I. General terms and conditions of use of Guichet.lu
Any person using the information, documents, products, software and/or services (hereinafter collectively referred to as the "Services") offered by the website Guichet.lu shall be deemed to be aware of, and to have accepted, all the provisions of these general terms and conditions of use.
Definition and objective
1. Guichet.lu is a website run by the Luxembourg Government (hereafter the "State"), to facilitate users' access to information pertaining to every stage of their life as private citizens and businesses, and simplify administrative procedures which users need to complete with the State and communal administrations.
2. Guichet.lu is aimed at two distinct user groups, which are clearly differentiated by two sections, one of which relates to private individuals (the "Citizens" section) and the other to professional persons (the "Business" section). Each section is made up of two parts: a purely informative part and a transactional part ("MyGuichet.lu") in which users may deal with all or some of their administrative matters directly online. The MyGuichet.lu service is subject to its own terms and conditions of use.
3. Use of Guichet.lu is free of charge.
Obligations of the user
4. Guichet.lu is accessible via the internet. The user declares that they are aware of the risks involved and that they accept those risks. They must guard against the effects of computer hacking by adopting a suitable and secure computer configuration.
5. The State accepts no liability for any loss or damage the user may suffer, directly or indirectly, in connection with browsing Guichet.lu or using the services which it offers, or from accessing any of the other websites to which it links.
7. The user can decide whether or not the Guichet.lu server is allowed to store cookies on their computer. They may change their browser settings at any time to prevent cookies from being accepted and stored. Moreover, the user can delete all previously stored cookies at any time using their browser.
8. The use of certain features of Guichet.lu (such as MyGuichet.lu) may be limited or disabled if the user does not accept cookies from the site. It is therefore recommended that the user set their browser to accept cookies from Guichet.lu.
Modification of Guichet.lu
9. The State reserves the right to update, modify or suspend Guichet.lu, without prior notice, for maintenance or updating operations, or for any other reason deemed necessary. In particular, the State may, at any time, withdraw, add to, supplement or clarify all or any part of the information and services contained in, or offered on, Guichet.lu. The State may not be held liable for any loss or damage whatsoever, whether direct or indirect, in connection with any such changes.
General limitations of liability
10. The State shall make its best effort to ensure optimal availability of the Guichet.lu website. However, it accepts no liability should the website become temporarily or wholly unavailable.
11. The State shall make its best effort to ensure that the computer system is secure.
12. The State shall make its best effort to ensure that the information and services contained on Guichet.lu, and published on social networks, and the advice and information provided by the Support Centre (Helpdesk), are accurate and correct. However, it may not be held liable for any omissions in connection with the update of information or forms, errors in the use of the system, coding errors, inaccuracies (notably regarding the geographic location of the administrative bodies and organisations, as this latter service is provided by an external source), gaps in the information provided, or any errors, inaccuracies or omissions in the answers provided by its Helpdesk. Indeed, while the aim is to disseminate accurate, up-to-date information from a range of sources, the State is not immune to the danger of hardware errors. None of the information published on Guichet.lu or provided by the Helpdesk in response to an individual request should be considered as exhaustive or as a commitment from the State. Explanations in layman's terms and translations are provided solely for information purposes. Only legal texts published in the Mémorial (Official Journal of the Grand Duchy of Luxembourg) shall be deemed authoritative. The information appearing on Guichet.lu is of a general nature. It is not tailored to personal or specific circumstances, and therefore cannot be regarded as constituting personal, professional or legal advice to the user. If the user needs personal or specific advice, they should always consult the competent departments within the different administrative bodies.
Limitation of liability of Guichet.lu and MyGuichet.lu
13. Guichet.lu and MyGuichet.lu expressly exclude liability for any consequences, whether direct or indirect, arising from:
- incompatibility between the service offered and the equipment, applications, procedures or infrastructures of the user or of any third party;
- any security breaches caused by the user or a third party, and more generally any security breaches not directly attributable to Guichet.lu;
- any errors and/or fraudulent acts committed by the user or a third party;
- any unavailability or malfunction of electronic communication systems or networks.
14. The data sent to the State or communal administrations and to public- or private-sector establishments, by means of forms downloadable from Guichet.lu, are the sole responsibility of the user and of the recipient once those data have been sent.
15. The State reserves the right to prevent access to any personal MyGuichet.lu space which is used for unlawful or fraudulent purposes, and it may do so without prior notice and without being required to pay any form of compensation.
