This document is intended to explain how the Luxembourg Chamber of Commerce (hereinafter the “Chamber of Commerce”) processes your personal data (hereinafter “The/Your Data”) in accordance with the legislation applicable to personal data and the General Data Protection Regulation (hereinafter the “GDPR”) in particular.
Who is the controller for Your Data?
The Chamber of Commerce, incorporated and with its registered office located at 7, rue Alcide de Gasperi, L-1615 Luxembourg, is the controller for Your Data.
Which Data is processed?
The Chamber of Commerce is committed to observing the data minimisation principle and ensures that only appropriate and relevant data is processed as required for the purposes defined.
Based on the purpose of the processing, the Chamber of Commerce mainly processes:
- identification and contact data: name, greeting, address, telephone number, date of birth, nationality, passport number;
- professional data: title, function, Curriculum Vitae, education, professional training, survey responses;
- usage data: data on preferences you have expressed regarding our services and/or the information that the Chamber of Commerce sends to you (link to subscribe to the newsletter);
- financial data: bank statement, IBAN;
- technical data: data collected during your visit to the Chamber of Commerce website, page visited, IP address, type of browser, browser version used, ID code for participation in surveys;
- data regarding your dietary requirements: allergies or food preferences;
- data regarding your image and/or voice.
How is Your Data collected?
The Chamber of Commerce collects Your Data either directly from you or indirectly from third parties (institutional partners such as employer federations, ministries, government bodies, embassies, professional chambers, the Luxembourg Business Registers, or non-institutional partners such as companies or associations).
Why is Your Data processed and what is the legal basis for such processing?
The Chamber of Commerce processes Your Data for the following purposes:
Legal basis for the processing
Purpose of the processing
Who does it apply to?
Processing is required for the fulfilment of the Chamber of Commerce’s public interest roles.
• Assist and support companies
• Issue documents related to export formalities (ATA carnets, certificates of origin, etc.)
• Organise events, assignments, trade delegations and shared stands
• Establish contacts with institutional and non-institutional partners
• Compile statistics and conduct research and analysis (using surveys)
• Organise company visits
• Provide services in connection with the European Enterprise Network (EEN)
• Send out publications
• Canvass opinion and comments on proposed European and domestic legislation
• Lead thematic working groups
• Beneficiaries of the services offered by the Chamber of Commerce, whether nationals or non-nationals (and where applicable, the contact person(s) of those entities)
• The contact person(s) in government bodies, federations, embassies and other institutional and non-institutional partners
• Speakers at events
• Anyone who wishes to receive one or more publications
• External experts
• Working group participants
Processing is required to ensure the Chamber of Commerce’s compliance with one of its legal obligations.
• Manage membership and subscriptions
• Manage Chamber of Commerce elections
• Analyse the files of the immigration commission ruling on the award of a residency permit for a self-employed person/company head
• Luxembourg nationals (and where applicable, the contact person(s) of these entities)
• Self-employed persons/company heads who are non-EU nationals requesting a residency permit
• The contact person(s) in government bodies
Processing is required for the application of any agreements concluded with the Chamber of Commerce that you are a party to
• Provide government procurement monitoring services
• Carry out procedures related to SME Packages
• Manage invoicing
• Provide rooms
• Beneficiaries of the services offered by the Chamber of Commerce, whether nationals or non-nationals (and where applicable, the contact person (s) of those entities)
• Other parties to agreements with the Chamber of Commerce and their contact persons
Processing is required for the Chamber of Commerce’s legitimate interests in connection with the provision of top-quality services and the verification thereof.
Manage the quality of services offered by the Chamber of Commerce and, in particular, conduct satisfaction surveys
Beneficiaries of the services offered by the Chamber of Commerce, whether nationals or non-nationals (and where applicable, the contact person(s) of those entities)
Processing is carried out with your consent
• Send out Chamber of Commerce newsletters and correspondence
• Event-related correspondence that may use photographs or video
• Training, education and information-sharing during meetings
• Anyone who has expressed a desire to receive the newsletter and/or other correspondence from the Chamber of Commerce
• Participants and speakers at events, training sessions and meetings of the Chamber of Commerce
Who is Your Data transferred to?
Your Data is processed by duly authorised people within the Chamber of Commerce, in accordance with their respective responsibilities.
For the aforementioned purposes, the Chamber of Commerce may transfer Your Data to:
- its institutional partners (employer federations, ministries, government bodies, embassies, trade organisations);
- its non-institutional partners (businesses, training organisations, speakers, consultants, service providers) particularly when providing advisory and support services to companies and jointly organising events, trade delegations and shared stands; or
- processors that process data on its behalf.
For the purposes of its international or other activities, the Chamber of Commerce may transfer Your Data to international organisations or to countries located outside the European Economic Area:
- subject to an adequacy decision made by the European Commission;
- not subject to an adequacy decision made by the European Commission, in which case such transfers are subject to appropriate guarantees (such as the European Commission’s standard contractual clauses and additional measures where necessary), to ensure an adequate level of protection in all circumstances for the data transferred;
- in the absence of an adequacy decision or appropriate guarantees, on the basis of your explicit consent or because the transfer is necessary for the conclusion or execution of an agreement concluded in your interests between the Chamber of Commerce and another natural person or legal entity.
