Privacy policy

Privacy policy of the Ministry of Research and Higher Education 

(hereinafter the “Policy”)

1. Introduction

Protecting your privacy is a key priority for the Ministry of Research and Higher Education, including its various departments (such as the Financial Aid Department), whose main offices are located at 18–20, Montée de la Pétrusse, L-2327 Luxembourg (hereinafter “MESR”).

This Policy governs the processing of your personal data by MESR, including its collection, use, storage, disclosure and protection. Personal data means any information relating to an identified or identifiable natural person (hereinafter “Personal Data”).

Please note that this Policy is not exhaustive. The nature of MESR’s activities and the contexts in which it processes your Personal Data make it difficult to provide a comprehensive description of all processing activities carried out by MESR or on its behalf.

2. Data controller and Data Protection Officer

MESR is the controller responsible for processing your Personal Data.

We have appointed a Data Protection Officer to inform and advise MESR on how to protect your privacy. You can contact our Data Protection Officer at:

Email: dataprotection@mesr.etat.lu

3. Collection and use of Personal Data

3.1. Personal Data collected

Depending on the services provided and the information supplied by individuals, MESR collects and processes, in particular, the following categories of Personal Data:

• identification data (surname, first name, postal address, telephone number, mobile number, fax number, title, identification number in the National Register of Natural Persons, identity card, passport, etc.);
• personal details (date and place of birth, age, marital status, sex, nationality, household circumstances, physical characteristics, behavioural data, lifestyle and consumption habits, type of accommodation, leisure activities, etc.);
• information relating to your residence status (residence permits, work permits, immigration, information on your housing situation in the country of study, etc.);
• images;
• economic and financial information (income, financial circumstances, tax situation, bank account, etc.);
• data on your professional and educational background, including, in particular, training and professional experience (CV, cover letters, letters of recommendation, employment certificates, academic and professional qualifications, etc.);
• authentication information and electronic identification data (email address, social media account, internal identifier, electronic certificate, logs, IP address, security data such as passwords, etc.);
• health data, for the application of Articles 22 to 24 of the Law of 6 July 2026 on State financial aid for higher education, in accordance with Article 32 of that Law.

3.2. Sources of Personal Data

In addition to the Personal Data collected directly from you, MESR may also collect Personal Data from other sources, including:

• higher education and research institutions;
• the State Treasury of the Grand Duchy of Luxembourg;
• the Government IT Centre (hereinafter “CTIE”), in particular the department responsible for the National Register of Natural Persons (RNPP);
• other ministries of the Grand Duchy of Luxembourg and foreign ministries;
• public authorities or bodies, such as the Joint Social Security Centre;
• financial institutions;
• foreign authorities responsible for academic and professional recognition, including, in particular, the ENIC-NARIC Networks or the Innovative Medicines Initiative (IMI).

3.3. Legal bases for MESR’s collection and processing of your Personal Data

The processing of your Personal Data is lawful where it:

• is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract;
  • is necessary to comply with a legal obligation to which MESR is subject, in particular under:
  • the Law of 28 October 2016 on the recognition of professional qualifications, as amended;
  • the Law of 21 May 1999 on the position of candidate in post-primary teaching careers, as amended;
  • the Law of 21 July 2023 on the organisation of higher education, as amended;
  • the Law of 6 July 2026 on State financial aid for higher education;
  • the provisions of the Law of 24 July 2014 on State financial aid for higher education, as amended, which remain applicable under the transitional provisions;
  • the Law of 27 June 2018 on the organisation of the University of Luxembourg, as amended;
  • the Law of 3 December 2014 on the organisation of public research centres, as amended;
  • the Law of 6 July 2026 on the organisation of the National Research Fund in the public sector;
  • the Grand-Ducal Regulation of 21 July 2023: (1) setting tuition fees for programmes leading to the higher technician’s certificate (brevet de technicien supérieur); (2) setting the allowances payable to external service providers involved in organising and delivering those programmes; and (3) repealing the Grand-Ducal Regulation of 23 February 2010 on the organisation of studies and the progression of students in programmes leading to the higher technician’s certificate, as amended;
  • the Grand-Ducal Regulation of 24 July 2000 on the candidature thesis (travail de candidature), as amended;
  • the Grand-Ducal Regulation of 6 July 2026 on State financial aid for higher education;
  • the Government’s Rules of Procedure, approved by the Grand-Ducal Order of 27 November 2023 approving and publishing the Government’s Rules of Procedure, as amended, in particular Annex B on the organisation of the ministries;
• is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in MESR (for example, granting State-guaranteed loans or organising the Student Fair);
• is necessary for reasons of substantial public interest;
• is necessary for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes; or
• 6. is based, where applicable, on your consent to the processing of your Personal Data.

