Privacy notice of the University of Luxembourg (students)
Introduction
In accordance with transparency obligations of the EU Regulation 2016/679 General Data Protection Regulation (hereafter the “GDPR”), this Privacy Notice (hereafter “the Notice”) explains how the University of Luxembourg processes personal data in relation to students who apply, enrol or have enrolled with the University (“you”).
In addition to the information in this Notice, you may be given further information about the uses of your personal data when you sign up to use specific services and facilities we offer
Who are we?
The University of Luxembourg (hereinafter “University”, “we”, “our”, “us”) is a public higher education and research establishment, operating under the supervision of the Ministry for higher education. Under the GDPR, the University is the controller of data that we hold about you, which means we are legally responsible for the personal data we collect and hold about you.
The University of Luxembourg has its official address at:
Maison du Savoir
2, place de l’Université
L- 4365 ESCH-BELVAL
Phone number: Tel.: (+352) 46 66 44 1
Internet address: https://wwwen.uni.lu/university
Further information on how the University processes personal data is provided on the section of the University website dedicated to data protection.
The University has appointed a Data Protection Officer (DPO). If you need further assistance, please contact our DPO by email: dpo@uni.lu or by postal mail using the above-mentioned postal address specifying “to the attention of the Data Protection Office”.
Why does the University process your personal data and on which legal basis?
Overall, the University will use your personal data to manage your relationship with us as a student at the University and for the organization of your studies. The main purposes of our processing activities, and their corresponding legal bases, are the following:
-
Purpose
Providing higher education courses leading to degrees, diplomas and certificates in accordance with the Law of 27 June 2018 regarding the organisation of the University of Luxembourg (hereafter “the Law”). This involves delivering and administering courses including remote courses, ensuring continuous support, monitoring your attendance, advising student development, proceed to academic assessment, providing financial aid and communications with you.
-
Legal basis
For all personal data
Performance of a task carried out in the public interest The processing is necessary for the performance of a task carried out in the public interest by the University as a higher education institution under the Law (Article 6 para. 1 (e) GDPR)
Performance of a contract
The processing of your personal data may be necessary for the performance of the contract we have entered with you as a doctoral candidate (both student and employee) (Article 6 para. 1 (b) GDPR).For special categories of personal data
Management of health care systems / services
We may process your special category data where this is necessary for health and social care purposes with respect to the management of health care systems and services (Article 9 para. 2 (h) GDPR).Consent
There may be occasions when we process your personal data relating to health to facilitate your education, e.g. .to make reasonable adjustments in relation to a disability or to provide psychological support (Article 9 para. 2 (a) GDPR).Establishment, exercise or defence of legal claims
It may be necessary to process your special category data in relation the establishing, exercising or defending legal claims (Article 9 para. 2 (f) GDPR).
-
Purpose
Assessing your application and managing your admission to one of our study, research or innovation programs. For this purpose, the University must obtain accurate information concerning your academic and/ or professional record to evaluate whether or not you meet the conditions of access and admission referred in Articles 32 to 34 and 37 of the Law.
-
Legal basis
For all personal data
Performance of a task carried out in the public interest The processing is necessary for the performance of a task carried out in the public interest by the University as a higher education institution under the Law (Article 6 para. 1 (e) GDPR).
-
Purpose
For this purpose, we will contact the institutions that delivered the certificates and/or diplomas that you submit in the course of your application in order to verify their authenticity and prevent any frauds.
-
Legal basis
Legitimate interests
The processing is necessary for our legitimate interest (Article 6 para. 1 (f) GDPR), consisting in preventing frauds in the course of the student application process and thus protecting the reputation of the University.
-
Purpose
Performing administrative proceedings in relation to your enrolment as a student, where your application is successful and you accept our offer; to calculate, record and collect tuition fees as well as to verify and/or ensure your affiliation to the social security regime in Luxembourg (“Caisse Nationale de Santé” or “CNS”).
-
Legal basis
For all personal data
Performance of a task carried out in the public interest The processing is necessary for the performance of a task carried out in the public interest by the University as a higher education institution under the Law (Article 6 para. 1 (e) GDPR).
