Privacy Notice
1. Preface
This is the privacy policy for the REM sleep behaviour disorder (RBD) study that is hosted by the University of Luxembourg’s Luxembourg Centre for Systems Biomedicine (UL-LCSB), the data controller hereinafter referred to as “we”, “us”, “our”.
This policy concerns the following websites and services accessible through those sites:
| Study Informative Website | https://www.rbd.lu
| Sleep Survey | https://survey.rbd.lu
In this policy we outline what personal data (“Data”) we collect when data subjects (“you”, “your”) visit our sites and use our services; for what purposes this data is collected; where and how long it is kept; and your rights regarding data as per EU General Data Protection Regulation (“GDPR”). We also list relevant contact persons regarding requests and inquiries on Data and data protection.
2. Who is the data controller?
The data controller is the University of Luxembourg.
University of Luxembourg,
2, avenue de l’Université,
L-4365 Esch-sur-Alzette.
University of Luxembourg’s Data Protection Officer’s contact information is given below. This contact should be used to exercise your rights regarding personal data and also for general inquiries on data protection.
Dr. Sandrine Munoz,
dpo (AT) uni (dot) lu
University of Luxembourg,
Data Protection Office, Central Administration,
Maison du Savoir,
2 avenue de l’Université
L-4365 Esch-sur-Alzette.
3 Study Informative Website
3.1 Site visitor information and site analytics
Data and its purpose of use
When you visit any of the RBD websites listed in the preface, we collect the following information:
- your IP address,
- your device type, name and id,
- your browser version,
- your operating system and language settings,
- date and time of web resource access request,
- content of access request,
- status and size of response to a request.
Site visitor information listed above is automatically collected by server-side software that delivers pages to site visitors. We use this data to analyse site access, which in turn allows us to further optimize and secure our site.
The data is used for statistical purposes only.
In addition, only if you agree to the use of site analytics, we will collect the following information during your visit of our site: - visitor id, which is a unique string calculated based on your IP address (two bytes masked), operating system, browser, browser plugins, and browser language,
- the URLs, and titles of pages you visit on our site as well as custom events on our pages (such as links clicked),
referrer page, which is the web page such as a search engine or newsletter link, that leads your visit to our site.
Site analytics information allows us to optimise our site content and its delivery. We use this information to determine whether you have visited our website before, what you have previously viewed or clicked on, how user-friendly our forms are and how you found us. The information cannot allow to identify you directly and only used for statistical purposes, and it helps us to analyse patterns of user activity and to develop a better user experience. We also use this information to prepare aggregated, anonymous statistical reports of visitor activity needed for performance evaluation.
Legal basis
The site visitor information is necessary for us in order to deliver the website to you as well as to guarantee the website’s stability and security. It is in our legitimate interest (GDPR Article 6(1)(f)) to collect and use site visitor information.
The site analytics information is helpful for us in order to deliver the website to you. The use of site analytics information is based on your consent (art 6.1.(a) of the General Data Protection Regulation 2016/679). You can deny or remove your consent to the use of site analytics in the settings of your web browser at any time. Alternatively, you can also manage your consent for the site analytics used on our website thanks to the cookies banner.
Storage location and duration
We store site visitor and site analytics data on servers located in Luxembourg for a period of 6 months. Visitor logs are deleted after this period, aggregated statistics on site visits are stored for an indefinite period.
Transfers outside European Union and European Economic Area
We do not transfer site visitor or site analytics information to any other country outside European Union & European Economic Area.
3.2 Site cookies
Data and its purpose of use
We use cookies on the RBD websites. Cookies are bits of information that are created and maintained by your web browser when you visit a website. Cookies are categorized as first-party and third-party. First-party cookies are placed by the website you visit and will not track your activity once you leave that website. Third-party cookies are often set by another site not the one you’re visiting, e.g. advertisements, social media widgets, and they may continue to track your activity across sites. RBD sites use first party cookies only.
Our sites use the cookies listed below:
- Technically necessary cookies:
- Cookie preference
When you visit our sites for the first time you will be notified of our cookie policy. You will have the option to proceed only with technically necessary cookies (i.e. optimisation, security and authentication) or (additionally) allow site analytics cookies. We will keep your preference in a cookie named “plg_system_eprivacy”. Your cookie preferences will be displayed on the top of the pages, and you will have the option to change your cookie settings at any time. - Optimization and security cookies
Our sites are fronted by load balancers and firewalls managed by the University of Luxembourg. As a result, additional cookies named “LBServer” and “TS*” will be placed in your browser.
