I. General terms and conditions of use (Ts&Cs) of Guichet.lu

Any person using the information, documents, products, software and/or services (hereinafter collectively referred to as the 'Services') offered by the website Guichet.lu shall be deemed to be aware of, and to have accepted, all the provisions of these general terms and conditions of use.

Definition and purpose

1. Guichet.lu is a website run by the Luxembourg Government (hereafter the 'State'), to facilitate users' access to information pertaining to every stage of their life as private citizens and businesses, and simplify administrative procedures which users need to complete with the State and communal administrations and public-sector establishments, as well as procedures before the courts and related bodies.

2. Guichet.lu is aimed at two distinct user groups, which are clearly differentiated by two sections, of which one relates to private individuals (the 'Citizens' section) and the other to professionals (the 'Business' section). Each section is made up of two parts: a purely informative part and a transactional part (MyGuichet.lu) in which users may carry out, in full or in part, their administrative procedures with State and communal administrations and public-sector establishments as well as proceedings before the courts and related bodies directly online. The MyGuichet.lu service is subject to its own terms and conditions of use.

The term 'body' refers to all the departments and offices assigned to a task.

The term 'competent authority(ies)' refers to State and communal administrations, public-sector establishments, administrative and judicial courts as well as bodies with/before which procedures/proceedings available on MyGuichet.lu exist.

3. The use of Guichet.lu is free of charge.

Obligations of the user

4. Guichet.lu is accessible via the internet. The user declares that they are aware of the risks involved and that they accept those risks. They must guard against the effects of computer hacking by adopting a suitable and secure computer configuration.

5. The State accepts no liability for any loss or damage the user may suffer, directly or indirectly, in connection with browsing Guichet.lu or using the services which it offers, or from accessing any of the other websites to which it links.

Cookie management

6. Guichet.lu uses cookies, which are small text files used to analyse information related to the user's browsing activities (frequency of visits, duration of visits, visited pages, language preferences, etc.). They are stored by Guichet.lu in a directory on the user's computer. A cookie contains the name of the server that created it, an identifier in the form of a unique number and an expiry date. The unique identifier allows Guichet.lu to recognise the user's computer each time they visit the site. Session cookies are deleted from the user's computer when the session is closed. However, persistent cookies remain on the user's computer for one month after the end of the session.

7. The user can decide whether or not the Guichet.lu server is allowed to store cookies on their computer. They may change their browser settings at any time to prevent cookies from being accepted and stored. Moreover, the user can delete all previously stored cookies at any time using their browser.

8. The use of certain features of Guichet.lu (such as MyGuichet.lu) may be limited or disabled if the user does not accept cookies from the site. It is therefore recommended that the user set their browser to accept cookies from Guichet.lu.

Modification of Guichet.lu

9. The State reserves the right to update, modify or suspend Guichet.lu, without prior notice, for maintenance or updating operations, or for any other reason deemed necessary. In particular, the State may, at any time, withdraw, add to, supplement or clarify all or any part of the information and services contained in or offered on Guichet.lu. The State may not be held liable for any loss or damage whatsoever, whether direct or indirect, in connection with any such changes.

General limitations of liability

10. The State will do its utmost to ensure optimal availability of the Guichet.lu website. However, it accepts no liability should the website become temporarily or wholly unavailable.

11. The State will do everything in its power to ensure that the computer system is secure.

12. The State shall make its best effort to ensure that the information and services contained on Guichet.lu, and published on social networks, and the advice and information provided by the Guichet.lu Helpdesk, are accurate and correct. However, it may not be held liable for any omissions in connection with the update of information or forms, errors in the use of the system, coding errors, inaccuracies (notably regarding the geographic location of the competent authorities: as this service is provided by an external source), gaps in the information provided, or any errors, inaccuracies or omissions in the answers provided by the Guichet.lu Helpdesk. The aim is to disseminate accurate, up-to-date information from a variety of sources, but the State is unable to avoid all risks of factual inaccuracy. None of the information published on Guichet.lu or provided by the Guichet.lu Helpdesk in response to an individual request should be considered as exhaustive or as a commitment from the State. Explanations in layman's terms and translations are provided solely for information purposes. Only legal texts published in the Mémorial (Official Journal of the Grand Duchy of Luxembourg) are deemed authoritative. The information appearing on Guichet.lu is of a general nature. It is not tailored to personal or specific circumstances, and therefore cannot be regarded as constituting personal, professional or legal advice to the user. If the user needs personal or specific advice, they should always consult the competent departments within the different competent authorities.

