Privacy Policy

The official version of this privacy policy is the French version.

This privacy policy informs you about how your personal data are collected, used, retained and protected when you use the Eltereforum website, create an account, register for an activity, make a booking or use the various services offered online.

1. Data controller

The data controller within the meaning of Article 4, point (7), of Regulation (EU) 2016/679 is the Ministry of Education, Children and Youth, represented by the minister responsible for education, children and youth.

The processing of personal data described in this policy is carried out by the Eltereforum service, which is attached to the Directorate-General for Child and Family Welfare (DGAEF) and operates the website.

Ministry of Education, Children and Youth

Directorate-General for Child and Family Welfare

Eltereforum service

33, rives de Clausen

L-2165 Luxembourg

Postal address: L-2926 Luxembourg

Email: eltereforum@men.lu

Tel.: (+352) 247-63700

The ministry’s data protection officer can be contacted at the following address:

Data Protection Officer

Ministry of Education, Children and Youth

33, rives de Clausen

L-2165 Luxembourg

Email: dpo@men.lu

2. Personal data collected

2.1 Principle of data minimisation

The Eltereforum service collects only the personal data necessary to provide the services offered, in accordance with the principle of minimisation set out in Article 5(1)(c) of Regulation (EU) 2016/679 (GDPR).

2.2 Data collected according to the services used

Depending on the features and services you use, the following categories of personal data may be processed:

2.2.1 Identification data

• Surname and first name:

  • Of the parent/legal representative (account creation, registrations, communications)

  • Of the child (only if necessary for participation in an activity)

Services concerned: Activity registration, account creation, contact forms.

2.2.2 Contact data

• Email address

• Telephone number (depending on the service)

• Postal address (where applicable)

Services concerned: Communications from the service, registration management, activity notifications.

2.2.3 Account management data

• Information necessary to create and manage your account (username, secure password)

• History of changes made to the account

• Information entered in your profile (family situation, language preferences, professional information if relevant)

Services concerned: All services requiring authentication (registration, participation tracking, access to personalised resources).

2.2.4 Data relating to activity registrations and bookings

• Date and time of registration

• Activities or services booked

• Participation status (confirmed, pending, cancelled)

• History of previous participation

For Activity Box registrations only:

• Child’s surname and first name

• Child’s date of birth

These data make it possible to check that the child is at least 1 year old and no more than 3 years old and that the family has not already had an Activity Box.

Services concerned: Activity registration, Activity Box, booking management.

2.2.5 Data concerning children

Where a specific activity or service justifies it, the following information concerning the child may be collected:

• Identification data: surname, first name, date of birth or age group

• Health data (if strictly necessary): known allergies, specific needs (disability, accommodations)

• Academic or school data (if necessary): school attended, school level

• Participation authorisation: parental agreement for specific activities

• Emergency contact: person to contact in an emergency (if different from the registering parent)

• Images or videos: only with the explicit consent of the parent/legal representative

Services concerned: Registration for educational activities, specialised services, support programmes.

Limitation: Sensitive data (health, academic data) are collected only if strictly necessary and with the explicit consent of the legal representative.

2.2.6 Communications sent to the Eltereforum service

When you contact the Eltereforum service (contact form, email, telephone), the following personal data may be processed:

• Sender’s data: surname, first name, email address, telephone number (if provided)

• Contextual data: subject of the communication (e.g. Activity Box registration request, question about a specific activity, technical problem)

• Content of the communication:

  • Specific subject (e.g. information request, complaint, report, registration problem)

  • Full text of the message

  • Attachments (supporting documents, documents)

  • Date and time of receipt

• Data relating to the child mentioned: only if relevant to handling your request

Services concerned: Contact forms, address, communication email addresses, requests for information.

2.2.7 Account preferences and settings

• Language choice and display settings

• Communication preferences (frequency and type of notifications)

• Privacy and cookie consent settings

Services concerned: All services offering personalisation options.

2.3 Technical data collected

When the Eltereforum website is used, certain technical data are collected automatically:

• IP address and technical logs: necessary for service security, abuse detection, technical maintenance

• Type of browser and device used: optimisation of the user experience

• Technical information relating to the connection: connection date/time, session duration

• Cookies and similar technologies: collected in accordance with the preferences expressed by the user

Purpose: System security, traffic analysis (with consent), service improvement.

Retention period: A maximum of 13 months for technical logs (see section 8. Retention period).

