Data Protection Office

Privacy notice for students

Introduction

In accordance with transparency obligations of the EU Regulation 2016/679 General Data Protection Regulation (hereafter the “GDPR”), this Privacy Notice (hereafter “the Notice”) explains how the University of Luxembourg processes personal data in relation to students who apply, enrol or have enrolled with the University (“you”).

In addition to the information in this Notice, you may be given further information about the uses of your personal data when you sign up to use specific services and facilities we offer.

Who are we?

The University of Luxembourg (hereinafter “University”, “we”, “our”, “us”) is a public higher education and research establishment, operating under the supervision of the Ministry for higher education. Under the GDPR, the University is the controller of data that we hold about you, which means we are legally responsible for the personal data we collect and hold about you.

The University of Luxembourg has its official address at:

MAISON DU SAVOIR
2, avenue de l’Université
L- 4365 ESCH-BELVAL
Phone number: Tel.: (+352) 46 66 44 1
Internet address: https://www.uni.lu/university

Further information on how the University processes personal data is provided on the section of the University website dedicated to data protection

The University has appointed a Data Protection Officer (DPO). If you need further assistance, please contact our DPO by email: dpo@uni.lu or by postal mail using the above-mentioned postal address specifying “to the attention of the Data Protection Office”.

Overall, the University will use your personal data to manage your relationship with us as a student at the University and for the organization of your studies. The main purposes of our processing activities, and their corresponding legal bases, are the following:

Higher education courses leading to degrees, diplomas and certificates
  • Purpose

    Providing higher education courses leading to degrees, diplomas and certificates in accordance with the Law of 27 June 2018 regarding the organisation of the University of Luxembourg (hereafter “the Law”). This involves delivering and administering courses including remote courses, ensuring continuous support, monitoring your attendance, advising student development, proceed to academic assessment, providing financial aid and communications with you.

  • For all personal data

    Performance of a task carried out in the public interest The processing is necessary for the performance of a task carried out in the public interest by the University as a higher education institution under the Law (Article 6 para. 1 (e) GDPR).

    Performance of a contract
    The processing of your personal data may be necessary for the performance of the contract we have entered with you as a doctoral candidate (both student and employee) (Article 6 para. 1 (b) GDPR).

    For special categories of personal data
    Management of health care systems / services
    We may process your special category data where this is necessary for health and social care purposes with respect to the management of health care systems and services (Article 9 para. 2 (h) GDPR).

    Consent
    There may be occasions when we process your personal data relating to health to facilitate your education, e.g. .to make reasonable adjustments in relation to a disability or to provide psychological support (Article 9 para. 2 (a) GDPR).

    Establishment, exercise or defence of legal claims
    It may be necessary to process your special category data in relation the establishing, exercising or defending legal claims (Article 9 para. 2 (f) GDPR).

Assessing your application and managing your admission
  • Purpose

    Assessing your application and managing your admission to one of our study, research or innovation programs. For this purpose, the University must obtain accurate information concerning your academic and/ or professional record to evaluate whether or not you meet the conditions of access and admission referred in Articles 32 to 34 and 37 of the Law.

  • For all personal data
    Performance of a task carried out in the public interest The processing is necessary for the performance of a task carried out in the public interest by the University as a higher education institution under the Law (Article 6 para. 1 (e) GDPR).

Administrative proceedings in relation to your enrolment
  • Purpose

    Performing administrative proceedings in relation to your enrolment as a student, where your application is successful and you accept our offer; to calculate, record and collect tuition fees as well as to verify and/or ensure your affiliation to the social security regime in Luxembourg (“Caisse Nationale de Santé” or “CNS”).

  • For all personal data
    Performance of a task carried out in the public interest The processing is necessary for the performance of a task carried out in the public interest by the University as a higher education institution under the Law (Article 6 para. 1 (e) GDPR).

    Performance of a contract
    The processing of your personal data may be necessary for the performance of the contract we have entered with you as a student of the University (Article 6 para. 1 (b) GDPR).

    Compliance with a legal obligation
    The processing of your personal data may also be necessary for compliance with our legal obligations under Article 6 para. 1 (c) GDPR (e.g. immigration, visas).

    The processing of your CNS unique identifier is necessary in order to verify and/or ensure your affiliation to the social security regime in Luxembourg, either you are EU student or non-EU student, in accordance with requirements of article 32 para.5 of the Loi du 27 juin 2018 ayant pour objet l’organisation de l’Université du Luxembourg.

