The present information notice (the « Information Notice ») describes the conditions under which the non-profit organisation Capitale Européenne de la Culture 2022, registered with the Luxembourg Trade and Companies Register under number F10850, having its registered office at 163 rue de Luxembourg, L-4222 Esch-sur-Alzette (« we » or « Esch2022 »), collects and processes personal data pertaining to the candidates (the « Candidate ») having submitted their application to participate in the Future Frequencies workshop and project online, on the website located at the following URL: https://futurefrequencies.esch2022.lu/ (the « Website »).

What personal data does Esch2022 process ?

Personal data means any information relating to an identified or identifiable natural person (the « Personal Data »).

Personal Data collected and processed by Esch2022 are those provided by the Candidate himself/herself when submitting an application to the Future Frequencies workshop. In addition, notes or assessments made by members of the selection committee (or other stakeholders) of the Future Frequencies workshop and any information related to the selection or non-selection of a candidate are also collected and processed.

When a candidate is selected and participates in the workshops, data related to the participation in the workshops are also processed.

For what purposes are the personal data collected and processed by Esch2022 ?

Personal Data collected by Esch2022 will be processed by Esch2022 for the following purposes:

• management of the applications (receipt, processing and analysis of the applications, selection of Candidates) ;
• communication with the selected or rejected Candidates ;
• organization and conduct of the workshops and other related events ;
• compilation of statistics on the applications received ;
• processing of access, rectification and opposition requests, and other rights with respect to Personal Data ;
• claims and litigation management.

The processing of the Personal Data is necessary for the selection of candidates who can participate in the workshop and for the organization of the workshop, i.e. to process the Candidates’ application for participation. It is also necessary for the legitimate interest of Esch2022 to develop its missions and services and to provide the assistance required by its corporate purpose.

These purposes constitute the legal basis for the data processing carried out by Esch2022.

Who are the data recipients ?

Personal Data will be processed internally by duly authorized persons, within the limits of their respective attributions.

They may also be communicated to the following third-parties:

• competent administrative and judicial authorities, such as tax authorities, to enable Esch2022 to fulfill its legal obligations in this regards ;
• financial institutions holding financial accounts ;
• Esch2022 data processors (including IT service providers) and external services providers (such as legal advisers, insurers, accountants, etc.), to the strictest extent necessary ;
• external partners of Esch2022 for the organization of the Future Frequencies workshop and related events and more generally the organization and / or financing of the « European Capital of Culture 2022 » programme (such as in particular the Ministry of Culture) ;
• external experts members of the selection Committee.

The identity of the selected Candidates may be published by Esch2022 on the Website as well as on any other web, paper or social network support. The selected Candidate may also not object to its mention in Esch2022’s programme of activity, for any reason whatsoever.

How does Esch2022 ensure the security of Personal Data ?

Personal Data collected by Esch2022 will be processed by Esch2022 as a data controller, in compliance with the applicable data protection legislation (i.e. EU General Data Protection Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (known as “GDPR”) and Luxembourg law dated 1st August 2018 on the organisation of the National Data Protection Commission and the general data protection framework, as well as any successor texts).

Esch2022 undertakes to implement technical and organizational security measures to ensure the protection of Personal Data against the risks associated with the use of information systems.

Esch2022 follows generally accepted security standards to help protect the Candidates’
Personal Data. However, no method of transmission over the Internet, or of electronic
storage, is 100% secure. Therefore, Esch2022 cannot guarantee the absolute security of the Personal Data.

Personal Data of the selected Candidates will be kept for the duration of the workshops,
until their completion, then, as of the completion date of the workshops, the Personal Data will be archived on a separate computer medium and accessible only if necessary by a limited number of persons specifically authorized to do so. Upon the dissolution of Esch2022, Personal Data will be transferred to the National Archives of Luxemburg who will process them, as a data controller, for purposes of preservation and documentation of the national cultural heritage, according to its own policies.

Personal Data of the rejected will be kept for a period of one year, for purposes of documentation of our activity. After a period of 2 months from the date of communication to the Candidate that his application has been rejected, however, they will be archived and accessible only if necessary by persons specifically authorized for this purpose. Upon the dissolution of Esch2022, such data will be purely and simply destroyed.

What are the Candidates’ rights ?

In accordance with the applicable data protection legislation, and subject to the limits provided by the applicable rules, Candidates are entitled to obtain, free of charge :

• access to the Personal Data pertaining to them ;
• confirmation that their Personal Data is or is not being processed ;
• information concerning at least the purposes of the processing, the categories of data to which the processing relates and the recipients or categories of recipients to whom the data are communicated; and
• communication, in an intelligible form, of the data being processed.

Subject to the limits provided by the applicable rules, Candidates may also have inaccurate or incomplete personal data rectified, object to the collect and processing of such data, on grounds relating to their particular situation, request the erasure of all or part of the data or a restriction of the processing, and make use of their right to data portability. However, Esch2022 can only respond favourably to the request for erasure within certain limits, in particular those related to its legal obligations as a data controller.

These rights may be exercised in written, by email addressed to : dataprotection@esch2022.lu. Esch2022 reserves the right to request a scan / hard copy of your ID so that we can verify your identity before processing your request. Candidates can also rectify their Personal Data via their personal account.

For more information on how Personal Data are collected and processed by Esch2022 or on how to exercise any of the aforementioned rights, you can contact us at the above mentioned address.

In the event of a breach of the data protection rules, you may also lodge a complaint before a supervisory authority such as the National Commission for Data Protection (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux. In this context, the CNPD provides an online complaint form: https://cnpd.public.lu/en/particuliers/faire-valoir/formulaire-plainte.html.