Your rights

Your rights when we process your personal data

When your personal information is processed by the University of Luxembourg that means you are a data subject and you have different rights defined in the GDPR. Additional information are provided on the Data Protection Policy on uni.lu and on the website of the Commission nationale pour la protection des données (National Commission for Data Protection, hereafter “CNPD”).

Right of access

You have the right to obtain confirmation from us as to whether or not personal data concerning you are being processed. Where that is the case you may obtain access to the personal data and the pieces of information detailed in the article 15 of the GDPR.

Right to rectification

In case the personal data concerning you is inaccurate or incomplete you have the right to obtain rectification or completion from us without undue delay.

Right to erasure (‘right to be forgotten’)

You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the specific grounds applies and the processing is not necessary according to Art. 17 paragraph 3 GDPR.

Right to restriction of processing

Under certain circumstances you have the right to obtain the restriction of processing from us.

Right to data portability

Under the conditions defined in the GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us.

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Art. 6(1). We will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Right to lodge a complaint with a supervisory authority

If you consider that the processing of personal data relating to you infringes the GDPR, you will have the right – without prejudice to any other administrative or judicial remedy – to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

How to exercise your data protection rights at the University of Luxembourg

• If the University of Luxembourg is processing your personal data and you would like to exercise your data protection rights, please send us a written request;
• In principle, we cannot accept verbal requests (telephone or face-to-face) as we may not be able to deal with your request immediately without first analysing it and reliably identifying you;
• You can send your request to the Data Protection Officer of the University by post in a sealed envelope or use our contact form;
• Your request should contain a detailed, accurate description of the right you want to exercise and the personal data concerned;
• You must provide a copy of an identification document to confirm your identity, for example, an ID card or passport. The document should contain an identification number, country of issue, period of validity, your name, address and date of birth;
• We recommend than any other data contained in the copy of the identification document such as a photo or any personal characteristics, be blacked out;
• Our use of the information on your identification document is strictly limited: the data will only be used to verify your identity and will not be stored for longer than needed for this purpose;
• In principle, we will not accept other means of assuring your identity. Should you wish to propose alternatives, we will assess their adequacy on a case-by-case basis.