    For special categories of personal data
    Employment and social security and social protection law
    Where obligations or rights exist in the field of employment or social protection law we may rely on this condition (e.g. with respect to doctoral candidates) Article 9 para. 2 (b) GDPR.

Entering into and performing our contractual relationship with doctoral candidates
  • Purpose

    Entering into and performing our contractual relationship with doctoral candidates having a double status of student and employee.

  • For all personal data
    Performance of a contract
    The processing of your personal data may be necessary for the performance of your employment relationship with the University (Article 6 para. 1 (b) GDPR).

    Performance of a task in the public interest
    The processing of data in relation to self-funded doctoral candidates, not having an employment relationship with the University, is public interest (Article 6 para. 1 (e) GDPR) as self-funded doctoral candidates will be benefiting from their doctoral education and education is in the mission of the University given by the law.

    For special categories of personal data
    Employment and social security and social protection law
    Where obligations or rights exist in the field of employment or social protection law we may rely on this condition Article 9 para. 2 (b) GDPR.

If you apply for a student job
  • Purpose

    If you apply for a student job or for and internship at the University

  • For all personal data
    Performance of a contract
    The processing is necessary for the implementation of pre-contractual measures taken at your request or for the performance of your work contract with the University (Article 6 para. 1 (b) GDPR).

    For special categories of personal data
    Employment and social security and social protection law
    Where obligations or rights exist in the field of employment or social protection law we may rely on this condition.

Providing educational resources and ICT facilities to our students
  • Purpose

    Providing educational resources and ICT facilities to our students ([such as/or through our] Moodle, the University’s course management platform). The information notice regarding the processing of your personal data in Moodle is detailed on the Moodle Platform.

    The information notice regarding the processing of your personal data in Moodle is detailed on the Moodle Platform.

  • Performance of a task carried out in the public interest The processing is necessary for the performance of a task carried out by the University as a higher education institution under the Law (Article 6 para. 1 (e) GDPR).

If you apply for student mobility or a double degree programme
  • Purpose

    If you apply for student mobility or a double degree programme. In this context, we process the personal data you submit to the University for the purposes of i) your participation in the student mobility/ double degree programme and ii) the designation of a host University for your student mobility.

    As part of the management of student mobility, the University uses the MoveON platform (provided by QS Unisolution acting as processor under the University’s instructions) to manage student mobility more efficiently and to make easier the filling-in and updating of forms, the creation of dashboards and reports.

  • Performance of a task carried out in the public interest
    The processing is necessary for the performance of a task carried out in the public interest by the University as a higher education institution under the Law (Article 6 para. 1 (e) GDPR). The Law of 27 June 2018 concerning the organisation of the University of Luxembourg establishes that Bachelor students shall accomplish 30 ECTS in a foreign institution.

    Performance of a contract
    In case of Master students and students in double-multiple, dual or joined degrees, the legal basis for the processing of personal data may also be the performance of the mobility contract (Art. 6 para. 1 (b) GDPR). More details will be provided when applying for the student mobility or relevant program.

    Legitimate interests
    The processing of student mobility data on the MoveON platform is necessary for a legitimate interest pursued by the University under Art 6 para. 1 (f) GDPR which consists of ensuring the management of the student mobility and the promotion of the student mobility opportunities.

As part of funding and financial support
  • Purpose

    As part of funding and financial support, for instance if you apply for a scholarship or bursary

  • Performance of a contract
    The processing is necessary for the implementation of pre-contractual measures taken at your request or for the performance of your contract with the University under Article 6 para. 1 (b) GDPR).

For Alumni activities
  • Purpose

    For Alumni activities. The University will communicate personal data submitted as part of your enrolment/re-registration with the University (e.g. contact details, including your private email address, and information regarding your studies at the University, degree, time of graduation), to the Alumni Relations Office of the University, for the purpose of providing you information about Alumni opportunities and for conducting surveys after your graduation. The information notice regarding the processing of your personal data as Alumni is detailed on the Alumni platform.

  • Legitimate interests
    For our alumni activities, we rely upon the legitimate interest of the University and that of our Alumni (i.e. communicating with our Alumni as part of the extended University community).

