.png)
Privacy notice
This document is intended to inform you about how Luxinnovation processes your personal data (hereafter “Your Data”) in accordance with the rules set by European Parliament and Council Regulation (EU) 2016/679 of 27 April 2016 relating to the protection of natural persons and the processing of personal data (hereafter “GDPR”), when you register online for an event (organized or co-organized by Luxinnovation) and/or when you join the Virtual Lab.
In all cases, Luxinnovation is committed to observing the data minimisation principle and ensures that only appropriate and relevant data are processed as required for the purposes defined.
Who is the Controller?
Luxinnovation GIE (hereinafter "Luxinnovation" or the "Data Controller"), is registered under number C16 in the Luxembourg Trade Register. Its head office is located at 5, Avenue des Hauts-Fourneaux L-4362 ESCH-sur-ALZETTE.
Luxinnovation is the Data controller, which means that Luxinnovation determines the purposes and means of processing Your Data as part of your registration for organized or co-organized events and/or your request for membership in the Virtual Lab offered on the sidelines. of these events.
On rare occasions, it may happen that Luxinnovation is not Data controller for the organization of an event, but Joint Manager. In this specific case, this will be mentioned in the disclaimer of the event concerned, located at the bottom of the registration form.
What are the personal data that are collected?
“Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject").
When you register to participate in an event or to request your membership to the Virtual Lab, here is the data collected by Luxinnovation :
- Identification details: Name(s), first name(s), Job title and Company name,
- Contact details : e-mail address
In the specific case of the Virtual Lab, this data will be visible to all members of the group, with the exception of the email address which remains strictly private. The data subject can also enter other fields: the company's website and an avatar (a photo or any other image chosen by the data subject).
What is the lawful basis of those processing operations?
The GDPR requires that any processing be based on one of the six lawful basis it lists:
- the need for the performance of a contract concluded with the data subject or pre-contractual measures at the latter’s request,
- a legal obligation, · the protection of the vital interests of a natural person,
- the fact that the processing is required for Luxinnovation to fulfil its public interest missions or,
- the legitimate interest of the controller.
You participate in one or more events organized by Luxinnovation, alone or in partnership with other Luxembourg organizations, you are a member of the Virtual Lab, Your Data is processed for the following purposes:
- identify yourself to register for the event in which you wish to participate and/or to submit your Virtual Lab membership request,
- send you email notification of information about the event and/or the Virtual Lab,
- offer you satisfaction surveys by e-mail on the events for which you are registered,
- share your data with the co-organizers (these are the Luxembourg institutional partners of Luxinnovation, exclusively located in the Grand Duchy) of the events for which you are registered,
- keep track of your participation history in our events,
- feed statistical studies carried out by Luxinnovation,
- inform you when a contact request or a new message is sent to you via the Virtual Lab.
Why and how does Luxinnovation share Your Data?
Your Data is only processed by Luxinnovation employees, i.e. by duly authorized persons, within the limits of their respective mission.
In the case of events co-organised with its Luxembourgish institutional partners (national federations, ministries, administrations, embassies, professional chambers), Luxinnovation may be required to transfer them Your Data for information and/or statistical purposes.
This sharing of personal data is carried out via a write-protected file (which cannot be copied, modified or extracted) in a container whose access rights are reserved for authorized persons only.
In the case of the Virtual Lab, Luxinnovation does not share any personal data. The data is only accessible to group members.
How long will Your Data be kept?
On the event registration platform: personal data is deleted within 24 months from the date of the event for which you registered.
Protected Excel table shared and Luxinnovation and potential co-organisers: personal data is deleted within 10 days from the date it was made available.
Databases: the personal data collected when you register for events are stored in the Luxinnovation database. They are deleted within 36 months from the date of last contact, unless you assert your right to erasure (see below).
At the Virtual Lab level: Member profiles are kept for a period of 24 months from the validity of their membership. A notification is sent to them by our systems to invite them to renew their membership and their explicit consent. If the member does not wish to extend their membership, their profile is deleted but exchanges with other forum participants are retained; and their author and their profile are then anonymized (their contact details and photo/avatar no longer appear).
Luxinnovation may – at its sole discretion – decide unilaterally to dissolve the Virtual Lab. All data collected (member profiles) and all forum exchanges are then permanently deleted.
In the event of a request to exercise rights: the personal data of the applicants are deleted within 5 years from the date of sending the request, whatever the purpose (see below “your rights” ) or Luxinnovation's answer.