Performance of a contract
The processing of your personal data may be necessary for the performance of the contract we have entered with you as a student of the University (Article 6 para. 1 (b) GDPR)..
Compliance with a legal obligation
The processing of your personal data may also be necessary for compliance with our legal obligations under Article 6 para. 1 (c) GDPR (e.g. immigration, visas).The processing of your CNS unique identifier is necessary in order to verify and/or ensure your affiliation to the social security regime in Luxembourg, either you are EU student or non-EU student, in accordance with requirements of article 32 para.5 of the Loi du 27 juin 2018 ayant pour objet l’organisation de l’Université du Luxembourg.
For special categories of personal data
Employment and social security and social protection law
Where obligations or rights exist in the field of employment or social protection law we may rely on this condition (e.g with respect to doctoral candidates) Article 9 para. 2 (b) GDPR.
-
Purpose
Entering into and performing our contractual relationship with doctoral candidates having a double status of student and employee.
-
Legal basis
For all personal data
Performance of a contract
The processing of your personal data may be necessary for the performance of your employment relationship with the University (Article 6 para. 1 (b) GDPR).
Performance of a task in the public interest
The processing of data in relation to self-funded doctoral candidates, not having an employment relationship with the University, is public interest (Article 6 para. 1 (e) GDPR) as self-funded doctoral candidates will be benefiting from their doctoral education and education is in the mission of the University given by the law.
For special categories of personal data
Employment and social security and social protection law
Where obligations or rights exist in the field of employment or social protection law we may rely on this condition Article 9 para. 2 (b) GDPR.
-
Purpose
If you apply for a student job or for and internship at the University
-
Legal basis
For all personal data
Performance of a contract
The processing is necessary for the implementation of pre-contractual measures taken at your request or for the performance of your work contract with the University (Article 6 para. 1 (b) GDPR).
For special categories of personal data
Employment and social security and social protection law
Where obligations or rights exist in the field of employment or social protection law we may rely on this condition.
-
Purpose
If you apply for an internship in the course of your study program to companies and/ or organisations and/or institutions (e.g., Ministries, hospitals, medical practice, …)
As part of the management of internships of students in Medicine and Nursing study programs, the University uses the Magic Moving Pixel platform (provided by Magic Moving Pixel S.A acting as processor under the University’s instructions) to manage internships more efficiently.
-
Legal basis
For all personal data
Performance of a contract
The processing is necessary for the implementation of pre-contractual measures taken at your request or for the performance of your internship agreement with the University and the hosting company/organisation/institution (Article 6 para. 1 (b) GDPR).For special categories of personal data
Processing is necessary for health and social care purposes with respect to the management of health care systems and services
Where you are in a course related to Medicine/ Nursing and need to undertake an internship in a hospital/ medical practice. Sensitive data concerning you is collected in order to assess whether you can work with persons in a healthcare situation.
-
Purpose
Providing educational resources and ICT facilities to our students ([such as/or through our] Moodle, the University’s course management platform).
The information notice regarding the processing of your personal data in Moodle is detailed on the Moodle Platform.
-
Legal basis
Performance of a task carried out in the public interest The processing is necessary for the performance of a task carried out by the University as a higher education institution under the Law (Article 6 para. 1 (e) GDPR).
-
Purpose
Providing access to resources of the University library (hereinafter the “BUL”), the Luxembourg National Library and the libraries that are members of the network Bibnet.lu.
This includes possibility to suggest to you a catalogue of resources available at BUL and Bibnet.lu based on the courses to which you are registered on Moodle. To this aim, the platform of the National Library is fed by our students’ database.
-
Legal basis
Legitimate interest
The processing is necessary for our legitimate interest (Article 6 para. 1 (f) GDPR), consisting in providing library resources to students which are necessary for the their study programs.
-
Purpose
If you apply for student mobility or a double degree programme. In this context, we process the personal data you submit to the University for the purposes of i) your participation in the student mobility/ double degree programme and ii) the designation of a host University for your student mobility.