For CCTV (video surveillance)
  • Purpose

    For CCTV (video surveillance). The University has implemented a system across all its campuses.

    The information notice regarding the processing of your personal data for video surveillance activities of the University is detailed on the University website.

  • Legitimate interests
    The processing is necessary for our legitimate interest (Article 6 para. 1 (f) GDPR) as detailed in the dedicated information notice about CCTV on the website of the University.

For the management of our website
  • Purpose

    For the management of our website. We process personal data with every visit to our website

  • Legitimate interests
    The processing is necessary for our legitimate interest (Article 6 para. 1 (f) GDPR) (i.e providing access to and protecting our website). The information notice regarding the processing in relation with the University website is detailed on the University website.

For numerous events
  • Purpose

    The University organises numerous events and may take photographs or videos. You will be notified before the event if the University intends to film and/or take photographs and/or onsite. If you do not wish to be photographed or filmed, please contact the organisers of the event.

  • Legitimate interests
    Depending on the circumstances under which the photographs or videos are taken, the legal basis of this processing activity is the legitimate interests of the University under Article 6 para. 1 (f) GDPR (i.e. internal or external communication).
    Consent
    In other cases, consent will be requested for taking and publishing photos or video recordings.

To participate in surveys
  • Purpose

    The University may invite you to participate in surveys as part of the application process and during your studies. For the purpose of such surveys, we will collect and process personal data regarding your educational background, motivation to apply, study experience, and your economic and professional situation. Participation is on a voluntary basis. More details are provided in the specific privacy notice of the respective survey.

  • Consent
    In relation to surveys, we will seek to obtain your consent to the processing of your personal data (Article 6 para. 1 (a) GDPR).

In the event of any emergency
  • Purpose

    The University may process your personal data in the event of any emergency that requires the University’s assistance.

  • Your personal data may be processed by the University and transferred to the emergency services where this is necessary in order to protect your vital interests (Article 6 para. 1 (d) and Article 9 para. 2 (c) GDPR). Vital interests are those relating to medical issues. For example, if a student collapses during a class, the professor will share the personal data of the student (name and surname) with the paramedics taking care of the student.

For providing support to refugees
  • Purpose

    The University may process your personal data for providing support to refugees.

  • In relation to this support, we will seek to obtain your consent to the processing of your personal data (Article 6 para. 1 (a) GDPR)

Which standard personal data do we collect and further process?

The categories of personal data processed is detailed below:

  1. Personal identification data: name, surname, preferred name, student number, sex, title, address, telephone number, nationality, second nationality (if applicable), date of birth, country of birth, place of birth. We may need to retain a copy of your identification documentation (copy of ID or passport).
  2. Electronic data: private email address and student email address and student account data (login details, IP addresses, logs), information about your use of our information and communications systems.
  3. Education information: admission records, schools and universities you have attended, examination results, ECTS achieved, study programme, semester, faculty, level of studies, examination records, certificates and/or diplomas, language skills, incident record, your feedback on course provision, University services and student experience, and information captured in your student record.
  4. Professional experience: data contained in CV, placement and internship record.
  5. Fees and other financial data: credit card, bank account number, financial support record including records relating to the fees paid, financial support, scholarships, and sponsorship). Credit card data is collected when making an online payment. Further information can be found at Wordline S.A. Privacy Notice.
  6. Banking data: IBAN, BIC, bank name, bank account holder. Banking data is collected when you are eligible for a grant (e.g. when applying for a scholarship during your student mobility).
  7. Immigration information concerning Visa and passport.
  8. Information gathered through our CCTV video surveillance. More information can be found on the information notice about CCTV on the website of the University.
  9. Emergency contact information (name and telephone number) of a third party.
  10. Photos and/or video images: visual materials, promotional materials, camera images.

The University collects the vast majority of the information directly from you, through the application process and during online registration. We also work closely with third parties (including, for example, funding and sponsorship partners, educational institutions, examination boards, and may receive information about you from them. In particular, we may receive the following information from third parties: examination or test results, evidence of sponsorship (e.g. scholarship, bursary).

The University does not carry out automated decision-making for the above-mentioned purposes.

Which sensitive personal data do we collect and based on which derogation under Article 9 GDPR?

