Legal notice

I. General terms and conditions of use (Ts&Cs) of Guichet.lu

Any person using the information, documents, products, software and/or services (hereinafter collectively referred to as the "Services") offered by the website Guichet.lu shall be deemed to be aware of, and to have accepted, all the provisions of these general terms and conditions of use.

Definition and objective

1. Guichet.lu is a website run by the Luxembourg Government (hereafter the "State"), to facilitate users' access to information pertaining to every stage of their life as private citizens and businesses, and simplify administrative procedures which users need to complete with the State and communal administrations.

2. Guichet.lu is aimed at two distinct user groups, which are clearly differentiated by two sections, one of which relates to private individuals (the "Citizens" section) and the other to professional persons (the "Business" section). Each section is made up of two parts: a purely informative part and a transactional part ("MyGuichet.lu") in which users may carry out all or some of their administrative procedures directly online. The MyGuichet.lu service is subject to its own terms and conditions of use.

3. The use of Guichet.lu is free of charge.

Obligations of the user

4. Guichet.lu is accessible via the internet. The user declares that they are aware of the risks involved and that they accept those risks. They must guard against the effects of computer hacking by adopting a suitable and secure computer configuration.

5. The State accepts no liability for any loss or damage the user may suffer, directly or indirectly, in connection with browsing Guichet.lu or using the services which it offers, or from accessing any of the other websites to which it links.

Cookie management

6. Guichet.lu uses cookies, which are small text files used to analyse information related to the user's browsing activities (frequency of visits, duration of visits, visited pages, language preferences, etc.). They are stored by Guichet.lu in a directory on the user's computer. A cookie contains the name of the server that created it, an identifier in the form of a unique number and an expiry date. The unique identifier allows Guichet.lu to recognise the user's computer each time they visit the site. Session cookies are deleted from the user's computer when the session is closed. However, persistent cookies remain on the user's computer for one month after the end of the session.

7. The user can decide whether or not the Guichet.lu server is allowed to store cookies on their computer. They may change their browser settings at any time to prevent cookies from being accepted and stored. Moreover, the user can delete all previously stored cookies at any time using their browser.

8. The use of certain features of Guichet.lu (such as MyGuichet.lu) may be limited or disabled if the user does not accept cookies from the site. It is therefore recommended that the user set their browser to accept cookies from Guichet.lu.

Modification of Guichet.lu

9. The State reserves the right to update, modify or suspend Guichet.lu, without prior notice, for maintenance or updating operations, or for any other reason deemed necessary. In particular, the State may, at any time, withdraw, add to, supplement or clarify all or any part of the information and services contained in or offered on Guichet.lu. The State may not be held liable for any loss or damage whatsoever, whether direct or indirect, in connection with any such changes.

General limitations of liability

10. The State shall make its best effort to ensure optimal availability of the Guichet.lu website. However, it accepts no liability should the website become temporarily or wholly unavailable.

11. The State will do everything in its power to ensure that the computer system is secure.

12. The State shall make its best effort to ensure that the information and services contained on Guichet.lu, and published on social networks, and the advice and information provided by the Guichet.lu Helpdesk, are accurate and correct. However, it may not be held liable for any omissions in connection with the update of information or forms, errors in the use of the system, coding errors, inaccuracies (notably regarding the geographic location of the administrative bodies and organisations, as this service is provided by an external source), gaps in the information provided, or any errors, inaccuracies or omissions in the answers provided by the Guichet.lu Helpdesk. The aim is to disseminate accurate, up-to-date information from a variety of sources, but the State is unable to avoid all risks of factual inaccuracy. None of the information published on Guichet.lu or provided by the Guichet.lu Helpdesk in response to an individual request should be considered as exhaustive or as a commitment from the State. Explanations in layman's terms and translations are provided solely for information purposes. Only legal texts published in the Mémorial (Official Journal of the Grand Duchy of Luxembourg) shall be deemed authoritative. The information appearing on Guichet.lu is of a general nature. It is not tailored to personal or specific circumstances, and therefore cannot be regarded as constituting personal, professional or legal advice to the user. If the user needs personal or specific advice, they should always consult the competent departments within the different administrative bodies.