- Survey cookies
If you participate in the sleep survey then our survey system places the cookies “p1000pid” and “survey”. These are required to remember the survey form of your chosen language and your survey session information.
- Analytics cookies (Optional)
If you allow the use of site analytics, our site will place the following first-party analytics cookies: “_pk_id” ,”_pk_ses”, “_pk_cvar”, “_pk_hsr” and “_pk_ref”.
- “_pk_id*” holds your unique visitor ID.
- “_pk_ref” holds the referrer page information, where applicable.
- “_pk_ses*”, “_pk_cvar” and “_pk_hsr” are short-lived cookies used to temporarily store data for a particular visit of yours to our site.
All cookies used by the RBD website are first-party. There is no personal information stored in technically necessary cookies. There is a unique visitor ID stored in analytics cookies.
Storage location and duration
Normally cookies are stored on your computer until the end of their expiry period summarized below. You may also choose to clear your browser cookies manually.
| Cookie function | Cookie name| Expiry period |
|--------------------|--------------------|--------------------|
| Cookie preference | plg_system_eprivacy| 12 months|
| Optimisation & Security | LBServer | End of browsing session |
| Optimisation & Security | TS* | End of browsing session |
| Survey | p1000pid | 1 hour |
| Survey | survey | End of browsing session |
| Analytics (optional) | _pk_id* | 1 year |
| Analytics (optional) | _pk_ref | 6 months |
| Analytics (optional) | _pk_ses*, _pk_cvar, _pk_hsr| End of browsing session |
Legal basis
We collect and use technically necessary cookies in our legitimate interest (GDPR Article 6(1)(f)) as it is necessary for us to deliver our sites to you in a stable and secure manner.
We collect analytics cookies with your consent (GDPR Article 6(1)(a)) and use those analytics cookies in our legitimate interest (GDPR Article 6(1)(f)) as this information allows us to improve our site for visitors.
Transfers outside European Union & European Economic Area
We do not transfer site visitor or site analytics information to any other country outside European Union & European Economic Area.
Essential cookies i.e. the Cookie preference, Optimisation & Security and Survey categories listed above are required for our websites to function. These cookies are stored on your computer, and information in them is transferred to servers in Luxembourg, when cookie information is used by our site servers.
Optional (analytics) cookies are placed only when you consent to their use. These cookies are stored on your computer, and information in them is transferred to servers in Luxembourg, when cookie information is used by our site analytics servers.
4 Sleep Survey
We collect standard personal data and health data when you participate in the RBD Sleep Survey. At the beginning of the survey the details of the data collected, the purpose and legal basis of its use, storage and transfer will be described to you with the RBD Study Electronic Subject Information Sheet.
5 How do we protect your data?
We have put in place a number of organisational and technical measures for the protection of your personal data in compliance with the EU GDPR. These measures include but are not limited to pseudonymisation, access control, encrypted data transmission, institutional policies, staff code of conduct and training on data protection.
Only authorized personnel at the UL-LCSB can access the data. Examples of such personnel include system administrators and the LCSB and the University of Luxembourg.
6 What are your rights regarding the data we collect?
As per GDPR, you as a “data subject” have rights on your personal data.
You have the right to be informed that the UL-LCSB is processing your personal information.
You have the right to access your personal information and in case it is inaccurate or incomplete you have the right to have it rectified without undue delay.
You have the right to ask that we delete your personal data or restrict its use. Where applicable, you have the right to object to our processing of your personal data, and the right to data portability. Your requests for deletion and processing restriction will be assessed by us and we will notify you of the result of this assessment within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and the number of applications (in accordance with article 12.3 GDPR).
You can request that we notify any other parties, to whom your data has been sent, of any changes made to your personal data
You have the right to lodge a complaint with the Luxembourgish data protection supervisory authority, CNPD, in case you consider that our processing of your personal data infringes the GDPR.
In order to exercise any of the above rights, you shall contact the University of Luxembourg’s Data Protection Officer in writing. The procedure for this is described in detail here.
Last updated: 1 February 2021