The Luxembourg Agency for Research Integrity (LARI), hereafter referred to as “LARI”, “we”, or “us”, is committed to protecting and respecting your privacy in compliance with applicable European and Luxembourg data protection laws. As the data controller, we determine the purposes and means of processing your personal data and ensure its protection in line with legal requirements.
The protection of your personal data is a core priority for LARI. The purpose of this Privacy Statement is to inform users of the LARI website about how their personal data is collected, processed, stored, and how they can exercise control over its use.
This Privacy Statement is available in English, French, and German. Only the English version is legally binding. Translations are provided for convenience and are generated automatically.
Scope of the Privacy Statement
This Privacy Statement applies to the collection, processing, and protection of personal data through the LARI website and associated platforms. We process personal data in accordance with:
- The General Data Protection Regulation (GDPR) (EU) 2016/679);
- The Luxembourg Law of 1 August 2018 on the protection of individuals with regard to the processing of personal data;
- The Directive 2002/58/EC on privacy and electronic communications (ePrivacy Directive);
- The Luxembourg Law of 30 May 2005 on the protection of privacy in the electronic communications sector, as amended.
Who We Are (Data Controller)
The Luxembourg Agency for Research Integrity (LARI) acting as the data controller, is a non-profit organization (a.s.b.l.) registered with the Luxembourg Trade and Companies Register (RCS Luxembourg) under number F11081.
Our registered office is located at: 8, avenue des Hauts-Fourneaux, L – 4362 Esch-sur-Alzette, Luxembourg.
LARI’s mission is to support its Member Organizations and their staff in fostering research integrity and helping to prevent research misconduct, investigating all cases of alleged research misconduct related to research performed at or funded by its Member Organizations, and supporting its Member Organizations in developing policies conducive to research integrity.
Data Protection Officer (DPO)
LARI has appointed a Data Protection Officer (DPO) to ensure compliance with data protection regulations and to act as a point of contact for any data protection concerns.
The company MGSI S. à r.l. has been mandated to fulfill this function. Its headquarters are located at: 52a route du Vin, L-5495 Wintrange, Luxembourg.
For any inquiries regarding the processing of your personal data or to exercise your rights under the GDPR, you may contact the DPO at: dpo@lari.lu
What personal information may we collect?
Personal data (“Personal Data”) refers to any information about you and which can be used to identify you directly or indirectly.
We collect and process the following categories of data:
- Personal identification data (e.g., first name, last name, contact details, CV)
- Personal details (e.g.,date of birth, gender, nationality)
- Official identification data (e.g. ID, passport)
- Electronic identification data (e.g. email address, IP address, geographical location, s)
- Bank and financial identification data (e.g. bank account numbers)
This is data that is both provided to us directly by you or generated using our services.
When you visit our website, you will be informed, via a cookie banner, of the use of cookies, which are necessary for browsing and for producing audience statistics. Some of these cookies are subject to your consent and you can change the cookie settings at any time in your browser or on our website by using the cookie banner. For more information, please consult our Cookie Policy.
Legal Basis and Purposes
LARI processes your personal data based on the following legal basis and for the following purposes.
- Performance of a contract (GDPR, Art. 6.1.b)
Where processing is necessary for the performance of a contract in order to provide services within the remit of LARI, including education, inquiries into and investigations of cases of alleged research misconduct, advisory service, and policy support.
LARI may process your personal data, e.g. your CV in case you apply for a job position for the purpose of being part of the Recruitment Process. This processing is necessary to take steps at the request of the data subject (you) prior to entering into an employment contract.
- Consent (GDPR, Art. 6.1.a)
We will process your personal data based on your consent, for example in case you contact us through the contact form to provide you with information you have requested, or in case you have registered to join our events.
- Legal Obligation (GDPR, Art. 6.1.c)
LARI may process your personal data where it is necessary to comply with legal and regulatory obligations.
- Legitimate Interest (GDPR, Art. 6.1.f)
LARI may process your personal data where it is necessary for checking any previous breaches of contracts with other institutions prior to entering into a contract or during the existence of the contract, to be able to defend our interests in defense or take legal action, to proceed to investigations in case of a potential breach of contracts or violation of law or regulation which would have a negative impact on LARI.
Data Collected During Website Visits
When you visit our website, we automatically collect and process certain information, including:
- Your browser type and operating system.
- The date and time of your visit.
- Your access status (e.g., successful page load or error message).
- The website from which you accessed our page.
- Your IP address and the name of your Internet Service Provider.
Purposes:
- To ensure the website functions properly and can be used efficiently.
- To protect our IT systems and detect potential fraud, attacks, or unauthorized access.
