Privacy Policy for the Lux-Covid19 Platform
1. Preface
Research Luxembourg, a joint initiative of Luxembourg’s public research sector, is mobilising its knowledge and resources to help address the challenge of COVID-19. A task force has been set up in order to offer the health system the combined expertise available within the Luxembourg public research sector. As part of this work, the FNR has tasked University of Luxembourg’s Luxembourg Centre for Systems Biomedicine with the establishment of a national online COVID-19 platform. Consequently, the UL-LCSB has launched the Lux-Covid19 Platform. The objective of this platform is to facilitate communication within Luxembourg’s research community and to accelerate the inception, coordination and execution of research projects.
This is the privacy policy for the Lux-Covid19 online platform that is hosted by the University of Luxembourg’s Luxembourg Centre for Systems Biomedicine (UL-LCSB), the data processor, on behalf of Fonds National de la Recherche (FNR) the data controller here on referred to as “we”, “us”, “our”.
In this policy we outline what personal data (“data”) we collect when data subjects (“you”, “your”) visit our sites and use our services, for what purposes this data is collected, where and how long it is kept and your rights regarding data as per the EU General Data Protection Regulation (“GDPR”). We also list relevant contact persons regarding requests and inquiries on data and data protection.
| Main Website | lux-covid19.lu This is the entry point and the homepage for the Lux-Covid19 Platform. It provides links to other websites in the platform. The Main Website is publicly available. |
| Project Catalog | projects.lux-covid19.lu This is a public catalog of research projects that Research Luxembourg members and collaborators can use to publish ideas for new projects, or publish information about projects that are in progress or that are completed. The Project Catalog is publicly available. |
| Project Catalog Submission Form | redcap.lux-covid19.lu This is a web form for publishing new entries in the Project Catalog. The Project Submission Form is publicly accessible. |
| Discussion Forum | forum.lux-covid19.lu This is an online forum where research collaborators can publish announcements and discuss project ideas, proposals and updates. Discussion Forum website is not publicly accessible. Participation is by invite only and requires signing up to the LCSB User Management System. |
The remainder of the policy document is organised as follows. In Section 2 we provide contact details for the data controller. In Section 3 we list your rights regarding the personal data collected. In Section 4 we summarise the measures taken to protect personal data. In Section 5 we list the personal data commonly collected on all four websites of the Lux-Covid19 platform. We outline where the data is stored, for what purposes the data is used and the lawful basis for us to process the data. In Section 5 you will also find our sites’ cookie policy.
Certain websites within the Lux-Covid19 platform collect further personal data, these are the Discussion Forum and the Project Catalog Submission Form described in Section 6 and Section 7 respectively.
2. Who is the data controller?
The Fonds National de la Recherche (FNR) is the Data Controller.
Maison du Savoir,
2, avenue de l’Université,
L-4365 Esch-sur-Alzette.
Tel.: +352 26 19 25-1
Fax.: +352 26 19 25-35
Postal Address.:
B.P. 1777
L-1017 Luxembourg
Email: info@fnr.lu
The FNR has mandated MGSI S.à r.l. to perform the Data Protection Officer function.
MGSI S.à r.l.,
1 rue Blender,
L-1229 Luxembourg,
3. What are your rights regarding the data we collect?
As per GDPR, you as a “data subject” have rights on your personal data.
You have the right to be informed that UL-LCSB is processing your personal information.
You have the right to access your personal information and in case it is inaccurate or incomplete you have the right to have it rectified without undue delay.
You have the right to ask that we delete your personal data or restrict its use. Where applicable, you have the right to object to our processing of your personal data, and the right to data portability. Your requests for deletion and processing restriction will be assessed by us and we will notify you of the result of this assessment within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and the number of applications (in accordance with article 12.3 GDPR).
You can request that we notify you in case any changes are made to your personal data or your data has been sent to any other party.
