The purpose of these General Terms and Conditions of Use (hereinafter the T&C) is to determine the rules governing the use of the Lux Héberge mobile application.

The Lux Héberge application is implemented by the State of the Grand Duchy of Luxembourg (hereinafter the State). It is published by the Centre des technologies de l'information de l'État du Grand-Duché de Luxembourg (hereinafter the CTIE) (560, rue de Neudorf, L-2220 Luxembourg).

By installing and/or using the Lux Héberge application on their mobile phone or tablet, users are deemed to have read and accepted, without reservation, all the terms and conditions of these T&C, and they also agree to the privacy policy available by following this link XXX. They undertake to comply with them.

Article 1: DEFINITIONS

The term "user" refers to an individual who downloads the Lux Héberge application onto a personal or professional mobile phone or tablet for his/her own use.

The term "application" refers to the Lux Héberge application which can be downloaded from the Apple App Store and Google Play Store and installed on compatible mobile phones and tablets.

The term "competent authorities" means the Grand-Ducal Police Force of the Grand Duchy of Luxembourg, the State Intelligence Service and the National Institute of Statistics and Economic Studies of the Grand Duchy of Luxembourg (STATEC).

The term "operator" means any natural or legal person who provides a tourist accommodation in exchange for a financial consideration, where the accommodation is short-term.

The term "accommodation record" means the document containing the personal information and data listed below.

The term "traveler" means any person aged 15 or over staying in tourist accommodation for a period not exceeding three consecutive months.

The terms "information and personal data" mean:

• the name of the individual operator or the company name of the corporate operator and, where applicable, the business name;
• the address of the accommodation;
• the identification number assigned by STATEC to each accommodation;
• the current number of the accommodation record;
• the traveler's family name, first name(s), date of birth and gender;
• the number of the ID document or driving license used by the traveler;
• the nationality of the traveler;
• the country of residence and postcode of the traveler's place of residence;
• the traveler's date of arrival and presumed date of departure;
• the number of children under the age of 15 accompanying the traveler;
• the purpose of the trip: "business" or "professional events" or "leisure and other".

The term "Near Field Communication" (hereinafter NFC) means a short-range wireless communication technology enabling the exchange of information between two devices.

The terms "Contactless Reader" or "NFC Reader" mean a reader that can communicate via Near Field Communication with another device.

The term "Machine-Readable Zone" (hereinafter MRZ) means an area on an official document reserved for the reading, identification and validation of that document.

The term "QR Code®" means a 2D barcode used to store information. It is deciphered by appropriate reading software using a mobile phone or a tablet equipped with a camera.

The VISOGO module is integrated into the application. Its role is to extract personal data from the traveler's identity document by scanning the MRZ.

Article 2: PURPOSE OF THE APPLICATION

The State has developed a mobile application to enable operators to collect information and personal data from travelers staying in a Luxembourg tourist accommodation and to transfer this information to the competent authorities.

The application can be used for the following purposes:

• to collect information, via a document reader, from an ICAO 9303-compliant travel (MRTD or eMRTD) or identity document (passport, ID card);
• to enter the information needed to complete an accommodation record. In addition, the mobile application offers three main functions:
  • automatic retrieval of personal information and data, which can be done by:
    • scanning a QR Code: data pre-filled in by passengers can be retrieved and displayed by operators using the camera on the mobile phone or tablet and the QR code scanning tool on the application;
    • external NFC reader: an external reader (e.g. IDBOX) can be connected to the device and data can be extracted as planned;
  • automatic and manual data entry;
  • submission of data to the relevant government bodies.

The purpose of the application may be modified or updated by the State at any time and without prior notice to the user.

Article 3: EQUIPMENT REQUIRED TO USE THE APPLICATION

To access and use the application, the operator must have:

• a compatible multimedia tool:
  • a mobile phone with a camera and the iOS 16.0 or Android® 7.0 operating system or any later version;
  • or a tablet with a camera and the iOS 16.0 or Android® 7.0 operating system or any later version;
• a customer account at the Apple App Store or the Google Play Store;
• an internet connection;
• the operator must have a Business eSpace on MyGuichet.lu.

