Privacy Policy for the Lux-Covid19 Platform



1. Preface

This is the privacy policy for the Lux-Covid19 platform that is hosted by the University of Luxembourg’s Luxembourg Centre for Systems Biomedicine (UL-LCSB), the data processor, on behalf of Fonds National de la Recherche (FNR) the data controller here on referred to as “we”, “us”, “our”.

In this policy we outline what personal data (“data”) we collect when data subjects (“you”, “your”) visit our sites and use our services, for what purposes this data is collected, where and how long it is kept and your rights regarding data as per the EU General Data Protection Regulation (“GDPR”). We also list relevant contact persons regarding requests and inquiries on data and data protection.

Main Website lux-covid19.lu

This is the entry point and the homepage for the Lux-Covid19 Platform. It provides links to other websites in the platform. The Main Website is publicly available.
Project Catalog projects.lux-covid19.lu

This is a public catalog of research projects that Research Luxembourg members and collaborators can use to publish ideas for new projects, or publish information about projects that are in progress or that are completed. The Project Catalog is publicly available.
Project Catalog Submission Form redcap.lux-covid19.lu

This is a web form for publishing new entries in the Project Catalog. The Project Submission Form is publicly accessible.
Discussion Forum forum.lux-covid19.lu

This is an online forum where research collaborators can publish announcements and discuss project ideas, proposals and updates. Discussion Forum website is not publicly accessible. Participation is by invite only and requires signing up to the LCSB User Management System.

The remainder of the policy document is organised as follows. In Section 2 we provide contact details for the data controller. In Section 3 we list your rights regarding the personal data collected. In Section 4 we summarise the measures taken to protect personal data. In Section 5 we list the personal data commonly collected on all four websites of the Lux-Covid19 platform. We outline where the data is stored, for what purposes the data is used and the lawful basis for us to process the data. In Section 5 you will also find our sites’ cookie policy.

Certain websites within the Lux-Covid19 platform collect further personal data, these are the Discussion Forum and the Project Catalog Submission Form described in Section 6 and Section 7 respectively.

2. Who is the data controller?

The Fonds National de la Recherche (FNR) is the Data Controller.

Maison du Savoir,
2, avenue de l’Université,
L-4365 Esch-sur-Alzette.
Tel.: +352 26 19 25-1
Fax.: +352 26 19 25-35

Postal Address.:
B.P. 1777
L-1017 Luxembourg
Email: info@fnr.lu

The FNR has mandated MGSI S.à r.l. to perform the Data Protection Officer function.

MGSI S.à r.l.,
1 rue Blender,
L-1229 Luxembourg,

3. What are your rights regarding the data we collect?

As per GDPR, you as a “data subject” have rights on your personal data.

You have the right to be informed that UL-LCSB is processing your personal information.

You have the right to access your personal information and in case it is inaccurate or incomplete you have the right to have it rectified without undue delay.

You have the right to ask that we delete your personal data or restrict its use. Where applicable, you have the right to object to our processing of your personal data, and the right to data portability. Your requests for deletion and processing restriction will be assessed by us and we will notify you of the result of this assessment within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and the number of applications (in accordance with article 12.3 GDPR).

You can request that we notify you in case any changes are made to your personal data or your data has been sent to any other party.

You have the right to lodge a complaint with the Luxembourgish data protection supervisory authority, CNPD, in case you consider that our processing of your personal data infringes the GDPR.

In order to exercise your rights regarding personal data and also for general inquiries on this privacy notice please contact the FNR by emailing info@fnr.lu.

4. How do we protect your data?

The UL-LCSB, on behalf and under instruction of the FNR, has put in place a number of organisational and technical measures for the protection of your personal data in compliance with the EU GDPR. These measures include but are not limited to access control, encrypted data transmission, institutional policies, staff code of conduct and training on data protection. UL-LCSB takes all measures reasonably necessary to protect against unauthorized access, use, alterations or destruction of your personal data. Only authorized personnel at the UL-LCSB and its host institution can access the data. Examples of such personnel include, but is not limited to, UL and UL-LCSB IT system administrators and data stewards that communicate with project contacts.

The types of personal data collected on our sites, its storage, use and sharing is described in the following sections. Please note that:

  • No personal data collected on Lux-Covid19 Platform’s website are used for direct marketing purposes.
  • The data collected on the platform will not be forwarded to 3rd parties.