What are your rights concerning Your Data?
You have a right to access Your Data, a right to rectify Your Data in the event of any errors and, subject to providing proof of legitimate and compelling grounds in accordance with the GDPR, a right to restriction of processing and a right to object to the collection of Your Data. However, in the latter two scenarios, exercising this right does not negate the validity of any previous processing.
You also have a right to the erasure of your personal data, and to data portability within the limits prescribed by the GDPR.
If the processing of Your Data is based on your consent, you have the right to withdraw this consent at any time; however, this withdrawal of consent shall not affect the legal basis of any previous processing.
Please note that the law authorises the Chamber of Commerce to store and continue processing certain personal data even when you have exercised your right of opposition or erasure, for compelling legitimate reasons such as complying with applicable legislation, in particular the Law of 26 October 2010, as amended, on the reorganisation of the Chamber of Commerce.
To exercise your rights, please contact the Chamber of Commerce’s Data Protection Officer (firstname.lastname@example.org). Should the Chamber of Commerce have any reasonable doubts as to your identity when exercising your rights, it may request any additional information that is required to confirm your identity.
You also have the right to file a complaint at any time with the National Commission for Data Protection (CNPD), 15, boulevard du Jazz, L-4370 BELVAUX, (link to the CNPD website) or the relevant supervisory authority for your country of residence or the place of the alleged infringement if you believe that your rights specified above have not been respected.
The right to unsubscribe/opt out
As the recipient of correspondence from the Chamber of Commerce, you may choose to unsubscribe at any time by clicking on the dedicated link at the bottom of all publications and newsletters sent to you.
This will allow you to unsubscribe from the newsletter, all publications and/or publications on certain topics. The Chamber of Commerce will then remove Your Data from the relevant distribution list(s).
How is Your Data protected?
The Chamber of Commerce undertakes to put in place the technical and organisational security measures required to protect Your Data.
How long is Your Data held for?
The Chamber of Commerce holds Your Data for as long as is necessary based on the purpose of the processing. The criteria used to determine this period are (i) the nature and sensitivity of the personal data and the purpose of its processing; (ii) the length of the statute of limitations for a right; (iii) general compliance with the law and regulations.
The Data processed in order to send out publications and newsletters is held until you unsubscribe or until receipt of an error message regarding the mailbox used.
In principle, Your Data is deleted at the end of the storage period. However, some data is anonymised and held by the Chamber of Commerce for use in statistics.
Events organised by the Chamber of Commerce
When you sign up for an event in person, online (webinar) or in hybrid format that has been organised by the Chamber of Commerce, you are informed and indicate your consent to the fact that:
- you may appear in photographs and/or videos taken or recorded during the event; and
- the event is likely to be recorded (sound and/or images) and broadcast, either live or after the event.
If you intend to oppose this processing of Your Data, we recommend that you indicate this prior to the event to the department responsible for its organisation, in order to find a means of preventing Your Data from being reproduced in photos and/or videos, to the extent that this is possible. If the event is held online, you will be offered the option of disabling your camera and/or microphone.
The purpose of taking and, where applicable, publishing/broadcasting photos and/or recordings of events is to provide information on events via the various communication channels used by the Chamber of Commerce, such as MERKUR, websites, newsletters, social media (LinkedIn, Facebook, Twitter, Instagram), video-sharing platforms (Vimeo, YouTube), etc.
Meetings organised by the Chamber of Commerce
When organising meetings held in person, online (videoconferences) or in hybrid format, the Chamber of Commerce may process:
- personal images in the form of photos; and/or
- people’s image, voice and name, in recordings that may be broadcast live or after the meeting.
If you switch on or leave your camera and/or microphone switched on during a videoconference, you consent to the recording and subsequent broadcast of your image and/or voice in accordance with the terms described below.
The purpose of recording meetings is to make the recording available on a read-only basis to participants and those who were unable to attend the meeting, with the aim of facilitating information sharing, training and/or educating employees of the Chamber of Commerce or, in exceptional circumstances, external employees (e.g. those providing services to the Chamber of Commerce) with access to the IT network of the Chamber of Commerce on which the recording has been made available.
The way in which the Chamber of Commerce processes Your Data may change in the future.
 Data “processing” consists, in particular, of the collection, recording, organisation, structuring, storage, adaptation, alteration or use of Your Data.
 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
 According to article 2 of the Law of 26 October 2010, as amended, on the reorganisation of the Chamber of Commerce:
“(...) The role of the Chamber of Commerce is, inter alia, to:
a) promote entrepreneurship and assist with the creation, development and longevity of companies;
b) promote a legislative and regulatory framework that is conducive to economic growth;
c) promote economic and business relationships at regional, European and international level;
d) promote the Luxembourg economy at home and abroad;
e) work to encourage any measures that help to defend and advance the interests of Luxembourg nationals;
f) guide and support Luxembourg companies seeking to expand internationally and access foreign markets;
g) develop and promote initial and ongoing professional training;
h) establish proposals for the content and monitoring of professional training;
i) promote compliance with legislation on commercial and industrial matters;
j) compile statistics and conduct research and analysis on commercial, industrial and financial matters, including those concerning small and medium-sized enterprises.”
 The European Economic Area consists of the European Union, Lichtenstein, Norway and Iceland.