The application is based on OCR and NFC technologies, which use the camera and NFC reader on the mobile phone or tablet. If these components are faulty or missing from the device, the purpose of the application cannot be achieved.

Article 4: AVAILABILITY OF THE APPLICATION

The State will do its utmost to ensure secure access, consultation and use of the application's information and services.

In principle, this service is available 24 hours a day, 7 days a week, except in cases of force majeure or the occurrence of an event beyond the control of the State, and subject to intervention owing to:

• maintenance operations;
• updates;
• technical improvements or to change the content and/or presentation;
• any other reason deemed necessary.

These interventions may be carried out at any time without prior notice to the user.

The unavailability or malfunctioning of the application does not entitle the user to any compensation.

Article 5: FINANCIAL CONDITIONS

The application can be downloaded free of charge from the Apple App Store and Google Play Store.

The equipment and material resources required to access and use the application are the sole responsibility of the user. The user is also responsible for any telecommunications costs incurred in accessing and using the application.

Article 6: INTELLECTUAL OWNERSHIP OF THE APPLICATION

Unless expressly stated otherwise and unless otherwise stipulated by law or contract, the State is the exclusive owner of all intellectual property rights relating to both the structure and content of the application.

These T&C do not transfer any intellectual property rights to the User in respect of either the structure or the content of the application and its services.

The user expressly undertakes that the use of the application will in no way infringe the rights of the State and in particular that such use will not constitute counterfeiting or unfair or parasitic competition of the information.

Elements of the application that are subject to so-called "open source" or "free software" licences are governed by the terms of the licences that accompany them. These T&C do not limit or grant more rights to users than those agreed in the relevant licence conditions.

All the texts, graphics, icons, photographs, illustrations and, more generally, all the elements making up the application may not be represented, reproduced, used or extracted, in whole or in part, on any medium whatsoever, without the express written authorisation of the Ministry for Digitalisation. Except in the event of legislative and/or regulatory provisions to the contrary or an express written waiver from the Ministry for Digitalisation, the user undertakes not to modify, adapt, merge, translate, reverse engineer, decompile, disassemble or create derivative works based on all or part of the elements making up the application. Failure to do so will render the user liable.

Article 7: USER LICENCE

The State grants the user a free user licence for the application, which is reserved for strictly personal use. The user is therefore prohibited from making any commercial use of it.

The term "commercial use" includes in particular:

• any profit or commercial income resulting from the marketing of the application or from competitive use;
• any use of the application with a commercial company and/or with a third party if this use leads to the marketing of the application.

This licence is non-exclusive, revocable at any time, non-assignable and non-transferable.

Article 8: LIMITATION OF LIABILITY

The State cannot fully guarantee the accuracy and completeness of all the information contained in the application, whether supplied by itself or by any other person or organisation. It cannot therefore be held responsible.

Nor shall the State be held liable in the event of interruption of access to the application due to maintenance operations, updates or technical improvements, or to changes in content and/or presentation.

In addition, the State may temporarily or permanently interrupt access to the application and any related services, without compensation of any kind.

The State cannot be held liable for any direct or indirect damage arising from developments or modifications to the application.

The State is not responsible for the content of any websites to which hypertext links on the application refer.

The user is solely responsible for updating successive versions or sub-versions of the application. The State cannot be held liable in this respect.

The State cannot be held responsible for the impossibility of accessing the application for any reason whatsoever.

The State cannot be held responsible for any reason whatsoever if the Internet connection is interrupted.

The State cannot be held responsible for any omissions and/or errors that the application may contain.

The State cannot be held liable for:

• damages of any kind, whether direct or indirect, resulting from the use of or inability to use the application and in particular any operating loss, financial or commercial loss, loss of programmes and/or data in particular in the information system of the user of the application;
• damage of any kind, whether direct or indirect, resulting from the content and/or use or inability to use websites linked to the application or to which the user may have access via the application.

