Privacy policy

This statement describes which personal data are processed when using this course site, for what purpose, on what basis and for how long.

Data controller

Rosa Lëtzebuerg asbl
19, rue du Saint Esprit, L-1475 Luxembourg
booking@formations.lgbt

Data protection contact: dpo@formations.lgbt

What data we process

Account and enrolment in a course

First name, surname, email address and, if you wish, phone, address, organisation and job title. Plus the sessions booked, the status of the enrolment and the attendance recorded.

Basis: performance of the participation contract. Without these details no enrolment is possible.

If your organisation registers you, someone names you as a replacement or our administration creates your profile, we receive your data from that source. You then receive a confirmation referring to this statement.

E-learning

For online courses we store your progress per module, your answers and attempts in knowledge checks, the result and the certificate issued. Basis: performance of the contract. Retention as for attendance records.

Billing details

Invoice recipient, billing address, VAT number, email address for sending and, if your organisation uses one, purchase order or cost centre.

Basis: performance of the contract and the statutory duty to retain accounting records.

Dietary information

Only for courses with catering and only if you provide them voluntarily. They go to the kitchen or the caterer, as a rule as a number without your name, and are deleted automatically 30 days after the course.

Such details may reveal religion or health. The basis is therefore your explicit consent, which you may withdraw at any time. Without the information we simply cannot take it into account for catering; participation is unaffected.

Courses through your employer

If you book through a framework contract of your organisation, the named contact person there learns your name, your email address and the course you wish to attend. This is unavoidable with employer-funded training.

You decide yourself: assignment to a contract only happens if you request it. You can enrol at your own expense at any time instead.

Enquiries via the form

Name, organisation, email, phone and your description of the request. Basis: your enquiry and our legitimate interest in answering it.

Requests reaching us by email or phone are also recorded here so they can be handled uniformly and evaluated as figures.

Applications to the fund

If you apply for coverage by our fund: name, organisation, email, phone, the desired training, the number of people, the requested share and your description of the financial situation. We do not ask for proof; your description counts as a declaration on your honour. Basis: your application as a pre-contractual step and our legitimate interest in allocating the fund's resources according to fixed criteria.

Only the members of the fund committee (head of the Rainbow Center, training officer, treasurer) and the training administration read the application. The decision is noted on the application. We automatically delete your description of the financial situation twelve months after the application; the share granted remains with the quote or invoice as an accounting record.

Donations to the fund

From donors we record name or organisation, address, email, amount, date and payment method in order to book the donation and issue a donation receipt on request. The receipt is sent to you by email, with a copy to our accounting address. Basis: the legal bookkeeping obligation and our legitimate interest in managing donations traceably. Donations do not give rise to any tax advantage. We do not publish donors' names.

Website statistics

We count views of the public pages, search terms and the origin of visits without cookies and without storing the IP address. Visitors are counted from a daily value that is discarded at the end of the day. The figures are deleted after 730 days.

Basis: our legitimate interest in operating and improving the website (Art. 6(1)(f) GDPR).

Trainers

For trainers we publish name, photo and short profile on the website for as long as the collaboration lasts. Basis: the contract for delivering the training.

Logs

We log changes to enrolments and the sending of emails with recipient, subject and time, but not their content. This serves traceability and troubleshooting.

Basis: our legitimate interest in traceability and security. The change log is deleted after 12 months, the sending log after 6 months.

Who receives the data

our own team, as far as necessary for running the course
the trainers of the course concerned, in the form of the participant list
with catering: the kitchen or the caterer, as a rule only as a number
when booking through a framework contract: the contact person at your organisation
for applications to the fund: the three members of the fund committee
our hosting provider Hetzner Online GmbH, Gunzenhausen (Allemagne), serveurs en Finlande (UE), which operates the servers, under a data processing agreement
Innovity sàrl-s, Luxembourg, which developed and maintains this website; it accesses the data when needed for maintenance and support, under a data processing agreement and bound to confidentiality
for quotes and invoices: our accounting software Odoo (Odoo S.A., Belgium), operated in the European Union under a data processing agreement; invoice recipient, address and the invoiced service are passed on
our external accountant FEDAS, Fédération des acteurs du secteur social au Luxembourg asbl: it receives the invoices and documents with recipient and address separately and processes them under its accounting mandate on its own responsibility

Where the data is processed

Accounts, registrations, requests and statistics are processed on this website and in its database, operated by our hosting provider in the European Union. Invoices and quotes are created and kept in Odoo.

We transmit invoices and documents separately to our external accountant FEDAS, Fédération des acteurs du secteur social au Luxembourg asbl; it has no access to this website or to Odoo.

No transfer outside the European Union takes place. We do not sell data and do not build advertising profiles.

How long we store data

Account: as long as you use it. Without registration, request or login for 36 months we anonymise the profile automatically.
Requests not accepted: 24 months after receipt, then without name, email, phone or message. Accepted requests remain with the order.
Attendance records, quotes and invoice documents: ten years, statutory retention period
Applications to the fund: the description of the financial situation twelve months after the application; the other data like other requests
Donations and donation receipts: ten years, legal retention period
Website statistics: 730 days, without personal data
Change log: 12 months, sending log: 6 months, security log: 30 days
Dietary information: 30 days after the course
generated files such as certificates: one hour, after that they are recreated on demand

On request we delete your profile. Enrolments then remain without any link to a person, so that attendance figures and billing stay traceable.

Cookies

We use no analytics or advertising cookies and embed no third-party services. Only technically necessary cookies are used:

Language choice, one year, only if you switch language
Sign-in to your account, set by WordPress, for the duration of the session

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with effect for the future.

Please contact dpo@formations.lgbt for this.

You may also lodge a complaint with the national data protection authority: Commission nationale pour la protection des données, 15 boulevard du Jazz, L-4370 Belvaux, www.cnpd.lu.

Security

Transmission is encrypted. Access to enrolments is limited to authorised people. Generated files are kept in a protected directory and removed after sending.

To protect against attacks we store, for blocked requests and login attempts, the IP address, time and requested path for 30 days. Basis: our legitimate interest in the security of the website (Art. 6(1)(f) GDPR).

As at 18 October 2026