Data Protection Information Notices

When you browse and use our website, LNS collects your personal data for the following purposes:

• Managing contact requests, feedback and complaints.
• Registering for services and events organised by LNS.
• Creating online accounts to schedule appointments for hair toxicology tests.

Online registration forms for our events may include specific references to the protection of personal data. These references supplement this privacy notice.

The following personal data may be collected by the LNS:

• Identification data: surname, first name, date of birth and national identification number (matricule).
• Contact details: telephone number, email address and postal address.
• Correspondence data between you and the LNS following your requests/feedback or complaints: subject and content of your message/feedback or complaint.

Your personal data is retained for the period strictly necessary to achieve the purposes for which it was collected or in accordance with our applicable legal obligations.

The processing of your personal data in the context of managing the LNS website is based on the following legal basis:

• Legitimate interest (art. 6(1)(f) of the GDPR): the processing is justified by the legitimate interests of the LNS in ensuring the proper functionality of its website and services (in particular the management of requests/comments and complaints).

The LNS may share your personal data:

• Internally: with LNS departments responsible for responding to and following up on your requests.
• Externally: with our web hosting provider.

Your personal data may be transferred outside the European Economic Area (EEA) if security and confidentiality guarantees equivalent to those in force in the EEA are in place (in particular through standard contractual clauses and the implementation of appropriate security measures).

Your personal data is stored in secure environments (electronic or physical) hosted within the LNS’s infrastructure or within the infrastructure of approved service providers.

The LNS implements technical and organisational security measures that are appropriate and proportionate to the risks identified in the processing operations. Technical measures include the implementation of protocols to prevent the loss, alteration or unauthorised access to personal data. Organisational measures include restricting access according to the ‘need to know’ principle and training staff on GDPR requirements.

To learn more about how cookies are used on our site, please see the cookie statement updated by Cookiebot.

By clicking on the YouTube, Instagram or LinkedIn button on our website, you will be redirected to these websites. These social networks may collect data relating to your browsing on our site and associate it with the data they already have about you. These social networks have their own cookie and privacy policies, over which we have no control. We therefore invite you to consult the policies of these networks to learn about the purposes of use, including advertising, of the browsing information they may collect through these application buttons.

In accordance with the GDPR, you have certain rights:

• Right of access (art. 15 of the GDPR): you may obtain confirmation that your personal data is being processed and, if so, access that data. Given the volume of information processed, we may ask you to specify the personal data or processing activities covered by your request.
• Right to rectification (art. 16 of the GDPR): you may request that your personal data be amended if it is inaccurate or incomplete.
• Right to erasure (art. 17 of the GDPR): in certain cases provided for by law, you may request the deletion of your personal data.
• Right to restriction of processing (art. 18 of the GDPR): you may request the temporary restriction of the processing of your personal data.
• Right to data portability (art. 20 of the GDPR): you may receive the personal data you have provided to us in order to transmit it to another data controller where applicable.
• Right to object (art. 21 of the GDPR): you may object to the processing of your personal data.

Should you have any questions or wish to exercise any of your rights, you may submit your request to our Data Protection Officer (DPO):

• by email : dpo@lns.etat.lu.
• by post: Laboratoire national de santé
  Data Protection Officer
  1 rue Louis Rech, L-3555 Dudelange.

You may lodge a complaint with the National Data Protection Commission (CNPD) if you believe that one of your rights has not been respected.

As part of its recruitment process, the LNS processes personal data contained in the applications it receives. The LNS processes candidates’ personal data for the following purposes:

• Managing the different stages of the recruitment process: pre-selection of applications, scheduling individual interviews, evaluating and selecting candidates, verification of documents required for pre-contractual steps
• Managing communications with candidates: email exchanges regarding the status of applications and the sharing of additional information.
• Updating our database of applications (resume database): storing resume for future recruitment needs.

The following personal data may be collected by the LNS:

• Contact details: surname, first name, telephone number and email address.
• Professional data: professional experience and training, certifications, skills, diplomas, resume, letter of recommendation, authorization to work in Luxembourg.
• Correspondence data: email exchanges.
• Evaluation sheet.

Only data required for the recruitment process is necessary for the LNS, such as your CV and cover letter.