3.4. Conditions applicable to your consent

You have the right to withdraw your consent to the processing of your Personal Data at any time. Withdrawal does not affect the lawfulness of processing based on your consent before it was withdrawn.

If you are under 16, MESR may, in accordance with applicable data protection law, process your Personal Data on the basis of your consent only if a holder of parental responsibility for you has also consented to or authorised the processing.

In such cases, MESR will make reasonable efforts to verify that a holder of parental responsibility has also consented to or authorised the processing of your Personal Data.

3.5. Consequences of refusing to provide your Personal Data

If you do not provide all the Personal Data requested, we are unlikely to be able to provide you with all the services offered by MESR or grant you benefits such as financial aid for higher education.

3.6. How we use your Personal Data

MESR processes your Personal Data for various purposes, including:

• administering candidates’ files and examination boards (for example, in relation to the candidature thesis);
• administering the records of students enrolled in a programme at a Luxembourg or foreign institution (for example, the centralised management of students enrolled in programmes leading to a higher technician’s certificate);
• administering, granting and monitoring financial aid for higher education (grants and loans);
• establishing and updating the register of higher education qualifications, managing the recognition of professional qualifications and the homologation of law degrees (in particular, examining applications and issuing ministerial orders);
• receiving students’ requests for information, forwarding them to the relevant university residences and the body responsible for managing student accommodation, and monitoring the proper implementation of agreements;
• administering and monitoring increases in financial aid, the granting of additional time to repay loans and partial or full waivers of repayment, and checking banks’ claims under the State guarantee (for example, monitoring, administering and preparing the work of the advisory committee);
• compiling statistics;
• managing applications, selecting award recipients, paying privately funded scholarships and monitoring them;
• inviting exhibitors, registering their requests and forwarding data to the relevant stakeholders or participants (for example, when organising the Student Fair and other exhibitions or events);
• managing the finances of certain MESR activities, administering payments and preparing reports;
• managing IT resources and access, allocating and administering access rights to IT resources, liaising with CTIE and drawing up an inventory of the IT equipment provided;
• managing support requests, including IT support, carrying out investigations using logs to resolve errors or incidents, monitoring application development and maintenance with external support, and extracting data from applications;
• more generally, under applicable law, responding to requests from other public and government authorities; protecting MESR and its operations or those of its partners; protecting the rights of MESR, its partners, you or others; and preparing and pursuing the legal remedies available;
• testing, assessing or otherwise evaluating the effectiveness of our technical and organisational measures to ensure the security of the processing of your Personal Data, or implementing such measures;
• preventing data breaches or the circumvention of our security measures, or mitigating their possible adverse effects;
• carrying out any other processing that is consistent with and useful for achieving MESR’s objectives or fulfilling its assigned tasks.

3.7. Use of cookies and similar technologies

MESR may use cookies. Cookies are text files stored on your device by a website you visit. They are widely used to make websites work, improve their efficiency and provide additional information to website owners.

Cookies are generally stored on your device’s hard drive. We use the information collected through cookies to analyse trends, administer our services and assess their effectiveness. This information helps us identify the most visited parts of our website and any difficulties visitors may encounter when accessing or using it.

These insights enable us to provide a more personalised experience when you use MESR’s services. They also help us improve your experience by identifying and expanding the most valued features and information, and by resolving access problems.

We may also use cookies or other technologies, particularly those known as web bugs or clear GIFs, which are generally embedded in emails, to help us confirm that you have received our emails and responded to them.

We may use third-party service providers, in particular to help us deliver our services or better understand how our website is used. These providers may place cookies on your device’s hard drive. The information collected through these cookies informs us and our providers about matters such as how visitors navigate our website.

Our third-party service providers may analyse this data, including any Personal Data, and provide us with reports to help us better understand your interests in MESR and better serve those interests. The data, including any Personal Data, collected by these providers may be linked and combined with other data concerning you, including Personal Data, processed by MESR.

4. Keeping your Personal Data up to date

MESR takes care to ensure that the Personal Data collected is accurate and up to date. However, you are responsible for keeping your Personal Data up to date and informing MESR of any changes.

5. Your data protection rights

5.1. General information

To exercise the data protection rights described in this section, you can contact MESR by email at dataprotection@mesr.etat.lu. Please clearly specify which Personal Data you wish to access, rectify or erase, or which processing of your Personal Data you wish to restrict.

5.2. Rights of access, rectification, restriction of processing, erasure and data portability

Within the limits of applicable data protection law, you may exercise your right of access to the Personal Data processed by MESR and request that your Personal Data be rectified or erased, or that its processing be restricted.

Within the limits of applicable data protection law, you have the right to (i) receive the Personal Data you have provided to MESR in a structured, commonly used and machine-readable format and (ii) transmit that Personal Data to another controller. Where technically feasible, MESR will, at your request, transmit your Personal Data directly to another controller of your choice.