As part of the management of student mobility, the University uses the MoveON platform (provided by QS Unisolution acting as processor under the University’s instructions) to manage student mobility more efficiently and to make easier the filling-in and updating of forms, the creation of dashboards and reports.
-
Legal basis
Performance of a task carried out in the public interest
The processing is necessary for the performance of a task carried out in the public interest by the University as a higher education institution under the Law (Article 6 para. 1 (e) GDPR). The Law of 27 June 2018 concerning the organisation of the University of Luxembourg establishes that Bachelor students shall accomplish 30 ECTS in a foreign institution.
Performance of a contract
In case of Master students and students in double-multiple, dual or joined degrees, the legal basis for the processing of personal data may also be the performance of the mobility contract (Art. 6 para. 1 (b) GDPR). More details will be provided when applying for the student mobility or relevant program.
Legitimate interests
The processing of student mobility data on the MoveON platform is necessary for a legitimate interest pursued by the University under Art 6 para. 1 (f) GDPR which consists of ensuring the management of the student mobility and the promotion of the student mobility opportunities.
-
Purpose
As part of funding and financial support, for instance if you apply for a scholarship or bursary
-
Legal basis
Performance of a contract
The processing is necessary for the implementation of pre-contractual measures taken at your request or for the performance of your contract with the University under Article 6 para. 1 (b) GDPR).
-
Purpose
For Alumni activities. The University will communicate personal data submitted as part of your enrolment/re-registration with the University (e.g. contact details, including your private email address, and information regarding your studies at the University, degree, time of graduation), to the Alumni Relations Office of the University, for the purpose of providing you information about Alumni opportunities and for conducting surveys after your graduation.
The information notice regarding the processing of your personal data as Alumni is detailed on the Alumni platform.
-
Legal basis
Legitimate interests
For our alumni activities, we rely upon the legitimate interest of the University and that of our Alumni (i.e. communicating with our Alumni as part of the extended University community).
-
Purpose
Management and resolution of conflicts and cases.
The University may offer the support of the Ombuds office for conflict resolution when students seek for the Ombuds’s support in case of disputes and conflicts
-
Legal basis
Legitimate interest
The processing is necessary for our legitimate interest (Article 6 para. 1 (f) GDPR), consisting in conflict management and mediation within the University, thus offering support to the University students.
-
Purpose
For CCTV (video surveillance). The University has implemented a system across all its campuses.
The information notice regarding the processing of your personal data for video surveillance activities of the University is detailed on the University website. -
Legal basis
Legitimate interests
The processing is necessary for our legitimate interest (Article 6 para. 1 (f) GDPR) as detailed in the dedicated information notice about CCTV on the website of the University.
-
Purpose
Monitoring, analysing, and investigate information security events and incidents, ensuring compliance with regulatory requirements, and maintaining the overall security posture of the University.
This includes collection and storage of security logs on applications of the central administration of the University used by students.
-
Legal basis
Legitimate interests
The processing is necessary for our legitimate interest (Article 6 para. 1 (f) GDPR) consisting in ensuring proper management of information security events and incidents occurring at the University.
-
Purpose
For the management of our website. We process personal data with every visit to our website
-
Legal basis
Legitimate interests
The processing is necessary for our legitimate interest (Article 6 para. 1 (f) GDPR) (i.e providing access to and protecting our website). The information notice regarding the processing in relation with the University website is detailed on the University website.
-
Purpose
The University organises numerous events and may take photographs or videos.
You will be notified before the event if the University intends to film and/or take photographs and/or onsite. If you do not wish to be photographed or filmed, please contact the organisers of the event.
-
Legal basis
Legitimate interests
Depending on the circumstances under which the photographs or videos are taken, the legal basis of this processing activity is the legitimate interests of the University under Article 6 para. 1 (f) GDPR (i.e. internal or external communication).
Consent
In other cases, consent will be requested for taking and publishing photos or video recordings.
-
Purpose
The University may invite you to participate to surveys as part of the application process and during your studies. For the purpose of such surveys we will collect and process personal data regarding your educational background, motivation to apply, study experience, and your economic and professional situation.
