FAST Search Luxembourg Privacy Policy

1. Identity of the data controller

This privacy policy is provided to you by FAST Search Luxembourg S.à r.l. (hereinafter “FAST Search Luxembourg”), a limited liability company registered with the Luxembourg Trade and Companies Register under number B310919, with its registered office at 9, Rue de Laboratoire, L-1911 Luxembourg, in its capacity as controller of the personal data collected in connection with its activities of genealogical research, investigations into dormant and unclaimed assets, checks on individuals or institutions, and background verification.

Data Protection Officer (DPO): FAST Search Luxembourg has appointed an external data protection officer, LuxGap Sàrl (2, Rue de l’École, L-8376 Kahler, Luxembourg), reachable at the email address dpo@luxgap.com.

The DPO is responsible for monitoring compliance with the applicable personal data protection regulations and acts as the point of contact for any question relating to the processing operations described in this policy.

2. Personal data collected

FAST Search Luxembourg ensures that it collects only the personal data strictly necessary for the purposes described below. This data is collected directly from the data subjects, from its principal (bank, insurance company, notarial office, business or individual), or through the use of public or private sources (civil-status registries, commercial registers, genealogical databases, sanctions and politically exposed persons databases, press and open sources). Depending on the nature of the assignment entrusted to it, the following categories of data may be processed:

Identification data: title, surname, first name(s), date and place of birth, nationality, parentage and family ties.
Contact data: postal address, telephone number, email address.
Location data: last known address, presumed place of residence, in connection with searches for missing persons or beneficiaries.
Supporting documents: copy of identity document, civil-status records, notarial deeds, certificates of heirship, CV, diplomas and professional certificates.
Economic and financial data: reference and nature of an asset (bank account, safe-deposit box, cheque), bank details, solvency information, patrimonial or estate-related data.
Professional data: position, mandates, shareholdings, business connections, career history, areas of operation.
Special categories and highly personal data: parentage data that may indirectly reveal an origin, sensitive family ties or a state of health; data relating to criminal convictions, offences or judicial proceedings; status as a politically exposed person (PEP) or a match on international sanctions lists. These categories are subject to enhanced vigilance and restricted access.

Data collected from open sources (OSINT, social media, press) may incidentally reveal special categories of data (opinions, health, origin) concerning the person sought or those around them. FAST Search Luxembourg undertakes to retain and use only the elements strictly relevant to the purpose pursued and to discard any irrelevant sensitive data as soon as it is identified.

3. Purposes of processing and legal bases

FAST Search Luxembourg processes personal data for specified, explicit and legitimate purposes, within the framework of the assignments entrusted to it. The main purposes and applicable legal bases are as follows:

Handling and performance of the client mandate: the receipt of the request, the scoping of the file, the preparation of the final report and its transmission to the principal are based on the performance of the contract concluded with the principal or on the pre-contractual measures taken at its request. Without this data, FAST Search Luxembourg could neither open the file nor deliver the results of its research.
Genealogical research and identification of beneficiaries: the reconstruction of a family tree and the identification of potential heirs or beneficiaries are based on the legitimate interest of FAST Search Luxembourg and its principal in locating the rightful beneficiaries of an estate. A legitimate interest assessment (LIA) is carried out for this processing. In this context, FAST Search Luxembourg may be required to contact the relatives and heirs of deceased persons directly in order to gather the information and supporting documents necessary to identify the rightful heirs and successfully complete the engagement.
Open-source research (OSINT) and use of local correspondents: locating a person whose address is unknown, as well as the use of local correspondents or investigators abroad for on-site checks, are also based on the legitimate interest of FAST Search Luxembourg, subject to a documented proportionality assessment (LIA).
Screening against sanctions lists and politically exposed persons: the verification of the name of a person or institution against international sanctions lists and politically exposed persons databases is carried out in order to meet the due diligence obligations incumbent on FAST Search Luxembourg’s principal (financial institution, insurer, undertaking subject to anti-money laundering obligations). This legal basis must be confirmed on a case-by-case basis according to the regulatory status of the principal.
Analysis and assessment of the risk level (profiling): the synthesis and weighting of the collected elements to establish an overall risk level constitutes a profiling operation within the meaning of Article 4(4) of the GDPR. This processing is based on the legitimate interest of FAST Search Luxembourg and its principal, is subject to a legitimate interest assessment, and may require a data protection impact assessment (DPIA) where sensitive or judicial data are involved.
Verification of identity, documents and references: checking the authenticity of identity documents, diplomas, certificates and professional references is based on the consent of the data subject (candidate, employee, contractual partner) where they themselves provide their documents or designate their referees.
Judicial and financial verification: checking a person’s criminal record and financial situation is based on the explicit consent of the data subject, within the limits permitted by applicable law and in direct connection with the position, contract or business relationship concerned.
Archiving of research and verification files: keeping the complete file (steps taken, sources consulted, correspondence, final report) meets a legal obligation of traceability and proof of due diligence, as well as FAST Search Luxembourg’s legitimate interest in being able to justify the services performed in the event of a dispute.
Administrative management and invoicing of the mandate: the issuance of invoices and the accounting management of the relationship with the principal are based on the performance of the contract and on the legal obligations to retain accounting records imposed by the Luxembourg Commercial Code.

