Privacy Notice

Last revised: September 2022

1.    An overview of data protection

We are committed to ensure the highest standards of data protection in compliance with the applicable legislation, notably with reference to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”).

In this document we detail the personal data we collect about You when You use our web site, the reason why we use your data, share your data and for how long we will keep it. Additionally, the notice also provides You with information regarding your rights, how to exercise them and whom You can contact in case of any query.

2.    Scope of the notice 

The present notice is directed to users or visitors of this website, that is, You. 

3.    Identity of the data controller

The data controller, that is, the entity responsible for collecting and processing your personal data, is the Luxembourg Institute of Science and Technology (LIST): 

Address:    
5, avenue des Hauts-Fourneaux
L-4362 Esch-sur-Alzette
Luxembourg

E-mail:    
dpo@list.lu

4.     Categories of personal data we collect 

a) Contact form

You may voluntarily enter in contact with us by using the contact form available on the website. We collect your name and email. We need this information with the purpose of contacting you back and answer your requests. We will keep this data for the duration of the project and a XX years of retention in accordance with LIST retention schedule.

b) Self-assessment tool 

The answers you provide when using the self-assessment tool are purely processed to provide you with final recommendations in the field of Connected and Autonomous Vehicles. This information is immediately deleted from our systems once the recommendation are formulated by the tool; in case you close the browser page before submitting your questionnaire, your answers will be temporarily saved in case you wish to resume the test. In any case, this information is then deleted on a daily and automatic basis.
When you complete the questionnaire, we will also have access to your IP address and technical logs related to your visit. However, please note that these data will be retained for a duration of 15 days and will only be accessible to LIST’s research team. 

c) Session Cookies

Cookies are small text files that are sent and stored to your personal computer or device when you visit a website. The information stored may be returned to the website’s servers or to the servers of the relevant third parties during a subsequent visit.

This website uses session cookies. These cookies are used to enable you to visit the website and its features and they are automatically deleted once the navigation browser is closed. Users’ consent is not required for session cookies.

d) This website uses third party services that may collect information used to identify you.
Link to privacy policy of third party service providers used by this website: https://policies.google.com/technologies/partner-sites

5.    Purpose and legal basis for processing

Please find here below a list of the legal basis on whose grounds LIST collects and processes your personal data:

  • Your consent, which is requested before using the self-assessment tool presented on this website;
  • LIST’s legitimate interest, which consists of replying to questions and queries, managing our and improving the present website and establishing and defending our legal rights.

6.    Share of your personal data with third parties

Your personal data, collected via this website, may be shared among project partners for the duration of the project. You can see the details of the partners at the following link: https://pascal-project.eu/partners.

More specifically, please note that the current website is managed by Inetum, a partner within PAsCAL project that does not have access to any data related to the self-assessment tool. 

7.    Ensuring personal data security and integrity

In compliance with the applicable data protection legislation, LIST has put in place appropriate technical and organisational measures in order to prevent or act upon any unauthorised and unlawful processing or disclosure, accidental loss, modification or destruction of personal data. These measures are implemented based on the current state of art, an evaluation of the risks derived by the processing activity and the need to protect personal data. Such technical and organisation measures are regularly updated and/or adjusted to new technical developments or any organisational change that may affect LIST. 

8.    Your rights and how to exercise them 

With regards to your personal data collected and processed by LIST, you may exercise at any time the following rights:

  • Right to access: You have the right to receive confirmation about whether or not your personal data is being processed by LIST. If that is the case, you have the right to know what data is being collected and processed and to obtain of copy of it;
  • Right to rectification: If the personal data we hold about you is inaccurate or incomplete, you have the right to request to have it rectified;
  • Right to erasure: Subject to certain conditions specified in art. 17 of the GDPR, you have the right to have your personal data deleted by LIST;
  • Right to restriction of processing: Subject to certain conditions specified in art. 18 of the GDPR, you have the right to obtain restriction of the processing of your personal data performed by LIST;
  • Right to data portability: Subject to certain conditions specified in art. 20 of the GDPR, you have the right to obtain a copy of the personal data you provided to LIST in in a structured, commonly used and machine-readable format and to request the transfer of these data to another data controller;
  • Right to object: You have the right to object the processing of your personal data when the conditions set out in art. 21 of the GDPR apply;
  • Right to withdraw consent: If LIST is processing your personal data based on your consent, you have the right to withdraw that consent at any time. The withdrawal of such consent shall not affect the lawfulness of processing based on consent before its withdrawal.
  • Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD). More information on how to lodge a complaint are available on CNPD’s website: https://cnpd.public.lu.

You may exercise any of these rights by contacting our Data Protection Officer (DPO): 

  • by e-mail at the following address: dpo@list.lu,
  • or by post at: 
    Luxembourg Institute of Science and Technology
    Attn. Data Protection Officer
    5, Avenue des Hauts-Fourneaux
    L-4362 Esch-sur-Alzette, Luxembourg.

Please kindly note that your rights are not absolute and they may be withheld in accordance with applicable data protection laws. In such event, LIST will provide you with the reasons for not complying with your request. In such case, you may lodge a complaint with the CNPD and seek a judicial remedy against such decision.

9.    Link to other websites

Please be aware that this website may contain links to other website that are not governed by this privacy notice. We encourage You to review the privacy notice of each website before disclosing any personal data.

10.    Changes to this notice 

LIST may make changes to this privacy notice from time to time, to reflect our current privacy practices or to comply with changes in the applicable data protection legislation. LIST encourages You to regularly visit this page in order to remain informed on how we collect and process personal data.

Pascale