Limitation of liability of Guichet.lu, MyGuichet.lu and the MyGuichet.lu app

13. Guichet.lu and MyGuichet.lu explicitly exclude liability for any consequences, whether direct or indirect, arising from:

1. incompatibility between the service offered and the equipment, applications, procedures or infrastructures of the user or of any third party;
2. any security breaches caused by the user or a third party, and more generally any security breaches not directly attributable to Guichet.lu;
3. any errors and/or fraudulent acts committed by the user or a third party;
4. any unavailability or malfunction of electronic communication systems or networks.

14. The data sent to the competent authorities or private sector bodies, by means of forms downloadable from Guichet.lu, is the sole responsibility of the user and of the recipient once this data has been sent.

15. The State reserves the right to terminate access to any eSpace on MyGuichet.lu which is used for unlawful or fraudulent purposes, and it may do so without prior notice or compensation of any kind.

Furthermore, the State reserves all rights and in particular the right to refuse, terminate or restrict, without prior notice or compensation of any kind, access to Guichet.lu and its services to any person, natural or legal, making abusive, unlawful or fraudulent use of these services.

Links to related sites

16. For users' convenience, Guichet.lu may contain links to other websites which they may find useful or interesting. The State, and more specifically the Ministry for Digitalisation, does not systematically monitor the content of those websites. Consequently, they accept no liability for the content of those websites, either in terms of the legality of such content or the accuracy of the information found there.

Online payment

17. The administrative fees for certain procedures can be paid using the payment system provided on Guichet.lu. Payment is made through a payment institution listed on the approved public register in Luxembourg, which guarantees the security of payment operations.

The payment details (credit card data or account number, amount of payment, etc.) are not processed by the Government IT Centre (CTIE) that, at any time, has no access to this data. The CTIE is not involved in the payment procedure. As such, it may not be held responsible for malfunctions in the operator's application, or for any fraudulent use of users' payment details. For matters regarding payments, the user is subject to the general terms and conditions of the operator.

Intellectual property

18. Guichet.lu, all the elements contained therein (including the layout) and the information and services are protected by the relevant intellectual property and copyright legislation.

19. Unless otherwise specified, the State grants no license or authorisation with regard to the intellectual property rights which it holds in respect of the Guichet.lu website, the elements it contains, or the services. Moreover, reproduction of the information, logo or services, either wholly or in part, and in whatever form or by whatever means, is not permitted without the prior written consent of the Ministry for Digitalisation.

20. Unless otherwise stated, users are authorised to view, download and print the available documents and information, on the following conditions:

• the documents may only be used for personal purposes, for information and in a strictly private context;
• the documents and information may not be modified in any way whatsoever;
• the documents and information may not be disseminated outside or beyond Guichet.lu.

21. The rights implicitly or expressly granted above constitute an authorisation to use Guichet.lu; in no circumstances do they constitute a transfer or assignment of property rights or other rights in relation to the website.

Changes to the general terms and conditions of use

22. These general terms and conditions of use may be modified or supplemented at any time, without prior notice, in line with changes made to Guichet.lu or changes in the law, or for any other reason deemed necessary. It is the user's responsibility to familiarise themselves with the general terms and conditions of use of Guichet.lu, of which only the most up-to-date version accessible online shall be deemed to be in force. It is possible that the general terms and conditions of use have changed in the interval between two visits of Guichet.lu, and it is therefore the user's responsibility to read through those conditions before using the site once again.

Applicable law and courts of competent jurisdiction

23. All disputes arising from the use of Guichet.lu and its Services, including MyGuichet.lu and the MyGuichet.lu mobile app, are governed by Luxembourg law, and the courts of the Grand Duchy of Luxembourg have exclusive jurisdiction to hear and settle such disputes.

II. Special terms and conditions of use applicable to MyGuichet.lu

Users of the MyGuichet.lu service, which can be accessed through Guichet.lu, shall be deemed to have read and accepted the entirety of these terms and conditions of use, as well as the general terms and conditions of use of Guichet.lu.