Limitation of liability of Guichet.lu, MyGuichet.lu and the MyGuichet.lu app

13. Guichet.lu and MyGuichet.lu explicitly exclude liability for any consequences, whether direct or indirect, arising from:

  1. incompatibility between the service offered and the equipment, applications, procedures or infrastructures of the user or of any third party;
  2. any security breaches caused by the user or a third party, and more generally any security breaches not directly attributable to Guichet.lu;
  3. any errors and/or fraudulent acts committed by the user or a third party;
  4. any unavailability or malfunction of electronic communication systems or networks.

14. The data sent to the State or communal administrations and to public- or private sector bodies, by means of forms downloadable from Guichet.lu, is the sole responsibility of the user and of the recipient once this data has been sent.

15. The State reserves the right to terminate access to any eSpace on MyGuichet.lu which is used for unlawful or fraudulent purposes, and it may do so without prior notice or compensation of any kind.

Furthermore, the State reserves all rights and in particular the right to refuse, terminate or restrict, without prior notice or compensation of any kind, access to Guichet.lu and its services to any person, natural or legal, making abusive, unlawful or fraudulent use of these services.

Links to related sites

16. For users' convenience, Guichet.lu may contain links to other websites which they may find useful or interesting. The State, and more specifically the Ministry for Digitalisation, does not systematically monitor the content of those websites. Consequently, they accept no liability for the content of those websites, either in terms of the legality of such content or the accuracy of the information found there.

Online payment

17. The administrative fees for certain procedures can be paid using the payment system provided on Guichet.lu. Payment is made through a payment institution listed on the approved public register in Luxembourg, which guarantees the security of payment operations.

The payment details (credit card data or account number, amount of payment, etc.) are not processed by the Government IT Centre (CTIE) that, at any time, has no access to this data. The CTIE is not involved in the payment procedure. As such, it may not be held responsible for malfunctions in the operator's application, or for any fraudulent use of users' payment details. For matters regarding payments, the user is subject to the general terms and conditions of the operator.

Intellectual property

18. Guichet.lu, all the elements contained therein (including the layout) and the information and services are protected by the relevant intellectual property and copyright legislation.

19. Unless otherwise specified, the State grants no license or authorisation with regard to the intellectual property rights which it holds in respect of the Guichet.lu website, the elements it contains, or the services. Moreover, reproduction of the information or services, either wholly or in part, and in whatever form or by whatever means, is not permitted without the prior written consent of the Ministry for Digitalisation.

20. Unless otherwise stated, users are authorised to view, download and print the available documents and information, on the following conditions:

  • the documents may only be used for personal purposes, for information and in a strictly private context;
  • the documents and information may not be modified in any way whatsoever;
  • the documents and information may not be disseminated outside or beyond Guichet.lu.

21. The rights implicitly or expressly granted above constitute an authorisation to use Guichet.lu; in no circumstances do they constitute a transfer or assignment of property rights or other rights in relation to the website.

Changes to the general terms and conditions of use

22. These general terms and conditions of use may be modified or supplemented at any time, without prior notice, in line with changes made to Guichet.lu or changes in the law, or for any other reason deemed necessary. It is the user's responsibility to familiarise themselves with the general terms and conditions of use of Guichet.lu, of which only the most up-to-date version accessible online shall be deemed to be in force. It is possible that the general terms and conditions of use have changed in the interval between two visits of Guichet.lu, and it is therefore the user's responsibility to read through those conditions before using the site once again.

Applicable law and courts of competent jurisdiction

23. All disputes arising from the use of Guichet.lu and its Services, including MyGuichet.lu and the MyGuichet.lu mobile app, shall be governed by Luxembourg law, and the courts of the Grand Duchy of Luxembourg shall have exclusive jurisdiction to hear and settle such disputes.

