Privacy Notice
Created: 11/08/2025
- An overview of data protection
The Luxembourg Institute of Science and Technology (hereafter “LIST”, “We”) is committed to ensure the highest standards of data protection in compliance with the applicable legislation, notably with reference to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereafter “GDPR”).
The present document aims at illustrating what personal data we collect about you, the reason why LIST uses your data and, as the case may be, share your data and the applicable retention periods. Additionally, the notice also provides you with information regarding your rights, how to exercise them and whom you can contact in case of any query.
- Scope of the notice
The present notice is directed to the legal representatives or other employees and contact points of LIST’s partners having collaborated with LIST in the framework of research projects which ended in 2024 (hereafter “You”) and who agree to participate in LIST’s online Satisfaction Survey 2025 (hereafter the “Survey”).
- Identity of the data controller
The data controller is LIST, having its registered office at 5, Avenue des Hauts-Fourneaux L-4362 Esch-sur-Alzette, Luxembourg.
- Categories of personal data we process
The categories of personal data that we collect about you include:
- Contact details: name, surname, email,
- Professional information: company/organisation,
- Your replies to the Survey and any other personal information you may decide to share with us voluntarily. We encourage you to avoid sharing non requested personal data about you or other people as they are not useful nor necessary for this Survey.
- Why and how your personal data is processed
LIST collects and uses your personal data for the following purposes :
|
Purpose
|
Details
|
|
To invite you to participate in this Survey
|
This includes processing your contact details to invite you via email to participate in the Survey.
|
|
To conduct the Survey
|
This includes processing your personal data for collecting your views through our Survey while ensuring that the Survey is completed by each invited participant.
We will also process your personal data to reply to your queries and comments when you decide to contact us.
|
- How we obtain the personal data of Participants
We obtain the personal data directly from You.
- Legal basis for processing
Below you can find the list of legal basis on whose grounds LIST collects and processes Participants’ personal data:
|
Purpose
|
Legal basis
|
|
To invite you to participate in this Survey
|
LIST has a legitimate interest to process your contact details as provided during our collaboration to invite you in this Survey which is directly linked to our collaboration and aims at evaluating it.
|
|
To conduct the Survey
|
LIST has a legitimate interest to process your personal data to be able to have feedback about its performance in order to improve its research collaboration activities in the framework of its missions as a public research centre.
|
- Share of your personal data with third parties
LIST may share your personal data with:
- LIST’s high management, heads of research units and other LIST employees on a need-to-know basis in order to consider the results in LIST’s strategy and activities in the future,
- LIST’s IT team and internal services on a need-to-know basis,
- External service providers that perform services on LIST behalf, such as IT service providers.
- Ensuring personal data security and integrity
In compliance with the applicable data protection legislation, LIST has put in place appropriate technical and organisational measures in order to prevent or act upon any unauthorised and unlawful processing or disclosure, accidental loss, modification or destruction of personal data. These measures are implemented based on the current state of art, an evaluation of the risks derived by the processing activity and the need to protect personal data. Such technical and organisation measures are regularly updated and/or adjusted to new technical developments or any organisational change that may affect LIST.
In particular, access on a need-to-know basis has been implemented to ensure only staff with appropriate need for the purpose has access to your personal data. Additionally, we have data processing agreements in place with our processors.
- Data retention periods
LIST will only retain your personal for a period of time that is strictly necessary for the purposes for which we collect your data, without prejudice to LIST to keep them for a longer duration for legal and/or regulatory obligations applying to LIST or due to exceptional situations that would justify them being kept longer (judicial procedure, etc.). Below are the details regarding the time we keep your personal data:
|
Purpose
|
Retention Period
|
|
To invite you to participate in this Survey
|
In this case we keep your personal data according to our CRM retention schedule
|
|
To conduct the Survey
|
In this case we keep your personal data up to 2 years after the end of the Survey
|
- Your rights and how to exercise them
With regards to your personal data collected and processed by LIST, you may exercise at any time the following rights:
- Right to access: You have the right to receive confirmation about whether or not your personal data is being processed by LIST. If that is the case, you have the right to know what data is being collected and processed and to obtain of copy of it;
- Right to rectification: If the personal data we hold about you is inaccurate or incomplete, you have the right to request to have it rectified;
- Right to erasure: Subject to certain conditions specified in art. 17 of the GDPR, you have the right to have your personal data deleted by LIST;
- Right to restriction of processing: Subject to certain conditions specified in art. 18 of the GDPR, you have the right to obtain restriction of the processing of your personal data performed by LIST;
- Right to data portability: Subject to certain conditions specified in art. 20 of the GDPR, you have the right to obtain a copy of the personal data you provided to LIST in in a structured, commonly used and machine-readable format and to request the transfer of these data to another data controller;
- Right to object: You have the right to object the processing of your personal data when the conditions set out in art. 21 of the GDPR apply;
- Right to withdraw consent: If LIST is processing your personal data based on your consent, you have the right to withdraw that consent at any time. The withdrawal of such consent shall not affect the lawfulness of processing based on consent before its withdrawal.
- Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD). More information on how to lodge a complaint are available on CNPD’s website: https://cnpd.public.lu.
You may exercise any of these rights by contacting our Data Protection Officer (DPO) via our online form available at: https://www.list.lu/en/support/dpo-contact-form/
- Changes to this Privacy Notice
LIST may make changes to this Privacy Notice from time to time, to reflect our current privacy practices or to comply with changes in the applicable data protection legislation. LIST encourages you to regularly visit this page in order to remain informed on our data protection policies.