Definition and purpose

24. Authentic sources: authentic sources are data held by the competent authorities about the user. The user is entitled to view and check this data, and to use it to auto-fill administrative forms or automatically generate documents for their own use.

25. The MyGuichet.lu service available from the Guichet.lu website is a package of online services designed to simplify administrative procedures for users dealing with state and communal administrations or public institutions, and proceedings with/before the courts and other bodies. It essentially enables users to input, submit and monitor applications, and to consult available authentic sources.

26. Use of the MyGuichet.lu service is free of charge and, except where provided for otherwise by law, optional. Users always have the option to contact the competent authority directly to have their application processed in a conventional, non-electronic way.

27. The MyGuichet.lu service is available for use within the framework of the legislation or regulations in force relating to the various administrative procedures offered.

28. The 'MyGuichet.lu account' consists of all the eSpaces to which the user has access. eSpaces can be private or professional. Users log in using one of the means of authentication accepted by MyGuichet.lu, in particular a LuxTrust product, a Luxembourg electronic identity card (eID) or an eIDAS device. Users are identified with their data contained in the National Registry of Natural Persons.

The data in this account consists of the procedures, documents, communications and declarative profile data contained in these eSpaces. The account also provides access to authentic sources.

Deleting a MyGuichet.lu account

Users who wish to delete their MyGuichet.lu account must delete all personal eSpaces in which they are active, or be uninvited from business eSpaces if the conditions for deletion are not met. The following conditions must be met in order to delete an eSpace:

• Private eSpace:
  
  • no procedures have the status 'Sent' or 'To be corrected'
• Business eSpace:
  
  • the user must be the administrator of the eSpace
  • the user must be the sole user of the eSpace (all invited users must have been removed)
  • no procedures have the status 'Sent' or 'To be corrected'

Disinvitation from a business eSpace

30. To leave a business eSpace, the user must ask an administrator for this eSpace to revoke their access. If the user is the only administrator of this eSpace, he/she can either appoint a new administrator and ask them to remove his/her access, or delete the eSpace him/herself.

Business eSpace roles

31. The administrator role for a business eSpace allows you to create, modify, sign and transmit procedures and documents, as well as add, delete or suspend a user's access and roles in this business eSpace.

Any user who creates a business eSpace is automatically given the role of administrator for that eSpace.

Multiple users of the same eSpace can have the role of administrator for that eSpace.

The administrator role can be revoked by another administrator of the same eSpace.

The manager role for a business eSpace enables you to create, modify, sign and transmit procedures and documents.

The role without signature for a business eSpace enables you to create, modify and transmit procedures and documents. Signing is not allowed.

Availability and development of MyGuichet.lu

32. MyGuichet.lu is available around the clock, seven days a week. However, the State reserves the right to update, modify or suspend MyGuichet.lu, without prior notice, for maintenance purposes, hardware or technical incidents, or for any other reason deemed necessary. Unavailability of the MyGuichet.lu service does not entitle users to any form of compensation. Should a user fail to meet a deadline due to the temporary unavailability of the Guichet.lu website and/or the MyGuichet.lu service, the State may not be held liable under any circumstances. The State may not be held liable for any direct or indirect damage in connection with developments or modifications of MyGuichet.lu.

Obligations of the user

33. The MyGuichet.lu service is accessible via the internet. The State will do its utmost to ensure the security of its IT systems. The user declares that they are aware of the risks involved and that they accept those risks. They must guard against the effects of computer hacking by implementing suitable and secure computer settings. The State accepts no liability for any loss or damage users may incur, whether directly or indirectly, in connection with their browsing on Guichet.lu or their use of MyGuichet.lu.

Changes to the terms and conditions of use relating specifically to the MyGuichet.lu service

34. These terms and conditions of use may be modified or supplemented at any time, without prior notice, in line with changes made to the MyGuichet.lu service or changes in the law, or for any other reason deemed necessary. Users are specifically informed of any changes whenever they use MyGuichet.lu, and asked to accept the new terms and conditions. Only the most up-to-date online version of the terms and conditions of use is deemed to be in force.

III. Specific conditions of use applicable to the MyGuichet.lu mobile app

The MyGuichet.lu app is operated by the Luxembourg Government (hereinafter referred to as the 'State'). It is published by the Government IT Centre (Centre des technologies de l'information de l'État – hereinafter referred to as 'CTIE'), located at 560 rue de Neudorf, Luxembourg.