II. Special terms and conditions of use applicable to MyGuichet.lu

Users of the MyGuichet.lu service, which can be accessed through Guichet.lu, shall be deemed to have read and accepted the entirety of these terms and conditions of use, as well as the general terms and conditions of use of Guichet.lu.

Definition and objective

24. Authentic sources: authentic sources are data held by the government administration departments about the user. The user is entitled to view and check this data, and to use it to auto-fill administrative forms or automatically generate documents for their own use.

25. The MyGuichet.lu service, which can be accessed through Guichet.lu, offers a package of online services intended to simplify the user's dealings with the state and communal administrations. It essentially enables users to input, submit and monitor applications, and to consult available authentic sources.

26. Use of the MyGuichet.lu service is free of charge and, except where otherwise provided for by law, optional. Users always have the option to contact the competent administrative body directly to have their application processed in a conventional, non-electronic way.

27. The MyGuichet.lu service is available for use within the framework of the legislation or regulations in force relating to the various administrative procedures offered.

Availability and development of MyGuichet.lu

28. MyGuichet.lu is available around the clock, seven days a week. However, the State reserves the right to update, modify or suspend MyGuichet.lu, without notice, for maintenance purposes, hardware or technical incidents, or for any other reason deemed necessary. Unavailability of the MyGuichet.lu service shall not entitle users to any form of compensation. The State accepts no liability whatsoever should the user fail to meet a deadline on account of the temporary unavailability of Guichet.lu and/or MyGuichet.lu. No liability shall attach to the State for any loss or damage whatsoever, whether direct or indirect, relating to any updates or changes to MyGuichet.lu.

Obligations of the user

29. The MyGuichet.lu service is accessible via the internet. The State shall make its best effort to ensure that the computer system is secure. The user declares that they are aware of the risks involved and that they accept those risks. They must guard against the effects of computer hacking by implementing suitable and secure computer settings. The State accepts no liability for any loss or damage users may incur, whether directly or indirectly, in connection with their browsing on Guichet.lu or their use of MyGuichet.lu.

Changes to the terms and conditions of use relating specifically to the MyGuichet.lu service

30. These terms and conditions of use may be modified or supplemented at any time, without prior notice, in line with changes made to the MyGuichet.lu service or changes in the law, or for any other reason deemed necessary. Users are specifically informed of any changes whenever they use MyGuichet.lu, and asked to accept the new terms and conditions. Only the most up-to-date online version of the terms and conditions of use is deemed to be in force.

III. Special conditions of use applicable to the mobile app MyGuichet.lu

The MyGuichet.lu app is operated by the Luxembourg Government (hereinafter referred to as the "State"). It is published by the Government IT Centre (Centre des technologies de l'information de l'État – hereinafter referred to as 'CTIE'), located at 1 Rue Mercier, Luxembourg.

By installing and/or using the MyGuichet.lu application (hereinafter, the "app"), the user is deemed to be aware of and have accepted all the stipulations of these terms and conditions. They also consent to the app's privacy policy. They agree to abide by these terms.

Definitions

31. The term "user" refers to any natural person aged 16 or over, and any legal person incorporated under private or public law, under either Luxembourg or foreign law, who downloads the MyGuichet.lu app to a mobile telephone or tablet.

32. The term "application" (or "app") refers to the software application MyGuichet.lu, which can be downloaded from the "Apple App Store" and "Google Play Store" platforms for installation on compatible mobile phones and tablets.

33. The term "QR code" refers to a 2D barcode designed to store data. QR codes can be decrypted by QR reader software from an image taken by a mobile phone or tablet with a camera or webcam.