Links to related sites
16. For users' convenience, Guichet.lu may contain links to other websites which they may find useful or interesting. The State, and more specifically the Ministry for Digitalisation, does not systematically monitor the content of those websites. Consequently, they accept no liability for the content of those websites, either in terms of the legality of such content or the accuracy of the information found there.
17. The administrative fees for certain procedures can be paid using the payment system provided on Guichet.lu. Payment is made through a payment institution listed on the approved public register in Luxembourg, which guarantees the security of payment operations.
The payment details (credit cards or account number, payment amount, etc.) never pass through the site of the Government IT Centre (Centre des technologies de l'information de l'Etat - CTIE); the CTIE never has access to those data. The CTIE is not involved in the payment procedure. As such, it may not be held responsible for malfunctions in the operator's application, or for any fraudulent use of users' payment details. For matters regarding payments, the user is subject to the general terms and conditions of the operator.
18. Guichet.lu, all the elements contained therein (including the layout) and the information and services are protected by the relevant intellectual property and copyright legislation.
19. Unless otherwise stated, the State grants no licence or authorisation with regard to the intellectual property rights which it holds in respect of Guichet.lu, the elements contained in it or the services it provides. Moreover, reproduction of the information or services, either wholly or in part and in whatever form or by whatever means, is not permitted without the prior written consent of the Ministry for Digitalisation.
20. Unless otherwise stated, users are authorised to view, download and print the available documents and information, on the following conditions:
- the documents may only be used for personal purposes, for information and in a strictly private context;
- the documents and information may not be modified in any way whatsoever;
- the documents and information may not be disseminated outside or beyond Guichet.lu.
21. The rights implicitly or expressly granted above constitute an authorisation to use Guichet.lu; in no circumstances do they constitute a transfer or assignment of property rights or other rights in relation to the website.
Changes to the general terms and conditions of use
22. These general terms and conditions of use may be modified or supplemented at any time, without prior notice, in line with changes made to Guichet.lu or changes in the law, or for any other reason deemed necessary. It is the user's responsibility to familiarise themselves with the general terms and conditions of use of Guichet.lu, of which only the most up-to-date version accessible online shall be deemed to be in force. It is possible that, in the interval between accesses to Guichet.lu, the general terms and conditions of use may have changed, and thus it is the user's responsibility to read through those conditions before using the site once again.
Applicable law and courts of competent jurisdiction
23. All disputes concerning the use of Guichet.lu and its services, including MyGuichet.lu, shall be governed by Luxembourg law, and the courts of the Grand Duchy of Luxembourg shall have exclusive jurisdiction to hear and settle such disputes.
II. Special terms and conditions of use applicable to MyGuichet.lu
Users of the MyGuichet.lu service, which can be accessed through Guichet.lu, shall be deemed to have read and accepted the entirety of these terms and conditions of use, as well as the general terms and conditions of use of Guichet.lu.
Definition and objective
24. Authentic sources: authentic sources are data held by the government administration departments about the user. The user is entitled to view and check those data, and to use them to auto-fill administrative forms or automatically generate documents for their own use.
25. The MyGuichet.lu service, which can be accessed through Guichet.lu, offers a package of online services intended to simplify the user's dealings with the state and communal administrations. It essentially enables users to input, submit and monitor applications, and to consult available authentic sources.
26. Use of the MyGuichet.lu service is free of charge and, save where otherwise provided for by law, optional. Users always have the option to approach the competent administrative body directly to have their application processed in the conventional, non-electronic way.
27. The MyGuichet.lu service is available for use within the framework of the legislation or regulations in force relating to the various administrative procedures offered.
Availability and development of MyGuichet.lu
28. MyGuichet.lu is available around the clock, seven days a week. However, the State reserves the right to update, modify or suspend MyGuichet.lu, without notice, for maintenance purposes, hardware or technical incidents, or for any other reason deemed necessary. Unavailability of the MyGuichet.lu service shall not entitle users to any form of compensation. The State accepts no liability whatsoever should the user fail to meet a deadline on account of the temporary unavailability of Guichet.lu and/or MyGuichet.lu. No liability shall attach to the State for any loss or damage whatsoever, whether direct or indirect, relating to any updates or changes to MyGuichet.lu.