By installing and/or using the MyGuichet.lu application (hereinafter, the 'app'), the user is deemed to be aware of and have accepted all the stipulations of these terms and conditions. They also consent to the app's privacy policy. They agree to abide by these terms.

Definitions

35. The term 'user' refers to any natural person aged 16 or over, and any legal person incorporated under private or public law, under either Luxembourg or foreign law, who downloads the MyGuichet.lu app to a mobile telephone or tablet.

36. The term 'application' (or 'app') refers to the software application MyGuichet.lu, which can be downloaded from the 'Apple App Store' and 'Google Play Store' platforms for installation on compatible mobile phones and tablets.

37. The term 'QR code' refers to a 2D barcode designed to store data. QR codes can be decrypted by QR reader software from an image taken by a mobile phone or tablet with a camera or webcam.

Purpose of the application

38. The purpose of the application is to allow users to use their mobile phone or tablet to access their private and/or business eSpace on MyGuichet.lu and carry out certain procedures and proceedings. In order to do so, users must first install the app and then link their MyGuichet.lu account to their compatible smartphone/tablet on which they have installed the app.

39. The user links their account by signing into MyGuichet.lu with their LuxTrust product or eID card from the browser of a computer (desktop or laptop), and then using their mobile phone or tablet to scan the QR Code displayed on the MyGuichet.lu site on the computer.

40. The free app allows users to:

• carry out certain online administrative procedures offered by the MyGuichet.lu platform, and track their progress directly from their smartphone and/or tablet;
• initiate procedures with/before the courts and other bodies;
  
• add supporting documents to their procedures/proceedings carried out from their private and/or business eSpace on MyGuichet.lu;
• consult their messages to and from the various competent authorities;
• access certain personal and/or professional data that is held by the Luxembourg competent authorities;
• receive messages in the form of a notification on any mobile phone compatible with 'push notification' technologies. These notifications can also be made via email or SMS or any other communication channel.

If, however, the user has difficulty accessing these functionalities, it will be possible to use the MyGuichet.lu service directly via the MyGuichet.lu website.

By installing the application on their mobile phone and accepting these Ts&Cs, users agree to receive such notifications.

However, users who do not wish to receive these notifications can disable them:

• either via the operating system of their mobile phone, which lets users authorise or not the notifications for each application installed on it;
• or via the application's 'Settings' menu.

These notifications do not entail any data processing.

Furthermore, the State cannot guarantee the systematic delivery/receipt of the above notifications to the user, regardless of the communication channel used.

41. The State may, at any time, change, expand or update the purpose of the app. If it is expanded, the user will be informed.

Hardware required for the app

42. To access and use the app, the user must have:

• a private and/or business eSpace on MyGuichet.lu;
• a compatible multimedia tool – i.e. a mobile device (smartphone or tablet) with a camera, an NFC reader capable of reading ISO7816 tags, an XML file reader and running iOS 11.0 or Android 6.0 or later versions;
• internet access;
• a customer account on either the 'Apple App Store' or the 'Google Play Store'.

Availability of the app

43. The State will do its utmost to ensure security of access, consultation and use of the information and services of the application.

44. The app is available, in principle, 24/7, except for reasons of force majeure or the occurrence of an event beyond the State's control, and during any operations:

• to carry out technical maintenance;
• to implement updates;
• to make technical improvements or change the content and/or presentation;
• for safety reasons;
• for any other reason deemed necessary.

Such operations may be carried out at any time, without prior notice to the user.

45. The unavailability or malfunction of the app does not entitle the user to any compensation.

Financial conditions

46. The app can be downloaded for free on the 'Apple App Store' or the 'Google Play Store'.

47. The user alone is responsible for the equipment and hardware necessary to access and use the app. The user shall also bear the telecommunications costs incurred by accessing and using the app.

Intellectual property concerning the app

48. The State is the exclusive owner of all intellectual property rights pertaining to the structure and content of the app, unless expressly stated otherwise and unless otherwise stipulated by law or contract.

49. These Ts&Cs do not entail the transfer of any intellectual property right to the user, with respect either to the structure or to the content of the app and its services.

50. Users expressly undertake to refrain from using the app in a way that may infringe the rights of the State and, in particular, refrain from any such use that may constitute counterfeiting or parasitic use of information, or unfair competition.