Objective of the application

34. The objective of the application is to allow users to use their mobile phone or tablet to access their private and/or business eSpace on MyGuichet.lu and carry out certain procedures. In order to do so, the user must first install the app and then link their MyGuichet.lu account to their compatible smartphone/tablet, on which they have installed the app.

35. The user links their account by signing into MyGuichet.lu with their LuxTrust product or eID card from the browser of a computer (desktop or laptop), and then using their mobile phone or tablet to scan the QR Code displayed on the MyGuichet.lu site on the computer.

36. The free app allows users to:

  • carry out certain online administrative procedures offered by the platform MyGuichet.lu, and track their progress directly from their smartphone and/or tablet;
  • add supporting documents to their procedures carried out from their private and/or business eSpace on MyGuichet.lu;
  • check their messages to and from third-party administrative bodies;
  • access certain personal and/or professional data that is held by the Luxembourg authorities.

37. The State may, at any time, change, expand or update the objective of the app. If it is expanded, the user will be informed.

Hardware required for the app

38. To access and use the app, the user must have:

  • a private and/or business eSpace on MyGuichet.lu;
  • a compatible multimedia tool – i.e. a mobile device (smartphone or tablet) with a camera, an NFC reader capable of reading ISO7816 tags and running iOS 11.0 or Android 6.0 or later versions;
  • internet access;
  • a customer account on "Apple App Store" or "Google Play Store".

Availability of the app

39. The State shall employ every effort to ensure security in accessing, viewing and using the content and services provided through the app.

40. In principle, the app is available 24/7, except for reasons of force majeure or the occurrence of an event beyond the State's control, and during operations:

  • to carry out technical maintenance;
  • to implement updates;
  • to make technical improvements or change the content and/or presentation;
  • for safety reasons;
  • for any other reason deemed necessary.

Such operations may be carried out at any time, without prior notice to the user.

41. In the event that the app is unavailable or does not work properly, users are not entitled to any indemnification.

Financial conditions

42. The app can be downloaded for free on "Apple App Store" or "Google Play Store".

43. The user alone is responsible for the equipment and hardware necessary to access and use the app. The user shall also bear the telecommunications costs incurred by accessing and using the app.

Intellectual property concerning the app

44. The State is the exclusive owner of all intellectual property rights pertaining to the structure and content of the app, unless expressly stated otherwise and unless otherwise stipulated by law or contract.

45. These Ts&Cs do not entail the transfer of any intellectual property right to the user, with respect either to the structure or to the content of the app and its services.

46. Users expressly undertake to refrain from using the app in a way that may infringe the rights of the State and, in particular, refrain from any such use that may constitute counterfeiting or parasitic use of information, or unfair competition.

47. None of the texts, graphics, icons, photographs, illustrations and, more generally, none of the elements making up the app, may be represented, reproduced, exploited or extracted, either in part or in full, on any medium whatsoever, without the Ministry for Digitalisation’s express, written authorisation.

Usage licence

48. The State grants the user a free usage licence for the app. However, users must refrain from using the app for business purposes. If they do so, they will incur personal liability.

49. The term "business purposes" includes, in particular:

  • any profit or commercial income resulting from the marketing of the app or any competitive use;
  • using the app with a commercial company and/or a third party if such use leads to the marketing of the app.

50. The licence is non-exclusive and non-transferable, and may be revoked at any time.  

Limitation of liability

51. The State cannot fully guarantee the accuracy or completeness of all information contained in the app, whether provided by the Government itself or by any other person or organisation. As such, the State may not be held liable.

52. In addition, the State may temporarily or permanently suspend access to the app and to any connected services, without indemnification.

53. The State accepts no liability for any direct or indirect damage occurring in connection with changes or modifications made to the app.

54. The user alone is responsible for updating to the latest version of the app. The State assumes no responsibility in this regard.

55. The State cannot be held liable:

  • if the application or its services cannot be accessed, for any reason;
  • if, for whatever reason, internet connection is interrupted;
  • for any omissions and/or errors in the app.

