Master privacy notice

February 2026

In this privacy notice, references to ‘we’, ‘us’, and ‘our’ means the IQ-EQ Group (“IQ-EQ Group”).    

The IQ-EQ Group means Saphilux S.à r.l  and its subsidiaries. The companies within the IQ-EQ Group that provide the services in the listed jurisdictions, and under the supervision of the relevant regulators in the listed jurisdictions, are listed here. 

This Privacy notice explains how we may collect and use personal information about you, and your rights in relation to that information. This notice reflects our consistent global policy for data protection, based on data protection principles under UK and European Union data protection laws. However, not all the activities, rights or obligations described in this notice may apply where an IQ-EQ office is in a jurisdiction with significantly different data protection laws. We supplement this notice with country-specific notices where necessary, for individuals based in those countries, and these are published on our website.  

We collect information about you directly from you, which includes information created in the course of delivering services to you.  We also collect information from the people and organisations described in this notice.  Most of the information we collect about you is necessary to manage all aspects of our relationship with you, and to provide you with our products and services.  

If, during the course of your relationship with us, you provide us with personal information about other people, you should make them aware that you are doing so and provide them with a copy of this privacy notice or direct them to the notice published on the IQ-EQ website. 

The personal information we process about you, and where relevant, others related to you, includes:  

• standard personal information, such as information we use to identify you, contact you and manage our relationship with you, and to deliver services to you 

• special categories of information (or sensitive personal information) which may include information about race, ethnic origin, political opinions, and health and medical information (depending on your relationship with us and the services you receive) 

• criminal offence information, and information relating to criminal convictions and offences, and sanctions status will be collected in line with our screening policies. 

Click Read more below for further detail on the types of personal information we may process.

We use your personal information: 

• to assess potential provision of services, and to provide services to you including performance management or termination of those services 

• to manage all aspects of our relationship with you, our business and those who provide services to us 

• to protect our (or our client’s or other people’s) rights, property (including keeping secure our company information), or safety 

• to obtain legal or other professional advice, and to enable us to exercise our rights including to defend ourselves from claims and to comply with our legal and regulatory obligations including to identify, manage, investigate and protect against fraud 

• to send marketing information to you, and to develop and tailor our sales and marketing activities 

• to respond to and handle reports of whistleblowing, complaints or grievances 

• to take part in, or be the subject of, any sale, merger or takeover involving all or part of the IQ-EQ Group 

• to manage our business, improve and develop products and services, better understand our client relationships, and help to determine those products or services offered by IQ-EQ Group which may be of interest to you

• to act as an introducer for products or services offered by third parties which may be of interest to you

• to support the wider business activities of the IQ-EQ Group, its shareholders and potential shareholders 

We will tell you if we use your data for a purpose that is not compatible with the purposes described here. This might be by updating this notice, or via a specific communication. 

The law requires us to have a lawful basis (a valid reason) for using your personal information. These are explained below.  There may be country-specific variations on these descriptions. For more information on country-specific variations, please contact the Group Privacy and Data Protection Team at dataprotection@iqeq.com

In addition to any recording of electronic communications that is either legally authorised or required, or to which you have consented, we may record electronic communications with you, including the related traffic data, if we do so in the course of lawful business practice.  Such processing will be for the purpose of:

• ensuring the training and supervision of employees and improving the quality of the service; and/or
• providing evidence of commercial transactions, or communications that took place through these electronic communications including the content of these communications (including any advice being given by us).

We may retain such records as long as legally required or permitted including for the period of time during which a dispute may arise further to the electronic communication recorded between you and us. The above applies to phone conversations as well as all other electronic communications (such as e-mails, SMS, instant messaging services or other equivalent technologies) with our independent offices.

We may be required to conduct criminal history checks, meaning that we may process information on criminal offences. The legal basis for these checks is because we need to comply with legal obligations such as those under financial services laws. 

We do not currently make solely automated decisions about you.  We may use some automated technologies to evaluate information about you, such as biometric matching with identity documents to confirm your identity, but we have additional processes in place to ensure any decisions based on that data are performed or verified by real people. 

