Chapters
Introduction
This document is intended to explain how the Luxembourg Chamber of Commerce (hereinafter the “Chamber of Commerce”) processes[1] your personal data (hereinafter “The/Your Data”) in accordance with the legislation applicable to personal data and the General Data Protection Regulation[2] (hereinafter the “GDPR”) in particular.
The Chamber of Commerce wishes to draw your attention to the fact that certain activities that involve it processing Your Data are also subject to specific notices accessible via the forms or websites from which this personal data is collected.
Who is the controller for Your Data?
The Chamber of Commerce, incorporated and with its registered office located at 7, rue Alcide de Gasperi, L-1615 Luxembourg, is the controller for Your Data.
If you have any questions regarding this Data Privacy Policy or if you wish to exercise your rights as described in section 7 below, please send an email to the following address: dpo@cc.lu.
Which Data is processed?
The Chamber of Commerce is committed to observing the data minimisation principle and ensures that only appropriate and relevant data is processed as required for the purposes defined.
Based on the purpose of the processing, the Chamber of Commerce mainly processes:
identification and contact data: name, greeting, address, telephone number, date of birth, nationality, passport number;
professional data: title, function, Curriculum Vitae, education, professional training, survey responses, position taken or vote cast at a meeting, financial results, membership;
usage data: data on preferences you have expressed regarding our services and/or the information that the Chamber of Commerce sends to you (link to subscribe to the newsletter);
financial data: bank statement, IBAN;
technical data: data collected during your visit to the Chamber of Commerce website, pages visited, IP address, type of browser, browser version used, ID code for participation in surveys;
data regarding your dietary requirements: allergies or food preferences;
data regarding your image and/or voice.
How is Your Data collected?
The Chamber of Commerce collects Your Data either directly from you or indirectly from third parties (institutional partners such as employer federations, ministries, government bodies, embassies, professional chambers, the Luxembourg Business Registers, or non-institutional partners such as companies or associations).
Why is Your Data processed and what is the legal basis for such processing?
The Chamber of Commerce processes Your Data for the following purposes:
| Legal basis for the processing | Purpose of the processing | Who does it apply to? |
|---|---|---|
| Processing is required for the fulfilment of the Chamber of Commerce’s public interest roles[3]. |
|
|
| Processing is required to ensure the Chamber of Commerce’s compliance with one of its legal obligations. |
|
|
| Processing is required for the application of any agreements concluded with the Chamber of Commerce that you are a party to, as well as the implementation of pre-contractual measures taken at your request. |
|
|
| Processing is required for the Chamber of Commerce’s legitimate interests in connection with the provision of top-quality services and the verification thereof. |
|
|
Processing is required for the Chamber of Commerce’s legitimate interests in connection with the publication of photographs via its communication channels. In this context, the Chamber of Commerce may process biometric data derived from photographs in accordance with Article 9.2(f) of the GDPR |
|
|
| Processing is carried out with your consent |
|
|
Furthermore, the Chamber of Commerce informs you that for certain purposes – such as the organisation of events, missions, guided tours and shared stands, the establishing of contact with institutional and non-institutional partners of the Chamber of Commerce, the management of memberships and subscriptions, and communication – further processing for archiving purposes in the public interest will be carried out on the basis of the amended law of 17 August 2018.
Is Your Data processed on the basis of an automated decision?
The Chamber of Commerce uses an automated decision-making process to calculate annual membership fees based on the profits of its members, in accordance with the Chamber of Commerce Membership Fee Regulations of 12 November 2010, which set out the methods for calculating the annual membership fees to be collected (the “Membership Fee Regulations”).
If you are a natural person member of the Chamber of Commerce, please refer to the Membership Fee Regulations for further details on the calculation method and criteria used.
You may request the intervention of a human being to review the automated decision by sending an email to the following address: dpo@cc.lu.
Who is Your Data transferred to?
Your Data is processed by duly authorised people within the Chamber of Commerce, in accordance with their respective responsibilities.
For the aforementioned purposes, the Chamber of Commerce may transfer Your Data to:
its institutional partners (employer federations, ministries, government bodies, embassies, trade organisations);
its non-institutional partners (businesses, training organisations, speakers, consultants, service providers) particularly when providing advisory and support services to companies and jointly organising events, trade delegations and shared stands; or
processors that process data on its behalf.
For the purposes of its international or other activities, the Chamber of Commerce may transfer Your Data to international organisations or to countries located outside the European Economic Area[4]:
subject to an adequacy decision made by the European Commission;
not subject to an adequacy decision made by the European Commission, in which case such transfers are subject to appropriate guarantees (such as the European Commission’s standard contractual clauses and additional measures where necessary), to ensure an adequate level of protection in all circumstances for the data transferred;
in the absence of an adequacy decision or appropriate guarantees, because the transfer is necessary for the conclusion or execution of an agreement concluded in your interests between the Chamber of Commerce and another natural person or legal entity.
What are your rights concerning Your Data?
You can:
access Your Data and obtain a copy of said data in accordance with Article 15 of the GDPR;
have inaccurate or incomplete data rectified in accordance with Article 16 of the GDPR;
object to the processing of Your Data under the conditions set out in Article 21 of the GDPR;
have such data erased under the conditions set out in Article 17 of the GDPR.
In certain cases, you have a right to data portability under Article 20 of the GDPR and a right to restriction of processing under the conditions set out in Article 18 of the GDPR.
If the processing of Your Data is based on your consent, you have the right to withdraw this consent at any time; however, this withdrawal of consent shall not affect the legal basis of any previous processing.