All sensitive data such as data revealing your ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (which uniquely identifies or confirms your identity), health data, data concerning your sexual orientation or judicial data (e.g., criminal record) are not required when you apply for a job advertised by the LNS. However, such data may be collected to enable the drafting of your employment contract if your application is successful.

In certain cases, a job posting at the LNS may specify additional categories of personal data required for a particular position. Where this is the case, providing this information is also mandatory (please refer back to the job posting).

If you provide a letter of recommendation in support of your application, it may contain personal data relating to another person (e.g., the name and position of the person who wrote the letter of recommendation). It is your responsibility to inform that person that their data will be processed by the LNS in accordance with this Privacy Notice.

Your personal data are collected:

• Directly from you as a candidate (e.g., job application or emails exchanges).
• Indirectly via publicly accessible sources (e.g., professional social networks such as LinkedIn) or through external partners (e.g. recruitment agencies).

If your application is successful, part of your recruitment file will be added to your employee file. It will then be processed and stored in accordance with our internal policies.

If your application is unsuccessful, your personal data will not be retained and will be deleted. However, if you agree to your data being retained for future vacancies, we will keep it in our resume database for a maximum period of two years.

The processing of your personal data in the context of the LNS recruitment process is based on the following legal basis:

• Consent (art. 6(1)(a) of the GDPR): the voluntary provision of additional information or the retention of resume in the resume database.
• Performance of pre-contractual measures (art. 6(1)(b) of the GDPR): the processing is necessary for the implementation of steps prior to entering into an employment contract or when a candidate applies directly to a job posting published online by the LNS.
• Compliance with a legal obligation (art. 6(1)(c) of the GDPR): the processing is required to comply with legal and regulatory obligations applicable to the LNS.
• Legitimate interest (art. 6(1)(f) of the GDPR): the processing is justified by the LNS’s legitimate interest in ensuring the effectiveness of its recruitment process in order to hire new employees.

The LNS may communicate candidates’ personal data:

• Internally: to the LNS employees responsible for recruitment. Access is strictly limited according to each person’s role and responsibilities, in accordance with the ‘need to know’ principle.

In the context of recruitment for a position subject to Board of Directors approval or notification pursuant to Article 6(2) of the Law of 7 August 2012 establishing the Laboratoire national de santé, your data may be disclosed to our directors.

• Externally: with recruitment agencies acting on behalf of the LNS when it uses a recruitment agency).

We may also receive requests from third parties duly authorised to obtain disclosure of personal data. We will only respond where permitted under applicable laws and regulations.

Your personal is stored in secure environments (electronic or physical) hosted within the LNS’s infrastructure or within the infrastructure of approved service providers.

The LNS implements technical and organisational security measures that are appropriate and proportionate to the risks identified in the processing operations. Technical measures include the implementation of protocols to prevent the loss, alteration or unauthorised access to personal data. Organisational measures include restricting access according to the ‘need to know’ principle and training staff on GDPR requirements.

In accordance with the GDPR, you have certain rights:

• Right to withdraw your consent (art. 7(3) of the GDPR): you have the right to withdraw your consent when the processing of your personal data is based on your consent.
• Right of access (art. 15 of the GDPR): you may obtain confirmation that your personal data is being processed and, if so, access that data. Given the volume of information processed, we may ask you to specify the personal data or processing activities covered by your request.
• Right to rectification (art. 16 of the GDPR): you may request that your personal data be amended if it is inaccurate or incomplete.
• Right to erasure (art. 17 of the GDPR): in certain cases provided for by law, you may request the deletion of your personal data.
• Right to restriction of processing (art. 18 of the GDPR): you may request the temporary restriction of the processing of your personal data.
• Right to data portability (art. 20 of the GDPR): you may receive the personal data you have provided to us in order to transmit it to another data controller where applicable.
• Right to object (art. 21 of the GDPR): you may object to the processing of your personal data.

Should you have any questions or wish to exercise any of your rights, you may submit your request to our Data Protection Officer (DPO):

• by email: dpo@lns.etat.lu
• by post: Laboratoire national de santé
  Data Protection Officer
  1 rue Louis Rech, L-3555 Dudelange.

You may lodge a complaint with the National Data Protection Commission (CNPD) if you believe that one of your rights has not been respected.