The object of this information note is to set out the conditions under which LUXINNOVATION GIE Economic Interest Group, registered in the Luxembourg Trade and Companies Registry under number C16 (hereinafter “LUXINNOVATION“), with registered office at 5 avenue des Hauts Fourneaux, L-4362 Esch-sur-Alzette, collects and processes the personal data of members (employees or representatives of legal entities governed by public or private law) (“the Members“) of the clusters it manages (“the Cluster(s)“).
It shall replace any other clause or notice relating to the personal data of Members from the date of its notification.
What personal data does LUXINNOVATION process?
Personal information or personal data is information which permits the direct or indirect identification of natural persons (“the Personal Data“).
Personal Data collected and processed by LUXINNOVATION may be provided by the Members themselves in order to join a Cluster or be based on public information (e.g. external databases, professional social networks, websites of legal entities, news, commercial registers, professional associations, etc.).
This information includes, insofar as may be necessary, but is not limited to:
- identification data: last name or business name, first name, address, telephone and fax numbers, e-mail address, national identification number, copy of identity card or passport, age, gender, date and place of birth, civil status, nationality, household composition, image, voice;
- bank and financial identification data;
- information on educational background, training and professional qualifications (academic curriculum, professional qualifications, licences held, professional experience, membership of/participation in organisations, publications, etc.);
- details on the current employment/profession of the person concerned.
For what purpose does LUXINNOVATION collect and process personal data?
LUXINNOVATION collects and processes Personal Data for the following purposes:
- administrative management of Members (including the preparation and online publication of a list of Members);
- assisting Members to implement their projects;
- putting Members in contact with each other and third parties;
- encouraging exchanges between Members and private or public research centres on joint national and/or European projects; prospecting which involves trying to find new Members;
- preparing statistics;
- promoting LUXINNOVATION activities (sending newsletters, magazines and brochures, organising events, preparing promotional materials, etc.). If you do not wish to receive marketing e-mails, follow the unsubscribe instructions in each e-mail sent;
- managing right to access, correct and oppose requests and any other rights relating to Personal Data;
- managing complaints and disputes.
Personal Data are collected and processed with the consent of the person concerned. They are, in any case, required to permit LUXINNOVATION to complete its public service mission and other legal obligations.
These purposes constitute the legal basis under which LUXINNOVATION processes data.
To whom are the Personal Data disclosed?
Personal Data are processed internally by LUXINNOVATION members of staff duly authorised, within the limit of their respective responsibilities.
The data may also be communicated to the following external recipients:
- competent legal and administrative authorities, for example, tax authorities, to allow LUXINNOVATION to fulfil its legal obligations in this regard;
- sub-contractors (for example, IT providers) and LUXINNOVATION external service providers (such as external consultants and legal advisers), to the extent strictly necessary and subject to the existence of specific contractual safeguards to ensure the safety and confidentiality of data;
- Cluster Members and local LUXINNOVATION partners (business or research partners), to enable LUXINNOVATION to fulfil its public service missions and meet its Members’ requests;
- individuals who wish to contact a Member of the Clusters;
- third parties through the online publication of the list of Members of the Clusters.
In response to an explicit request to contact a Member, LUXINNOVATION may also be required, from time to time, to send the Personal Data of the individual concerned to potential business and research partners in order to conclude a potential contract and which may be located outside the European Union in a country that does not offer the same level of protection as that in place in the European Union.
How does LUXINNOVATION protect the Personal Data that it processes?
Personal Data are collected and processed by LUXINNOVATION, in its capacity as controller, in accordance with the data protection law applicable (namely the Law of 2 August 2002 on the Protection of Persons with regard to the Processing of Personal Data, as amended, and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 – the General Data Protection Regulation (GDPR) – which will enter into force on 25 May 2018, as well as any other subsequent regulations).
LUXINNOVATION undertakes to implement technical and organisational security measures to insure the protection of Personal Data against the risks of using information systems.
Personal Data are stored for the duration of the contractual relationship between LUXINNOVATION and the Member, and for a maximum of 10 years which corresponds to the applicable limitation period. Two months after a Member’s membership of a Cluster has ended, these Data are filed electronically and may be accessed only when required, by a limited number of persons specifically authorised for this purpose.
What rights do Members have?
In accordance with the law currently in force, the Member, or where relevant, its beneficiaries with a legitimate interest, has the right to obtain free of charge:
- access to its personal data,
- confirmation as to whether or not personal data concerning it are being processed,
- information at least on the purposes of the processing operation, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed,
- communication in an intelligible form of the data undergoing processing and of any available information as to their source.
The Member (or where relevant its beneficiaries) also has the right to obtain the rectification of its Personal Data and a right to object to the collection and processing of it on the basis of compelling legitimate grounds.
These rights may be exercised by contacting the LUXINNOVATION Data Protection Officer (DPO) by e-mail: dpo@Luxinnovation, or by telephone: +352 43 62 63 1.
From 25 May 2018, Members will also be entitled to request that all or part of the data be deleted or that processing be restricted; to object to the processing of data; and to exercise their right to data portability, within the limits provided for by applicable regulations.
Members are entitled to lodge a complaint, in case of breach of the applicable regulations on personal data protection, to a supervisory authority such as the National Commission for Data Protection (abbreviated CNPD in French).