The University may also invite you to participate to surveys and interviews in some specific cases (e.g. you did not pursue your study program).
Participation is on a voluntary basis. More details are provided in the specific privacy notice of the respective survey.
-
Legal basis
Legitimate interests
The processing is necessary for our legitimate interest (Article 6 para. 1 (f) GDPR) (i.e. collect the students’ opinion, identify areas for improvement and allow decision-making).
-
Purpose
Generation of empirical indicators.
The University will use personal data related to you that is already collected and available in its databases in order to generate empirical indicators for statistics and institutional reporting.
-
Legal basis
Legitimate interests
The processing is necessary for our legitimate interest (Article 6 para. 1 (f) GDPR) (i.e. generation of empirical indicators in order to allow statutory reporting of the University ie. to the government).
-
Purpose
The University may process your personal data in the event of any emergency that requires the University’s assistance.
-
Legal basis
Your personal data may be processed by the University and transferred to the emergency services where this is necessary in order to protect your vital interests (Article 6 para. 1 (d) and Article 9 para. 2 (c) GDPR).
Vital interests are those relating to medical issues. For example, if a student collapses during a class, the professor will share the personal data of the student (name and surname) with the paramedics taking care of the student.
-
Purpose
The University may process your personal data for providing support to refugees.
-
Legal basis
In relation to this support, we will seek to obtain your consent to the processing of your personal data (Article 6 para. 1 (a) GDPR)
FAQ on the Privacy notice for students of the University of Luxembourg
The categories of personal data processed is detailed below:
- Personal identification data: name, surname, preferred name, student number, sex, title, address, telephone number, nationality, second nationality (if applicable), date of birth, country of birth, place of birth, CNS unique identifier. We may need to retain a copy of your identification documentation (copy of ID or passport).
- Electronic data: private email address and student email address and student account data (login details, IP addresses, logs), information about your use of our information and communications systems.
- Education information: admission records, schools and universities you have attended, examination results, ECTS achieved, study programme, semester, faculty, level of studies, examination records, certificates and/or diplomas, language skills, incident record, your feedback on course provision, University services and student experience, and information captured in your student record.
- Professional experience: data contained in CV, placement and internship record.
- Fees and other financial data: credit card, bank account number, financial support record including records relating to the fees paid, financial support, scholarships, and sponsorship). Credit card data is collected when making an online payment. Further information can be found at: https://www.six-payment-services.com/en/services/legal/privacy-statement.html .
- Banking data: IBAN, BIC, bank name, bank account holder. Banking data is collected when you are eligible for a grant (e.g. when applying for a scholarship during your student mobility).
- Immigration information concerning Visa and passport.
- Information gathered through our CCTV video surveillance. More information can be found on the information notice about CCTV on the website of the University.
- Emergency contact information (name and telephone number) of a third party.
- Photos and/or video images: visual materials, promotional materials, camera images;
- Data related to disputes: type of dispute/case, any data that the student voluntarily discloses to the Ombuds (e.g. mental health problems, correspondence, etc.);
- Security logs (e.g. user authentication logs) on an application which could contain an IP address or a username of the employees as users.
The University collects the vast majority of the information directly from you, through the application process and during online registration. We also work closely with third parties (including, for example, funding and sponsorship partners, educational institutions, examination boards, and may receive information about you from them. In particular, we may receive the following information from third parties: examination or test results, evidence of sponsorship (e.g. scholarship, bursary).
The University does not carry out automated decision-making for the above-mentioned purposes.
The categories of sensitive data processed is listed below:
- Data concerning health (disabilities): where you choose to indicate the University of any special disability in order to make the reasonable adjustments. Reasonable adjustments are defined by Articles 38 and 39 of University Law 27 June 2018. Is based on Article 9 para. 2 a) GDPR as it will be asked you to give your explicit consent to the processing of health data for providing reasonable adjustments.
- Data concerning health (others): where you are, for instance, in a course related to Medicine/ Nursing and need to undertake an internship in a hospital/ medical practice. Sensitive data concerning you is collected in order to assess whether you can work with persons in a healthcare situation (processing is necessary for health and social care purposes with respect to the management of health care systems and services).