Obligations of the user
29. The MyGuichet.lu service is accessible via the internet. The State shall make its best effort to ensure that the computer system is secure. The user declares that they are aware of the risks involved and that they accept those risks. They must guard against the effects of computer hacking by implementing suitable and secure computer settings. The State accepts no liability for any loss or damage users may incur, whether directly or indirectly, in connection with their browsing on Guichet.lu or their use of MyGuichet.lu.
Changes to the terms and conditions of use relating specifically to the MyGuichet.lu service
30. These terms and conditions of use may be modified or supplemented at any time, without prior notice, in line with changes made to the MyGuichet.lu service or changes in the law, or for any other reason deemed necessary. Users are specifically informed of any changes whenever they use MyGuichet.lu, and asked to accept the new terms and conditions. Only the most up-to-date online version of the terms and conditions of use is deemed to be in force.
III. Personal data protection
General information on MyGuichet.lu
31. The personal data communicated by the user are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
32. Technical and organisational security measures are implemented by the CTIE to ensure an appropriate level of confidentiality, integrity, availability and resilience of the services offered through MyGuichet.lu, and protect users' rights and freedoms in accordance with industry standards. Only the users themselves or authorised users may access the personal data, and then only if they have a legitimate reason to do so. Except where these Ts and Cs specify otherwise, the user data are stored in Luxembourg.
33. Users have the right to access, correct and remove data concerning them. They may exercise these rights by applying to the relevant data controller. Where applicable, these rights may be exercised through features available on MyGuichet.lu (authentic sources, erase function, etc.).
If a technical problem prevents the use of these features, users may refer to the Helpdesk.
Where the CTIE is the data controller, the user may send their request by post to the following address: "Centre des technologies de l'information de l'Etat 1, rue Mercier B.P. 1111 L-1011 Luxembourg".
The user is also entitled to restrict and oppose processing, and to withdraw consent. They may also invoke their right to data portability. All of these entitlements may be exercised by approaching the relevant data controllers directly.
34. Users can file claims relating to the protection of their personal data through the various communication channels available, and to the relevant data controller for their request and/or application. In addition, users can file claims with the CTIE's data protection officer at the following email address: firstname.lastname@example.org. Furthermore, users may refer to the National Commission for Data Protection (Commission nationale pour la protection des données) to resolve any disputes in this domain.
MyGuichet.lu processing operations pertaining to procedures and authentic sources
35. The features offered by MyGuichet.lu allow users, if they so desire, to create administrative procedures, view authentic sources and use the latter to pre-fill procedure-related forms or generate documents for their own use. When submitting their applications to the appropriate administration or establishment, users are asked to give their express consent for their personal data to be processed by the relevant administration or establishment as part of their application and/or request.
36. The data controller is the administration or establishment which implemented the procedure in question or the access to a given authentic source on MyGuichet.lu. Their contact details are available either in the "Contact" section – which is clearly displayed for each procedure – or in the data header of an authentic source. The CTIE, which hosts the MyGuichet.lu platform, is the data controller's only subcontractor.
37. With regard to procedures, the purpose of each is specified in its title, with further details provided in the relevant legal texts. Those legal texts can be found on the public Guichet.lu page describing the procedure, in the "For more information" section, accessible via the link "More information on this procedure". This link is clearly visible when the user begins a procedure, and can always be accessed via the procedure-status tracking features. Thanks to the messages sent by the administration or establishment in question through MyGuichet.lu, users can also monitor the progress of their administrative procedures.
38. When the user submits their form or complete application file (form plus any annexes thereto and supporting documents) by electronic means, the information they provide is recorded and then forwarded directly to the competent administrative body or establishment. The computer system places an electronic time-stamp on the application file sent via MyGuichet.lu, stating and evidencing the date and time that the file was forwarded to the competent administrative body or establishment. The dossier remains stored in MyGuichet.lu. In principle, it is not possible to cancel or modify any applications which have been forwarded in this way to the competent administrative body or establishment via MyGuichet.lu. Any request to cancel or modify an application must, where applicable, be sent directly to the administration or establishment in question.
39. Where a signature is required, the user must sign the online form using an electronic signature. In accordance with article 1322-1 of the Civil Code, the use of an electronic signature within the framework of a procedure filed through MyGuichet.lu identifies the person who has applied the signature, and certifies their acceptance of the contents of the signed document. Consequently, in the event of any dispute, electronically signed documents, as well as any data used as a time-stamp and to guarantee the correctness and completeness of the filing process, shall be admissible before the courts and shall constitute evidence of the details contained in them and of the commitments they represent.