The State declines all responsibility in the event of improper use of the mobile phone or tablet, or in the event of an incident related to the use of these devices when using the application. Under no circumstances may the State be held liable for any damage of any kind whatsoever caused to the user, his or her terminal, computer and telephone equipment and the data stored on it, or for any consequences that may arise from this for his or her personal, professional or commercial activity.

The user declares that he/she is aware of and accepts the risks, limits and problems of the mobile Internet network and the application's operating systems, for which the State cannot be held liable, and in particular acknowledges that:

• use of the application is at the user's own risk;
• the application is accessible to it "as is" and according to its availability;
• It is the user's responsibility to protect their own data stored on their mobile phone, tablet and/or software, and it is their responsibility to take all appropriate measures to protect them against any attack (malfunction, virus, hacking, etc.);
• the technical performance of the Internet requires the processing time necessary to respond, consult, query or transfer information.

The user undertakes not to use the application for fraudulent activities.

The user acknowledges that he/she alone is responsible for any breach of his/her obligations as set out in these T&C, and for the consequences thereof.

Article 9: HOSTING OF THE APPLICATION

The application is hosted by the State in the Grand Duchy of Luxembourg.

Article 10: PROTECTION OF USER PERSONAL DATA AND PRIVACY POLICY

Personal data communicated directly or indirectly by the user in the course of using the application shall be processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of data and the Act of 1^er August 2018 organising the National Commission for Data Protection and implementing the aforementioned Regulation (EU) 2016/679.

The privacy policy for the Lux Héberge application and information on the protection of users' personal data can be consulted by following this link: XXX

Article 11: MODIFICATION OF THE GENERAL CONDITIONS OF USE

The State reserves the right to modify or supplement, at any time, all or part of the provisions of these T&C in order to adapt them to changes in the services, to technical, legal or jurisprudential developments or when new services are introduced. The user will be notified of any such changes.

Any changes made are deemed to have been accepted unreservedly by any user accessing the application after they have been posted online. The State therefore invites all users to inform themselves and to consult the application's GTUs, of which only the updated version accessible online is deemed to be in force on the date of use of the application by the user.

Article 12: APPLICABLE LAW AND JURISDICTION

These T&C are governed by Luxembourg law.

Any dispute or objection relating to the performance or interpretation of these T&C which cannot be settled amicably between the parties shall be submitted to the Luxembourg courts.

The present privacy policy informs users of the way in which their personal information is collected, stored and used when they use the Lux Héberge application. It also indicates the choices the user can make regarding the use of the information provided.

Personal data communicated directly or indirectly by the user as part of the use of the Lux Héberge application (hereinafter the Application) are processed in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of data and the Law of 1^er August 2018 organising the National Commission for Data Protection and implementing the aforementioned Regulation (EU) 2016/679.

The application does not give rise to the collection of any personal data about the user by the State and/or the CTIE, except for the processing operations described below.

Article 1: DATA CONTROLLER

The operator of the tourist accommodation is the controller responsible for the collection and transmission of travelers’ personal data. After transmission, the processing of personal data is governed by the law of February 28, 2025, relating to accommodation forms.

Article 2: SUBCONTRACTOR

The CTIE (560, rue de Neudorf, L-2220 Luxembourg) is the State's subcontractor. It is responsible for the development, maintenance and deployment of the application.

Article 3: SECURITY MEASURES

Technical and organisational security measures are put in place by the State and by the CTIE to guarantee an appropriate level of confidentiality, integrity, availability and resilience of the services delivered via the application and to ensure the protection of the rights and freedoms of the user and, more generally, of the persons concerned in accordance with industry standards.

In the event that the CTIE in turn has recourse to subcontractor(s), it will ensure that said subcontractors present sufficient guarantees regarding the implementation of appropriate technical and organisational measures so that the processing meets the requirements of Regulation (EU) 2016/679 and the Law of 1 August 2018 and guarantees the protection of the user's rights.

The user consents to authorised persons having access to his/her personal data collected for legitimate reasons.

Personal data will only be processed for the purpose of enabling the user to benefit from the services offered via the application. By activating and/or using these services, the user consents to the respective data processing operations.

