Privacy policy for the LU-Alert App

The Luxembourg State respects your privacy in all circumstances. This privacy policy (hereinafter called the 'policy') informs the user about the way in which their data is collected, stored and used when they use the LU-Alert app. It also informs the user of the choices they can make regarding the use of the information provided.

The meaning of the terms within this policy is the same as that shown in Article 1 of the General terms and conditions of use for the LU-Alert app.

The personal data communicated directly or indirectly by the user within the context of use of the LU-Alert app (hereinafter the 'app') shall be processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the 'GDPR') as well as the law of 1 August 2018 on the organisation of the National Commission for Data Protection and on the implementation of the GDPR. The data processed by the app is also subject to Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, transposed into national law by the amended law of 30 May 2005 on the protection of privacy in the electronic communications sector.

Without prejudice to the processing of personal data conducted by Apple or Google, in particular as a result of having a personal account, the app processes the personal data referred to in Article 4.

Article 1. Data controller 

The data controller responsible for processing the personal data is the Ministry of Home Affairs.

Article 2. Processor

The Government IT Centre (Centre des technologies de l'information de l'État – hereinafter referred to as 'CTIE') acts as the processor in the sense of the GDPR for the Ministry of Home Affairs. 

Intersec acts as the processor in the sense of the GDPR for the CTIE.

Article 3. Security measures

The CTIE takes various technical and organisational security measures to ensure an appropriate level of privacy, integrity, availability and resilience of the services provided through the app, and to protect user’s rights and freedoms in keeping with industry standards.

Article 4. Personal data collected, purposes and retention period

The user's personal data that is processed includes a unique technical identifier of their terminal, their geolocation data, if the user agrees to share the terminal's geo tracking with the app, and the terminal's IP address. 

The aforementioned identifier and the IP address may be accessed by third parties as necessary for the app's technical functionality. The geolocation data cannot be accessed by a third party.

a) Unique technical identifier

On first use of the app, as a user, a unique technical identifier is automatically generated to formally distinguish the user's terminal. An anonymous contact profile is then created, which is kept on the GeoSafe servers hosted in Luxembourg on behalf of the CTIE, without the user having to provide their personal information. 

An example of an internal contact identifier: id:contact162954380

This unique technical identifier allows the app to keep an anonymous trace of this instance of the app in order to store in its memory the elements required to send alerts to this terminal.

The automatic re-use of this unique technical identifier from one use session to another ensures consistent user experience.

b) Geolocalisation

Geolocation is necessary for the alert system to send targeted notifications to terminals in geographic zones of a reasonable size. The position used is the user's approximate or exact position based on limited temporal and spatial precision and according to the terminal's settings authorised for the app. 

If the user has activated geolocation for the app, they will receive messages according to the option chosen:

• My location: the user will receive a message if the GPS/Galileo/GLONASS position or that of another satellite positioning system selected by the terminal (with a precision of up to 3 or 4 metres) intersects one or more alert notification zones;
• Around my location: the user will receive a message if one or more alert notification zones are situated within a radius of 1 km of the GPS/Galileo/GLONASS position or that of another satellite positioning system selected by the terminal.

If the user has defined one or more places of interest in the app, this data is sent and saved in the app. For each place of interest chosen, the following data is used:

• the precise geographic coordinates (latitude, longitude) of the place of interest;
• the name given to the place of interest (optional);
• the postal address associated with the place of interest (optional).

The user's location data is only processed to activate notifications if this function has been selected.

Processing the terminal's geographic location data is done locally within the app. The user's data is neither collected nor repatriated outside of the terminal.

c) The terminal's IP adress

The IP address of the user's terminal is collected in the connection journals (logs) for security purposes.

Without access to the terminal's geolocation, the app is still able to provide the following two function modes:

• Disable proximity alerts: no alert will be received/displayed in relation to the terminal's geolocation;
• All alerts: the user requests that all of the active alerts available on the LU-Alert alerts portal are displayed (no filter is applied based on the geolocation of the terminal or the places of interest).

Article 5. Consent and consequence in case of refusal

Processing is carried out based on Article 6, paragraph 1, letter a) of the GDPR. The user consents to the aforementioned data being collected so that the purpose of the app can be achieved, namely, to receive alert messages.

The collection of data is equally permitted and justified by the safeguarding of vital interests and enables the user to receive alert messages based on the selected criteria (geographical zones, areas of interest, etc.). 

Article 6. Usage tracking, telemetry and mapping services

For its proper operation and maintenance, the app communicates anonymised information to its respective app platforms ('App Store' and 'Google Play') which track its behaviour:

• app performance measurement if the user has given their express consent;
• reports, including anonymous collection of the technical specifications (hardware and software) of mobiles in the event of system crashes and if the user has given their express consent.

Furthermore, the app exchanges anonymised information with its mapping (Mapbox) and address-lookup-function service providers.

These communications do not involve processing any of the user's personal data as the information concerned is anonymised.

Article 7. Data storage

Unless otherwise stipulated in this privacy policy, and/or in the General terms and conditions of use of the app, the user's data is stored in the Grand Duchy of Luxembourg.

Article 8. Processing linked to management of the app by the 'App Store' and 'Google Play' platforms 

The 'App Store' and 'Google Play' platforms are likely to process the personal data disclosed directly or indirectly by the user when downloading the app.

In this case, Apple and Google have sole responsibility for processing the user's personal data.

As Apple and Google are also subject to the GDPR as well as to the aforementioned law of 1 August 2018, it is up to the user to contact those organisations to exercise their rights.

Article 9. Further processing

The personal data collected (other than geolocation) may be processed for historical, statistical or scientific purposes, and, furthermore, be made available to the judicial authorities on request.

Article 10. User rights

The user has the right to access, rectification and erasure of data concerning them. They should contact the data controller in order to exercise these rights.

Users also have the right to restrict processing of their personal data, to object to its use, to withdraw their consent, and the right to data portability. These rights can be exercised by contacting the data controller directly.

The processing of your data does not involve automated decision-making that produces legal effects concerning you or significantly affects you in a similar way.

Users can send their requests by post to the following address:

Ministère des Affaires intérieures

19, rue Beaumont

L-1219 Luxembourg

Should you have any questions concerning the processing of your personal data, please also contact the data protection officer at the Ministry of Home Affairs: 

• by email : [email protected] or [email protected]
• byt phone : (+352) 247 72 015

Article 11. Complaints

Users may address claims pertaining to protection of their personal data to the data controller's data protection officer.

Moreover, users may file a complaint with a data protection supervisory authority. In Luxembourg, this is the National Commission for Data Protection (Commission nationale pour la protection des données - CNPD) (https://cnpd.public.lu/en.html; 15, Boulevard du Jazz, L-4370 Belvaux; phone: (+352) 26 10 60-1).

Article 12. Conditions for modifying the privacy policy

The State reserves the right to adapt or modify this policy at any time, either in whole or in part, and without being limited thereto, to guarantee to the user that the app complies with developments in relation to services, technical advances, or changes in the law or jurisprudence or when new services are implemented.

The user is informed of this policy on first use of the app and of any modification or adaptation by way of a pop-up window which appears on the user's terminal when they access the app. To continue to benefit from the app's functions, the user must accept all new versions of this policy.

The new versions of this policy will thus be deemed known and accepted by the user.