56. The State may not be held liable for:

  • damage of any sort, whether direct or indirect, resulting from the use of or inability to use the app or its services – in particular, notably any operating, financial or commercial loss, or loss of programs and/or data in the user's information system;
  • damage of any sort, whether direct or indirect, resulting from the content and/or use or inability to use websites linked to the app or which the user would usually be able to access through the app.

57. The State accepts no liability whatsoever for any misuse of the mobile phone or tablet, or for any incident relating to the use of those devices while running the app. Under no circumstances may the State be held liable for any damage whatsoever, caused to the user, their terminal, their computing or phone equipment and data stored thereon, or for the consequences of such damage for their personal, professional or commercial activities.

58. The user declares that they are fully aware of and accept the risks, limitations and problems of the internet network and the app's operating system, for which the State may not be held liable. In particular, the user acknowledges that:

  • they use the app at their own risk;
  • the app is accessible ‘as is’, depending on its availability;
  • they are responsible for protecting their own data and/or software stored on their mobile phone, and for taking all appropriate measures to protect them against any damage (loss of the phone, malfunction, virus, hacking, etc.);
  • given the technical capabilities of the internet, processing time is required to respond to, view, request or transfer the information. 

59. Users undertake not to use the app for fraudulent purposes.

60. Users acknowledge that they, and they alone, are responsible for any breach of their obligations under these Ts&Cs, and for the consequences of such a breach.

Changes to the Ts&Cs for the MyGuichet.lu app

61. The State reserves the right to modify, expand or supplement any or all of these Ts&Cs at any time, so that they reflect changes to services, or technical, jurisprudential or legal changes, or any new services that may be introduced. Users will be specifically informed of any changes to the Ts&Cs before using the app, and asked to accept those changes.

62. Nevertheless, the State advises all users to apprise themselves of the Ts&Cs governing the use of the app. Only the latest version of these Ts&Cs accessible online is deemed to be in force at the time of use.

IV. Protection of personal data

General information on MyGuichet.lu

63. The personal data communicated by the user is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

64. Technical and organisational security measures are implemented by the CTIE to ensure an appropriate level of confidentiality, integrity, availability and resilience of the services offered through MyGuichet.lu, and protect users' rights and freedoms in accordance with industry standards. Only the users themselves or authorised users may access the personal data, and then only if they have a legitimate reason to do so. Except where these Ts&Cs specify otherwise, the user data is stored in Luxembourg.

65. Users have the right to access, rectification and erasure of data concerning them. They may exercise these rights by applying to the relevant data controller. Where applicable, these rights may be exercised through features available on MyGuichet.lu (authentic sources, erase function, etc.).

If a technical problem prevents the use of these features, users may refer to the Guichet.lu Helpdesk.

Where the CTIE is the data controller, the user may send their request by post to the following address: "Centre des technologies de l'information de l'État 1, rue Mercier B.P. 1111 L-1011 Luxembourg".

The user is also entitled to restrict and oppose processing, and to withdraw consent. They may also invoke their right to data portability. All of these entitlements may be exercised by approaching the relevant data controllers directly.

66. Users can file claims relating to the protection of their personal data through the various communication channels available, and also to the relevant data controller for their request and/or application. In addition, users can file claims with the CTIE's data protection officer at the following email address: dataprotection@ctie.etat.lu. Furthermore, users may refer to the National Commission for Data Protection (Commission nationale pour la protection des données) to resolve any disputes in this domain.

MyGuichet.lu processing operations pertaining to procedures and authentic sources

67. The features offered by MyGuichet.lu allow users, if they so desire, to create administrative procedures, view authentic sources and use those sources to pre-fill procedure-related forms or generate documents for their own use. When submitting their applications to the appropriate administration or establishment, users are asked to give their express consent for their personal data to be processed by the relevant administration or establishment as part of their application and/or request.