2.4 Variation according to the service or activity

The data requested may vary depending on the service or activity concerned. At each collection, you will be explicitly and transparently informed about:

• Required data vs. optional data

• The purpose of collection

• The retention period

• Your rights (access, rectification, deletion, portability)

This information is provided through:

• Prior information notice at the time of registration

• Clearly labelled registration or contact forms

• General terms of use of the service

3. Purposes of processing

Your personal data may be used to:

• create, manage and secure your user account;

• enable your authentication;

• manage your information and preferences;

• enable registration and booking for activities or events;

• manage, amend or cancel your bookings;

• send you confirmations and practical information relating to your registrations;

• inform you of a change to or cancellation of an activity;

• respond to your requests submitted through contact forms;

• ensure the security, proper functioning and improvement of the website;

• compile usage statistics with the user’s prior explicit consent, collected through a cookie consent banner;

• comply with applicable legal and regulatory obligations.

The data collected are not used for commercial purposes.

Personal data are not sold, rented or transferred to third parties, nor used for commercial prospecting purposes.

Transfer of your data to a third country

Your data are in principle processed within the European Economic Area.

Absence of automated processing

The data are not processed for the purposes of an automated individual decision within the meaning of Article 22 of Regulation (EU) 2016/679.

4. Legal basis for processing

4.1 Applicable legal framework

The processing of personal data carried out by the Eltereforum service is performed in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of personal data (“GDPR”), as well as applicable Luxembourg legislation, in particular the amended Law of 16 December 2008 on child and family welfare.

4.2 Legal bases under Article 6 GDPR

Depending on the service concerned and the purpose pursued, processing is based on one of the legal bases listed in Article 6(1) GDPR:

4.2.1 Consent (Article 6(1)(a) GDPR)

Processing is based on your freely given, specific, informed and unambiguous consent when:

• You accept traffic analysis cookies (audience measurement)

• You consent to receive marketing or informational communications

• You agree to images/videos of the child being used in the context of an activity

Arrangements: Consent is collected through a checkbox before collection. You may withdraw your consent at any time through your account’s privacy settings.

Effect of withdrawal: Withdrawal of consent does not affect the lawfulness of the processing carried out before that withdrawal. After consent is withdrawn, processing based on that consent ceases immediately.

4.2.2 Performance of a contract (Article 6(1)(b) GDPR)

Processing is based on the performance of a service requested by the user when:

• You create an account on the Eltereforum website

• You register for an activity or a booking

• You participate in a programme offered by the service (e.g. Activity Box, educational workshops)

Data concerned: surname, first name, email address, registration information, data relating to the child (age, specific needs).

Purpose: Deliver the requested service and manage your participation.

4.2.3 Legal obligation (Article 6(1)(c) GDPR)

Processing is based on compliance with a legal obligation imposed on the State or the ministry in the following cases:

• Retention of data for public archiving

• Compliance with accounting or administrative obligations

• Disclosure of data to the competent public authorities

Legal references: Luxembourg laws on archiving and administrative obligations applicable to the public sector.

4.2.4 Task carried out in the public interest (Article 6(1)(e) GDPR)

Processing is based on the performance of a task entrusted to the ministry and the Eltereforum service by law when it concerns:

• The organisation and management of activities and services intended for children and families

• Support for parenting and childcare

• Analysis of families’ needs to adapt the services offered

• Management of attendance statistics for internal information purposes

Legal references:

• Amended Law of 16 December 2008 on Child and Family Welfare, Article 11, point (p): parental and family education for young people and parents,

• Amended Law of 16 December 2008 on Child and Family Welfare, Article 11, point (q): emotional and relationship education for children and young adults,

Data concerned: registration data, participation data, child’s data (to the extent strictly necessary).

Purpose: Organise activities, adapt services to families’ needs, assess the relevance of the services offered.

4.2.5 Legitimate interest (Article 6(1)(f) GDPR)

Processing is based on the legitimate interest of the Eltereforum service when it concerns:

• Ensuring the technical security of the website and detecting abuse (protection against attacks, fraud, etc.)

• Optimising access to available places for activities (checking eligibility criteria, limiting Activity Box per family, etc.)

• Improving the quality of the services offered (anonymous usage analysis, etc.)

• Contacting absent participants to free up places (Activity Box, activities, etc.)

Data concerned: IP address, technical logs, registration data, participation.

Purpose: Security, equitable access, service optimisation.

Limitation: This legitimate interest is exercised with respect for your rights and freedoms; the data are used only for the purposes listed.

4.3 Absence of a legal basis

In the absence of an applicable legal basis, processing will not take place. If the Eltereforum service wishes to process your data for a purpose not covered by an existing legal basis, it will request your prior consent.

5. Activity registrations and bookings

When you register for an activity or make a booking, the information necessary to manage that registration is recorded, in particular to:

• record your participation;

• manage available places;

• send you a confirmation;

• contact you for organisational reasons;

• inform you of a change or cancellation;

• ensure that the activity runs smoothly.