- Other data: during your studies you may encounter distress and/or other difficulties. The University offers free and confidential advice and support for mental health, learning support in case of disability, (is based on your explicit consent under Article 9 para. 2 (a) GDPR).
Your personal data collected as part of your application/re-registration will be communicated:
Internal recipients
- to the Student Administration (Service des Etudes et de la Vie Etudiante – SEVE). SEVE is the main office in charge of all matters relating to your admissions, enrollment and academic support (progress of your file, payments, student support, student services/ life);
- to the relevant Faculty/ Interdisciplinary Centre in charge of your study program;
- to the Study Program administrators of your Faculty/ Interdisciplinary Centre for the correct functioning of your study program;
- to the lecturers and professors involved in conducting the courses you have enrolled to (name, surname);
- the International Relations Office in charge of your student mobility;
- to the Alumni Relations Office and Alumni network. For more information, please refer to the Alumni privacy notice;
- to the University Logistics Office in case you live in any of the student housing facilities;
- to the Litigation Committee in case you bring a claim before this administrative body;
- to the Office of Statistics and Institutional Research;
- to the Ombuds Office.
External recipients
- to public administrations located in Luxembourg such as the Ministry of Higher Education and Research, the Ministry of Education, Children and Youth, and the Ministry of Foreign and European Affairs.
- to the National Health Fund (“Caisse Nationale de Santé” or “CNS”) in order to ensure your enrolment to the social security regime of Luxembourg if you are a non-EU student;
- to other public administrations located abroad, insofar as this communication is necessary to comply with the University’s legal obligations or in the context of your application;
- to higher education institutions and/or professional associations located in Luxembourg, the European Union or beyond that cooperate with the University in the delivery of a study programme insofar as that is foreseen in the respective cooperation agreement and to the extent necessary for the purpose of delivering such study programme;
- to institutions that delivered certificates and/or diplomas that you submit in the course of your application in order to verify the authenticity of these documents;
- to the Fonds National de la Recherche (hereinafter “FNR”) in case you participate to a Project funded by the FNR for the purpose of the quality framework for Doctoral training;
- to the University library (hereinafter the “BUL”), the Luxembourg National Library and the libraries that are members of the network Bibnet.lu in order to give you access to the BUL’s resources. The BUL is a member of the library network Bibnet.lu;
- to the recipients involved in your student mobility if you enrol for student mobility. Information will be given later in the mobility privacy notice forms;
- to the organiser of an activity (name, surname, email, status) if you register in one of the activities offered by the Office of Student Life. You will need to register with Affluences in order to participate to these activities;
- to emergency services (e.g. police, firefighters, ambulance services…) in an urgent situation or in an emergency;
- to essential IT providers and cloud services providers (e.g. Microsoft,) acting under contract to the University, including Restena Foundation which is in charge of managing the security logs;
- to companies and/ or organisations and/or institutions (e.g., Ministries, hospitals/medical practice, etc.) that provide internship and/ or scholarship opportunities to students. The University will only share your personal identification data, your electronic data, your education information, your immigration information, and your emergency contact information;
- to the Magic Moving Pixel platform used for the management of internships in the course of Medicine and Nursing study programs;
- to student associations if you wish to register in one of these associations as part of your student life:
- to QS Unisolution (MoveOn) for the purposes of international mobility management. For more information about this platform, please refer to their website at: https://www.qs-unisolution.com/ ;
- to Streff Luxembourg, having its registered office at 138 Route d’ Arlon, 8008 Strassen, Luxembourg, for the archiving of student physical files. Streff Luxembourg is acting as a processor and is bound contractually with the University including the GDPR data protection requirements.
- to International SOS, having its registered office at Esplanade 1, 1020, Brussels, Belgium, for international advice and assistance worldwide. International SOS is acting as a processor if you wish to make use of their services when travelling abroad.
- to Cisco Systems Inc, having its registered office at 9-11 New Square Park Bedfont Lakes, Feltham, United Kingdom, for the purposes of providing online courses. Cisco Systems is acting as a processor and the University has entered into an agreement with Cisco in order to have a video conferencing solution. For more information about CISCO systems, please refer to their privacy policy: Cisco Webex Meetings Privacy Data Sheet.
