Data and information collected by City of Luxembourg departments

In accordance with the laws on the protection of natural persons with regard to the processing of personal data, the City of Luxembourg hereby informs users that the data and information collected by its departments are processed for the purpose of performing the tasks falling within its remit, pursuant to the legal and regulatory provisions in force.

Users' personal data and information will be retained for as long as necessary to achieve the purposes of their processing.

For more information, please contact the Data Protection Officer or the Data Controller:

  • Data Protection Officer
    42, Place Guillaume II
    L-1648 Luxembourg
    or
    dpo@vdl.lu
  • Administration communale de la Ville de Luxembourg
    42, Place Guillaume II
    L-1648 Luxembourg
    or
    protectiondesdonnees@vdl.lu

You have the right to access and rectify your personal data and, where applicable, the right to data portability and the right to restrict the processing of your data. You have the right to have your personal data erased, unless the processing of such data is mandatory.

With legitimate reasons, you also have the right to object to the processing of your personal data, unless the processing is required to fulfil a legal obligation.

To lodge a complaint, you may contact the National Commission for Data Protection (Commission Nationale pour la Protection des Données– CDPD):

15, boulevard du Jazz
L-4370 Belvaux.

Newsletter

The information notice on the data processing operations carried out for the purpose of managing the newsletter can be viewed here.

The newsletter is usually sent out on Wednesdays in the early afternoon. However, under no circumstances may the City of Luxembourg be held liable for any direct or indirect damage arising as a result of the newsletter being cancelled or sent at a later date.

Form server

The City subcontracts some of the processes required to implement the various procedures available on its form server to the Government IT Centre (Centre des technologies de l'information de l'Etat – CTIE). As a Luxembourg-based government agency, the CTIE provides all of the required guarantees as to the implementation of appropriate technical and organisational measures to control access to the data it handles. The subcontractor has undertaken to comply with the data protection rules and principles outlined in the GPDR.

When a user selects a procedure on https://form-server.vdl.lu and an electronic signature is required, the user will be redirected automatically to the CTIE's MyGuichet online service to authenticate their identity. Once the user's identity has been authenticated, they will be able to fill in the form, which is hosted on a platform belonging to the City. The completed form will then be sent as a PDF document to the MyGuichet platform, where the user must sign it electronically. The PDF form is stored in a CTIE back-office system that the City has access to, as well as in the applicant's private e-space. The signed PDF form is also forwarded to the City's back-office system for application-tracking purposes. The data contained in the form is automatically extracted and then fed into the City's information system for the purpose of processing the application.

Form server

When filling in forms on form-server.vdl.lu, users may be required to provide some personal information, which may vary depending on the form they selected.

These forms adhere as closely as possible to the data minimisation principle established by the GDPR, which provides that personal data must be adequate, relevant and limited to what is necessary for the purposes for which it is being processed.

Any personal data collected through these forms may be:

  • stored on the City's servers for the sole purpose of processing the procedure submitted by the user;
  • forwarded to the City's departments tasked with processing the application;
  • sent to the City's information systems for automatic processing of the application. Such automatic processing does not involve any form of profiling, or any decisions that may have legal repercussions for the applicant or affect them to a significant degree.

Users' personal data will be retained for a period of time that is compliant with legal provisions and in keeping with the purposes for which it was collected.

Cityapp

In principle, cityapp may be used without having to provide any personal data other than the language in which the user prefers the app to be displayed (English, French or German).

In some cases, users may be asked to provide the following personal data, which is entirely optional:

  • User status (resident, worker or visitor);
  • Surname;
  • First name;
  • Home address;
  • Work address;
  • Email address.

These details may be requested in the following cases, or for the following purposes:

  • To customise widgets;
  • To enable the user to access their personal e-space on their smartphone to manage their personal data, and for the purpose of pre-filling contact forms;
  • Filling in contact forms (see point below).

Such data is stored on the user's smartphone only.

The only data stored on the City's servers is the data required for the purpose of configuring widgets. Such data is anonymised, thus making it impossible to identify the user. As such, no links can be established between the stored data and a natural person.

"Report-It" and other contact forms

When filling in contact forms, including when using the "Report-It" service to report an incident, users may be required to provide the following personal data:

  • Surname;
  • First name;
  • Home address;
  • Email address;
  • Phone number.