You have the right to lodge a complaint with the Luxembourgish data protection supervisory authority, CNPD, in case you consider that our processing of your personal data infringes the GDPR.
In order to exercise your rights regarding personal data and also for general inquiries on this privacy notice please contact the FNR by emailing info@fnr.lu.
4. How do we protect your data?
The UL-LCSB, on behalf and under instruction of the FNR, has put in place a number of organisational and technical measures for the protection of your personal data in compliance with the EU GDPR. These measures include but are not limited to access control, encrypted data transmission, institutional policies, staff code of conduct and training on data protection.
Only authorized personnel at the UL-LCSB and its host institution can access the data. Examples of such personnel include UL and UL-LCSB IT system administrators and data stewards that communicate with project contacts.
The types of personal data collected on our sites, its storage, use and sharing is described in the following sections. Please note that:
- No personal data collected on Lux-Covid19 Platform’s website are used for direct marketing purposes.
- The data collected on the platform will not be forwarded to 3rd parties.
5. Lux-Covid19 Platform Websites
5.1 Site visitor information
Data and its purpose of use
When you visit any of the four Lux-Covid19 websites listed in the preface, we collect the following information:
- your IP address,
- your device type, name and ID,
- your browser version,
- your operating system and language settings,
- date and time of web resource access request,
- content of access request,
- status and size of response to a request.
This information is automatically collected by server-side software that deliver pages to site visitors. We use this data to analyse site usage, which in turn allows us to further optimize and secure our site. The data will be used for statistical purposes only.
Legal basis
The site visitor information is necessary for us in order to deliver the website to you as well as to guarantee the website’s stability and security. In accordance with Research Luxembourg’s mission of addressing the challenge posed by COVID-19, which we outlined in the preface, it is in our legitimate interest (GDPR Article 6(1)(f)) to collect and use site visitor information.
Storage location and duration
We store site visitor data on servers located in Luxembourg, specifically at the University of Luxembourg’s data centre, for a maximum period of 12 months. Visitor logs are deleted after this period, aggregated statistics on site visits are stored for an indefinite period.
Transfers
Site visitor information collected by our server-side software is not transferred to any other country.
5.2 Site cookies
Data and its purpose of use
Lux-Covid19 Platform’s websites make use of cookies. Cookies are bits of information that are created and maintained by your web browser when you visit a website. Cookies are categorized as first-party and third-party. First-party cookies are placed by the website you visit and will not track your activity once you leave that website. Third-party cookies are often set by another site not the one you’re visiting, e.g. advertisements, social media widgets, and they may continue to track your activity across sites.
Lux-Covid19 Platform’s websites are designed to use the cookies listed below:
-
Feature cookies
When you visit our sites for the first time you will be notified of our cookie policy. We will keep the fact that we have notified you of our cookie policy in a cookie named “cookieconsent_status”. -
Optimization and security cookies
Our sites are fronted by load balancers and firewalls managed by the University of Luxembourg. As a result, additional cookies named “LBServer” and “TS*” will be placed in your browser. -
Authentication cookies
When you log in to our discussion forum we place authentication cookies. Specifically, “_bypass_cache” “forum_session” and “_t” will be placed to know your preference to be remembered and the fact that you have authenticated.
Optimization and security and authentication cookies are first-party and there is no personal information stored in them. In addition, our websites make use of the following optional cookies:
- Twitter (optional)
Our sites include the Twitter feed of Research Luxembourg. The Twitter widget does not place any cookies if solely used it to view tweets. However, this widget also includes Like or Share functions. If you choose to interact with these functions then you will make a connection to Twitter.com, which may place cookies, including third-party cookies on your browser. You can reach the Twitter privacy policy here.