40. The scope of the collected data is determined by the legal foundations upon which the request or application is based, and by the data controller. Those data are accessible only to the user and the data controller. Apart from the information provided by the user to the administrative body or establishment, the latter have no access to the data or to the documents stored on MyGuichet.lu. However, the user accepts and agrees that a strictly limited number of people at the CTIE, or subcontractors bound by a non-disclosure agreement, may, on demand, temporarily access the data for a given application as part of the processing of a request for assistance filed by the user with the Guichet.lu Helpdesk.
41. As part of the processing of their application, the user accepts and agrees that, where necessary, the data they submit may be copied within the data controller's information system. The CTIE cannot know in advance to whom the data controllers may forward the data or how the data may be processed in the future, and such matters are beyond its purview. The CTIE merely provides a platform for initiating and tracking procedures between two clearly identified parties. Hence, where applicable, it is up to the user to directly approach the relevant data controllers to find out whom their data will be shared with or how they will be processed.
42. The length of time for which data will be kept varies depending on the type of procedure, and falls within the purview of the data controller. The criteria used to determine that length of time depend on the relevant legal basis. When users consult authentic sources, these data are never kept in MyGuichet.lu.
43. It should be noted that the legal foundations on which the procedures are based may contain specific provisions governing the exercise of the users' rights.
44. The processing of certain applications submitted to the competent authorities via MyGuichet.lu may require the forwarding of personal data to the competent authorities of another EU Member State or of a Member State of the European Economic Area. Where applicable, such personal data may be forwarded through the Internal Market Information system (IMI), which was set up for the purposes of administrative cooperation, pursuant to the terms of EU Regulation 1024/2012. Such personal data are processed in accordance with Regulation (EC) No. 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data. Further information can be found here.
Procedures on MyGuichet.lu pertaining to identification, management of pre-filling data and availability of a storage space
45. When they first log in and on subsequent occasions, the user accepts and agrees that MyGuichet.lu may access their data as held in the National Registry of Natural Persons. They also accept and agree that the authentication data contained in the electronic certificate issued by the LuxTrust certification authority may be used to establish their identity, and that said certificate may be recorded in their profile.
46. The data controller is the CTIE.
47. The purpose of these various processes is to unequivocally establish users' identity, and in so doing accelerate the filing of procedures by allowing users to:
- select data from authentic sources;
- voluntarily provide personal data;
- upload, to the server, documents that can be reused time and again in the user's storage space (notably supporting documents).
48. These data can only be accessed by the authorised user. When using the auto-fill feature, the user themselves can control the insertion of some of the data.
49. The data or documents kept by the user in their storage space shall remain their sole responsibility. Use of the storage space shall not absolve the user of their responsibility to retain the original of any document that they may have copied and saved in that space.
50. The user's profile data are kept for as long as their account remains on the platform.
Processing related to event logs
51. The user accepts and agrees that the data relating to their activity on MyGuichet.lu (identifier, surname, first name, procedure or feature used, date and time, settings) may be audited, i.e., recorded and stored, for the sole purpose of allowing said data to be made available to the relevant data controllers (CTIE or, where applicable, the relevant administrations) or to the judicial authorities in the following limiting cases:
- the resolution of data-security incidents in the legitimate interest of ensuring the security of MyGuichet.lu;
- the establishment, exercise or defence of a right through the courts as part of a legal, administrative or extrajudicial procedure in connection with the procedure being audited.
52. The identity of the data controller depends on the feature being audited. Only the data controller has access to the audited data.
53. The user is informed that the confidentiality of such data is assured to the highest of standards, and that such data may only be extracted if the data controllers or judicial authorities explicitly request such an extraction, providing valid reasons for their request.
54. In view of the wide variety and the number of procedures, and the relevant legal bases, on the one hand, of the highly restrictive data access and extraction measures that have been implemented, the data will be kept for 5 years overall under the current system.
Data processing in connection with procedures without authentication
55. Data processing in connection with these features enable an application to be filed without authentication, voluntarily by the user. The user will be required to give their explicit consent to the processing of their personal data by the relevant administration or the establishment for the purpose of completing their application and/or request.
56. The data controller is the government administration department or establishment that has implemented the procedure. Their contact details are available in the "Who to contact" section which is clearly displayed for each procedure. The CTIE, which hosts the MyGuichet.lu platform, is the data controller's only subcontractor.
57. With regard to these procedures, the purpose of each is specified in its title, with further details provided in the relevant legal texts. These legal texts can be obtained from the relevant data controller.