5. Lux-Covid19 Platform Websites

5.1 Site visitor information and site analytics

Data and its purpose of use

When you visit any of the four Lux-Covid19 websites listed in the preface, we collect the following information:

  • your IP address,
  • your device type, name and ID,
  • your browser version,
  • your operating system and language settings,
  • date and time of web resource access request,
  • content of access request,
  • status and size of response to a request,

This information is automatically collected by server-side software that deliver pages to site visitors. We use this data to analyse site usage, which in turn allows us to further optimize and secure our site. The data will be used for statistical purposes only.

In addition, only if you agree to the use of site analytics, we will collect the following information during your visit of our site:

  • visitor id, which is a unique string calculated based on your IP address (two bytes masked), operating system, browser, browser plugins, and browser language,
  • the URLs, and titles of pages you visit on our site as well as custom events on our pages (such as links clicked),
  • referrer page, which is the web page such as a search engine or newsletter link, that leads your visit to our site.

Site analytics information allows us to optimise our site content and its delivery. We use this information to determine whether you have visited our website before, what you have previously viewed or clicked on, how user-friendly our forms are and how you found us. The information is anonymous and only used for statistical purposes, and it helps us to analyse patterns of user activity and to develop a better user experience. We also use this information to prepare aggregated, anonymous statistical reports of visitor activity needed for performance evaluation.

Legal basis

The site visitor and site analytics information are necessary for us in order to deliver the website to you as well as to guarantee the website’s stability and security. In accordance with Research Luxembourg’s mission of addressing the challenge posed by COVID-19, which we outlined on the main website, it is in our legitimate interest (GDPR Article 6(1)(f)) to collect and use site visitor information.

Storage location and duration

We store site visitor and site analytics data on servers located in Luxembourg, specifically at the University of Luxembourg’s data centre, for a maximum period of 12 months. Visitor logs are deleted after this period, aggregated statistics on site visits are stored for an indefinite period.

Transfers

Site visitor and site analytics information collected by our server-side software is not transferred to any other country.

5.2 Site cookies

Data and its purpose of use

Lux-Covid19 Platform’s websites make use of cookies. Cookies are bits of information that are created and maintained by your web browser when you visit a website. Cookies are categorized as first-party and third-party. First-party cookies are placed by the website you visit and will not track your activity once you leave that website. Third-party cookies are often set by another site not the one you’re visiting, e.g. advertisements, social media widgets, and they may continue to track your activity across sites.

Lux-Covid19 Platform’s websites are designed to use the cookies listed below:

  • Cookie preference
    When you visit our sites for the first time you will be notified of our cookie policy. You will have the option to proceed only with technically necessary cookies (i.e. optimisation, security and authentication) or (additionally) allow site analytics cookies. We will keep your preference in a cookie named “lap”. Your cookie preferences will be displayed at the bottom of pages, and you will have the option to change your cookie settings at any time.

  • Optimization and security cookies
    Our sites are fronted by load balancers and firewalls managed by the University of Luxembourg. As a result, additional cookies named “LBServer” and “TS*” will be placed in your browser.

  • Authentication cookies
    When you log in to our discussion forum we place authentication cookies. Specifically, “_bypass_cache” “forum_session” and “_t” will be placed to know your preference to be remembered and the fact that you have authenticated.

Optimization and security, authentication cookies are first-party and there is no personal information stored in them.

In addition, our websites make use of the following optional cookies:

  • Analytics cookies (Optional)
    If you allow the use of site analytics, our site will place the following first-party analytics cookies: “_pk_id” ,”_pk_ses”, “_pk_cvar”, “_pk_hsr” and “_pk_ref”.
    • “_pk_id*” holds your unique visitor ID.
    • “_pk_ref” holds the referrer page information, where applicable.
    • “_pk_ses*”, “_pk_cvar” and “_pk_hsr” are short-lived cookies used to temporarily store data for a particular visit of you to our site.
  • Twitter (optional)
    Our sites include the Twitter feed of Research Luxembourg. The Twitter widget does not place any cookies if solely used it to view tweets. However, this widget also includes Like or Share functions. If you choose to interact with these functions then you will make a connection to Twitter.com, which may place cookies, including third-party cookies on your browser. You can reach the Twitter privacy policy here.

