Privacy notice
This document is intended to inform you about how Luxinnovation processes your personal data (hereafter “Your Data”) in accordance with the rules set by European Parliament and Council Regulation (EU) 2016/679 of 27 April 2016 relating to the protection of natural persons and the processing of personal data (hereafter “GDPR”), when you register online for an event (organized or co-organized by Luxinnovation).
In all cases, Luxinnovation is committed to observing the data minimisation principle and ensures that only appropriate and relevant data are processed as required for the purposes defined.
Who is the Controller?
Luxinnovation GIE (hereinafter "Luxinnovation" or the "Data Controller"), is registered under number C16 in the Luxembourg Trade Register. Its head office is located at 5, Avenue des Hauts-Fourneaux L-4362 ESCH-sur-ALZETTE.
Luxinnovation is the Data Controller, which means that it determines the purposes and means of processing Your Data in the specific context of your registration for the events it organizes.
What are the personal data that are collected?
« “Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject ».
When you register to participate in an event, here is the data collected by Luxinnovation :
• Identification details: Name(s), first name(s), Job title and Company name,
• Contact details : e-mail address
What is the lawful basis of those processing operations?
The GDPR requires that any processing be based on one of the six lawful basis it lists:
• the need for the performance of a contract concluded with the data subject or pre-contractual measures at the latter’s request,
• a legal obligation,
• the protection of the vital interests of a natural person,
• the fact that the processing is required for Luxinnovation to fulfil its public interest missions or,
• the legitimate interest of the controller.
You participate in event(s) that Luxinnovation organises, alone or in partnership with other Luxembourgish organisations, Your Data are processed for the following purposes:
If you are a candidate applying for a position at Luxinnovation, Your Data are processed for the following purposes:
• identify yourself and register for the event in which you wish to participate,
• send you by e-mail information about the event you have chosen,
• offer you satisfaction surveys by e-mail on the events for which you are registered,
• share your data with the co-organizers (partners of Luxinnovation and exclusively Luxembourgish entities) of the events to which you are registered,
• Keep track of your history of participation in our events.
Why and how does Luxinnovation share Your Data?
Your Data is only processed by Luxinnovation employees, i.e. by duly authorized persons, within the limits of their respective mission.
In the case of events co-organised with its Luxembourgish institutional partners (national federations, ministries, administrations, embassies, professional chambers), Luxinnovation may be required to transfer them Your Data for information and/or statistical purposes.
This sharing of personal data is carried out via a write-protected Excel file (which cannot be copied, modified or extracted) in a container with access rights restricted to authorized persons only.
How long will Your Data be kept?
On Registration platform: personal data is deleted as soon as the event has ended (the end is marked by sending the satisfaction form),
Protected Excel table shared and Luxinnovation and potential co-organisers: personal data is deleted within 10 days from the date it was made available,
Databases: personal data is deleted within 36 months from the date of the last contact.
Services providers
In order to be able to provide our services, we use the support of service providers. In order to ensure the protection of your personal data in this case, we conclude processing contracts with each service provider, which are selected according to strict criteria. All our subcontractors provide sufficient guarantees to implement appropriate technical and organizational measures. Our third country data processors are either located in a country offering an adequate level of data protection (Article 45 GDPR) or provide appropriate safeguards (Article 46 GDPR)
Adequate level of protection: The provider comes from a country whose level of data protection has been recognized by the European Commission. For more information, please see the following link:
https://commission.europa.eu/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en
EU Standard Contractual Clauses: Our provider has submitted to EU Standard Contractual Clauses to ensure secure transfer of data. For more information, please consult the following link:
Binding Corporate Rules: Article 47 of the GDPR provides for the possibility of ensuring data protection when transferring data to a third country via Binding Corporate Rules (BCRs). These are reviewed and approved by data security authorities within the framework of the consistency mechanism in accordance with Article 63 of the GDPR.