68. The data controller is the administrative body or establishment which implemented the procedure in question or granted access to a given authentic source on MyGuichet.lu. Their contact details are available either in the "Contact" section – which is clearly displayed for each procedure – or in the data header of an authentic source. The CTIE, which hosts the MyGuichet.lu platform, is the data controller's only subcontractor.

69. The purpose of each procedure is specified in its title, with further details provided in the relevant legal texts. Those legal texts can be found on the public Guichet.lu page describing the procedure, in the "For more information" section, accessible via the link "More information on this procedure". This link is clearly visible when the user begins a procedure, and can always be accessed via the procedure status tracking features. Thanks to the messages sent by the administration or establishment in question through MyGuichet.lu, users can also monitor the progress of their administrative procedures.

70. When the user submits their form or complete application file (form plus any annexes thereto and supporting documents) by electronic means, the information they provide is recorded and then forwarded directly to the competent administrative body or establishment. The computer system places an electronic time-stamp on the application file sent via MyGuichet.lu, evidencing the date and time that the file was forwarded to the competent administrative body or establishment. The file remains stored in MyGuichet.lu. In principle, it is not possible to cancel or modify any files which have been forwarded in this way to the competent administrative body or establishment via MyGuichet.lu. Any request for cancellation or modification must, where applicable, be sent directly to the administrative body or establishment in question.

71. Where a signature is required, the user must sign the online form using an electronic signature. In accordance with article 1322-1 of the Civil Code, the use of an electronic signature within the framework of a procedure filed through MyGuichet.lu identifies the person who has applied the signature, and certifies their acceptance of the contents of the signed document. Consequently, in the event of any dispute, electronically signed documents, as well as any data used as a time-stamp and to guarantee the correctness and completeness of the filing process, shall be admissible before the courts and shall constitute evidence of the details contained in them and of the commitments they represent.

72. The scope of the collected data is determined by the legal or regulatory basis upon which the request or procedure is based, and by the data controller. This data is accessible only to the user and the data controller. Apart from the information provided by the user to the administrative body or establishment, the latter have no access to the data or to the documents stored on MyGuichet.lu. However, the user accepts and agrees that a strictly limited number of people at the CTIE, or subcontractors bound by a non-disclosure agreement, may, on demand, temporarily access the data for a given application as part of the processing of a request for assistance filed by the user with the Guichet.lu Helpdesk.

73. As part of the processing of their application, the user accepts that, where necessary, the data they submit may be copied within the data controller's information system. The CTIE cannot know in advance to whom the data controllers may forward the data or how the data may be processed in the future, and such matters are beyond its purview. The CTIE merely provides a platform for initiating and tracking procedures between two clearly identified parties. Hence, where applicable, it is up to the user to directly approach the relevant data controllers to find out whom their data will be shared with or how it will be processed.

74. The length of time for which data will be kept varies depending on the type of procedure, and falls within the purview of the data controller. The criteria used to determine that length of time depend on the relevant legal basis. When users consult authentic sources, the data is never kept in MyGuichet.lu.

75. It should be noted that the legal bases on which the procedures are based may contain specific provisions governing the exercise of the users' rights.

76. The processing of certain applications submitted to the competent authority or establishment via MyGuichet.lu may require the forwarding of personal data to the competent authorities of another EU or EEA Member State. Where applicable, such personal data may be forwarded through the Internal Market Information system (IMI), which was set up for the purposes of administrative cooperation, pursuant to the terms of EU Regulation 1024/2012. Such personal data is processed in accordance with Regulation (EC) No. 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data. Further information can be found here.

Procedures on MyGuichet.lu pertaining to identification, management of pre-filling data and availability of a storage space

77. When they first log in and on subsequent occasions, the user accepts and agrees that the MyGuichet.lu platform may access their data as held in the National Registry of Natural Persons. They also accept and agree that the authentication data contained in the electronic certificate issued by the LuxTrust certification authority may be used to establish their identity, and that said certificate may be recorded in their profile.