The categories of sensitive data processed is listed below:

  1. Data concerning health (disabilities): where you choose to indicate the University of any special disability in order to make the reasonable adjustments. Reasonable adjustments are defined by Articles 38 and 39 of University Law 27 June 2018. is based on Article 9 para. 2 a) GDPR as it will be asked you to give your explicit consent to the processing of health data for providing reasonable adjustments.
  2. Data concerning health (others): where you are, for instance, in a course related to Medicine/ Nursing and need to undertake an internship in a hospital/ medical practice. Sensitive data concerning you is collected in order to assess whether you can work with persons in a healthcare situation (processing is necessary for health and social care purposes with respect to the management of health care systems and services).
  3. Other data: during your studies you may encounter distress and/or other difficulties. The University offers free and confidential advice and support for mental health, learning support in case of disability, (is based on your explicit consent under Article 9 para. 2 (a) GDPR).

Who are the recipients of your personal data?

Your personal data collected as part of your application/re-registration will be communicated:

Internal recipients

  1. to the Student Administration (Service des Etudes et de la Vie Etudiante – SEVE). SEVE is the main office in charge of all matters relating to your admissions, enrollment and academic support (progress of your file, payments, student support, student services/ life);
  2. to the relevant Faculty/ Interdisciplinary Centre in charge of your study programme;
  3. to the Study Programme administrators of your Faculty/ Interdisciplinary Centre for the correct functioning of your study programme;
  4. to the lecturers and professors involved in conducting the courses you have enrolled to (name, surname);
  5. the International Relations Office in charge of your student mobility;
  6. to the Alumni Relations Office and Alumni network. For more information, please refer to the Alumni privacy notice;
  7. to the University Logistics Office in case you live in any of the student housing facilities;
  8. to the Litigation Committee in case you bring a claim before this administrative body;
  9. to the Office of Statistics and Institutional Research.

External recipients

  1. to public administrations located in Luxembourg such as the Ministry of Higher Education and Research, the Ministry of Education, Children and Youth, and the Ministry of Foreign and European Affairs.
  2. to the National Health Fund (“Caisse Nationale de Santé” or “CNS”) in order to ensure your enrolment to the social security regime of Luxembourg if you are a non-EU student;
  3. to other public administrations located abroad, insofar as this communication is necessary to comply with the University’s legal obligations or in the context of your application;
  4. to higher education institutions and/or professional associations located in Luxembourg, the European Union or beyond that cooperate with the University in the delivery of a study programme insofar as that is foreseen in the respective cooperation agreement and to the extent necessary for the purpose of delivering such study programme;
  5. to the Fonds National de la Recherche (hereinafter “FNR”) in case you participate to a Project funded by the FNR for the purpose of the quality framework for Doctoral training;
  6. to the University library (hereinafter the “BUL”), the Luxembourg National Library and the libraries that are members of the network Bibnet.lu in order to give you access to the BUL’s resources. The BUL is a member of the library network Bibnet.lu;
  7. to the recipients involved in your student mobility if you enrol for student mobility. Information will be given later in the mobility privacy notice forms;
  8. to the organiser of an activity (name, surname, email, status) if you register in one of the activities offered by the Office of Student Life. You will need to register with Affluences in order to participate to these activities;
  9. to emergency services (e.g. police, firefighters, ambulance services…) in an urgent situation or in an emergency;
  10. to essential IT providers and cloud services providers (e.g. Microsoft,) acting under contract to the University;
  11. to companies and/ or organisations and/or institutions (e.g., Ministries) that provide internship and/ or scholarship opportunities to students. The University will only share your personal identification data, your electronic data, your education information, your immigration information, and your emergency contact information.
  12. to student associations if you wish to register in one of these associations as part of your student life:
  13. to QS Unisolution (MoveOn) for the purposes of international mobility management. For more information about this platform, please refer to Quacquarelli Symonds (QS) Website ;
  14. to Streff Luxembourg, having its registered office at 138 Route d’ Arlon, 8008 Strassen, Luxembourg, for the archiving of student physical files. Streff Luxembourg is acting as a processor and is bound contractually with the University including the GDPR data protection requirements.
  15. to International SOS, having its registered office at Esplanade 1, 1020, Brussels, Belgium, for international advice and assistance worldwide. International SOS is acting as a processor if you wish to make use of their services when travelling abroad.
  16. to Cisco Systems Inc, having its registered office at 9-11 New Square Park Bedfont Lakes, Feltham, United Kingdom, for the purposes of providing online courses. Cisco Systems is acting as a processor and the University has entered into an agreement with Cisco in order to have a video conferencing solution. For more information about CISCO systems, please refer to their privacy policy: Cisco Webex Meetings Privacy Data Sheet .