Consent: In addition, a transfer of data to a third country without an adequate level of protection will only take place if you have given us your consent for this purpose in accordance with Art. 49 sec. 1 bed. a) GDPR.
What are your rights and how can you exercise them?
As a data subject, you have various rights. Below is a brief description of these rights and how you can exercise them.
• Right to information (GDPR, article 19): You can send us any questions regarding the recording and processing of Your Data.
• Right of access (GDPR, article 15): You may, at any time, and by written request to us, obtain confirmation that Personal Data concerning you is processed or not and, where applicable, obtain access to such data and a free copy thereof.
• Right to rectification (GDPR, article 16): You may, at any time, and via a written request addressed to us, obtain the rectification of any inaccurate personal data concerning you. You can also request that incomplete data be completed in the same way.
• Right to erasure (GDPR, article 17): You may, at any time, and by written request to us, obtain the deletion of Your Data, provided that one of the following reasons applies:
- the data is no longer necessary for the purposes for which it was collected and processed;
- you have withdrawn your consent on which the processing was based and there is no other legal basis for it;
- you object to the processing and there is no compelling legitimate reason for it;
- the data has been unlawfully processed; the data must be deleted in order to comply with a legal obligation.
- Right to limitation of processing: You may request, by sending a written request to us, that the processing be limited for one of the following reasons:
- you dispute the accuracy of the Personal Data (processing will be limited for the period necessary to verify the accuracy of the data);
- in the event of unlawful processing, you object to the deletion of Your Data and request that its use be limited;
- we no longer need Your Data for processing purposes, but it is still necessary for you to establish, exercise or defend legal claims;
- you have objected to the processing (the processing will be limited for the period necessary to verify the existence of legitimate grounds pursued by Luxinnovation that would prevail over yours).
Where processing restrictions are granted, personal data may, with the exception of storage, be processed only with the consent of the data subject, or for the establishment, exercise or defence of legal rights, or for the protection of the rights of another natural or legal person, or for important reasons relating to the public interest.
• Right of opposition (GDPR, article 21): You have the right to object, at any time and by sending a written request to us, for reasons relating to your particular situation, to the processing of Your Data based on the performance of a public mandate or necessary for the legitimate interests pursued by us.
We will no longer process such personal data unless it is demonstrated that there are legitimate and compelling reasons for processing that prevail over your interests and rights and freedoms, or for the establishment, exercise or defence of legal rights.
When your personal data is processed for the purpose of prospection, you have the right to object at any time to this processing.
• Right to portability (GDPR, article 20) : You have the right, by sending a written request to us, to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and to transmit such data to another controller without the firm hindering it, when:
- the processing is based on your consent or a contract; and
- the processing is carried out using automated processes.
- Right to withdraw consent : Where the processing is based on your consent, you have the right to withdraw it at any time by sending a written request to us. The withdrawal of your consent will not affect the lawfulness of the processing operation based on the consent given before it was withdrawn.
- Right to lodge a complaint: We make every effort to ensure that our legal obligations regarding data protection are respected and to respond as quickly as possible to any complaint addressed to us in this regard.
For any questions regarding the processing of your personal data carried out by Luxinnovation, and for any queries regarding the exercise of your rights, please contact the Luxinnovation DPO : DPO@luxinnovation.lu.
In the event that you are not satisfied with the response received, you have the option of filing a complaint with the Luxembourg supervisory authority:
Commission Nationale pour la Protection des Données (the “CNPD”)
15, Boulevard du Jazz
L-4370 Belvaux Grand-Duchy of Luxembourg
You also have the option of contacting the supervisory authority in your country. You will find the contact details of all the supervisory authorities here: https://edpb.europa.eu/about-edpb/board/members_en.
Changes to this Data Protection Notice
Luxinnovation undertakes to keep this Notice up to date, taking into account any changes in the processing of your personal data. In any case, the date will be modified accordingly.
Luxinnovation invites you to read this notice regularly when you use our online registration platform.
Last modified: September 2023