51. None of the texts, graphics, icons, photographs, illustrations and, more generally, none of the elements making up the app, may be represented, reproduced, exploited or extracted, either in part or in full, on any medium whatsoever, without the Ministry for Digitalisation’s express, written authorisation.

Usage licence

52. The State grants the user a free usage licence for the app. However, users must refrain from using the app for commercial purposes. If they do so, they will incur personal liability.

53. The term 'commercial purposes' includes, in particular:

• any profit or commercial income resulting from the marketing of the app or any competitive use;
• using the app with a commercial company and/or a third party if such use leads to the marketing of the app.

54. The licence is non-exclusive and non-transferable, and may be revoked at any time.  

Limitation of liability

55. The State cannot fully guarantee the accuracy or completeness of all information contained in the app, whether provided by the Government itself or by any other person or organisation. As such, the State may not be held liable.

56. In addition, the State may temporarily or permanently interrupt access to the app and any related services, without compensation of any kind.

57. The State may not be held liable for any direct or indirect damage in connection with developments or modifications of the application.

58. The user alone is responsible for updating to the latest version of the app. The State assumes no responsibility in this regard.

59. The State cannot be held liable:

• if the application or its services cannot be accessed, for any reason;
• if, for whatever reason, internet connection is interrupted;
• for any omissions and/or errors in the app.

60. The State may not be held liable for:

• damage of any sort, whether direct or indirect, resulting from the use of or inability to use the app or its services – in particular, notably any operating, financial or commercial loss, or loss of programs and/or data in the user's information system;
• damage of any sort, whether direct or indirect, resulting from the content and/or use or inability to use websites linked to the app or which the user would usually be able to access through the app.

61. The State accepts no liability whatsoever for any misuse of the mobile phone or tablet, or for any incident relating to the use of those devices while running the app. Under no circumstances may the State be held liable for any damage whatsoever, caused to the user, their terminal, their computing or phone equipment and data stored thereon, or for the consequences of such damage for their personal, professional or commercial activities.

62. The user declares that they are fully aware of and accept the risks, limitations and problems of the internet network and the app's operating system, for which the State may not be held liable. In particular, the user acknowledges that:

• they use the app at their own risk;
• the app is accessible ‘as is’, depending on its availability;
• they are responsible for protecting their own data and/or software stored on their mobile phone, and for taking all appropriate measures to protect them against any damage (loss of the phone, malfunction, virus, hacking, etc.);
• given the technical capabilities of the internet, processing time is required to respond to, view, request or transfer the information. 

63. Users undertake not to use the app for fraudulent purposes.

64. Users acknowledge that they, and they alone, are responsible for any breach of their obligations under these Ts&Cs, and for the consequences of such a breach.

Changes to the Ts&Cs for the MyGuichet.lu app

65. The State reserves the right to modify, expand or supplement any or all of these Ts&Cs at any time, so that they reflect changes to services, or technical, jurisprudential or legal changes, or any new services that may be introduced. Users will be specifically informed of any changes to the Ts&Cs before using the app, and asked to accept those changes.

66. Nevertheless, the State advises all users to apprise themselves of the Ts&Cs governing the use of the app. Only the latest version of these Ts&Cs accessible online is deemed to be in force at the time of use.

IV. Protection of personal data

General information on MyGuichet.lu

67. The personal data communicated by the user is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

68. Technical and organisational security measures are implemented by the CTIE to ensure an appropriate level of confidentiality, integrity, availability and resilience of the services offered through MyGuichet.lu, and protect users' rights and freedoms in accordance with industry standards. Only the users themselves or authorised users may access the personal data, and then only if they have a legitimate reason to do so. Except where these Ts&Cs specify otherwise, the user data is stored in Luxembourg.

69. Users have the right to access, rectification and erasure of data concerning them. They may exercise these rights by applying to the relevant data controller. Where applicable, these rights may be exercised through features available on MyGuichet.lu (authentic sources, erase function, etc.).

If a technical problem prevents the use of these features, users may refer to the Guichet.lu Helpdesk.

Where the CTIE is the data controller, the user may send their request by post to the following address: 'Centre des technologies de l'information de l'État, B.P. 1111, L-1011 Luxembourg'.