Certain activities may require additional information, particularly where they are intended for a specific age group or where a particular check is necessary.

In that case, only the information necessary to organise and manage the activity concerned is requested.

6. Recipients of personal data

Access to personal data is strictly limited to persons who need them in the course of their duties and who are subject to an obligation of confidentiality.

Data may be disclosed or made accessible to the following categories of recipients:

a) Authorised staff of the Eltereforum service, within the limits of their respective responsibilities and on a need-to-know basis.

b) The competent State services and administrations, where disclosure is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e) GDPR), or where it is required by a legal or regulatory provision. Such disclosure is assessed on a case-by-case basis and limited to the data strictly necessary for the purpose pursued.

c) Technical service providers acting as processors within the meaning of Article 28 GDPR, in particular for hosting, development, corrective and adaptive maintenance, IT outsourcing and technical support for the website. In the course of these interventions, these providers — including external developers — may access personal data processed by the website. This access is strictly limited to what is necessary to carry out their task and is governed by a data processing agreement in accordance with Article 28(3) GDPR, providing in particular for:

• processing of data solely on documented instructions from the controller, to the exclusion of any purpose of their own;

• a confidentiality commitment by persons authorised to process the data;

• implementation of appropriate technical and organisational measures within the meaning of Article 32 GDPR, including access traceability;

• prohibition of engaging a further processor without the controller’s prior written authorisation;

• deletion or return of the data at the end of the service;

• processing of data within the European Union, with any transfer to a third country taking place only on the basis of the appropriate safeguards provided for in Chapter V GDPR.

As far as possible, technical interventions are carried out on anonymised or pseudonymised data.

d) The competent judicial, administrative or supervisory authorities, where a legal obligation requires it or in response to a request based on a legal basis.

7. Data retention

Your personal data are retained only for the period necessary to achieve the purposes for which they were collected, subject to legal or administrative obligations imposing a different retention period.

The applicable retention periods are as follows:

The retention of registration data beyond the date of the activity is justified by the need to ensure its administrative and organisational follow-up, in particular the management of cancellations and postponements, the communication of practical information to participants, the preparation of attendance lists, the evaluation of the activity and the handling of any complaints. After this period, only anonymised statistical data that do not allow you to be identified may be retained to evaluate the services offered by the Eltereforum service.

Certain services offered by the Eltereforum service may be covered by a specific information notice where the nature of the data collected, their purpose or their retention period differ from the processing described in this policy. In that case, the specific information is provided to you when the data concerned are collected, in particular when you register for the activity or service concerned.

At the end of the applicable period, your data are deleted or irreversibly anonymised, subject to obligations arising from archiving legislation.

8. Data security

Appropriate technical and organisational measures are implemented to protect personal data against, in particular:

• unauthorised access;

• accidental loss or destruction;

• alteration;

• unauthorised disclosure;

• misuse of the data.

Access to data is limited to authorised persons and systems necessary for the operation of the services.

9. Cookies and audience measurement

The website may use cookies and similar technologies necessary for its operation, in particular to:

• ensure your authentication and maintain your session;

• remember certain preferences;

• guarantee the security of the service;

• measure website usage and traffic where permitted.

Cookies that are not strictly necessary are used in accordance with the choices expressed in the website’s cookie management tool.

You can change your preferences at any time through the Cookie management feature available on the website.

10. Your rights

In accordance with the GDPR and subject to the conditions provided for by applicable legislation, you have, in particular, the following rights:

• the right to be informed about the processing of your data;

• the right of access to your personal data;

• the right to rectification of inaccurate or incomplete data;

• the right to erasure where the legal conditions are met;

• the right to restriction of processing;

• the right to object where applicable;

• the right to data portability where applicable;

• the right to withdraw your consent at any time for processing based on it.

To exercise your rights or ask a question about the processing of your personal data, you can contact:

Data Protection Officer

Email: dpo@men.lu

Verification of your identity may be requested where necessary to ensure that information relating to personal data is disclosed to the data subject.

11. Complaint to the CNPD

If you consider that the processing of your personal data does not comply with applicable regulations, you may lodge a complaint with the Luxembourg supervisory authority by email through the form on the cnpd.public.lu website:

National Commission for Data Protection (CNPD)

15, boulevard du Jazz

L-4370 Belvaux

Luxembourg

12. Changes to the privacy policy

Last updated: [26.08.2026]

This privacy policy may be adapted to take account of changes to the services offered, the data processing carried out or applicable regulations.

The version published on the website is the version in force; its last update date appears at the beginning of this section. We invite you to consult it periodically.