Your GDPR rights
Your data protection rights
LuxID is operated by POST Luxembourg and is subject to the European Union's General Data Protection Regulation (GDPR), Regulation (EU) 2016/679 (opens in a new tab) and Luxembourg's data protection law (Loi du 1er août 2018) (opens in a new tab). As a LuxID Account holder, you have the following rights regarding your personal data.
Right of access
GDPR Article 15 (opens in a new tab) You can request a copy of all personal data LuxID holds about you. This includes your profile information, authentication history, consent records, and any data shared with LuxID Partners.
To request a copy of your data, see How to retrieve your data for the full procedure. A self-service export is not available yet; LuxID provides the data on request.
Right to rectification
GDPR Article 16 (opens in a new tab) If any of your personal data is inaccurate or incomplete, you have the right to correct it. You can update most information directly in your LuxID Account settings, including your name, email address, and phone number.
Right to erasure
GDPR Article 17 (opens in a new tab) Also known as the "right to be forgotten". You can request that LuxID delete all your personal data. This is done by deleting your LuxID Account. Some data may be retained for a limited period as required by Luxembourg law (for example, for anti-fraud or legal-compliance purposes).
Right to restrict processing
GDPR Article 18 (opens in a new tab) You can request that LuxID limit how your personal data is used while a concern is being resolved - for example, if you believe your data is inaccurate or if you have objected to its processing. To request this, contact the DPO at privacy@post.lu.
Right to data portability
GDPR Article 20 (opens in a new tab) You have the right to receive your personal data in a structured, commonly used, machine-readable format. A self-service download is not available yet; you can request a copy of your data - see How to retrieve your data.
Right to object
GDPR Article 21 (opens in a new tab) You can object to the processing of your personal data in certain circumstances, such as when data is processed based on legitimate interest rather than your consent. To object, contact the DPO at privacy@post.lu.
Right not to be subject to automated decisions
GDPR Article 22 (opens in a new tab) You have the right not to be subject to a decision based solely on automated processing that significantly affects you. For example, LuxID's security systems may automatically block an account when they detect a serious risk. If your account is blocked, you can ask for the decision to be reviewed by a person - see Why LuxID blocked my account.
Right to withdraw consent
GDPR Article 7(3) (opens in a new tab) Where LuxID processes your data based on your consent (for example, sharing attributes with a LuxID Partner), you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing that occurred before the withdrawal.
To manage your consents, go to account.luxid.lu (opens in a new tab) > Applications.
Rights related to automated decision-making
GDPR Article 22 (opens in a new tab) You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you. LuxID's security systems can automatically block an account when they detect a serious risk; if this affects you, you can ask for the decision to be reviewed by a person - see Why LuxID blocked my account.
Right to lodge a complaint
GDPR Article 77 (opens in a new tab) If you believe your data protection rights have been violated, you have the right to file a complaint with Luxembourg's data protection authority:
Commission Nationale pour la Protection des Données (CNPD) 15, Boulevard du Jazz L-4370 Belvaux Luxembourg Website: https://cnpd.public.lu/ (opens in a new tab) Complaint form: https://cnpd.public.lu/en/particuliers/faire-valoir/formulaire-plainte.html (opens in a new tab)
Data controller
The data controller for LuxID is:
POST Luxembourg - a public undertaking (établissement public) established by the law of 10 August 1992, as amended RCS Luxembourg J28 - VAT LU 15400030 38, place de la Gare L-1616 Luxembourg
Data Protection Officer
For any question about how your personal data is handled, or to exercise your rights, you can contact POST Luxembourg's Data Protection Officer (DPO):
Email: privacy@post.lu
Post: POST Luxembourg - DPO, 38, place de la Gare, L-1616 Luxembourg
How to exercise your rights
You can exercise some rights directly from your LuxID Account (opens in a new tab) - for example correcting your personal information, withdrawing consent for a partner, or deleting your account. For all other GDPR requests - such as receiving a copy of your data - the single point of contact is POST Luxembourg's Data Protection Officer (DPO) at privacy@post.lu. POST Luxembourg will respond to your request within one month, as required by GDPR Art. 12(3) (opens in a new tab).