In any event, FAST Search Luxembourg undertakes not to further process the data in a manner incompatible with the purposes for which it was initially collected. Any new purpose not provided for in this policy will be subject to prior information of the data subjects and, if necessary, to the collection of their consent.

Information of data subjects in the event of indirect collection: where data is collected from the principal, from open sources or from third parties rather than from the data subject themselves, FAST Search Luxembourg endeavours to comply with its information obligation under Article 14 of the GDPR. In certain cases, this information may be deferred, limited or omitted where it proves impossible or would require disproportionate effort, or where it would be likely to compromise the objective of the research or verification in progress (for example, before the definitive identification of a beneficiary or the finalisation of a reputation check). FAST Search Luxembourg documents the reasons for any derogation from this principle.

4. Data retention periods

FAST Search Luxembourg retains personal data for the period strictly necessary for the purposes for which it was collected, subject to the applicable legal retention obligations. By way of indication, as set out in the internal records of processing:

Files concerning heirs and missing persons: retained for the duration of the mandate, then archived for a period of, in principle, 10 years from the end of the mandate. Under Luxembourg law, the action for petition of inheritance remains subject to the ordinary 30-year limitation period under Article 2262 of the Civil Code. This 30-year period must not, however, be applied by default; in accordance with the minimisation principle, it is justified only where a risk of late challenge has been specifically documented with the principal.
Files relating to dormant assets (accounts, safe-deposit boxes): the information and documents relating to the account (identification of the holder, last transaction, balance before deposit) are retained for the entire duration of the deposit of inactive bank assets, then for a further 5 years after the end thereof (Annex 3 of the Law). FAST Search Luxembourg aligns the retention of its own file with this same period where the mandate so provides.
Due diligence and background-check files: customer due diligence documents are retained for 5 years after the end of the business relationship or the transaction concerned, extendable for a further 5 years (10 years maximum) where necessary and documented.
Copies of identity documents and supporting documents: deleted as soon as the corresponding verification has been carried out, unless their retention is required under one of the points above.
Accounting and invoicing records: retained for 10 years from the close of the accounting year concerned.

5. Recipients of the data

Access to personal data is strictly limited to the persons and entities that need it in the performance of their duties. FAST Search Luxembourg does not sell or rent personal data to third parties for commercial purposes.

Within FAST Search Luxembourg: the staff assigned to the file concerned, in accordance with authorisation rules limiting access to the data necessary for their role.
The principal: the bank, insurer, notarial office, business or individual behind the request, recipient of the final report and, as the case may be, of certain interim data.
Local correspondents and investigators abroad: partners responsible for on-site checks where the person sought is located outside Luxembourg or the European Union. These providers access only the data strictly necessary for their assignment.
Providers of sanctions and politically exposed persons databases: technical recipients in connection with screening operations.
IT service providers: processors ensuring the hosting, maintenance or security of FAST Search Luxembourg’s information systems, bound by contractual obligations compliant with Article 28 of the GDPR.
External HR providers: where applicable, payroll or recruitment-management providers acting for the administrative management of staff.
External advisers: lawyers, auditors or statutory auditors, where necessary for the defence of FAST Search Luxembourg’s rights or compliance with audit obligations.

In the event of a legal request from a competent judicial or administrative authority, FAST Search Luxembourg may be required to disclose certain data, within the limits imposed by law. In the event of a data breach likely to create a risk to the rights and freedoms of the data subjects, the National Commission for Data Protection (CNPD) will be notified within 72 hours in accordance with Article 33 of the GDPR.

6. Transfers of data outside the European Union

Certain activities of FAST Search Luxembourg involve the use of correspondents or investigators located outside the European Union, in particular where the person sought is located abroad. Such processing may give rise to a transfer of data outside the EU/EEA.

Where such a transfer is made to a country recognised by the European Commission as offering an adequate level of protection (adequacy decision), no additional safeguard is required. In other cases, FAST Search Luxembourg ensures that the transfer is governed by appropriate safeguards within the meaning of Chapter V of the GDPR, in particular the Standard Contractual Clauses adopted by the European Commission, supplemented where necessary by additional measures.

