Privacy Policy

Recitals

For INCERT GIE it is an essential goal to ensure that we protect the information entrusted to us by you, our customers, external service providers, members, visitors, job applicants, volunteers, users of our INCERT website and services and any other third parties whose personal data are processed by INCERT GIE. INCERT GIE committed to process your personal data in compliance with applicable data protection laws, including as of 25 May 2018: The General Data Protection Regulation (“GDPR”); and The amended Luxembourg Law of 30 May 2005 on the protection of persons with regard to the processing of personal data in the field of electronic means of communication. Scope of this Privacy Policy

• This Policy sets out the principles and guidelines for the protection of your Personal Data, which include the Personal Data collected on – or by means of – the Websites. INCERT GIE collects Personal Data online (including by e-mail) or offline; this Policy is applicable regardless of the means of collection or processing. The notion of Personal Data refers to all information relating to an identified or identifiable natural person. An “identifiable” person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to them.  
  
  Data Controller
  INCERT GIE, a Luxembourg public organization, established at L-3372 Leudelange, 15 rue Léon Laval, and registered with the Luxembourg Trade and Companies Register under the number C101 is the data controller responsible for your Personal Data.
  
  Legal basis for Personal Data Processing
  We process your personal data for one of the following purposes and on the following legal basis:
  

• For the good execution of our contractual orpre-contractual relationship that you or your organization are a part of and to provide our services based on your instructions;

• For the compliance of our legal obligations and to keep records of our compliance processes or tax records; To pursue our legitimate interests, or those of a third-party recipient of your personal data, in a way which is reasonably expected as part of running INCERT GIE, which is not detrimental to you and has minimal impact on your privacy. If the processing of the personal data is based on legitimate interest, you may at any time request information on the balancing test realized by INCERT GIE in the context of recourse on the basis of legitimate interest;

• To provide you with information you have registered for, i.e. where you have expressly provided us with your consent to process your personal data in that manner. The consent can be withdrawn at any moment. If the processing is in parallel based on another legal basis, then the withdrawal of the consent will in principle not impact the processing by INCERT GIE.
  
  For certain processing, more than one legal basis may apply. 
  
  Types of personal data which are processed
  
  INCERT GIE processes the following types of personal data about its clients and contacts:

• Contact information (e.g. name, surname, professional and personal addresses, mail and telephone number);

• Identification data and personal information (e.g. preferred language, job title, organization);

• Professional information (e.g. job function, identity of your employer, department, organization name);

• Any other personal data provided to INCERT GIE and allowing INCERT GIE to perform its contractual duties.
  
  Collection of personal data‍

  ‍We collect personal data directly from you or your organization when:

• You, or your organization uses any of our services and provides us with personal data relating to you, your company, your employees, your suppliers or other involved third parties;

• You or your organization offer(s) to provide or provide(s) services to us;

• You correspond with us by phone, email or other electronic means, or in writing, or when you provide other information directly to us, including in conversation with our staff.

• You or your organization browse(s), complete(s) a form or make(s) an enquiry or otherwise interact(s) on our website or other Social Media;
  
  Purpose of the processing of personal data

  INCERT GIE processes client’s and contact’s Personal Data, for the following purposes:

• To provide the clients with the services requested by them;

• Processing is necessary for the performance of a contract to which the data subject is party.

• Processing is necessary for the establishment, exercise or defense of legal claims.

• To deal with communications received from clients and contacts via phone or email, and responding to client’s or contact’s queries;

• Processing is necessary for the performance of a contract to which the data subject is party.

• Processing is necessary to pursue the legitimate interests of the controller.

• To comply with applicable laws and regulations;

• Processing is necessary for compliance with a legal obligation to which the controller is subject.

• To process clients related claims;

• Processing is necessary for the purposes of the legitimate interests pursued by the controller.

• To maintain and update our list of contacts;

• Processing is necessary for the purposes of the legitimate interests pursued by the controller.

• To manage INCERT GIE relationships with its clients and contacts; Processing is necessary for the performance of a contract to which the data subject is party.

• Processing is necessary for the purposes of the legitimate interests pursued by the controller.
  
