LuxID activity controls

What are activity controls?

LuxID is built around data minimisation: it keeps only the activity needed to run the service and keep your account secure, and it does not build advertising or tracking profiles. There is nothing you need to switch on or off.

LuxID does keep internal logs of this activity for security, but a self-service view of those logs in your account is not available yet - we plan to add one in the future. In the meantime, you can request a copy of your data.

What activity does LuxID store?

LuxID stores only the minimum information necessary to provide its services:

• Authentication history - Records of when and where you signed in.
• Consent records - Which LuxID Partner services you have authorised and what data you agreed to share with each.
• Account changes - A log of changes to your account settings, such as password changes, email updates, or 2-Step Verification configuration changes.

LuxID does not track your browsing activity, build advertising profiles, or monitor your usage of partner services after you sign in.

What you can see in your account

Signed in to your LuxID Account (opens in a new tab), you can see and manage:

• Account - your personal information (name, email address, phone number, date of birth).
• Security - your password, 2-Step Verification, and passkey settings.
• Applications - the LuxID Partner services connected to your account and what each one can access.

LuxID also keeps activity logs, such as your sign-in history, for security. These are not yet viewable in your account - to obtain them, request a copy of your data.

How to control what is shared

You can revoke access for any LuxID Partner service at any time:

1. Sign in to your LuxID Account (opens in a new tab).
2. Go to Applications.
3. Select the partner service you want to manage.
4. Review or revoke the permissions you have granted.

Revoking access means the partner service can no longer use LuxID to access your data. Note that data the partner service already collected independently is governed by that service's own privacy policy. To see, retrieve, or delete the data LuxID holds about you, see Find, retrieve, and delete data.

Your rights under GDPR

As a user of a service operated by POST Luxembourg, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Delete your data (right to erasure)
• Export your data (right to data portability)
• Object to or restrict certain processing

For more information, see the LuxID Terms and Conditions (opens in a new tab) or contact LuxID support. For a full explanation of each right and how to exercise it, see Your GDPR rights.

The supervisory authority for data protection in Luxembourg is the Commission nationale pour la protection des donnees (CNPD) (opens in a new tab).