7. Your rights as a data subject

In accordance with the GDPR, every data subject has the following rights, exercisable under the conditions described below:

Right of access: to obtain confirmation that data concerning them is being processed and to receive a copy thereof together with the information relating to that processing.
Right to rectification: to request the correction of inaccurate or incomplete data.
Right to erasure: to request the deletion of their data where it is no longer necessary for the purposes pursued, subject to legal retention obligations or the need to retain certain data for the establishment, exercise or defence of legal claims.
Right to object: to object, on grounds relating to their particular situation, to processing based on the legitimate interest of FAST Search Luxembourg, in particular to profiling or open-source research operations. FAST Search Luxembourg may refuse such objection if it demonstrates the existence of compelling legitimate grounds, in particular related to the mandate in progress.
Right to restriction of processing: to request the temporary suspension of processing, for example while the accuracy of contested data is being verified.
Right to data portability: for data provided directly and processed on the basis of consent or a contract, to request its return in a structured, machine-readable format.

These rights may be exercised by contacting FAST Search Luxembourg’s DPO at the details indicated in section 1. FAST Search Luxembourg may request proof of the requester’s identity before acting on the request. A response will be provided within the one-month period provided for by the GDPR, extendable by two months in the event of particular complexity, with prior information to the requester.

Given the nature of FAST Search Luxembourg’s activities (ongoing investigations, unfinalised files), the exercise of certain rights may be deferred or partially limited for as long as the disclosure of information would be likely to compromise the objective of the mandate in progress or would infringe the rights of a third party. The reasons for any refusal, total or partial, will be communicated to the requester.

8. Data security

FAST Search Luxembourg implements technical and organisational security measures appropriate to the risks presented by its processing, in accordance with Article 32 of the GDPR, in particular:

individualised and compartmentalised access control, limiting access to data to the strict need of each staff member;
encryption and securing of the transmission channels used to exchange documents with principals and correspondents;
confidentiality clauses applicable to staff and external correspondents having access to personal data;
secure storage of, and restricted access to, identity documents and sensitive documents;
data backup and restoration procedures;
an internal data-breach management procedure, providing for notification of the CNPD within 72 hours and, where applicable, information of the data subjects where the risk is high, in accordance with Articles 33 and 34 of the GDPR.

9. Subcontracting and shared responsibility

Where FAST Search Luxembourg uses processors to process personal data on its behalf (IT providers, local correspondents acting as processors, HR providers), contracts compliant with Article 28 of the GDPR are concluded. These contracts require the processors:

to process the data only on documented instructions from FAST Search Luxembourg;
to guarantee the confidentiality of the data;
to implement appropriate security measures;
not to engage other processors without prior authorisation;
to assist FAST Search Luxembourg in complying with the rights of data subjects;
to delete or return the data at the end of the contract.

10. Data relating to employees and candidates (summary)

As part of the management of its staff and its recruitment, FAST Search Luxembourg also processes personal data concerning its employees and job candidates. This processing is the subject of a dedicated data protection notice, provided directly to employees and candidates. This summary sets out its main points:

Administrative management and payroll: identity, contact details, bank details, tax and social security identification numbers, position held. Legal basis: performance of the employment contract and the employer’s legal obligations. Retention: generally 10 years.
Medical monitoring, absences and workplace accidents: identity, fitness statement, justification of absence, circumstances of an accident. Legal basis: legal obligation of the employer. Retention: duration of the contractual relationship or 10 years depending on the case.
Professional evaluations, training and disciplinary sanctions: identity, evaluation results, elements relating to a disciplinary dispute. Legal basis: legitimate interest of the employer. Retention: duration of the contractual relationship, or 3 years for disciplinary sanctions.
Criminal record check of employees: identity, position held. Legal basis: legal obligation related to fitness to hold the position. This data is not retained beyond the verification.
Applications: identity, contact details, career history, CV. Legal basis: pre-contractual steps. Retention: immediate deletion where the application is unsuccessful, or up to 2 years where the candidate consents to extended retention.
Employees’ image rights: processing based exclusively on the employee’s consent, which may be withdrawn at any time.

The recipients of this data include the human resources department, management, and FAST Search Luxembourg’s external HR providers (in particular for payroll and application management), bound by contractual confidentiality obligations. Employees and candidates have the same rights as those described in section 7 of this policy, to be exercised with FAST Search Luxembourg’s DPO.

11. Changes to the privacy policy

This privacy policy may evolve in order to reflect changes in FAST Search Luxembourg’s processing practices or legal and regulatory changes. In the event of a substantial update, FAST Search Luxembourg will inform the data subjects through the appropriate channels. It is recommended to consult this document regularly in order to be aware of its latest version in force.

Last updated: July 2026