Information notice on personal data processing in respect of the registration of your child(ren) in the canteen of the Luxembourg-Kirchberg European School
1- Re :
The purpose of this information notice (hereinafter "Notice") is to inform you, as a customer of SODEXO LUXEMBOURG S.A., about the terms and conditions of the processing of your personal data by SODEXO LUXEMBOURG S.A., as part of customer relationship management for the processing of orders and the billing of meals at the European School (hereafter "processing").
SODEXO LUXEMBOURG S.A. (hereafter “SODEXO”) respects your privacy.
3- Personal Data Processing Categories
SODEXO will collect the following categories of personal data (hereafter referred to as "personal data"):
- Information about your marital status and identity: your surname, first name, gender,
- Information about your personal life: e-mail address, personal address, telephone number
- Information about your child(ren) and their schooling: surname, first name, date of birth, class, registration number at the European School, type and nature of meals
- Information about meal ordering and billing: type of meals, bills issued, paid bills, unpaid bills
4- Purposes of Personal Data Processing
SODEXO will process personal data for the purposes listed below without this list being exhaustive (hereafter referred to as the "purposes"):
- Customer relationship management: management of the billing file, dispatch of bills, sending of bill payment reminders, sending of formal notice, amicablerecovery of bills or collection of bills by court order.
5- Legal Basis of Personal Data Processing
As part of the processing purposes listed above, SODEXO processes your personal data in accordance with the following legal bases:
- in the legitimate interests of customer relationship management;
- the execution of the service contract with the customer;
- to meet the legal and regulatory obligations of SODEXO.
6- Categories of Recipients
Within SODEXO, your personal data can only be accessed by those authorized by virtue of their function as specified by the processing purposes listed above and/or to the extent that such access is required on a legal or regulatory basis.
7- International Transfers of Personal Data
Given the international nature of the SODEXO Group, your personal data may be transferred for the above processing purposes to internal or external authorized recipients, which may be located in countries outside the European Union or the European Economic Area, and may not therefore offer an adequate level of personal data protection. In order to guarantee the security and confidentiality of the personal data thus transferred, SODEXO implements the appropriate measures based on the European Commission’s Standard Contractual Clauses or any other equivalent mechanism.
8- Data Security
We maintain adequate technical and organizational security measures to protect personal data from destruction, loss, alteration, unauthorized disclosure, or unauthorized access, whether accidental or unlawful.
9- Data Retention
Your personal data will be stored or retained only for the period of time necessary to fulfil the purposes of the processing described in this notice and/or, as the case may be, during the periods of applicable legal or regulatory requirements, namely for a maximum of 10 years from 1 September of the year of registration.
10- Your Rights
In accordance with the conditions provided by law or applicable regulations, you have rights of access, opposition, deletion, limitation, portability and complaint
You may request access to your personal data. You may also request to have inaccurate personal data corrected or incomplete data completed.
You also have the right to know the sources of the relevant personal data, and you are entitled to request and receive the personal data that concerns you.
Right to object
You have the right to object to the processing of your personal data for legitimate reasons, except when the processing is carried out in accordance with the mandatory provisions of applicable law.
Right to delete
Your right to be forgotten entitles you to request the deletion of personal data when:
(i) the data is no longer necessary for the purposes for which it was collected and processed;
(ii) you choose to withdraw your consent (if your consent has been collected as the legal basis for processing), but this withdrawal does not affect the lawfulness of the processing before it is implemented;
(iii) you object to the processing;
(iv) your data has been processed unlawfully;
(v) your data must be erased to fulfil a legal obligation; or
(vi) its deletion is required to ensure compliance with current legislation.
Right to limitation
You may also request that the processing of your personal data be limited if:
(i) you dispute the accuracy of the data;
(ii) Sodexo no longer needs the data for processing purposes; and
(iii) you have objected to the processing of the data, but SODEXO’s legitimate reasons prevail over yours.
Right to portability
You may ask us to provide you with your personal data in a structured, commonly used, machine-readable format, or you may request to have it "ported" directly to another processor provided that:
(i) the processing is based on your consent or on the fulfilment of a contract concluded with you; and
(ii) that it is realised by automated means.
Right to lodge a complaint
If you have a complaint against us regarding the protection of your personal data, you may complete and send the Application / Complaint Form or lodge your complaint by e-mail or post in accordance with our Global Claims / Complaints Management Policy. If our response does not satisfy you, you may contact the National Data Protection Commission (CNPD) using the following link: www.cnpd.lu
However, please send your request or complaint to us in advance by e-mail to our local contact at the following address: firstname.lastname@example.orgTo do this, please complete the form (on our Global Policy on Personal Data Protection) using the following link: Global Data Protection Policy. We undertake to process your request as quickly as possible and to find an amicable solution so that we can process your request and find an amicable solution.
To exercise these rights or for any questions and/or updates of your personal data, you may get in touch with your local contact and/or send an e-mail to the following address: email@example.com.
11- Changes to the Notice
If we decide to change this notice, we will issue a revised version of the notice and/or take any other necessary action in accordance with applicable laws and regulations.
12- Global Data Protection Office
SODEXO has set up a dedicated team at group level, the Global Data Protection Office which, if required, you can contact at the address below if you have any questions about the protection of your personal data: firstname.lastname@example.org
Locally, you can also get in touch with your local contact at the following address: email@example.com.