,  to provide services to you, to receive services from you or to manage orders and billing;
  • performing any other activities related to the operation of our business including those surrounding security requirements  or marketing/communication activities.

Personal data you may provide to Victor Buck Services or submit on this website (such as your name, your e-mail or your address) will be processed by Victor Buck Services as data controller within the meaning of applicable data protection legislation.
Victor Buck Services may be unable to process your request if you do not provide requested personal data.


  • GDPR: General Data Protection Regulation
  • Personal Data: any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  • Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
  • Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Recipient: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.
  • Cookies: A cookie is a text file that a Web browser stores on a user’s machine.
  • IP address: An IP address is a unique address that identifies a device on the Internet or a local network. It allows a system to be recognized by other systems connected via the Internet protocol.


When someone visits Victor Buck Services website (, we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site.
You can read more about how we use cookies on our Cookies Management Policy available on Victor Buck Services’ website.
Victor Buck Services has put in place the appropriate security measures to ensure the confidentiality, integrity and availability of all personal data gathered via the website. In order to deliver this service, it processes the IP addresses of visitors to the Victor Buck Services website.
Lawfulness of processing:

  • Legitimate interest
  • Consent


In order to be able to identify the person who contacts Victor Buck Services via the website and to provide an answer, Victor Buck Services will collect only the necessary information, which consists of Last name, First name, Company, Email address and the message related to the contact request.
All information contained in this communication will be considered confidential and will only be disclosed to Victor Buck Services employees who will manage the contact request.
Lawfulness of processing:

  • Legitimate interest


Customer focus and satisfaction are one of the foundations on which Victor Buck Services (Victor Buck Services) built its business. Should you have any persistent major concern or issue with the way Victor Buck Services supports your business, you can log a complaint, as per CSSF Regulation 16-07, through the form that you can find at:
For standard services request and queries, please refer to the service Desk.
Please return the completed form and associated evidences to Victor Buck Services by e-mail at or by mail to : Victor Buck Services – Complaint office, IVY Building, 13-15 Parc d’Activités, L-8308 Capellen.
Victor Buck Services will treat each and every complaint with due care, equity and propose the best solution possible.
An acknowledgement of our receipt of your complaint will be issued within 10 business days after the receipt of the Complaint. A full and detailed response should be provided to you within one month of the receipt of your complaint.
Victor Buck Services will need to collect some personal data relating to the complainant in order to identify him/her and to be able to give an appropriate answer. Personal data that Victor Buck Services will gather consist of the Firstname, Lastname, Company, Title, Email address, Phone, Fax, Postal Address.
In the context of the complaint, CSSF may then access and receive information shared (including personal data) as part of the treatment of your complaint.
All the information provided will be considered as confidential and will only be processed by authorised Victor Buck Services’ employees who will manage the complaint.
Lawfulness of processing:

  • Legitimate interest
  • Legal obligation


The provision of your personal data to Victor Buck Services is necessary to take part into the recruitment process, in accordance with Art. 6 (1) b) of GDPR in order to take steps at the request of the data subject prior to entering into a contract.  All of the information you provide during the process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary.We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes or store any of your information outside of the European Economic Area. The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format.
We will use the contact details you provide to us (such as last name, first name and email)  to contact you to progress your application. We will use the other information you provide (CV, application letter) to assess your suitability for the role you have applied for.
Victor Buck Services may also proceed to a screening of your profile on the basis of professional related information, available on public websites.
If the recruitment process is not successful, your personal data shall be retained for duration of 12 months from the end of the recruitment process unless you oppose thereto. If the recruitment process is successful, your personal data shall be part of your employee file and then be kept for the same duration than your employee file.
We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

Lawfulness of processing:

  • Legitimate interest


When visiting Victor Buck Services’ premises, or for the purpose of establishing the commercial relationship with its customers or suppliers or during the whole commercial relationship (for marketing, contractual documents, billing, orders management Victor Buck Services may have to collect Personal Data including personal identification data (first name; surname); professional and/or electronic identification data (professional phone number(s); email address; identifiers; IP address; passwords) your image (for video-monitoring to the extent legally permitted).

Lawfulness of processing:

  •  Legitimate interest
  •  Legal obligation

The above personal data are necessary:

-to comply with applicable laws and regulations (AML-KYC proceedings; Authority reporting and professional duties, in particular induced by the “PSF” status of Victor Buck Services; external and internal audits…)

-for the performance of contractual obligations (offers; contracts; invoicing; use of applications).

-for the purposes of the legitimate interests (video monitoring for the protection of people, offices and assets or the maintenance of the customer or supplier’s relationship (marketing and communication services)

Personal data collected will be processed by the concerned internal service(s) or department(s) of Victor Buck Services in accordance with the above purposes and in compliance with the applicable laws. Such Personal Data may be disclosed to its affiliated company located in a jurisdiction outside the European Union or sub-contractors when necessary for the performance of services and limited to the above purposes.

To the extent that the performance of certain services may require the transfer of personal data to a third country out of the European Union subject to implementation of appropriate safeguards including standard data protection clauses adopted by the Commission or ad hoc contractual clauses as authorized by the competent supervisory authority.



Visitors to our website Please refers to Cookies list.
Contact request Information related to contact request will be kept for 6 months from the request.
Complaint handling Information related to complaint handling will be kept for 10 years from the closing of the complaint.
Job applications All the CV received for a job application will be kept 12 months after the recruitment process ends.