Storage location and duration
Normally cookies are stored on your computer until the end of their expiry period summarized below. You may also choose to clear your browser cookies manually.
| Cookie category | Cookie name | Expiry period |
|---|---|---|
| Feature | cookieconsent_status | 1 year |
| Optimisation & Security | LBServer | End of browsing session |
| Optimisation & Security | TS* | End of browsing session |
| Authentication | _bypass_cache | End of browsing session |
| Authentication | _t | 60 days |
| Authentication | _forum_session | End of browsing session |
Legal basis
In accordance with Research Luxembourg’s mission of addressing the challenge posed by COVID-19, which we outlined in the preface, use of cookies is in our legitimate interest (GDPR Article 6(1)(f)), as cookies enable us to deliver our websites to you in a stable and secure manner.
Transfers
Essential cookies i.e. the Optimisation & Security and Authentication categories listed above are required for our websites to function. These cookies are stored on your computer, and information in them is transferred to servers in Luxembourg, when cookie information is used by our site servers.
Optional cookies that may be placed by the Twitter widget are stored on your computer. Information in these cookies may be transferred to servers in the United States and elsewhere. Please see the privacy policy of Twitter for details.
6. Discussion Forum
6.1 LCSB User Management System (LUMS) Account Information
Data and its purpose of use
We collect additional personal data, beyond the IP address, when you use our Discussion Forum. In order to use the forum website you will require an account within LCSB’s User Management System (LUMS).
When creating a LUMS account for you we collect and store the following personal data:
- For your LUMS account:
- your name and surname
- your email
- your job title
- your home organisation
- For your Discussion Forum profile:
- your profile picture (optional)
We use the information in your LUMS account to log you in to the discussion forum website and to allow you to participate in the discussions on the site. Our discussion forum does not allow anonymous posts, all posts are associated with the user, who is the creator of the post. For all the forum posts you make, the name and surname information in your LUMS account will be visible to participants of the forum.
You may provide additional data for your Discussion Forum profile, like a profile picture on the profile settings page. Our discussion forum makes that data available to others who can access the forum. You don’t have to provide this additional information, and you can erase it at any time.
We use the email in your LUMS account to maintain your account and to communicate with you regarding account maintenance. We also use your email to communicate any changes to LUMS service availability and updates.
Storage location and duration
The data collected by the Discussion Forum is stored on servers located in Luxembourg, specifically at the University of Luxembourg’s data centre.
Your data will be retained for as long as the Discussion Forum is operational, even after you stop using the service. In case the Discussion Forum is decommissioned, we will keep your LUMS account information for as long as the associated Discussion Forum content is deemed necessary to be archived at the UL-LCSB. When the archival period is over, we will keep your LUMS account information for a duration of 1 year for record keeping purposes.
Legal basis
For the Discussion Forum, LUMS account information is necessary for us to deliver to you our service of the facilitation of communication within the Luxembourg research community in response to the COVID-19 pandemic (GDPR Article 6(1)(b)).
Transfers
LUMS Account information and the information on your Discussion Forum profile is not transferred to any other country.
7. Project Catalog’s Submission Form
7.1 Project Contact Information
Data and its purpose of use
When you use the Lux-Covid19 Project Catalog’s Submission Form we will ask you to provide information about project contact persons. Specifically, we ask for:
- Name, surname and institutional email of the persons that are considered primary and secondary contacts for the project being submitted to the Project Catalog. We will list this information in the Project Catalog website in order to allow research collaborators to contact you.
Storage location and duration
Project contact information collected in the Project Catalog is stored on servers located in Luxembourg, specifically at the University of Luxembourg’s data centre. Project contact information will be retained for as long as the Project Catalog is live, even after you stop using the service. In case the services are decommissioned, we will keep the data for the minimum amount necessary for compliance with the GDPR and Luxembourgish Data Protection laws.
Legal basis
Project contact information is necessary for us to deliver to you our service of the facilitation of communication within the Luxembourg research community in response to the COVID-19 pandemic (GDPR Article 6(1)(f)).
Transfers
The contact information collected by the Project Catalog is not transferred to any other country.