For the attention of persons who consult and use the INDR websites and online accounts and persons who subscribe to the INDR Newsletter.

The purpose of this notice is to define the conditions under which personal data is processed and collected in accordance with Regulation 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ("GDPR").

What personal data is processed?

Personal data is any information that makes it possible to identify, directly or indirectly, a natural person (referred to as the "data subject").
The data that INDR is currently likely to process are as follows:

• surname, first name, gender, institution or company, position, postal address, e-mail address, telephone number, date of membership,
• information on connections to INDR's sites and social media accounts (Google Analytics and associated cookies, MailChimp, etc.), such as pages consulted, date and time of consultation, IP address, source sites used to access INDR's sites and online accounts, geographical area and computer hardware used.
  This information is mainly provided by the person concerned directly, in particular by contacting an INDR representative or employee, or via INDR's online sites and accounts. By way of exception, the surname, first name, institution or company, position, postal address, e-mail address and telephone number may also be obtained by consulting publicly available information, such as telephone directories, websites, press releases or information.

For what purposes are personal data processed and what is the legal basis for the processing?

Data is processed as part of the overall management of INDR's activities, i.e.

• for the user-friendliness and optimization of online sites and accounts
• to send out newsletters
• for administrative purposes
• for statistical purposes.

Where the INDR has not entered into a contract with the data subject, or where processing is not based on the data subject's consent or on a legal obligation, the INDR processes personal data on the basis of a legitimate interest, in accordance with its mission (see "Who are we?" section), unless the interests or fundamental rights and freedoms of the data subject prevail.

To whom are personal data transferred? How long is it kept?

Personal data is for internal, non-commercial use only. They may be shared only for IT purposes with service providers in Europe and third countries subject to presenting sufficient guarantees with regard to the RGPD, for the performance of the contract between the INDR and its members as part of its mission (see "Who are we?" section) or for any other legitimate legal reason.

The INDR draws attention to the fact that information on connections to INDR sites and online accounts as well as the IP address may be collected and processed by Internet operators, such as Google to evaluate site usage and provide other services related to Internet usage. It is up to the person concerned to manage or deactivate cookies using the options of the browser they are using.

Personal data may be stored, copied to backup servers or systems or archived by INDR for as long as necessary for the above-mentioned activities or for legitimate legal reasons, respectively for as long as the data subject does not request to be removed from the newsletter mailing list.

What are your rights?

INDR takes all reasonably possible technical and organizational measures to ensure the protection of personal data against loss, misuse, unauthorized access, disclosure, alteration or destruction.

Under the conditions set out in the RGPD, you can access and obtain a copy of your data (Article 15), obtain rectification of inaccurate or incomplete data (Article 16), object to the processing of your data (Article 21), obtain erasure of your data (Article 17), and benefit from a right to portability (Article 20) and limitation of processing (Article 18).

If consent is the legal basis for the processing of personal data, you may withdraw your consent at any time by contacting INDR without affecting the lawfulness of the processing based on consent carried out prior to the withdrawal of consent.

INDR processes personal data for business purposes. Should INDR become aware of data concerning a child, it undertakes to remove such data from its systems as soon as possible.

Please find below the contact details to ask questions, assert your rights or lodge a complaint:

National Institute for Sustainable Development and Corporate Social Responsibility (Data Protection)

7, rue Alcide de Gasperi, B.P. 3024 L-1030 Luxembourg-Kirchberg
Phone: +352 27 330 1
Email: info@indr.lu
Website: www.indr.lu

If you believe that INDR's processing of your personal data constitutes a breach of the GDPR, you may also lodge a complaint with the CNPD (www.cnpd.lu).

Disclaimer

INDR makes every effort to ensure that the information and data available on its websites and online accounts are correct and up-to-date. This information and data has been collected and compiled from sources which, to the best of INDR's knowledge, are reliable. However, INDR cannot be held responsible for any errors, omissions, alterations or delays in updating this information and data. Users of INDR websites and online accounts are therefore requested not to base their decisions on such information and data without verifying its accuracy. They acknowledge that they use such information and data at their own risk.

INDR websites and online accounts provide links to third-party websites for information purposes only. INDR accepts no responsibility for the management or content of these sites, or for the data protection practices employed. Users of INDR websites and online accounts acknowledge that they access such third-party sites at their own risk.

Modification of the notice
INDR reserves the right to modify the present notice at any time and without prior notice. It is the responsibility of the person concerned to ensure that they have the most recent notice in force.

RGPD - Notice October 2020.