Privacy Notice – Cyberfraud.lu

Last updated: 08.10.2026

This Privacy Notice outlines how the Luxembourg House of Cybersecurity (hereafter “LHC” or “we”) processes and protects personal data in connection with the www.cyberfraud.lu website, in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) and the applicable Luxembourg data protection laws.

We may update this Privacy Notice from time to time in order to ensure that its content accurately reflects regulatory developments. Any such modification, if substantial, will be clearly communicated to you, either via the website or via other appropriate means. The latest applicable version will be available on our website.

Should you have any questions or remarks regarding this Privacy Notice, do not hesitate to contact us at privacy@lhc.lu

Processing of personal data

For the purposes of this Privacy Notice, “personal data” means any information relating to an identified or identifiable natural person.

“Processing” means any operation performed on personal data, such as collecting, recording, organising, storing, consulting, using, disclosing, restricting, erasing or destroying personal data.

“Data controller” means the person or organisation that determines the purposes and means of the processing of personal data.

Who is the Data Controller?

The data controller for the processing activities described in this Privacy Notice is:

Luxembourg House of Cybersecurity g.i.e.
122, Rue Adolphe Fischer
L-1521 Luxembourg
Luxembourg Trade Register Number: C90

As data controller, LHC determines the purposes and means of the processing of your personal data. For any questions relating to the processing of your personal data or to the exercise of your data protection rights, you can contact us at privacy@lhc.lu

Who are the data subjects?

The data subjects covered by this policy include all individuals whose personal data may be collected or processed through the website, including:

Website visitors: Individuals who access or browse the website, regardless of whether they actively provide personal information.

What personal data do we process and for what purposes?

Categories of personal data

When you are surfing the Website, we collect and process web server logs, including IP addresses, user-agents, URLs, date and time logs. We collect those logs for our legitimate interest as these logs enable the technical and functional management of our website. Furthermore, we analyse the data to ensure the optimal security of the Website.

When you contact us by email, we process your contact information and any other personal data you voluntarily provide in your communication. This information is processed solely for the purposes of handling your enquiry, responding to your request, and facilitating any necessary follow-up communication. The personal data collected will not be used for purposes other than those directly related to your enquiry or request.

We confirm that we process your personal data in a fair and lawful manner and only for the explicit and legitimate purposes as above-mentioned. At all times, we strive to ensure that your personal data is adequate, relevant and not excessive in relation to the purposes for which they are processed.

If you access or use third-party websites linked to this Website, any personal data collected or processed through those websites will be subject to their respective privacy policies.

Legal basis of the processing activities

The processing of personal data through the Website is based on the legitimate interests of the organisation, pursuant to Article 6(1)(f) of the General Data Protection Regulation (GDPR). The Website uses Matomo Analytics to collect and analyse limited technical and usage-related information, including partially anonymised IP addresses, operating systems, browsers and plugins, device types, pages visited, searches performed, and referral sources.

Such processing is conducted exclusively for statistical and analytical purposes, with the aim of monitoring website traffic, assessing website performance, understanding visitor interactions, and improving the Website's functionality, content, and overall user experience. The legitimate interests pursued consist of ensuring the effective operation, maintenance, and continuous improvement of the Website, provided that these interests are not overridden by the rights and freedoms of the data subjects.

How long do we retain your personal data?

In no circumstances, we keep your personal data for a longer period than strictly necessary to fulfil the purpose for which it was collected.

As the retention period is dependent on the purpose for which the personal data were initially collected, the purpose is the criterion that is used to determine the appropriate retention period.

After the expiry of the retention period, we strive to securely erase, destroy or anonymize personal data that is no longer required in relation to the purpose for which they were collected.

LHC does not sell rent, trade, or otherwise disclose personal data to third parties for commercial, advertising, or marketing purposes.

Personal data collected through the Website is limited to technical and usage-related information gathered through Matomo Analytics, exclusively for statistical purposes, website performance monitoring, and the continuous improvement of the Website's functionality and user experience.

Security of your personal data

LHC implements appropriate technical and organisational measures to protect your personal data against unauthorised access, use, disclosure, alteration, loss or destruction.

These measures are designed to ensure a level of security appropriate to the nature of the personal data processed and the risks associated with the processing.

Your rights as a data subject

You have certain rights in relation to the personal data LHC processes about you. Subject to the conditions provided by applicable data protection law, these include:

Right of access: You have the right to obtain confirmation as to whether LHC processes your personal data and, where this is the case, to access your personal data and obtain a copy of it;
Right of rectification: You have the right to request the correction of inaccurate personal data and, where appropriate, the completion of incomplete personal data;
Right of erasure: You have the right to request the deletion of your personal data where the conditions set out in Article 17 GDPR are met;
Right of restriction of processing: You have the right to request the restriction of the processing of your personal data where the conditions set out in Article 18 GDPR are met;
Right of data portability: Where the conditions set out in Article 20 GDPR are met, you have the right to receive the personal data you have provided to LHC in a structured, commonly used and machine-readable format and, where technically feasible, to have those data transmitted directly to another controller;
Right to object: Where applicable, you have the right to object to the processing of your personal data in accordance with Article 21 GDPR;
Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (“CNPD”) if you consider that the processing of your personal data infringes applicable data protection law.

Exercising your rights

To exercise any of these rights, or if you have questions or concerns regarding the processing of your personal data, you may contact LHC at privacy@lhc.lu

Where necessary to verify your identity and protect your personal data against unauthorised access, LHC may request additional information before responding to your request.