Where information is shared with third parties, the University will seek to share the minimum amount necessary. For example, we may in appropriate cases share only your student number and not your name (this is known as pseudonymisation).

All third-party service providers that process data on our behalf are required to take appropriate security measures to protect your data in line with our policies. We do not allow them to use your data for their own purposes. We permit them to process your data only for specified purposes and in accordance with our instructions.

Does the University transfer your personal data outside of the European Union?

Your Personal Data is mainly processed within the European Union for the different purposes listed in section 2. For international mobility proper information about the transfer will be provided in the dedicated form. There may be occasions when we transfer your data outside of the European Economic Area, for example, if we communicate with you using a cloud-based service provider that operates outside of the European Economic Area. Generally, i.e. where the University transfers your personal data to a third party that is located in a country which does not have adequate privacy protection, the University will put in place a contract with the third party that includes the standard international data transfer contractual terms approved by the European Commission.

For instance, for the use of Microsoft and CISCO appropriate safeguards have been put in place by the University including the conclusion of the further agreements. For further information on the measures in place, please contact us using the details set out in the “Who are we?” section above.

How long does the University store your personal data?

The University will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for. Your personal data will be retained for in accordance with the University’s Data Retention Procedure. The retention periods we have defined depend on the purposes of our processing activities. After you leave the University certain parts of your personal data may be retained for archiving (e.g. to confirm your award and period of study).

What are your rights with regard to the processing of your personal data?

According to the GDPR, you benefit notably from the following rights: right to be informed, right to access to your personal data, right to rectification, right to erasure, right to restrict the scope of the processing, right to object, right to data portability, right to lodge a complaint.

  • Right to be informed: you have the right to know how your personal data is collected and used.
  • Right to access you have the right to obtain a copy of the personal data we hold about you and to check whether it is lawfully processed.
  • Right to rectification: you have the right to request the University to rectify any inaccurate personal data we hold about you.
  • Right to erasure: you have the right to obtain from us the erasure of personal data concerning you without undue delay. This right will only apply where, for example, you consider that there is no good reason for us continuing to process it and your personal data are not necessary for us; or where you withdraw your consent if we are using your personal data based on your consent; or where you object to the way we process your data (in line with the Right to object mentioned below).. Note, however, that we may not always be able to comply with your request of erasure for specifical legal reasons which will be notified to you, if applicable at the time of your request.
  • Right to restrict the processing: you have the right to suspend the processing of your personal data under certain circumstances (for instance if you want us to establish its accuracy or the reason for processing it).
  • Right to object: you have the right to object on grounds relating to your situation, based on points (e) or (f) of Article 6 (1) GDPR.
  • Right to data portability: in the instances where the processing is based on your consent and is carried out by automated means, you have the right to receive your personal data and to request the transmission of your data to another party.
  • Right to withdraw consent: in the instances where you have consented to the processing, you can withdraw your consent at any time by contacting the relevant department.

The University provides further information on its website page to the exercice of rights section.

In practice, you can exercise your rights by contacting directly the service in charge (SEVE) (open a ticket: for currently enrolled students, or for prospective students, alumni and others) that will liaise with the DPO, the contact details are dpo@uni.lu.

Any request shall be processed by the University without undue delay, and where feasible no later than one (1) month after its receipt, at least in order to inform you about the status of your request. This period may be extended for two (2) additional months for complex cases or due to a high volume of requests. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

If you remain unsatisfied, you have the right – without prejudice to any other administrative or judicial remedy – to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

In Luxembourg, the competent authority is the Commission Nationale pour la Protection des Données (CNPD).

Contact of the CNPD:

Commission Nationale pour la Protection des Données
1, avenue du Rock’n’Roll

Service des réclamations
L-4361 Esch-sur-Alzette

Tel. : (+352) 26 10 60 -1
Fax : (+352) 26 10 60 -29

You can also use their contact form.

Changes to this Notice

Any changes we make to this Notice in the future will be posted on the University’s website and, where appropriate, notified to you by e-mail.

Last update: on 6 October 2023.