Users are also entitled to restrict and oppose processing, and to withdraw consent. They may also invoke their right to data portability. All of these entitlements may be exercised by contacting the relevant data controllers directly.

70. Users can file claims relating to the protection of their personal data through the various communication channels available, and also to the relevant data controller for their request and/or application. In addition, users can file claims with the CTIE's data protection officer at the following email address: dataprotection@ctie.etat.lu. Furthermore, users may refer to the National Commission for Data Protection (Commission nationale pour la protection des données) to resolve any disputes in this domain.

Particularities for proceedings before the administrative and judicial courts as well as before the Luxembourg and Diekirch Bar Association

71. The personal data protection policy relating to proceedings before the administrative and judicial courts can be consulted on the Justice portal.

The personal data protection policy relating to procedures with the Luxembourg and Diekirch Bar Association can be consulted on the website of the Luxembourg Bar Association.

MyGuichet.lu processing operations pertaining to procedures and authentic sources

72. The features offered by MyGuichet.lu allow users, if they so desire, to create administrative procedures, view authentic sources and use those sources to pre-fill procedure-related forms or generate documents for their own use. When submitting their procedures to the competent authority indicated, users are asked to give their express consent for their personal data to be processed by the relevant administration or establishment as part of their application and/or request.

73. The data controller is the competent authority which implemented the procedure in question or granted access to a given authentic source on MyGuichet.lu. Their contact details are available either in the 'Contact' section – which is clearly displayed for each procedure – or in the data header of an authentic source. The CTIE, which hosts the MyGuichet.lu platform, is the data controller's only subcontractor.

74. The purpose of each procedure is specified in its title, with further details provided in the relevant legal texts. Those legal texts can be found on the public Guichet.lu page describing the procedure, in the 'Related procedures and links' section, accessible via the 'More information on this procedure' link. This link is clearly visible when the user begins a procedure, and can always be accessed via the procedure status tracking features. Thanks to the messages sent by the administration or establishment in question through MyGuichet.lu, users can also monitor the progress of their administrative procedures.

75. When the user submits their form or complete application file (form plus any annexes thereto and supporting documents) by electronic means, the information they provide is recorded and then forwarded directly to the competent authority. The computer system places an electronic time-stamp on the application file sent via MyGuichet.lu, evidencing the date and time that the file was forwarded to the competent authority. The file remains stored in MyGuichet.lu. In principle, it is not possible to cancel or modify any files which have been forwarded in this way to the competent authority via MyGuichet.lu. Any request for cancellation or modification must, where applicable, be sent directly to the competent authority in question.

76. Where a signature is required, the user must sign the online form using an electronic signature. In accordance with article 1322-1 of the Civil Code, the use of an electronic signature within the framework of a procedure filed through MyGuichet.lu identifies the person who has applied the signature, and certifies their acceptance of the contents of the signed document. Consequently, in the event of any dispute, electronically signed documents, as well as any data used as a time-stamp and to guarantee the correctness and completeness of the filing process, shall be admissible before the courts and shall constitute evidence of the details contained in them and of the commitments they represent.

77. The scope of the collected data is determined by the legal or regulatory basis upon which the request or procedure is based, and by the data controller. This data is accessible only to the user and the data controller. Apart from the information provided by the user to the competent authority, the latter has no access to the data or to the documents stored on MyGuichet.lu. However, the user accepts and agrees that a strictly limited number of people at the CTIE, or subcontractors bound by a non-disclosure agreement, may, on demand, temporarily access the data for a given application as part of the processing of a request for assistance filed by the user with the Guichet.lu Helpdesk.

78. As part of the processing of their application, the user accepts that, where necessary, the data they submit may be copied within the data controller's information system. The CTIE cannot know in advance to whom the data controllers may forward the data or how the data may be processed in the future, and such matters are beyond its purview. The CTIE merely provides a platform for initiating and tracking procedures between two clearly identified parties. Hence, where applicable, it is up to the user to directly approach the relevant data controllers to find out whom their data will be shared with or how it will be processed.

79. The length of time for which data will be kept varies depending on the type of procedure, and falls within the purview of the data controller. The criteria used to determine that length of time depend on the relevant legal basis. When users consult authentic sources, the data is never stored in MyGuichet.lu.

80. It should be noted that the legal bases on which the procedures are based may contain specific provisions governing the exercise of the users' rights.