We will advise you of any use of automated individual decision-making which produces legal effects or which significantly affects you, and inform you about the logic involved, as well as the significance and the envisaged consequences of such processing.

As far as is necessary to meet the purposes of processing, we may share your personal information with any entity within the IQ-EQ Group, including those in countries outside of your home country. We have appropriate legal and security safeguards in place to ensure that your data is managed in a way that is consistent with your rights and our legal obligations in your home jurisdiction. 

We may share information with the following recipients, for the purposes described in this notice: 

• companies and employees within the IQ-EQ Group 

• internal and external service providers such as HR and legal 

• our insurers 

• anyone acting on our behalf, for example our legal representatives, accountants, tax and other professional advisors

• regulated professionals such as lawyers, notaries or auditors
• independent agents, intermediaries or brokers

• banks, insurance companies, wealth managers and other custodians 

• our regulators, auditors and statutory agencies or public bodies upon request and to the extent permitted by law;

• the police and other law enforcement agencies to help them perform their duties, or with others if we have to do this by law or under a court order

• third parties for whom we act as an introducer

• anyone else we are required to, or allowed to share information with by law (for example, with social security and tax offices)

• potential buyers of all or part of our business 

Processors are companies that process personal data on our behalf.  They may store, have access to, or make changes to personal data according to the services contract.  We maintain a list of Processors and Subprocessors here.

IQ-EQ is a global group using global organisations and information systems (which may be on-premise or cloud hosted).  Your personal information may be sent to or be accessed from other countries, including some that offer a different level of protection from where you live or work. When we transfer information internationally, we make sure we have appropriate safeguards in place through contracts, policies and procedures, to ensure that your information has at least the same level of protection as it does in your home jurisdiction.

IQ-EQ is fully committed to protecting the personal data of its clients, employees, suppliers and other stakeholders in accordance with the requirements of the European Union General Data Protection Regulation as well as specific data protection requirements which may also be applicable in certain countries in which we operate.  

Most of your personal data will be kept for as long as you have a relationship with us, and for a set period afterwards. We may retain it for longer than the defined period where there is a requirement to do so, for example where required under company law, or for anti-money laundering or counter terrorism purposes, or because you are involved in legal proceedings of some kind and we need to keep your information until the end of those proceedings, or until the end of any relevant period in which you might make a claim. 

Other types of information such as records of emails or information created in the course of your relationship with us may be kept for longer. This may be due to legal obligations, or because this information relates to services we have provided, and so will be held for as long as necessary to perform our obligations under our service agreements. 

Your rights under data protection laws may depend on where in the world you live.  These rights are usually not absolute, meaning there may be circumstances where your rights are limited or there are exemptions to our obligation to fulfil a request to exercise your rights.   

“Do Not Sell My Personal Information” Notice for California consumers.

Under the California Consumer Privacy Act (CCPA), California consumers have the right to:

• Request that a business that collects a consumer’s personal data disclose the categories and specific pieces of personal data that a business has collected about consumers.
• Request that a business delete any personal data about the consumer that a business has collected.
• Request that a business that sells a consumer’s personal data, not sell the consumer’s personal data.

If you make a request, we have 30 days to respond to you. If you would like to exercise any of these rights, please contact us at iqeq-uslegal@iqeq.com.

If you have any questions or concerns about this notice, or the way your personal information is processed, please contact the Group Data Protection Officer (DPO) and the Group Privacy and Data Protection Team at dataprotection@iqeq.com  

If you wish to complain about any aspect of how we process personal information, please contact the Group Data Protection Officer at dataprotection@iqeq.com. We will acknowledge your complaint promptly and aim to resolve your issue as quickly as possible, and within any prescribed timelines that apply to the region you are in.  You will be informed of the outcome of our investigation.

You also have the right to complain to your local data protection authority, where one exists, though in most cases they will expect you to try to resolve any concerns with the IQ-EQ team first.

For a full list of privacy and data protection authorities for all IQ-EQ jurisdictions, contact the Group Privacy and Data Protection Team at dataprotection@iqeq.com 

The current list of EU data protection authorities can be found here, or at www.edpb.europa.eu/about-edpb/about-edpb/members_en