78. The data controller is the CTIE.

79. The purpose of these various processes is to unequivocally establish users' identity, and in so doing, speed up the completion of procedures by allowing users to:

  1. select data from authentic sources;
  2. voluntarily provide personal data;
  3. upload, to the server, documents that can be reused time and again in the user's storage space (notably supporting documents).

80. This data can only be accessed by the authorised user. When using the auto-fill feature, the user themselves can control the insertion of some of the data.

81. The data or documents kept by the user in their storage space shall remain their sole responsibility. Use of the storage space shall not absolve the user of their responsibility to retain the original of any document that they may have copied and saved in that space.

82. The user's profile data are kept for as long as their account remains on the platform.

Data processing in connection with requests sent to the Guichet.lu Helpdesk

83. The user accepts that authorised persons within the CTIE have access to the data transmitted with their request in order to process the request.

84. The data controller, in this context, is the CTIE.

85. The purpose of the processing is to provide a response to the user's request/question. In addition, this data may be further processed by the CTIE for statistical purposes.

86. The personal data communicated by the user shall be retained for as long as necessary for the processing of their request/question, plus one year to allow for subsequent reopening in order to improve the quality of the service provided to users.

Processing related to event logs

87. The user accepts that the data relating to their activity on MyGuichet.lu (identifier, surname, first name, procedure or feature used, date and time, settings) may be audited, i.e., recorded and stored, for the sole purpose of allowing said data to be made available to the relevant data controllers (CTIE or, where applicable, the relevant administrations) or to the judicial authorities in the following limiting cases:

  • the resolution of data-security incidents in the legitimate interest of ensuring the security of MyGuichet.lu;
  • the establishment, exercise or defence of a right through the courts as part of a legal, administrative or extrajudicial procedure in connection with the procedure being audited.

88. The data controller responsible depends on the feature being audited. Only this data controller has access to the audited data.

89. The user is informed that the confidentiality of such data is assured to the highest of standards, and that such data may only be extracted if the data controllers or judicial authorities explicitly request such an extraction, providing valid reasons for their request.

90. In view of the wide variety and the number of procedures, and the relevant legal bases, on the one hand, of the highly restrictive data access and extraction measures that have been implemented, the data will be kept for 5 years overall under the current system.

Data processing in connection with procedures without authentication

91. Data processing in connection with these features enables an application to be filed without authentication, and on a voluntary basis, by the user. The user will be required to give their explicit consent to the processing of their personal data by the relevant administration or the establishment for the purpose of completing their application and/or request.

92. The data controller is the administrative body or establishment that has implemented the procedure. Their contact details are available in the "Who to contact" section which is clearly displayed for each procedure. The CTIE, which hosts the MyGuichet.lu platform, is the data controller's only subcontractor.

93. The purpose of each of these procedures is specified in its title, with further details provided in the relevant legal texts. These legal texts can be obtained from the relevant data controller.

94. The scope of the collected data is determined by the legal or regulatory basis and by the data controller. The user's email address is always required so that they can be sent a reference, which is to be quoted in any further requests between the two parties.

95. As part of the processing of their application, the user accepts that, where necessary, the data they submit may be copied within the data controller's information system. The CTIE cannot know in advance to whom the administrative bodies or establishments may forward the data or how the data may be processed in the future, and such matters are beyond its purview. The CTIE merely provides a platform for initiating and tracking procedures between two clearly identified parties. Hence, where applicable, it is up to the user to directly approach the relevant data controllers to find out whom their data will be shared with or how it will be processed.

96. The length of time for which data will be kept varies depending on the type of procedure without authentication, and falls within the purview of the data controller. The criteria used to determine that length of time also depend on the relevant legal basis.

97. It should be noted that the relevant legal bases upon which procedures without authentication are based may contain specific provisions governing the exercise of the users' rights.