81. The processing of certain procedures submitted to the competent authority via MyGuichet.lu may require the forwarding of personal data to the competent authority of another EU or EEA Member State. Where applicable, such personal data may be forwarded through the Internal Market Information system (IMI), which was set up for the purposes of administrative cooperation, pursuant to the terms of EU Regulation 1024/2012. Such personal data is processed in accordance with Regulation (EC) No. 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data. Further information can be found here.

Procedures on MyGuichet.lu pertaining to identification, management of pre-filling data and availability of a storage space

82. When users first log in and on subsequent occasions, they accept and agree that the MyGuichet.lu platform may access their data as held in the National Registry of Natural Persons. They also accept and agree that the authentication data contained in the electronic certificate issued by the LuxTrust certification authority may be used to establish their identity, and that said certificate may be recorded in their profile.

83. The data controller is the CTIE.

84. The purpose of these processes is to unequivocally establish users' identity, and in so doing, speed up the completion of procedures by allowing users to:

1. select data from authentic sources;
2. voluntarily provide personal data;
3. upload, to the server, documents that can be reused time and again in the user's storage space (notably supporting documents).

85. This data can only be accessed by the authorised user. When using the auto-fill feature, the user themselves can control the insertion of some of the data.

86. The data or documents kept by users in their storage space are their sole responsibility. Use of the storage space does not absolve users of their responsibility to retain the original of any document that they may have copied and saved in that space.

87. The user's profile data are kept for as long as their account remains on the platform.

Data processing in connection with requests sent to the Guichet.lu Helpdesk

88. The user accepts that authorised persons within the CTIE have access to the data transmitted with their request in order to process the request.

89. The data controller, in this context, is the CTIE.

90. The purpose of the processing is to provide a response to the user's request/question. In addition, this data may be further processed by the CTIE for statistical purposes.

91. The personal data communicated by the user will be retained for as long as necessary for the processing of their request/question, plus one year to allow for subsequent reopening in order to improve the quality of the service provided to users.

Processing related to event logs

92. The user accepts that the data relating to their activity on MyGuichet.lu (identifier, surname, first name, procedure or feature used, date and time, settings) may be audited, i.e., recorded and stored, for the sole purpose of allowing said data to be made available to the relevant data controllers (CTIE or, where applicable, the competent authorities) or to the judicial authorities in the following limiting cases:

• the resolution of data security incidents in the legitimate interest of ensuring the security of MyGuichet.lu;
• the establishment, exercise or defence of a right through the courts as part of a legal, administrative or extrajudicial procedure in connection with the procedure being audited.

93. The data controller responsible depends on the feature being audited. Only this data controller has access to the audited data.

94. Users are informed that the confidentiality of such data is assured to the highest of standards, and that such data may only be extracted if the data controllers or judicial authorities explicitly request such an extraction, providing valid reasons for their request.

95. In view of the wide variety and the number of procedures, and the relevant legal bases, on the one hand, and of the highly restrictive data access and extraction measures that have been implemented on the other, the data will be kept for 5 years overall under the current system.

Data processing in connection with procedures without authentication

96. Data processing in connection with these features enables an application to be filed without authentication, and on a voluntary basis, by the user. The user will be required to give their explicit consent to the processing of their personal data by the relevant competent authority for the purpose of completing their procedure and/or application.

97. The data controller is the competent authority that has implemented the procedure in question. Their contact details are available in the 'Who to contact' section which is clearly displayed for each procedure. The CTIE, which hosts the MyGuichet.lu platform, is the data controller's only subcontractor.

98. The purpose of each of these procedures is specified in its title, with further details provided in the relevant legal texts. These legal texts can be obtained from the relevant data controller.

99. The scope of the collected data is determined by the legal or regulatory basis and by the data controller. The user's email address is always required so that they can be sent a reference, which is to be quoted in any further requests between the two parties.

100. As part of the processing of their application, the user accepts that, where necessary, the data they submit may be copied within the data controller's information system. The CTIE cannot know in advance to whom the competent authorities may forward the data or how the data may be processed in the future, and such matters are beyond its purview. The CTIE merely provides a platform for initiating and tracking procedures between two clearly identified parties. Hence, where applicable, it is up to the user to directly approach the relevant data controllers to find out whom their data will be shared with or how it will be processed.

