Information notice on the protection of personal data

Introduction

The customer is placed at the center of CFL multimodal and CFL cargo, their subsidiaries and concerns.

The protection of your personal data is therefore naturally a priority for us and for each entity that processes your personal data for the purposes of its activity.

This notice provides the necessary information and explains how we collect, use, share, store and protect your personal information. It also tells you about your rights and how to exercise them.
 

1. Who is the data controller?

CFL multimodal and CFL cargo and their subsidiaries, which are established and have their registered office in 100, Z.A.E. Wolser-E, L-3437 Dudelange, are the data controller of your personal data that we process.

As such, we are responsible for how we collect, use, share, store and protect your personal data.

2. What categories of personal data are processed and for what purposes?

CFL multimodal and CFL cargo and their subsidiaries (CFL freight group) prioritize efforts to ensure the highest possible level of security for all customers. 

In order to carry out these tasks, we ask you to provide proof of identity for verification purposes and we collect the following personal data:

• identification data (surname, forename, address, telephone number, etc.),
• personal particulars (date of birth, sex, nationality, identity card and/or other administrative identification documents, etc.),
• electronic identification data in case of access to a CFL and CFL freight application (IP address, cookies, e-mail address, etc.),
• financial data (credit card or bank account numbers) in connection with your purchased service,
• data relating to the composition of your household for the subscription of certain tickets, transport cards,
• data relating to your profession, employment,
• images, photos, sounds for processing relating to the safety of the infrastructure or rolling stock,
• trade fair photos (including, if applicable, other personal data that you provide to us in connection with the trade fair photos) to document our trade fairs (i.e. pictures of meetings, and similar events in which the persons depicted have taken part.

We also process special categories of personal data, also known as sensitive data in certain cases, namely:

• data relating to offences or convictions,
• data relating to health.

In any event, the CFL freight group is committed to ensuring that data are collected for specific purposes and that they are processed in an adequate and relevant manner and only for what is necessary for the purpose in question.
The purposes pursued are as follows:

• the management of services provided by the CFL freight group,
• the management of our contractual relations,
• the management of subscriptions and all documents of carriage,
• commercial management of prospects,
• prospecting and marketing,
• the management of complaints and incidents,
• the compilation of statistics,
• the prevention and processing of offences,
• the management of pre-litigation or litigation disputes of the CFL freight group, the management of collection requests, and the management of reminders and debt recovery,
• personalization of your access to the system,
• support for people with reduced mobility or disabilities,
• attendance at meetings and events, including access and dietary requirements,
• press and public relations work, editorial reporting and advertising and marketing purposes in connection with the trade fairs, events and other occasions.

3. How we collect, process and use your data.

We collect and use the personal data you provide when you use our services. 
When we collect trade fair photos, other events, within the framework of the necessary balancing of interests, we have weighed up your interest in confidentiality and our interests in the creation and use of trade fair photos, taking due account of your personal rights. Otherwise, we will not be able to create and use trade fair photos.  If we wish to publish and use photographic material of you in which you are prominently visible for press and advertising purposes, we will obtain your consent to do so. You can revoke your consent at any time with effect for the future.
Personal information may also be collected using cookies, web beacons and other similar technologies.
For each of the afore described purposes, your data are collected and processed:

• in accordance with the applicable regulations on the protection of personal data including the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the Guidelines thereto and national laws implementing the GDPR where applicable,
• on a legal basis, i.e.
  • on the basis that the processing of your personal data is necessary for the performance of a contract to which you are a party or for the performance of pre-contractual measures taken at your request; or
  • on the basis of your consent; or
  • on the basis that the processing is necessary for compliance with a legal obligation to which we are subject as data controller; or
  • on the basis of an interest recognised as legitimate, or
  • on the basis that the processing of your data is necessary for the performance of a task in the public interest with which we are entrusted (safety of visitors and staff, protection of property, prevention and identification of offences, etc.).

4. Who has access to your data?

We make sure that your personal data are processed in accordance with the purposes indicated above. These data are shared with some of our internal services in strict compliance with the assignments entrusted to them.

5. Where are your data processed? Are they transferred?

Your data are processed under appropriate technical and organizational measures to protect the security thereof and primarily their confidentiality, integrity and availability.
For transfers, we contractually on service providers guarantees of security and confidentiality of your personal data contractually through appropriate technical and organizational measures in accordance with the regulations and make sure that these guarantees are respected.

6. How long do we keep your data?

We keep your personal data for as long as necessary for the purpose of processing and for us to fulfil our obligations arising out of limitation periods and/or any other legal provisions.

7. What are your rights with regard to your personal data?

In accordance with the regulations, you have the right to:

• access the personal data we hold about you,
• have the data rectified if they are inaccurate or incomplete,
• have your data removed in certain cases, for example, whenever your data are no longer necessary for the purpose for which they were collected and we no longer have a contractual or legal obligation to retain them,
• request a restriction on the processing of your personal data, such as limiting the processing of data whose accuracy you question and for the time we need to verify your request,
• request the portability of your personal data so that they can be provided in a structured, commonly used and readable format or to have it transferred to another controller,
• withdraw your consent at any time (except where the processing is based on legal requirements other than your consent) to the processing of your personal data without prejudice to the lawfulness of the processing based on the consent given before your withdrawal,
• object to the processing of your data based solely on the pursuit of our legitimate interests or prohibit us from processing them, including for direct marketing,
• lodge a complaint with the competent authority for the protection of personal data in your country and/or in the Grand Duchy of Luxembourg (Commission Nationale Pour la Protection des Données – CNPD [National Data Protection Commission], 15 Boulevard du Jazz, L-4370 Esch-sur-Alzette – www.cnpd.public.lu).

8. How to contact us and how to exercise your rights.

You can address your questions concerning the processing of your personal data and/or the exercise your aforementioned rights:   

• by post: for the attention of the Data Protection Officer (DPO), 100 Z.A.E. Wolser-E, L-3437 Dudelange, or
• by e-mail: DPO@cfl-mm.lu

In the interests of confidentiality and data protection, we shall ascertain your identity before issuing the requested information.
 
Complaints regarding the processing of your personal data can be sent to the e-mail or postal address mentioned above or to the supervisory authority of the Grand Duchy of Luxembourg, the Commission Nationale Pour la Protection des Données – CNPD [National Data Protection Commission], 15 Boulevard du Jazz, L-4370 Esch-sur-Alzette – www.cnpd.public.lu.

9. How we update this information notice.

In order to comply with the regulations in force, we undertake to update this information notice as and when necessary.

The latest version is posted on our website (www.cfl-mm.lu).