Data processing in connection with the management of the newsletter

98. The email address provided by the user when they sign up for the website newsletter will be shared with a subcontractor for the sole purpose of disseminating the newsletter. That subcontractor – Mailjet, based in Paris, France – is subject to the same legal obligations with regard to the protection of personal data. To prevent abuse of the system, the user must confirm their subscription by clicking on a link sent to the email address they provided.

99. The user may unsubscribe at any time using a link provided in each email, or by contacting the Guichet.lu Helpdesk. In the event of problems of use with respect to the newsletter, the user must also contact the Guichet.lu Helpdesk. The user's data will not be kept for longer than their subscription lasts.

100. The data controller is the CTIE.

Guichet.lu processing in connection with audience measurement

101. Certain data relating to the user's hardware and software, which is not of a nature that will reveal the user's identity, is collected when they visit the public-domain site. The sole purpose of collecting such data is to garner statistics on website traffic (type of browser, resolution, approximate location, and so on) in order to provide users with the best possible user experience.

102. The data controller is the CTIE.

103. Under no circumstances is the user's full IP address kept. Moreover, the public page from which MyGuichet.lu is accessed is not subject to this audience measurement data collection process. As such, the traffic data for all visitors to the page from which the transactional website is accessed is protected from mass transfer to a third party.

104. This data is kept in a solution provided by a subcontractor – Adobe Systems Inc. – who, as such, is subject to the same legal obligations regarding the protection of personal data, should that data be harvested in the future.

105. The data is kept for no longer than is necessary to observe how audiences evolve on the basis of browsers, resolution settings or other available statistical data.

Processing in connection with online surveys

106. Users' data is harvested, with their permission, for the sole purpose of conducting surveys for the State's administrative bodies. In addition, technical audience measurement data is collected at the same time.

107. The data controller and the recipient of such data are the government's administrative bodies who commission the surveys. The CTIE is their main subcontractor, and acts under their authority on a dedicated platform.

108. The data is kept for the duration of the survey, plus a few weeks for the results to be statistically analysed.

109. These surveys are conducted directly on the website of a subcontractor – specifically, alchemer.eu, developed by Alchemer LLC – located in the United States. That subcontractor is subject to the same legal obligations regarding the protection of personal data, as the surveys are carried out for or by users from the European Union.

110. The procedures by which these surveys are carried out are such that none of the collected data can be used to personally identify the user. Even by combining technical identifier data (IP address or information about the user's browser or device) and data harvested from multiple surveys, both the subcontractor operating the platform and the CTIE would still be unable to personally identify the users. In addition, the surveys are configured in such a way that personal data is never visible to CTIE operators or those of the government administration departments who commissioned the surveys.

V. Guichet.lu on social networks

Moderation policy

111. Any user who joins the Guichet.lu social networking community undertakes to refrain from any form of discrimination based on race, colour, religion, gender, sexual orientation, age, ethnic origin, disability, marital or employment status.

112. Abusive, racist, sexist or otherwise offensive comments have no place on social networks. Any such comments will be deleted and reported.

113. The main purpose of the Guichet.lu social media accounts is to relay information and content published on Guichet.lu.

114. The Guichet.lu social media accounts are not intended to process requests, questions and comments containing personal data such as surnames, first names, national identification numbers, dates of birth, telephone numbers, email addresses, or attachments or scans of documents that contain personal data.

For such requests, questions or comments, users of the Guichet.lu community must use the contact form available on Guichet.lu.

In this respect, requests, questions or comments containing personal data (the identifier of the person's account on this social network is generally not taken into account) made on Guichet.lu's accounts on social networks will not be processed and will, to the extent possible, be deleted.

115. Guichet.lu's Facebook, Twitter and LinkedIn accounts are monitored, in principle, from Monday to Friday between 08.00 and 18.00. The pages are not continuously monitored after working hours, or during weekends and holidays.

Languages

116. Guichet.lu communicates in French, German, English and Luxembourgish on social media.

Last update