Storage location and duration

Normally cookies are stored on your computer until the end of their expiry period summarized below. You may also choose to clear your browser cookies manually.

Cookie category Cookie name Expiry period
Cookie preference lap 6 months
Cookie preference MATOMO_SESSID Temporarily created when user opts out of analytics
Optimisation & Security LBServer End of browsing session
Optimisation & Security TS* End of browsing session
Authentication _bypass_cache End of browsing session
Authentication _t 60 days
Authentication _forum_session End of browsing session
Analytics (optional) _pk_id* 1 year
Analytics (optional) _pk_ref 6 months
Analytics (optional) _pk_ses*, _pk_cvar, _pk_hsr End of browsing session

Legal basis

In accordance with Research Luxembourg’s mission of addressing the challenge posed by COVID-19, which we outlined on the main website, use of cookies is in our legitimate interest (GDPR Article 6(1)(f)), as cookies enable us to deliver our websites to you in a stable and secure manner.

Transfers

Essential cookies i.e. the Optimisation & Security and Authentication categories listed above are required for our websites to function. These cookies are stored on your computer, and information in them is transferred to servers in Luxembourg, when cookie information is used by our site servers.

Optional cookies that may be placed by the Twitter widget are stored on your computer. Information in these cookies may be transferred to servers in the United States and elsewhere. Please see the privacy policy of Twitter for details.

6. Discussion Forum

6.1 LCSB User Management System (LUMS) Account Information

Data and its purpose of use

We collect additional personal data, beyond the IP address, when you use our Discussion Forum. In order to use the forum website you will require an account within LCSB’s User Management System (LUMS). When creating a LUMS account for you we collect and store the following personal data:

  • For your LUMS account:
    • your name and surname
    • your email
    • your job title
    • your home organisation
  • For your Discussion Forum profile:
    • your profile picture (optional)

We use the information in your LUMS account to log you in to the discussion forum website and to allow you to participate in the discussions on the site. Our discussion forum does not allow anonymous posts, all posts are associated with the user, who is the creator of the post. For all the forum posts you make, the name and surname information in your LUMS account will be visible to participants of the forum.

You may provide additional data for your Discussion Forum profile, like a profile picture on the profile settings page. Our discussion forum makes that data available to others who can access the forum. You don’t have to provide this additional information, and you can erase it at any time.

We use the email in your LUMS account to maintain your account and to communicate with you regarding account maintenance. We also use your email to communicate any changes to LUMS service availability and updates.

Storage location and duration

The data collected by the Discussion Forum is stored on servers located in Luxembourg, specifically at the University of Luxembourg’s data centre.

Your data will be retained for as long as the Discussion Forum is operational, even after you stop using the service. In case the Discussion Forum is decommissioned, we will keep your LUMS account information for as long as the associated Discussion Forum content is deemed necessary to be archived at the UL-LCSB. When the archival period is over, we will keep your LUMS account information for a duration of 1 year for record keeping purposes.

Legal basis

For the Discussion Forum, LUMS account information is necessary for us to deliver to you our service of the facilitation of communication within the Luxembourg research community in response to the COVID-19 pandemic (GDPR Article 6(1)(b)).

Transfers

We will not transfer the LUMS Account information and the information on your Discussion Forum profile to any other country.

7. Project Catalog’s Submission Form

7.1 Project Contact Information

Data and its purpose of use

When you use the Lux-Covid19 Project Catalog’s Submission Form we will ask you to provide information about project contact persons. Specifically, we ask for:

  • Name, surname and institutional email of the persons that are considered primary and secondary contacts for the project being submitted to the Project Catalog. We will list this information in the Project Catalog website in order to allow research collaborators to contact you.

Storage location and duration

Project contact information collected in the Project Catalog is stored on servers located in Luxembourg, specifically at the University of Luxembourg’s data centre. Project contact information will be retained for as long as the Project Catalog is live, even after you stop using the service. In case the services are decommissioned, we will keep the data for the minimum amount necessary for compliance with the GDPR and Luxembourgish Data Protection laws.

Legal basis

Project contact information is necessary for us to deliver to you our service of the facilitation of communication within the Luxembourg research community in response to the COVID-19 pandemic (GDPR Article 6(1)(f)).

Transfers

The contact information collected by the Project Catalog is not transferred to any other country.



Last updated: 28 May 2020