Chapters
Introduction
This document is intended to explain how the Luxembourg Chamber of Commerce (hereinafter the “Chamber of Commerce”) processes[1] your personal data (hereinafter “The/Your Data”) in accordance with the legislation applicable to personal data and the General Data Protection Regulation[2] (hereinafter the “GDPR”) in particular.
Who is the controller for Your Data?
The Chamber of Commerce, incorporated and with its registered office located at 7, rue Alcide de Gasperi, L-1615 Luxembourg, is the controller for Your Data.
If you have any questions regarding this Data Privacy Policy or if you wish to exercise your rights as described in section 6 below, please send an email to the following address: dpo@cc.lu.
Which Data is processed?
The Chamber of Commerce is committed to observing the data minimisation principle and ensures that only appropriate and relevant data is processed as required for the purposes defined.
Based on the purpose of the processing, the Chamber of Commerce mainly processes:
- identification and contact data: name, greeting, address, telephone number, date of birth, nationality, passport number;
- professional data: title, function, Curriculum Vitae, education, professional training, survey responses, position or vote at a meeting;
- usage data: data on preferences you have expressed regarding our services and/or the information that the Chamber of Commerce sends to you (link to subscribe to the newsletter);
- financial data: bank statement, IBAN;
- technical data: data collected during your visit to the Chamber of Commerce website, page visited, IP address, type of browser, browser version used, ID code for participation in surveys;
- data regarding your dietary requirements: allergies or food preferences;
- data regarding your image and/or voice.
How is Your Data collected?
The Chamber of Commerce collects Your Data either directly from you or indirectly from third parties (institutional partners such as employer federations, ministries, government bodies, embassies, professional chambers, the Luxembourg Business Registers, or non-institutional partners such as companies or associations).
Why is Your Data processed and what is the legal basis for such processing?
The Chamber of Commerce processes Your Data for the following purposes:
Legal basis for the processing | Purpose of the processing | Who does it apply to? |
|---|---|---|
Processing is required for the fulfilment of the Chamber of Commerce’s public interest roles[3]. |
|
|
Processing is required to ensure the Chamber of Commerce’s compliance with one of its legal obligations. |
|
|
Processing is required for the application of any agreements concluded with the Chamber of Commerce that you are a party to |
|
|
Processing is required for the Chamber of Commerce’s legitimate interests in connection with the provision of top-quality services and the verification thereof. |
|
|
Processing is carried out with your consent |
|
|
Who is Your Data transferred to?
Your Data is processed by duly authorised people within the Chamber of Commerce, in accordance with their respective responsibilities.
Your Data is processed by duly authorised people within the Chamber of Commerce, in accordance with their respective responsibilities.
For the aforementioned purposes, the Chamber of Commerce may transfer Your Data to:
- its institutional partners (employer federations, ministries, government bodies, embassies, trade organisations);
- its non-institutional partners (businesses, training organisations, speakers, consultants, service providers) particularly when providing advisory and support services to companies and jointly organising events, trade delegations and shared stands; or
- processors that process data on its behalf.
For the purposes of its international or other activities, the Chamber of Commerce may transfer Your Data to international organisations or to countries located outside the European Economic Area[4]:
- subject to an adequacy decision made by the European Commission;
- not subject to an adequacy decision made by the European Commission, in which case such transfers are subject to appropriate guarantees (such as the European Commission’s standard contractual clauses and additional measures where necessary), to ensure an adequate level of protection in all circumstances for the data transferred;
- in the absence of an adequacy decision or appropriate guarantees, on the basis of your explicit consent or because the transfer is necessary for the conclusion or execution of an agreement concluded in your interests between the Chamber of Commerce and another natural person or legal entity.
What are your rights concerning Your Data?
You have a right to access Your Data, a right to rectify Your Data in the event of any errors and, subject to providing proof of legitimate and compelling grounds in accordance with the GDPR, a right to restriction of processing and a right to object to the collection of Your Data. However, in the latter two scenarios, exercising this right does not negate the validity of any previous processing.
You also have a right to the erasure of your personal data, and to data portability within the limits prescribed by the GDPR.
If the processing of Your Data is based on your consent, you have the right to withdraw this consent at any time; however, this withdrawal of consent shall not affect the legal basis of any previous processing.
Please note that the law authorises the Chamber of Commerce to store and continue processing certain personal data even when you have exercised your right of opposition or erasure, for compelling legitimate reasons such as complying with applicable legislation, in particular the Law of 26 October 2010, as amended, on the reorganisation of the Chamber of Commerce.
To exercise your rights, please contact the Chamber of Commerce’s Data Protection Officer (dpo@cc.lu). Should the Chamber of Commerce have any reasonable doubts as to your identity when exercising your rights, it may request any additional information that is required to confirm your identity.
You also have the right to file a complaint at any time with the National Commission for Data Protection (CNPD), 15, boulevard du Jazz, L-4370 BELVAUX, (link to the CNPD website) or the relevant supervisory authority for your country of residence or the place of the alleged infringement if you believe that your rights specified above have not been respected.