5.3. Right to object

Under applicable data protection law, you have the right to object at any time, on grounds relating to your particular situation, to MESR’s processing of your Personal Data, unless:

• there are compelling legitimate grounds for the processing which override your interests, rights and freedoms; or
• the processing is necessary for the establishment, exercise or defence of legal claims.

Where Personal Data is processed for statistical purposes, you have the right to object to the processing on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out in the public interest.

5.4. Automated individual decision-making

As a general rule, MESR does not use automated individual decision-making.

If MESR were to decide to use automated individual decision-making, it would, taking account of the risks this could pose to your rights and freedoms, ensure that appropriate measures were in place to protect your legitimate interests. In particular, you would be able to express your point of view in writing by emailing dataprotection@mesr.etat.lu.

6. Disclosure of Personal Data

MESR may disclose your Personal Data, in particular, to the following categories of recipients:

• ministries of the Grand Duchy of Luxembourg and foreign ministries;
• other public bodies or authorities, including, in particular, the Direct Tax Administration, the Joint Social Security Centre, the State Treasury of the Grand Duchy of Luxembourg, the Registration and Estates Administration and the National Solidarity Fund;
• service providers;
• national and foreign law enforcement bodies, supervisory authorities, regulatory agencies or other government representatives;
• research and statistical bodies, such as the National Institute of Statistics and Economic Studies of the Grand Duchy of Luxembourg (STATEC);
• foreign authorities responsible for academic and professional recognition, including, in particular, the ENIC-NARIC Networks or the Internal Market Information System (IMI).

7. International transfers of your Personal Data

In principle, your Personal Data is processed in the Grand Duchy of Luxembourg.

However, MESR may transfer your Personal Data outside the European Economic Area or to international organisations (“third countries”) in accordance with applicable data protection law. Depending on the circumstances, MESR may therefore transfer your Personal Data to third countries where one of the following conditions is met:

• an adequate level of protection is ensured: the European Commission has adopted an adequacy decision confirming that the third country concerned provides a level of protection essentially equivalent to that guaranteed in the European Union;
• appropriate safeguards are in place: for example, a legally binding and enforceable instrument has been adopted between public authorities or bodies, or provisions ensuring enforceable and effective rights for data subjects have been included in administrative arrangements between the public authorities or bodies concerned;
• the transfer or series of transfers of your Personal Data to the third country concerned is lawful because at least one of the conditions set out in Article 49 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) is met, in particular where:
  • the transfer is necessary for important reasons of public interest; or
  • the transfer is necessary for the establishment, exercise or defence of legal claims.

Where a transfer or series of transfers of Personal Data to a third country or an international organisation takes place under Article 49 of the GDPR, the absence of an adequacy decision or appropriate safeguards entails a risk. Your Personal Data may be subject to laws and regulations that do not ensure an adequate level of protection for your rights and freedoms of the kind normally provided in the European Union. Such a transfer may therefore adversely affect the protection of your privacy.

8. External websites

MESR websites, including, in particular, those relating to the Student Fair and the Financial Aid Department (mengstudien.public.lu), may contain references or links to other websites or online services, or facilitate access to them (hereinafter “External Websites”).

We do not control these External Websites or their content and cannot under any circumstances be held liable for External Websites to which MESR refers or provides a link, whether directly or indirectly.

In particular, MESR cannot under any circumstances be held liable for the content of External Websites, any information displayed on them, their policies, data protection standards, promotions, products, practices, services or actions, or any other damage, loss, failure or problem caused by or related to External Websites.

The inclusion of a link or reference on MESR’s website does not imply that MESR endorses an External Website. These External Websites have separate and independent data protection policies. We therefore encourage you to read the policies, rules, terms, data protection practices and regulations of each website you visit.

We seek to protect the integrity of our website and welcome any comments on the External Websites to which it refers.

9. Retention of your Personal Data

Without prejudice to the right to process your Personal Data further for purposes that are not incompatible with the original purpose, and subject to MESR’s legal and regulatory obligations, MESR retains your Personal Data in a form that allows identification for no longer than is necessary for the purposes pursued.

When retaining your Personal Data is no longer necessary, including to comply with documentation and archiving obligations, we will erase it securely.

10. Questions or complaints

If you have any questions or concerns about this Policy, or would like further information about MESR’s processing of your Personal Data, you can contact MESR (see section 2).

If you are not satisfied with our response or action, you may contact and lodge a complaint with the National Commission for Data Protection (Commission nationale pour la protection des données), Luxembourg’s supervisory authority, whose offices are located at 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg.

11. Availability and changes to this Policy

This Policy is and will remain available to you on MESR’s website.

MESR reserves the right, at any time and at its sole discretion, to revise, change, amend, update, supplement, add or remove parts of this Policy. If such changes are made, MESR will make the amended Policy available on its website. It is your responsibility to review the amended Policy.