Protection of personal data

In accordance with the laws on the protection of natural persons with regard to the processing of personal data, the City of Luxembourg reminds users that the data and information collected by its departments are processed for the purpose of performing the tasks falling within its remit, pursuant to the legal and regulatory provisions in force.

Personal data and information are retained for as long as necessary to achieve the purposes of their processing.

For more information, please contact the data protection officer or the data controller:

• Data Protection Officer
  42, Place Guillaume II
  L-1648 Luxembourg
  or
  dpo@vdl.lu
  
• Administration communale de la Ville de Luxembourg
  42, Place Guillaume II
  L-1648 Luxembourg
  or
  protectiondesdonnees@vdl.lu

You have the right to access and rectify your personal data, as well as, where applicable, the right to data portability and the restriction of the processing of your data. You have the right to have your personal data erased, unless the processing of such data is mandatory.

You also have the right to object to the processing of your personal data if you provide legitimate reasons, unless the processing is required to abide by a legal obligation.

To lodge a complaint, you may contact the National Commission for Data Protection (Commission Nationale pour la Protection des Données– CDPD):

15, boulevard du Jazz
L-4370 Belvaux.

The City subcontracts some of the activities required for the execution of the different procedures available on its form server to the Government IT Centre (Centre des technologies de l'information de l'Etat – CTIE). As it is a Luxembourg government agency, the CTIE provides all the requisite guarantees in respect of the technical and organisational measures for accessing the data, and these measures have been implemented in an appropriate manner. The subcontractor has undertaken to comply with the data protection rules and principles outlined in the GPDR.

When selecting a procedure on the https://form-server.vdl.lu website for which an electronic signature is required, users will be automatically redirected to the CTIE's MyGuichet online service, where they will be required to authenticate their identity. Once their identity has been authenticated, the applicant should then fill in this form, which is hosted on a platform belonging to the City. The completed form will then be sent as a PDF document to the MyGuichet platform, where the applicant must sign it electronically. The PDF form is stored in a CTIE back-office system that the City has access to, as well as in the applicant's private e-space. The signed PDF form is also forwarded to the City's back-office system, where it is used for processing purposes, and automatically analysed to extract data contained in the form to populate the City's information system, which is designed to process the request.

Form server

When completing the forms available at form-server.vdl.lu, users may be requested to provide a range of personal data depending on the particular form selected.

These forms adhere as closely as possible to the data minimisation principle established by the GDPR, which provide that personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

Any personal data collected through these forms may be:

• stored on the City's servers for the sole purpose of processing the request;
• forwarded to the departments in charge of processing the request;
• sent to the City's information systems for the automatic processing of the request, which neither entails the profiling of the person having made the request, nor produces legal or similarly significant effects concerning this person.

Users' personal data is retained for a period of time that is compliant with legal provisions and in keeping with the purposes for which they were collected.

When filling in contact forms, including when using the "Report-It" service, the user may be requested to provide the following personal data:

• Surname
• First name
• Home address
• Email address
• Phone number

When a user reports an incident, the following information provided by the user will be published:

• Location of the incident (address)
• Any images submitted by the user
• Description
• "Report created on" date
• "Last updated on" date
• Report status

Any personal data collected through these contact forms may be:

• stored on the City's servers for the sole purpose of processing the request for information or the incident submitted through the "Report-It" service
• forwarded by email to the departments selected by the user for processing (contact page on vdl.lu, and in the cityapp under Services > Need help? > Contact form > Request information)
• forwarded by email to the City's service provider for processing (in the cityapp under Services > Need help?).

Users' personal data is retained for a period of time that is compliant with legal provisions and in keeping with the purposes for which they were collected.

Generally, events organised by the City of Luxembourg are public events, and it is possible that participants may be photographed or filmed. It is possible these likenesses may be published either digitally or in print.