General information notice
The University of Luxembourg (the University), 2 rue de l’Université, L-4365 Esch-sur-Alzette commits to protect your personal data in accordance with the General Data protection Regulation UE 2016/679 (“GDPR”)
This notice related to personal data processing aims to inform users and visitors of the University website and the individuals who contact us in any way of communication or are interacting with the University in its mission of education or research or who provide us with services
Your personal data may be collected and processed for a specific purpose. If this specific purpose is not expressly specified in this information notice, you will be informed in advance about this specific purpose in a separate information notice.
Who is the controller of your personal data?
The University is the controller of your personal data. This information notice explains how the University handles personal data.
What personal data does University process?
The University always has a purpose for processes personal data, and does not process more data than is necessary for that purpose.
The University receives personal data directly from you or from a third party which is authorised or required to share this personal data with the University.
We may collect different categories of personal data related to you such as:
- Name and address details ( e.g Name, adress, postal code, country);
- Age and date of birth;
- Contact details (e.g email address(es) and telephone number(s);
- Education & professional experience (e.g CV, certificates, diplomas);
- Financial data e.g IBAN, credit card details, salary, income, statements of expenses;
- Identification data e.g ID document number, passport photo;
- Photos and video images in the context of events;
- Academic research e.g data processed in the context of academic research;
- Student file related data;
- Alumni related data;
The data collected on the website of the University of Luxembourg stem exclusively from the voluntary registering of your personal data, for example by subscribing to our newsletter, by registering to an event, by filling online forms.
The University also processes cookies on its website. Information is provided on the University’s cookie notice.
Purposes of the processing
The University of Luxembourg processes personal data for the following purposes:
- For performing our mission of education as defined in the University law;
- For performing our mission of research as defined in the University law;
- For operational management
- For video-surveillance in order to secure our buildings and the persons coming to these buildings
- For managing the newsletters
- For Alumni activities
- For the management and optimisation of the University’s website
- When necessary for recording lectures
- For the provision of services requested by you
Legal basis for the processing of personal data at the University
Whenever the University of Luxembourg processes your personal data, it does so with a legal basis.
The University primarily process your personal data to perform its public tasks of education and research. Students data and candidates to Maters and Bachelors is processed to fulfill its mission of education.
The University process your personal data in the context of academic research. The University does this in the public interest, in the legitimate interest of the University’s partners or in its legitimate interest or based on your consent. You will always be specifically informed about this in a dedicated information notice.
However, the University may also process your personal data:
- To perform a contract with you e.g if you are a provider;
- To comply with a statutory obligation
- To serve the legitimate interest of the University or a third party
- or with your consent.
The legal basis are detailed in the respective information notices ( e.g information notice about events, information notice related to the process of personal data about students, information notice about research participants, information notice about Alumni, information notice about video-surveillance CCVT).
Recipients of your personal data
The University has taken steps to ensure that only those individuals who need to process your personal data have access to it. In addition, the University may share data with parties outside of the University under the following circumstances:
- Service provides or vendors that perform services on our behalf;
- Law enforcement or other government and regulatory bodies or agencies, upon request and to the extent permitted by law;
- Certain regulated professionals such as lawyers or auditors;
- Other research or/and educational institutions where that is necessary for the provisions of research or education jointly with that institution or for the performance of academic research in conjunction with this institution. The University concludes written agreements with these parties regarding the processing and security of personal data.
The University of Luxembourg does not keep personal data for longer than is necessary to achieve the purpose of processing. The University has defined a retention period for each purpose. If this retention can be extended, the terms under which it may be extended are also specified.
In some cases, the University has to keep your personal data for the necessary for compliance with its legal obligations.
Personal data can also be kept for a longer period for historical, statistical and scientific purposes.
Do we transfer your personal data outside European Union (EU) or European Economic Area?
The University of Luxembourg may share your personal data with a party outside EU or an international organisation in a context of third party providers or academic or research collaboration.
For transfers to countries outside EU/EEA for which the level of protection has not been recognised as adequate by the European Commission, the University will either implement appropriate safeguards provided for by current data protection law e.g conclusion of standard contractual clauses or rely on a derogation applicable to specific situation e.g your explicit consent.
What are your rights with regard to the processing of your personal data?
According to the GDPR, you benefit notably from the following rights: right to be informed, right to access to your personal data, right to rectification, right to erasure, right to restrict the scope of the processing, right to object, right to data portability, right to lodge a complaint.
- Right to be informed: you have the right to know how your personal data is collected and used.
- Right to access you have the right to obtain a copy of the personal data we hold about you and to check whether it is lawfully processed.
- Right to rectification: you have the right to request the University to rectify any inaccurate personal data we hold about you.
- Right to erasure: you have the right to obtain from us the erasure of personal data concerning you without undue delay. This right will only apply where, for example, you consider that there is no good reason for us continuing to process it and your personal data are not necessary for us; or where you withdraw your consent if we are using your personal data based on your consent; or where you object to the way we process your data (in line with the Right to object mentioned below). Note, however, that we may not always be able to comply with your request of erasure for specifical legal reasons which will be notified to you, if applicable at the time of your request.
- Right to restrict the processing: you have the right to suspend the processing of your personal data under certain circumstances (for instance if you want us to establish its accuracy or the reason for processing it).
- Right to object: you have the right to object on grounds relating to your situation, based on points (e) or (f) of Article 6 (1) GDPR.
- Right to data portability: in the instances where the processing is based on your consent and is carried out by automated means, you have the right to receive your personal data and to request the transmission of your data to another party.
- Right to withdraw consent: in the instances where you have consented to the processing, you can withdraw your consent at any time by contacting the relevant department. For the newsletter you can unsubscribe by clicking the unsubscribe link in our emails.
The University provides further information on its website page to the exercise of rights section.
Any request shall be processed by the University without undue delay, and where feasible no later than one (1) month after its receipt, at least in order to inform you about the status of your request. This period may be extended for two (2) additional months for complex cases or due to a high volume of requests. Please note that we may keep a record of your communications to help us resolve any issues which you raise.
If you remain unsatisfied, you have the right – without prejudice to any other administrative or judicial remedy – to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.
In Luxembourg, the competent authority is the Commission Nationale pour la Protection des Données (CNPD).
Contact of the CNPD
Commission Nationale pour la Protection des Données
1, avenue du Rock’n’Roll
Service des réclamations
Tel. : (+352) 26 10 60 -1
Fax : (+352) 26 10 60 -29
You can also use their contact form.
Changes to this information notice
This information notice is dated of 16 August 2023 and will be revised time to time to ensure that it remains up to date. In the event of major changes, you will be notified.