58. The scope of the collected data is determined by the legal or regulatory foundations upon which the procedure is based, and by the data controller. The user's email address is always required so that they can be sent a reference, which is to be quoted in any further requests between the two parties.
59. As part of the processing of their application, the user accepts and agrees that, where applicable, any data they submit may be copied within the data controller's information system. The CTIE cannot know in advance to whom the administrative bodies or establishments may forward the data or how the data may be processed in the future, and such matters are beyond its purview. The CTIE merely provides a platform for initiating and tracking procedures between two clearly identified parties. Hence, where applicable, it is up to the user to directly approach the relevant data controllers to find out whom their data will be shared with or how they will be processed.
60. The length of time for which data will be kept varies depending on the type of procedure without authentication, and falls within the purview of the data controller. The criteria used to determine that length of time also depend on the relevant legal basis.
61. It should be noted that the relevant legal foundations upon which procedures without authentication are based may contain specific provisions governing the exercise of the users' rights.
Guichet.lu processing in connection with the management of the newsletter
62. The email address provided by the user when they sign up for the website newsletter will be shared with a subcontractor for the sole purpose of disseminating the newsletter. That subcontractor – Mailjet, based in Paris, France – is subject to the same legal obligations with regard to the protection of personal data. To prevent abuse of the system, the user must confirm their subscription by clicking on a link sent to the email address they provided.
63. The data controller in this instance is the CTIE.
64. The user may unsubscribe at any time using a link provided in each email, or by contacting the CTIE Helpdesk. The user's data will not be kept for longer than their subscription lasts.
Guichet.lu processing in connection with audience measurement
65. Certain data relating to the user's hardware and software, which are not capable of revealing the user's identity, are collected when they visit the public-domain site. The sole purpose of collecting such data is to garner statistics on website traffic (type of browser, resolution, approximate location, and so on) in order to provide users with the best possible user experience.
66. The data controller in this instance is the CTIE.
67. Under no circumstances is the user's full IP address kept. Moreover, the public page from which MyGuichet.lu is accessed is not subject to this audience-measurement data collection process. As such, the traffic data for all visitors to the page from which the transactional website is accessed are protected from mass transfer to a third party.
68. These data are kept in a solution provided by a subcontractor – specifically, Adobe Systems Inc. – who, as such, is subject to the same legal obligations regarding the protection of personal data, should those data be harvested in the future.
69. The data is kept for no longer than is necessary to observe how audiences evolve as a function of browsers, resolution settings or other available statistical data.
Processing in connection with online surveys
70. Users' data are harvested, with their permission, for the sole purposes of conducting surveys for the State's administrative bodies. In addition, technical audience-measurement data are collected at the same time.
71. The data controller and the recipient of such data are the government administration departments who commission the surveys. The CTIE is their main subcontractor, and acts under their authority on a dedicated platform.
72. The data are kept for the duration of the survey, plus a few weeks for the results to be statistically analysed.
73. These surveys are conducted directly on the website of a subcontractor – specifically, surveygizmo.eu, developed by Widgix Limited – located in the United States. That subcontractor is subject to the same legal obligations regarding the protection of personal data, as the surveys are carried out for or by users from the European Union.
74. The procedures by which these surveys are carried out are such that none of the collected data can be used to personally identify the user. Even by combining technical identifier data (IP address or information about the user's browser or device) and data harvested from multiple surveys, both the subcontractor operating the platform and the CTIE would still be unable to personally identify the users. In addition, the surveys are configured in such a way that personal data are never visible to CTIE operators or those of the government administration departments who commissioned the surveys.
IV. Guichet.lu on social networks
75. Any user who joins a Guichet.lu social-networks community undertakes to refrain from any form of discrimination based on race, colour, religion, gender, sexual orientation, age, ethnic origin, disability, marital or employment status.
76. Abusive, racist, sexist or offensive comments have no place on social networks. Any such comments will be deleted and reported.
77. The Guichet.lu Facebook, Twitter and Google+ accounts are monitored Monday to Friday, 08:00 to 18:00. The pages are not continuously monitored after working hours, or during weekends and holidays.
78. The primary language used by Guichet.lu on social networks is French. Depending on the situation and on the target audiences, information may be published in the other two national languages (German and Luxembourgish) and in English.
79. Insofar as possible, the Guichet.lu team will endeavour to answers all questions or comments in the user's own language.