When reporting incidents, the following information provided by the user will be published:

  • Location of the incident (address);
  • Any images submitted by the user;
  • The description of the incident;
  • The date on which the incident was reported;
  • The date on which the reported incident was last updated;
  • The status of the report.

Any personal data collected through these contact forms may be:

  • stored on the City's servers for the sole purpose of processing the request for information or the incident submitted through the "Report-It" service;
  • forwarded by email to the departments selected by the user for processing (contact page on vdl.lu, and in the cityapp under Services > Need help? > Contact form > Request information);
  • forwarded by email to the City's service provider for processing (in the cityapp under Services > Need help?).

Users' personal data will be retained for a period of time that is compliant with legal provisions and in keeping with the purposes for which it was collected.

Indigo Neo app

The information that is collected is stored by the City of Luxembourg for the purpose of managing the payment of parking fees, monitoring parking, and managing fines.

This information is stored for the maximum period of time that is allowed for the specified purposes. It is handled by authorised City of Luxembourg staff, and shared only with authorised third parties for the purpose of managing parking violations and appeals against penalty charges.

In line with the General Data Protection Regulation EU 2016/679, you may exercise your right to be informed, your right to access to your personal data, and your right to rectify your personal data by contacting the City of Luxembourg's Data Protection Officer, whose contact details can be found on the "Legal Notice" page on www.vdl.lu.

Public events

Events organised by the City of Luxembourg are generally public events and, during these events, it is possible that participants may be photographed and/or filmed. Such photographic and/or video content may be published either digitally or in print.

Citybiblio.lu

In principle, internet users can visit the citybiblio.lu website without having to provide any personal data, unless they decide to log in to their account.

Processing of log-in data

If the user decides to log in to the their account on the citybiblio.lu website to enjoy a more personalised experience, they may be required to share the following personal data:

  • Surname (required);
  • First name (required);
  • Email address;
  • Identifiers of the reader's card(s) added to the user's account (required);
  • Interests and preferences (likes, ratings, and favourites, as well as preferred genres, languages and media);
  • User settings, including notification and newsletter-related preferences;
  • "Accessibility help" activation status;
  • Selected avatar.

Such data will be collected and processed for the purpose of administering the user's requests and managing the various services on offer. By filling in a form, you consent to having your personal data processed for the purpose of managing your request. The data provided by logged-in users will be stored and processed in order to display resources that match their tastes and interests based on their stated preferences, with a view to improving their overall experience of the site.

Signing up for events and contact form

When signing up for events or using the contact form, users may be required to provide the following personal data:

  • Surname (required);
  • First name (required);
  • Email address (required);
  • Number of people to sign up for an event (required).

Such data will be processed for the purpose of administering the user's request, managing the various services on offer, and managing attendance. Only data that is relevant and necessary for the provision of our services is collected, processed and stored, in strict compliance with the principle of data minimisation.

When you sign up for an in-person, online (e.g. webinar) or hybrid event organised by one of our departments, you acknowledge that you have been informed about and consent to the following:

  • You may appear in photographs or video footage captured during the event.
  • The event may be recorded (sound or video) and may be broadcast live or after the event.

If you wish to object to such processing of your personal data, we recommend that you contact the organising department before the event in order to find a way of ensuring that you or your data does not appear in photographs or videos captured during the event. If the event in question is an online event, you will be asked to disable your camera and/or microphone.

Photographs and recordings of events and, where applicable, the broadcasting of such content, are for communication purposes. Such communication may involve publishing or broadcasting the content on the organising department's various communication media, such as external websites and portals, internal network platforms, newsletters, social media platforms (LinkedIn, Meta, X, Instagram, and any other social media platforms that may exist in the future), etc.

Data retention

Users' personal data will be retained for a period of time that does not exceed the time required to achieve the purposes for which such data is collected and processed.

Users' personal data will never be used for any purposes other than those mentioned above, will be processed within the European Union, and will not be transferred to third parties. The Cité Bibliothèque's Data Controller, as well as the subcontractors tasked with assisting them in developing and maintaining the Cité Bibliothèque's website, implement appropriate technical and organisational measures to safeguard the security of your personal data, and particularly the confidentiality, integrity and availability of such data.