In the absence of consent, the user will not be able to activate the said services to use the application, and their purpose will not be achieved.

Article 4: PERSONAL DATA COLLECTED

The personal data collected is as follows:

• if the user is an operator/host :
  • their name if they are a natural person ;
  • the address of the accommodation;
  • the identification number assigned by STATEC to each accommodation;
• if the user is a traveller :
  • family name, first name(s), date of birth and gender;
  • the number of the ID document or driving license used by the traveller;
  • nationality of the traveller;
  • the country of residence and postcode of the traveller's place of residence;
  • the traveller's date of arrival and presumed date of departure;
  • the number of children under the age of 15 accompanying the traveller;
  • the purpose of the trip: "business" or "professional events" or "leisure and other".

It should be noted that the personal data of the traveller set out above is collected by the operator (the accommodation provider) when the operator prepares and/or sends the accommodation record for the traveller concerned.

A document reader can be used to extract personal data from the traveller's identity document (passport, ID card), such as family name(s), first name(s), gender, nationality, date of birth and ID document number.

As part of the pre-filling of the traveller's accommodation details via MyGuichet.lu, a QR code with travel information is generated. This information contains, among other things, the personal data mentioned above. This QR code is read by the application in order to prepare the traveller's accommodation record.

The application does not give rise to any storage of the user's personal data by the State and/or the CTIE.

Article 5: CONSENT AND CONSEQUENCES IN THE EVENT OF REFUSAL

The user consents to the above-mentioned data being collected in order to achieve the purpose of the application, i.e. to enable operators to collect information and personal data from a traveller using tourist accommodation and to transfer this data to the competent authorities in the form of an accommodation record. By activating and using the services of the application, the user consents to the respective processing of data.

In the absence of consent, the user will be unable to use the application and its purpose will not be achieved.

Article 6: TRANSFER OF DATA

The user's personal data is not transferred outside the territory of the European Union.

If the user's personal data is transferred abroad, the relevant legal provisions will be complied with and the user will be informed of this by updating this privacy policy.

ARTICLE 7: PROCESSING LINKED TO ACCESS AND THE FUNCTIONS OFFERED BY THE MYGUICHET.LU PLATFORM

To access the application, users must register with the MyGuichet.lu platform, by means of a registration request for their device (mobile phone or tablet).

Any processing of personal data carried out in such cases is not covered by this Privacy Policy. It is therefore the responsibility of the user to inform himself/herself of the Terms and Conditions of MyGuichet.lu and in particular article IV (“Protection of personal data”) available at:

https://guichet.public.lu/fr/support/aspects-legaux.html.

ARTICLE 8: PROCESSING RELATED TO THE MANAGEMENT OF THE APPLICATION BY THE APPLE APP STORE AND THE GOOGLE PLAY STORE

The Apple App Store and the Google Play Store may process personal data provided directly or indirectly by the user when downloading the application.

In this case, Apple and Google alone are responsible for processing the user's personal data.

Given that Apple and Google are also subject to the aforementioned Regulation (EU) 2016/679 as well as the aforementioned law of 1 August 2018, it is up to the user to contact these bodies to exercise their rights of access, rectification and erasure of data concerning them, as well as their rights to limit processing, oppose processing, withdraw consent and portability.

Article 9: DURATION OF DATA RETENTION

Personal data collected as part of the process of creating and transferring hosting forms is kept for 6 months from the date of collection.

Personal data relating to the management of requests from authorities is kept for the duration of the procedure before the authority concerned.

Article 10: SUBSEQUENT PROCESSING

The personal data collected may be processed for historical, statistical or scientific purposes and may also be made available to the judicial authorities on request.

Article 11: CONDITIONS FOR CHANGES TO THE PRIVACY POLICY

The State reserves the right to modify this Privacy Policy at any time in order to ensure that the application complies with changes in services, technical, legal or jurisprudential developments or when new services are introduced.

Users are invited to familiarise themselves with this Policy each time they use the application, without any need for formal notification.