101. The length of time for which data will be kept varies depending on the type of procedure without authentication, and falls within the purview of the data controller. The criteria used to determine that length of time also depend on the relevant legal basis.

102. It should be noted that the relevant legal bases upon which procedures without authentication are based may contain specific provisions governing the exercise of the users' rights.

Data processing in connection with the management of the newsletter

103. The email address provided by the user when they sign up for the website newsletter will be shared with a subcontractor for the sole purpose of disseminating the newsletter. That subcontractor – 'Mailjet', based in Paris, France – is subject to the same legal obligations with regard to the protection of personal data. To prevent abuse of the system, the user must confirm their subscription by clicking on a link sent to the email address they provided.

104. The user may unsubscribe at any time using a link provided in each email, or by contacting the Guichet.lu Helpdesk. In the event of problems of use with respect to the newsletter, the user must also contact the Guichet.lu Helpdesk. The user's data will not be kept for longer than their subscription lasts.

105. The data controller is the CTIE.

Guichet.lu processing in connection with audience measurement

106. Certain data relating to the user's hardware and software, which is not of a nature that will reveal the user's identity, is collected when they visit the public website. The sole purpose of collecting such data is to garner statistics on website traffic (type of browser, resolution, approximate location, and so on) in order to provide users with the best possible user experience.

107. The data controller is the CTIE.

108. Under no circumstances is the user's full IP address kept. Moreover, the public page from which MyGuichet.lu is accessed is not subject to this audience measurement data collection process. As such, the traffic data for all visitors to the page from which the transactional website is accessed is protected from mass transfer to a third party.

109. This data is kept in a solution provided by a subcontractor – Adobe Systems Inc. – who, as such, is subject to the same legal obligations regarding the protection of personal data, should that data be harvested in the future.

110. The data is kept for no longer than is necessary to observe how audiences evolve on the basis of browsers, resolution settings or other available statistical data.

Processing in connection with online surveys

111. Users' data is harvested, with their permission, for the sole purpose of conducting surveys on behalf of the State's administrative bodies. In addition, technical audience measurement data is collected at the same time.

112. The data controller and the recipient of such data are the government's administrative bodies who commission the surveys. The CTIE is their main subcontractor, and acts under their authority on a dedicated platform.

113. The data is kept for the duration of the survey, plus a few weeks for the results to be statistically analysed.

114. These surveys are conducted directly on the website of a subcontractor – specifically, alchemer.eu, developed by Alchemer LLC – located in the United States. That subcontractor is subject to the same legal obligations regarding the protection of personal data, as the surveys are carried out for or by users from the European Union.

115. The procedures by which these surveys are carried out are such that none of the collected data can be used to personally identify the user. Even by combining technical identifier data (IP address or information about the user's browser or device) and data harvested from multiple surveys, both the subcontractor operating the platform and the CTIE would still be unable to personally identify the users. In addition, the surveys are configured in such a way that personal data is never visible to CTIE operators or those of the government administration departments who commissioned the surveys.

V. Guichet.lu on social networks

Moderation policy

116. Any user who joins the Guichet.lu social networking community undertakes to refrain from any form of discrimination based on race, colour, religion, gender, sexual orientation, age, ethnic origin, disability, marital or employment status.

117. Abusive, racist, sexist or otherwise offensive comments have no place on social networks. Any such comments will be deleted and reported.

118. The main purpose of the Guichet.lu social media accounts is to relay information and content published on Guichet.lu.

119. The Guichet.lu social media accounts are not intended to process requests, questions and comments containing personal data such as surnames, first names, national identification numbers, dates of birth, telephone numbers, email addresses, or attachments or scans of documents that contain personal data.

For such requests, questions or comments, users of the Guichet.lu community must use the contact form available on Guichet.lu.

In this respect, requests, questions or comments containing personal data (the identifier of the person's account on this social network is generally not taken into account) made on Guichet.lu's accounts on social networks will not be processed and will, to the extent possible, be deleted.

120. Guichet.lu's Facebook, Twitter and LinkedIn accounts are monitored, in principle, from Monday to Friday between 08.00 and 18.00. The pages are not continuously monitored after working hours, or during weekends and holidays.

Languages

121. Guichet.lu communicates on social media in French, German, English and Luxembourgish.