Services providers
In order to be able to provide our services, Luxinnovation uses the support of service providers. To ensure the protection of your personal data in this case, we conclude processing contracts with each service provider, which are selected according to strict criteria. All our subcontractors provide sufficient guarantees to implement appropriate technical and organizational measures. Our third country data processors are either located in a country offering an adequate level of data protection (Article 45 GDPR) or provide appropriate safeguards (Article 46 GDPR).
Adequate level of protection: The provider comes from a country whose level of data protection has been recognized by the European Commission. For more information, please see the following link:
EU Standard Contractual Clauses: Our provider has submitted to EU Standard Contractual Clauses to ensure secure transfer of data. For more information, please consult the following link:
What are your rights and how can you exercise them?
As a data subject, you have various rights. Below is a brief description of these rights and how you can exercise them.
- Right to information (GDPR, article 19): You can send us any questions regarding the recording and processing of Your Data.
- Right of access (GDPR, article 15): You may, at any time, and by written request to us, obtain confirmation that Personal Data concerning you is processed or not and, where applicable, obtain access to such data and a free copy thereof.
- Right to rectification (GDPR, article 16): You may, at any time, and via a written request addressed to us, obtain the rectification of any inaccurate personal data concerning you. You can also request that incomplete data be completed in the same way.
- Right to erasure (GDPR, article 17): You may, at any time, and by written request to us, obtain the deletion of Your Data, provided that one of the following reasons applies:
- the data is no longer necessary for the purposes for which it was collected and processed;
- you have withdrawn your consent on which the processing was based and there is no other legal basis for it;
§ you object to the processing and there is no compelling legitimate reason for it;
§ the data has been unlawfully processed; the data must be deleted in order to comply with a legal obligation.
- Right to limitation of processing: You may request, by sending a written request to us, that the processing be limited for one of the following reasons:
- you dispute the accuracy of the Personal Data (processing will be limited for the period necessary to verify the accuracy of the data);
- in the event of unlawful processing, you object to the deletion of Your Data and request that its use be limited;
- we no longer need Your Data for processing purposes, but it is still necessary for you to establish, exercise or defend legal claims;
- you have objected to the processing (the processing will be limited for the period necessary to verify the existence of legitimate grounds pursued by Luxinnovation that would prevail over yours).
Where processing restrictions are granted, personal data may, with the exception of storage, be processed only with the consent of the data subject, or for the establishment, exercise or defence of legal rights, or for the protection of the rights of another natural or legal person, or for important reasons relating to the public interest.
- Right of opposition (GDPR, article 21): You have the right to object, at any time and by sending a written request to us, for reasons relating to your particular situation, to the processing of Your Data based on the performance of a public mandate or necessary for the legitimate interests pursued by us.
We will no longer process such personal data unless it is demonstrated that there are legitimate and compelling reasons for processing that prevail over your interests and rights and freedoms, or for the establishment, exercise or defence of legal rights.
When your personal data is processed for the purpose of prospection, you have the right to object at any time to this processing.
- Right to portability (GDPR, article 20) : You have the right, by sending a written request to us, to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and to transmit such data to another controller without the firm hindering it, when:
- the processing is based on your consent or a contract; and
- the processing is carried out using automated processes.
- Right to withdraw consent (GDPR, article 13-2): Where the processing is based on your consent, you have the right to withdraw it at any time by sending a written request to us. The withdrawal of your consent will not affect the lawfulness of the processing operation based on the consent given before it was withdrawn.
- Right to lodge a complaint (GDPR, article 77): We make every effort to ensure that our legal obligations regarding data protection are respected and to respond as quickly as possible to any complaint addressed to us in this regard.
For any questions regarding the processing of your personal data carried out by Luxinnovation, and for any queries regarding the exercise of your rights, please contact the Luxinnovation DPO : dpo@luxinnovation.lu.
In the event that you are not satisfied with the response received, you have the option of filing a complaint with the Luxembourg supervisory authority:
Commission Nationale pour la Protection des Données (the “CNPD”)
15, Boulevard du Jazz
L-4370 Belvaux Grand-Duchy of Luxembourg
You also have the option of contacting the supervisory authority in your country. You will find the contact details of all the supervisory authorities here: https://edpb.europa.eu/about-edpb/board/members_en.
Changes to this Data Protection Notice
Luxinnovation undertakes to keep this Notice up to date, taking into account any changes in the processing of your personal data. In any case, the date will be modified accordingly.
Luxinnovation invites you to read this notice regularly when you use our online registration platform.
Last modified: November 2023
