The Max Planck Institute Foundation Luxemburg for Procedural Law (hereafter also referred as Institute or as Max Planck Institute Luxembourg) takes the protection of personal data very seriously. The Max Planck Institute Foundation Luxemburg for Procedural Law (hereafter also referred as Institute or as Max Planck Institute Luxembourg) processes personal data collected when filling in a form on our website, when contacting an employee via e-mail or when visiting the premises in compliance with the European Union General Data Protection Regulation or GDPR (Regulation (EU) 2016/679) and the Luxembourgish data protection legislation (Law of 01 August 2018). The Institute shall never publish personal data nor transfer them to third parties without informing the individual concerned and requesting consent if necessary. The following Policy will explain which processing are in place, which data may be collected and how they are utilized. It will also recapitulate your rights, how to exercise them and who to contact to do so.

As a matter of principle, the Institute only collects and uses personal data of employees, applicants, website users and visitors to the extent necessary to ensure the operation of its website and services and to fulfil the Institute's mission. The collection and use of personal data may only take place after individuals have given their consent or where the processing of the data is legally permitted subject to the provision of appropriate information. Each processing limits the collection of personal data to what is strictly necessary (data minimization) and is accompanied by information on the:

• data controller and the purposes for which the data are collected
• basis for the processing of the data
• compulsory or optional nature of the data collection for the management of the request and a reminder of the categories of data processed;
• source of the data (source other than the individuals themselves);
• categories of data subjects;
• recipients of the data (only the Max Planck Institute Luxembourg in principle, unless specified when transmission to a third party is necessary);
• data retention period;
• security measures (general description);
• possible existence of data transfers outside the European Union or of automated decision-making;
• the data processing rights and freedoms of individuals and how to exercise them with the Max Planck Institute Luxembourg

Persons whose personal data are collected in the context of the various processing operations mentioned below may exercise the following rights, insofar as no legal exceptions apply on a case-by-case basis:

• Information (Article 15 GDPR)
• Correction (Article 16 GDPR)
• Deletion (Article 17 (1) GDPR)
• Restriction of processing (Article 18 GDPR)
• Data transmission (Article 20 GDPR)
• Revocation of processing (Article 21 GDPR)
• Revocation of consent (Article 7 (3) GDPR)
• Right to complain to the Supervisory Authority (Article 77 GDPR).

To receive further information or to exercise their data protection rights and freedoms with regard to the processing of personal data managed by the Max Planck Institute Luxembourg, individuals and users may contact the Institute’s Data Protection Officer (DPO). The MPI has appointed an external DPO. LuxGap S.à r.l. has been mandated in this function.
Its headquarters are located in Luxembourg, 6a route d’Arlon L-8399 Windhof. The DPO may be contacted:

• by e-mail: dpo@mpi.lu
• or by post mail to the following address:

Max Planck Institute Foundation Luxemburg
Attn: Data Protection Officer
4, rue Alphonse Weicker
L-2721 Luxembourg

Users wishing to exercise any of their rights must attach a copy / scan of one of their identity documents such as an identity card or driving licence.

The processing of personal data for which the data subject has given his/her consent is based on Art. 6 (1) (a) GDPR.

The processing of personal data for the performance of a contract where the contracting party is the data subject is based on Art. 6 (1) (b) GDPR. This also applies to processing necessary for the implementation of pre-contractual measures.

The data processing necessary to safeguard the justified interest of the Max Planck Institute Luxembourg, provided that the interests, fundamental rights and basic freedoms of the data subject do not override the aforementioned interest, is based on Article 6.1.f GDPR.

The data subject's personal data is deleted or rendered permanently anonymous as soon as the purpose of storage ceases to exist. The storage period may also be determined by the European or Luxembourg laws and regulations to which the Institute is subject. The deletion of data then takes place at the end of the storage period prescribed by one of the above-mentioned standards, unless the subsequent storage of data is necessary for the conclusion or performance of a contract.

The responsible entity within the meaning of the GDPR and Luxembourg data protection legislation is the

Max Planck Institute Luxemburg
4, rue Alphonse Weicker
L-2721 Luxembourg
Tel.: +352 269488
Email: dpo@mpi.lu
Internet:www.mpi.lu

The Institute, through its website and social media, offers users the possibility of registering for various events, which involves entering personal data in a form. It usually, but not exclusively, collects the email address, the referring organisation or university, the surname and the first name. Each registration form informs individuals of the specific processing of data and the Institute requests their consent where necessary as part of the registration process. The legal basis for data processing is the user's consent in accordance with Article 6.1.a GDPR.

If the registration serves the performance of a contract to which the user is a party or the implementation of pre-contractual measures, the additional legal basis for the processing is art. 6 (1) (b) GDPR.

Data are deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. This is the case for data collected during the registration process if registration is cancelled or modified on our website. This is also the case for data collected for the purpose of fulfilling a contract or implementing pre-contractual measures, if such data is no longer necessary for the performance of the contract. It may be necessary to continue to store the personal data of the contractual partner after the end of the contract in order to fulfil contractual or legal obligations.

A user can cancel the registration at any time and can have their collected personal data modified or erased at any time. If the data are required for the performance of a contract or for the implementation of pre-contractual measures, early deletion of the data is only possible insofar as there are no contractual or legal obligations preventing such deletion.

Data subjects may contact the Max Planck Institute Luxembourg in order to obtain information about bibliographic references, give their opinion on the library's services, recommend and request interlibrary loans for books and journals.

The processing of personal data collected through the contact form is necessary to perform a task in the legitimate interest of the institute, as the expansion of the library collection is an essential pillar of the Institute’s research mission.

Those forms generally, but not exclusively, collect the capacity (internal or external), the email address, family name and first name of the users. Each form informs the individuals of the specific data processing.

The data are erased as soon as they are no longer necessary for the purpose for which they were collected. At that time, the Institute will keep the collected data for a period of 10 years. A user may at any time request the modification or deletion of the personal data collected.

Requests submitted to the Institute’s Library via the contact forms are sent to library@mpi.lu, acquisition@mpi.lu (soon to be replaced by library.acquisition@mpi.lu) and ill@mpi.lu, which are managed by the relevant staff member of the library. Requests are not forwarded to any other department or unit within the Institute other than the Management Board.

The website of the Max Planck Institute Luxembourg uses Google Inc. (Alphabet Group) for various settings. First, the data protection forms for withdrawing consent and for exercising data protection rights are supported by Google Form. They usually, but not exclusively, collect users’ email address, family name and first name. The collected data are transmitted to and stored by Google on servers located in the European Union and are not transferred outside of the European Union. The personal data that users share with the Institute will be kept for a period of one year, after which they will be anonymized or erased.

Secondly, the Institute’s website uses Google Analytics, which is a web analysis service. The information collected by this service about your use of the website is transmitted to and stored by Google on servers within the European Union. Google will use this information for the purpose of evaluating the use of the website, compiling reports on website activity for the Institute and providing other services relating website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on behalf of Google, including the operator of the Institute’s website. Google will not associate your IP address with any other data held by Google.

Any data subject may lodge a complaint with the Commission National de la Protection des Données if he/she considers that the processing of personal data concerning him/her infringes the GDPR, in particular, if the data subject resides and/or works in the Grand-Duchy of Luxembourg, or if the infringement is alleged to have taken place in the Grand-Duchy of Luxembourg.