Information note on personal data protection - Complaints
0 results for «»
Personal data protection
Introduction
CFL care about their customers.
Thus, the protection of your personal data naturally constitutes a priority for the CFL, or any entity of the CFL group who has to process your personal data for the purpose of its activities.
This note provides you with the necessary information and explains to you how we collect, use, share, store and protect your personal details. It also informs you on your rights and on how to exercise them.
CFL provides various services to its customers and is committed to providing a quality service. As part of this, CFL follows up any suggestions or complaints you may make.
It is for this purpose that your personal data may be processed by our departments.
Thus, the protection of your personal data naturally constitutes a priority for the CFL, or any entity of the CFL group who has to process your personal data for the purpose of its activities.
This note provides you with the necessary information and explains to you how we collect, use, share, store and protect your personal details. It also informs you on your rights and on how to exercise them.
CFL provides various services to its customers and is committed to providing a quality service. As part of this, CFL follows up any suggestions or complaints you may make.
It is for this purpose that your personal data may be processed by our departments.
1. Who is the controller?
The controller regarding your personal data processed is the Société Nationale des Chemins de Fer Luxembourgeois (the CFL), established and having its registered office in L‑1160 Luxembourg, 16, boulevard d’Avranches, and registered with the Trade and Companies Register of Luxembourg under number B59025.
As such, we are liable for the way we collect, use, share, store and protect your personal data.
As such, we are liable for the way we collect, use, share, store and protect your personal data.
2. What categories of personal data are processed and for what purpose?
To process your complaints, we collect and process the following data:
- identification data (surname, first name, gender, language);
- contact data (e-mail address, telephone number);
- connection data;
- data concerning the complaint (nature of the complaint, proof of any kind, bank details, any information that may be deliberately shared by the person concerned);
In any case, we make sure that the data are collected for the determined purposes and that they are processed in an adequate and relevant way, and only to the extent necessary as regards the intended purpose.
The purposes are as follows:
The purposes are as follows:
- Follow-up and management of complaints (responding to your complaint, contacting you for clarification or advice).
- Follow-up and management of suggestions
3. How do we collect, process, and use your data?
We collect and use the personal data you provide us when using our services.
For each purpose described above, the collection and processing are:
For each purpose described above, the collection and processing are:
- carried out in accordance with the applicable regulations on the protection of personal data
- legally based on the fact that the processing of your personal data is necessary to achieve a purpose recognized as legitimate.
4. Who can access your data?
We make sure to take any appropriate technical and organisational measures to ensure the security of your personal data, in particular their confidentiality, integrity, and availability.
The data will be shared with some of our internal departments in strict compliance with the missions these departments have been entrusted with:
The data will be shared with some of our internal departments in strict compliance with the missions these departments have been entrusted with:
- Passenger Activities Department (Direction Activités Voyageurs),
- Legal and Insurance division (Division Juridique et Assurances),
- Quality department (Service Qualité).
Some IT providers may have access to specific personal data in the framework of maintenance tasks carried out upon the request of the competent services of the CFL.
We contractually impose on our service providers to safeguard the security and the confidentiality of your personal data by means of appropriate technical and organizational measures such as standard contractual clauses, in accordance with European regulations and ensure that these guarantees are respected.
We contractually impose on our service providers to safeguard the security and the confidentiality of your personal data by means of appropriate technical and organizational measures such as standard contractual clauses, in accordance with European regulations and ensure that these guarantees are respected.
5. How long do we keep your data?
We keep your personal data for as long as it is needed to follow up your complaint or suggestion.
The retention period is 10 years for complaints relating to a commercial act.
The retention period is 10 years for complaints relating to a commercial act.
6. What are your rights regarding your personal data?
Under the conditions foreseen by regulation, you can:
- access to the personal data we hold on you,
- have the data rectified if they are inaccurate or incomplete,
- have the data erased, in some cases, such as, for example, each time your data are not necessary for the intended purpose, and we do not have the contractual or legal obligation to keep them,
- ask for the restriction of the processing of your personal data, such as the restriction of the processing of an item whose accuracy you deny and for the time we need to verify your request,
- ask for the portability of your personal data in order to have your personal data transmitted to you in a structured, commonly used and readable format, or to have it transmitted to another controller,
- withdraw your consent to the processing of your personal data at any time (unless the processing is based on a legal ground other than your consent), without affecting the lawfulness of the processing based on your consent given before its withdrawal,
- object to the processing of your data based on the sole pursuit of our legitimate interests and prohibit us from processing them, including for direct marketing,
- file a complaint with the authority in charge of the protection of personal data in your country and/or in the Grand Duchy of Luxembourg (Commission Nationale pour la Protection des Données – CNPD, established in 15, boulevard du Jazz, L 4370 Belvaux).
7. How to contact us and how to exercise your rights?
You may address your questions relating to the processing of your personal data and/or a request regarding the exercise of your rights mentioned above to the Data Protection Officer (DPO) of the CFL:
- on our website www.cfl.lu by clicking on the link gdpr.cfl.lu,
- or by regular mail for the attention of the Data Protection Officer (DPO), Société Nationale des Chemins de Fer Luxembourgeois (CFL), 9, place de la Gare – L 1616 Luxembourg.
Any complaint relating to the processing of your personal data can be sent to the postal address above, or to the Luxembourgish supervisory authority, the Commission Nationale pour la Protection des Données – CNPD, established in 15, boulevard du Jazz, L‑4370 Belvaux.