To exercise your rights, please contact the Chamber of Commerce’s Data Protection Officer (dpo@cc.lu). Should the Chamber of Commerce have any reasonable doubts as to your identity when exercising your rights, it may request any additional information that is required to confirm your identity.
You also have the right to file a complaint at any time with the National Commission for Data Protection (CNPD), 15, boulevard du Jazz, L-4370 BELVAUX, (link to the CNPD website) or the relevant supervisory authority for your country of residence or the place of the alleged infringement if you believe that your rights specified above have not been respected.
The right to unsubscribe/opt out
As the recipient of correspondence from the Chamber of Commerce, you may choose to unsubscribe at any time by clicking on the dedicated link at the bottom of all publications and newsletters sent to you.
This will allow you to unsubscribe from the newsletter, all publications and/or publications on certain topics. The Chamber of Commerce will then remove Your Data from the relevant distribution list(s).
However, please note that the Chamber of Commerce may be required to keep Your Data in its databases if it processes such data for other purposes, as provided for under this Data Privacy Policy.
How is Your Data protected?
The Chamber of Commerce undertakes to put in place the technical and organisational security measures required to protect Your Data.
How long is Your Data held for?
The Chamber of Commerce holds Your Data for as long as is necessary based on the purpose of the processing. The criteria used to determine this period are (i) the nature and sensitivity of the personal data and the purpose of its processing; (ii) the length of the statute of limitations for a right; (iii) general compliance with the law and regulations.
The Data processed in order to send out publications and newsletters is held until you unsubscribe or until receipt of an error message regarding the mailbox used.
The Chamber of Commerce holds data on traffic and operations on its website (cc.lu) for a maximum of six months. Please refer to the Cookie Policy for details regarding cookies.
In principle, Your Data is deleted at the end of the storage period. However, some data is anonymised and held by the Chamber of Commerce for use in statistics.
Events organised by the Chamber of Commerce
When you sign up for an event in person, online (webinar) or in hybrid format that has been organised by the Chamber of Commerce, you are informed and indicate your consent to the fact that:
you may appear in photographs and/or videos taken or recorded during the event; and
the event is likely to be recorded (sound and/or images) and broadcast, either live or after the event.
If you intend to oppose this processing of Your Data, we recommend that you indicate this prior to the event to the department responsible for its organisation, in order to find a means of preventing Your Data from being reproduced in photos and/or videos, to the extent that this is possible. If the event is held online, you will be offered the option of disabling your camera and/or microphone.
The purpose of taking and, where applicable, publishing/broadcasting photos and/or recordings of events is to provide information on events via the various communication channels used by the Chamber of Commerce, such as MERKUR, websites, newsletters, social media (LinkedIn, Facebook, Bluesky, Instagram), video-sharing platforms (Vimeo, YouTube), etc.
In the context of events organised with partners, the Chamber of Commerce may transfer photographs and/or recordings of the event to said partners. For further details, please refer to section 6 of this Data Privacy Policy.
Meetings organised by the Chamber of Commerce
When organising meetings held in person, online (videoconferences) or in hybrid format, the Chamber of Commerce may process:
personal images in the form of photos; and/or
people’s image, voice and name, in recordings that may be broadcast live or after the meeting.
If you switch on or leave your camera and/or microphone switched on during a videoconference, you consent to the recording and subsequent broadcast of your image and/or voice in accordance with the terms described below.
The purpose of recording meetings is to make the recording available on a read-only basis to participants and those who were unable to attend the meeting, with the aim of facilitating information sharing, training and/or educating employees of the Chamber of Commerce or, in exceptional circumstances, external employees (e.g. those providing services to the Chamber of Commerce) with access to the IT network of the Chamber of Commerce on which the recording has been made available.
In addition, subject to prior oral notification, a meeting held remotely (videoconferencing) or in a hybrid format may be automatically transcribed solely for the purpose of facilitating the drafting of the minutes of said meeting. In this respect, Your Data contained in the transcript will only be accessible to a limited number of employees of the Chamber of Commerce and will be deleted as soon as the minutes have been drafted.
How is this Data Privacy Policy updated?
The way in which the Chamber of Commerce processes Your Data may change in the future.
Accordingly, the Chamber of Commerce reserves the right to update this document as needed to reflect any changes in the way processing is carried out, or in the event of a change in the applicable legal provisions. If such changes occur, the most recent version of this Data Privacy Policy published online shall apply.
The previous version is available here
[1] Data “processing” consists, in particular, of the collection, recording, organisation, structuring, storage, adaptation, alteration or use of Your Data.
[2] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
[3] According to article 2 of the Law of 26 October 2010, as amended, on the reorganisation of the Chamber of Commerce:
“(...) The role of the Chamber of Commerce is, inter alia, to:
a) promote entrepreneurship and assist with the creation, development and longevity of companies;
b) promote a legislative and regulatory framework that is conducive to economic growth;
c) promote economic and business relationships at regional, European and international level;
d) promote the Luxembourg economy at home and abroad;
e) work to encourage any measures that help to defend and advance the interests of Luxembourg nationals;
f) guide and support Luxembourg companies seeking to expand internationally and access foreign markets;
g) develop and promote initial and ongoing professional training;
h) establish proposals for the content and monitoring of professional training;
i) promote compliance with legislation on commercial and industrial matters;
j) compile statistics and conduct research and analysis on commercial, industrial and financial matters, including those concerning small and medium-sized enterprises.”
[4] The European Economic Area consists of the European Union, Lichtenstein, Norway and Iceland.