Personal data transfer to third parties
LARI will never sell or rent personal information to third parties. However, we may need to disclose information to third parties in connection with purposes set out in this privacy statement, such as with organisations that fund, subscribe to, or otherwise support LARI as well suppliers and subcontractors who may process information on our behalf and IT/web based related support and services.
Where we are under a legal or regulatory duty to do so, we may disclose information to the police, regulatory bodies or legal advisors, and/or, where we consider it necessary to protect the rights, property or safety of LARI, its personnel, visitors, , Board of Directors, National Commission for Research Integrity, users or others.
When using suppliers who operate partially or fully outside the European Economic Area (EEA), potentially within a country that may have different data protection laws. In this example, LARI will take steps to ensure they provide an adequate level of data protection in accordance with Luxembourgish law.
How long do we keep your personal data?
Web contact form: your personal data will be processed for the time strictly necessary to meet your request and will be deleted one year after the last message.
Recruitment process and spontaneous applications: your CV and information related to the recruitment process will be processed until the recruitment process has been closed.
In case of spontaneous applications, your CV will be kept for 6 months.
Personal data processed in the context of investigations of cases of alleged research misconduct are kept for 10 years and final reports are kept for 30 years.
Exclusive for professional contacts: your data will be keptuntil our professional relations end or you decide to cancel or oppose the processing of your contact data for such purposes.
Data subjects Rights
In accordance with the General Data Protection Regulation (EU 2016/679), any data subject of which LARI act as controller processes personal data may exercise the following rights:
Right of access: you have the right to obtain confirmation that we are processing your personal data and where this is the case to obtain a copy of these data.
Right of rectification: you have the right to obtain from us without undue delay the rectification of inaccurate personal data that you are concerned.
Right to erasure: in specific cases, you have the right to request the erasure of your personal data. We may, however, retain certain information about you as required by law or when we have a legal basis to do so.
Right to restriction of processing: you can obtain from the us restriction of processing where one of the following applies:
- When you dispute the accuracy of your data for the time needed to verify the accuracy of the data;
- In the case of unlawful processing by us and you do not wish the deletion of the personal data in question;
- We no longer need your personal data but these are necessary for the recognition, exercise or defense of rights in court;
- When you have exercised your right to oppose the time to verify that the legitimate reasons, we are pursuing take precedence over yours;
Right to object: you have the right to object at any time, on grounds related to your particular situation, to any processing of your personal data necessary for the performance of a task carried out in the public interest or based on legitimate interest;
Right to data portability: you have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format and to transmit these data to another controller. However, when the personal data are not processed by automated means, you do not fulfil the conditions to exercise your right to portability.
Right to withdraw your consent: you can withdraw your consent at every moment when the processing activity is based on it;
Right to lodge a complaint: you have the right to lodge a complaint with the competent supervisory authority, which in Luxembourg is the CNPD (National Commission for Data Protection).
Some of these rights may be limited where we have an overriding interest or legal obligation to continue to process the data or where data may be exempt from disclosure due to reasons of legal professional privilege or professional secrecy obligations.
To exercise this right, contact LARI’s DPO by email: dpo@lari.lu or by writing to:
Luxembourg Agency for Research Integrity (LARI)
8, avenue des Hauts-Fourneaux
L-4362 Esch-sur-Alzette, Luxembourg
Complaints
A person also has the right to lodge a complaint about any use of their information with the Commission Nationale pour la Protection des Données (CNPD).
The Luxembourg Supervisory Authority is:
Commission Nationale pour la Protection des Données
15, Boulevard du Jazz
L-4370 Belvaux
Phone: (+352) 26 10 60 -1
Data security
LARI undertakes to ensure the protection and security of Personal Data, in order to ensure the confidentiality of your Personal Data and prevent your Personal Data from being distorted, damaged, destroyed or disclosed to unauthorized parties or used in an unlawful manner.
LARI maintains adequate physical, electronic, and procedural safeguards to protect Personal Data from loss, misuse and unauthorized access, disclosure, alteration and destruction.
Since all Personal Data is confidential, access is limited to Authorized Persons who have a need to know such data in carrying out their tasks. Without prejudice to the rules applicable in relation to professional secrecy rules, all the people who have access to your Personal Data are bound by a duty of confidentiality and must comply with appropriate data protection clauses and legislation and are subject to disciplinary actions and/or other sanctions if they fail to meet these obligations.
Contact Us
Please contact us if you have any queries, suggestions or comments regarding this privacy statement, either via email to dpo@lari.lu
or by writing to us at:
A/S DPO
Luxembourg Agency for Research Integrity (LARI)
8, avenue des Hauts-Fourneaux
L-4362 Esch-sur-Alzette, Luxembourg
Policy operational date: November 2018
Date of last review: January 2025