AML-KYC Information related to the AML-KYC process will be kept for 10 years after contract termination.
Visitor reception Personal Data included in badges and in Confidentiality forms are kept for 3 years from date of signature.
Video-monitoring (when visiting Victor Buck Services’ premises) 30 days after data creation
Offers ; contracts ; invoicing ; commercial correspondence (when applicable) Personal Data included in contracts will be kept for 10 years after contract termination.
Marketing; Prospection (B2B) Personal Data related to Prospects not having responded to solicitation are kept a maximum of 3 years further to the communication
Personal Data related to Clients are kept a maximum of 10 years further to the contract termination.



The lawful bases for processing are set out in Article 6 of the GDPR. At least one of these must apply whenever Victor Buck Services process personal data:

  • Consent: the data subject has given clear consent for Victor Buck Services to process their personal data for a specific purpose.
  • Contract: the processing is necessary for a contract Victor Buck Services have with the data subject, or because they have asked Victor Buck Services to take specific steps before entering into a contract.
  • Legal obligation: the processing is necessary for Victor Buck Services to comply with the law (not including contractual obligations).
  • Legitimate interests: the processing is necessary for Victor Buck Services legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the data subject’s personal data which overrides those legitimate interests.

All processing of personal data done by Victor Buck Services (as a controller) is well defined and all purposes set in accordance with the GDPR.



Regarding the processing of a data subject request, once Victor Buck Services has verified the identity of the data subject making the request (using “reasonable means”), Victor Buck Services will provide an answer within a time period of a month.
If the request is made electronically, Victor Buck Services should provide the information in a commonly used electronic format.
This time period could be extended by two months where the request is complex or Victor Buck Services receives a high number of requests. In such cases, Victor Buck Services will inform the data subject within one month of the receipt of the request and explain why the extension is necessary.
Victor Buck Services can refuse to comply with a request if the request is manifestly unfounded or excessive, taking into account whether the request is repetitive in nature.
If Victor Buck Services considers that a request is manifestly unfounded or excessive it can:

  • request a « reasonable fee » to deal with the request; or
  • refuse to deal with the request.

In either case, Victor Buck Services will justify its decision. Victor Buck Services will base the reasonable fee on the administrative costs of complying with the request.


According to Article 15 of the GDPR data subjects have the right to access their personal data and supplementary information. The right of access allows data subjects to be aware of and verify the lawfulness of the processing.
Under the GDPR, data subjects will have the right to obtain from Victor Buck Services:

  • confirmation that their data is being processed;
  • access to their personal data; and
  • other supplementary information.


Under Article 16 of the GDPR data subjects have the right to have inaccurate personal data rectified. A data subject may also be able to have incomplete personal data completed – although this will depend on the purposes for the processing. This may involve providing a supplementary statement to the incomplete data.


Under Article 17 of the GDPR data subjects have the right to have personal data erased. This is also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain circumstances.
Data subjects have the right to have their personal data erased if:

  • the personal data is no longer necessary for the purpose which Victor Buck Services originally collected or processed it for;
  • Victor Buck Services is relying on consent as its lawful basis for processing the data, and the data subject withdraws his/her consent;
  • Victor Buck Services is relying on legitimate interests as its basis for processing, the data subject objects to the processing of his/her data, and there is no overriding legitimate interest to continue this processing;
  • Victor Buck Services is processing the personal data for direct marketing purposes and the data subject objects to that processing;
  • Victor Buck Services has processed the personal data unlawfully;
  • Victor Buck Services has to do it to comply with a legal obligation; or
  • Victor Buck Services has processed the personal data to offer information society services to a child.


Article 18 of the GDPR gives data subjects the right to restrict the processing of their personal data in certain circumstances. This means that an data subject can limit the way that an organisation uses his/her data. This is an alternative to requesting the erasure of his/her data.
Data subjects have the right to restrict the processing of their personal data where they have a particular reason for wanting the restriction. This may be because they have issues with the content of the information Victor Buck Services holds or how Victor Buck Services has processed his/her data.
In brief, the right to restrict processing implies that, when applied, Victor Buck Services will only keep the personal data (store it) without doing any further processing until the restriction of processing is applicable.
Data subjects have the right to request Victor Buck Services restrict the processing of their personal data in the following circumstances:

  • the data subject contests the accuracy of their personal data and Victor Buck Services is verifying the accuracy of the data;
  • the data has been unlawfully processed and the data subject opposes erasure and requests restriction instead;
  • Victor Buck Services no longer needs the personal data but the data subject needs Victor Buck Services to keep it in order to establish, exercise or defend a legal claim; or
  • the data subject has objected to Victor Buck Services processing his/her data under Article 21(1), and Victor Buck Services is considering whether its legitimate grounds override those of the data subject.


The right to data portability allows data subjects to obtain and reuse their personal data for their own purposes across different services. It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability where technically feasible (cf. Art. 20 (2) GDPR).
The right to data portability only applies to personal data a data subject has provided to a controller (Victor Buck Services); where the processing is based on the data subject’s consent or for the performance of a contract; and when processing is carried out by automated means.


Data subjects have the right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority, direct marketing (including profiling) and processing for purposes of scientific/historical research and statistics.

You may exercise your access, rectification, erasure, data portability rights and request restriction of or object to the processing in accordance with the applicable data protection legislation at the following email address: or by post to the attention of Victor Buck Services – DPO, IVY Building, 13-15 Parc d’Activités, L-8308 Capellen. You have the right to lodge a complaint with the CNPD