Where information is shared with third parties, the University will seek to share the minimum amount necessary. For example, we may in appropriate cases share only your student number and not your name (this is known as pseudonymisation).
All third-party service providers that process data on our behalf are required to take appropriate security measures to protect your data in line with our policies. We do not allow them to use your data for their own purposes. We permit them to process your data only for specified purposes and in accordance with our instructions.
Your Personal Data is mainly processed within the European Union for the different purposes listed in section 2. For international mobility proper information about the transfer will be provided in the dedicated form. There may be occasions when we transfer your data outside of the European Economic Area, for example, if we communicate with you using a cloud-based service provider that operates outside of the European Economic Area. Generally, i.e. where the University transfers your personal data to a third party that is located in a country which does not have adequate privacy protection, the University will put in place a contract with the third party that includes the standard international data transfer contractual terms approved by the European Commission.
For instance, for the use of Microsoft and CISCO appropriate safeguards have been put in place by the University including the conclusion of the further agreements. For further information on the measures in place, please contact us using the details set out in the “Who are we?” section above.
The University will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for. Your personal data will be retained for in accordance with the University’s Data Retention Procedure. The retention periods we have defined depend on the purposes of our processing activities. After you leave the University certain parts of your personal data may be retained for archiving (e.g. to confirm your award and period of study).
According to the GDPR, you benefit notably from the following rights: right to be informed, right to access to your personal data, right to rectification, right to erasure, right to restrict the scope of the processing, right to object, right to data portability, right to lodge a complaint.
- Right to be informed: you have the right to know how your personal data is collected and used.
- Right to access you have the right to obtain a copy of the personal data we hold about you and to check whether it is lawfully processed.
- Right to rectification: you have the right to request the University to rectify any inaccurate personal data we hold about you.
- Right to erasure: you have the right to obtain from us the erasure of personal data concerning you without undue delay. This right will only apply where, for example, you consider that there is no good reason for us continuing to process it and your personal data are not necessary for us; or where you withdraw your consent if we are using your personal data based on your consent; or where you object to the way we process your data (in line with the Right to object mentioned below).. Note, however, that we may not always be able to comply with your request of erasure for specifical legal reasons which will be notified to you, if applicable at the time of your request.
- Right to restrict the processing: you have the right to suspend the processing of your personal data under certain circumstances (for instance if you want us to establish its accuracy or the reason for processing it).
- Right to object: you have the right to object on grounds relating to your situation, based on points (e) or (f) of Article 6 (1) GDPR.
- Right to data portability: in the instances where the processing is based on your consent and is carried out by automated means, you have the right to receive your personal data and to request the transmission of your data to another party.
- Right to withdraw consent: in the instances where you have consented to the processing, you can withdraw your consent at any time by contacting the relevant department.
The University provides further information on its website page to the exercice of rights section.
In practice, you can exercise your rights by doing a ticket on guichet étudiants Data Subject Rights – Students Service Portal
For any other question you can contact the Data Protection Office by sending an email to dpo@uni.lu.
Any request shall be processed by the University without undue delay, and where feasible no later than one (1) month after its receipt, at least in order to inform you about the status of your request. This period may be extended for two (2) additional months for complex cases or due to a high volume of requests. Please note that we may keep a record of your communications to help us resolve any issues which you raise.
If you remain unsatisfied, you have the right – without prejudice to any other administrative or judicial remedy – to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.
In Luxembourg, the competent authority is the Commission Nationale pour la Protection des Données (CNPD).
Contact of the CNPD:
Commission Nationale pour la Protection des Données
15, Boulevard du Jazz
Service des réclamations
L-4370 Esch-sur-Alzette
Tel. : (+352) 26 10 60 -1
Fax : (+352) 26 10 60 -29
You can also use their contact form, at:
Changes to this Notice
Any changes we make to this Notice in the future will be posted on the University’s website and, where appropriate, notified to you by e-mail.
Last update: on 18 November 2024.