The right to unsubscribe/opt out
As the recipient of correspondence from the Chamber of Commerce, you may choose to unsubscribe at any time by clicking on the dedicated link at the bottom of all publications and newsletters sent to you.
This will allow you to unsubscribe from the newsletter, all publications and/or publications on certain topics. The Chamber of Commerce will then remove Your Data from the relevant distribution list(s).
However, please note that the Chamber of Commerce may be required to keep Your Data in its databases if it processes such data for other purposes, as provided for under this Data Privacy Policy.
How is Your Data protected?
The Chamber of Commerce undertakes to put in place the technical and organisational security measures required to protect Your Data.
How long is Your Data held for?
The Chamber of Commerce holds Your Data for as long as is necessary based on the purpose of the processing. The criteria used to determine this period are (i) the nature and sensitivity of the personal data and the purpose of its processing; (ii) the length of the statute of limitations for a right; (iii) general compliance with the law and regulations.
The Data processed in order to send out publications and newsletters is held until you unsubscribe or until receipt of an error message regarding the mailbox used.
The Chamber of Commerce holds data on traffic and operations on its website (cc.lu) for a maximum of six months. Please refer to the Cookie Policy for details on cookies.
In principle, Your Data is deleted at the end of the storage period. However, some data is anonymised and held by the Chamber of Commerce for use in statistics.
Events organised by the Chamber of Commerce
When you sign up for an event in person, online (webinar) or in hybrid format that has been organised by the Chamber of Commerce, you are informed and indicate your consent to the fact that:
- you may appear in photographs and/or videos taken or recorded during the event; and
- the event is likely to be recorded (sound and/or images) and broadcast, either live or after the event.
If you intend to oppose this processing of Your Data, we recommend that you indicate this prior to the event to the department responsible for its organisation, in order to find a means of preventing Your Data from being reproduced in photos and/or videos, to the extent that this is possible. If the event is held online, you will be offered the option of disabling your camera and/or microphone.
The purpose of taking and, where applicable, publishing/broadcasting photos and/or recordings of events is to provide information on events via the various communication channels used by the Chamber of Commerce, such as MERKUR, websites, newsletters, social media (LinkedIn, Facebook, Twitter, Instagram), video-sharing platforms (Vimeo, YouTube), etc.
Meetings organised by the Chamber of Commerce
When organising meetings held in person, online (videoconferences) or in hybrid format, the Chamber of Commerce may process:
- personal images in the form of photos; and/or
- people’s image, voice and name, in recordings that may be broadcast live or after the meeting.
If you switch on or leave your camera and/or microphone switched on during a videoconference, you consent to the recording and subsequent broadcast of your image and/or voice in accordance with the terms described below.
The purpose of recording meetings is to make the recording available on a read-only basis to participants and those who were unable to attend the meeting, with the aim of facilitating information sharing, training and/or educating employees of the Chamber of Commerce or, in exceptional circumstances, external employees (e.g. those providing services to the Chamber of Commerce) with access to the IT network of the Chamber of Commerce on which the recording has been made available.
In addition, subject to prior oral notification, a meeting held remotely (videoconference) or in a hybrid format may be automatically transcribed solely for the purpose of facilitating the drafting of the minutes of said meeting. In this respect, Your Data contained in the transcript will only be accessible to a limited number of employees of the Chamber of Commerce and will be deleted as soon as the minutes have been drafted.
How is this Data Privacy Policy updated?
The way in which the Chamber of Commerce processes Your Data may change in the future.
Accordingly, the Chamber of Commerce reserves the right to update this document as needed to reflect any changes in the way processing is carried out, or in the event of a change in the applicable legal provisions. If such changes occur, the most recent version of this Data Privacy Policy published online shall apply.
[1] Data “processing” consists, in particular, of the collection, recording, organisation, structuring, storage, adaptation, alteration or use of Your Data.
[2] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
[3] According to article 2 of the Law of 26 October 2010, as amended, on the reorganisation of the Chamber of Commerce:
“(...) The role of the Chamber of Commerce is, inter alia, to:
a) promote entrepreneurship and assist with the creation, development and longevity of companies;
b) promote a legislative and regulatory framework that is conducive to economic growth;
c) promote economic and business relationships at regional, European and international level;
d) promote the Luxembourg economy at home and abroad;
e) work to encourage any measures that help to defend and advance the interests of Luxembourg nationals;
f) guide and support Luxembourg companies seeking to expand internationally and access foreign markets;
g) develop and promote initial and ongoing professional training;
h) establish proposals for the content and monitoring of professional training;
i) promote compliance with legislation on commercial and industrial matters;
j) compile statistics and conduct research and analysis on commercial, industrial and financial matters, including those concerning small and medium-sized enterprises.”
[4] The European Economic Area consists of the European Union, Lichtenstein, Norway and Iceland.