  
    Data retention period
  
  We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements and, where required for INCERT GIE to assert or defend against legal claims, until the end of the relevant retention period or until the claims in question have been settled. If you want to learn more about our specific retention periods for your personal data established in our retention policy you may contact us at dpo@incert.lu. Please find hereafter an overview of the different retention periods depending on the pursued purpose/processed category of personal data: 

‍






‍

Personal data protection

INCERT GIE has taken the appropriate technical security and organizational measures to protect the personal data from loss, abuse and unauthorized access. Furthermore, access to personal data has only been granted to the individuals at INCERT GIE that need to process the personal data in accordance with the purposes that have been stated above.

INCERT GIE does not disclose any client related information unless we are required by law or with your prior consent. We have also put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed.

Your right

The law gives you certain rights in respect of the information that we hold about you. Below are your rights:

• Access: You have the right to request a copy      of the personal data that we hold about you. There are exceptions to this      right, so that access may be denied if, for example, making the      information available to you would reveal Personal Data about another      person, or if we are legally prevented from disclosing such information.      You are entitled to see the Personal Data held about you. If you wish to      do this, please contact us using the contact details provided above.

• Accuracy: We aim to keep your Personal Data      accurate, current, and complete. We encourage you to contact us to let us      know if any of your Personal Data is not accurate or changes, so that we      can keep your Personal Data up-to-date.

• Objecting: In certain circumstances, you also      have the right to object to processing of your Personal Data provided that no legitimate grounds      for the processing exist which override the interest, rights and freedoms      of yours or unless the personal data is necessary for the legal defence of      the INCERT GIE’s interests

• Porting: You have the right to receive in particular situations      specified in the GDPR, all personal data relating to you and provided by      you to INCERT GIE and to transfer such data to another controller (right      to data portability). INCERT GIE reserves the right to charge a fee for      such transfer, especially in case of frequent requests and / or in the      event of a request deemed excessive in terms of volume of data to be      transferred. You have to inform INCERT GIE in writing in due course before      the end of the contract if you intend to make use of this right.      Otherwise, INCERT GIE can not be held responsible for the erasure of the      personal data.

·       Restriction of processing :

You have the right to obtain in particular situations specified in the GDPR, the restriction of processingso that your personal data may only be processed with your consent (without prejudice to our right to store the data in accordance with the applicable legal provisions). The execution of this right does not impact and previous processing’s ;

• Erasure: You have the right to ask us to erase      your Personal Data when the personal data is no longer necessary for the      purposes for which it was collected, or when, among other things, your      personal data have been unlawfully processed provided that constraints and legal      obligations applicable to INCERT GIE do not conflict with such a request.

• Complaints: If you believe that your data      protection rights may have been breached, you have the right to lodge a      complaint with the applicable supervisory authority (https://cnpd.public.lu/fr.html),      or to seek a remedy though the courts.

• Right to withdraw consent: If you have      provided your consent to the collection, processing and transfer of your      Personal Data, you have the right to fully or partly withdraw your consent      at any time.

Personal data transfer

INCERT GIE collects personal data to complete its pursued purposes, as described above. 

Consequently, INCERT GIE will store personal data, inter alia in electronic form and solely for professional use. Personal data may be stored, respectively transferred to any other place of work of INCERT GIE, to a processor or other co-contractor of INCERT GIE, as well as to any public administration or authority when legal obligations etc. applying to INCERT GIE require such a transfer, respectively when the transfer is in line with the purpose of the processing for which the data were delivered to / collected by INCERT GIE.

When we transfer your information to other countries, we will use, share and safeguard that information as described in this Policy. In the event of the transfer of personal data to another country, in particular a country outside the European Economic Area, INCERT GIE will ensure that the transfer is carried out in compliance with the legal provisions in force in terms of data protection, including the GDPR, inter alia by putting in place appropriate safeguards.

Cookies and similar technologies

What are cookies?

Cookies are small text files that website stores on a browser when they visit the website. Websites use them for multiple purposes like storing login statuses, remembering the cart items in an e-commerce store, identifying whether a user is a new visitor or returning user, or analyzing the user behavior on the website, etc. Incert.lu does not collect any cookies.

Changes to this Privacy Policy

We reserve the right to update and change this Policy from time to time in order to reflect any changes to the way in which we process your Personal Data or changing legal requirements. Any changes we may make to our Policy in the future will be posted on this page and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to our Policy.

Contact Details

If you have any questions about our use of your Personal Data, or if you want to exercise your rights, you can contact our data privacy team. The best way to do this is by email to dpo@incert.lu, but if you prefer you can also write to us at: Data Protection Team, 15 rue Léon Laval, Leudelange, Luxembourg.