🔐 Privacy & GDPR

Last update: 15 May 2026 · Version 1.0

1. Identity of the controller(s)

Luxgap Sàrl — 2, rue de l'École, L-8376 Kahler, Luxembourg — VAT LU30886939 — RCS B231193 — operates this platform as joint controller with each organisation listed on the landing page. Each organisation determines the purposes of processing reports concerning it (legal compliance with EU Directive 2019/1937 and Luxembourg law of 16 May 2023).

📧 Data Protection Officer (DPO) : Julien Winkin · dpo@luxgap.com

2. What data we collect

From the whistleblower (you)

• Optional identity: name, email, phone (only if you provide them)
• Communication preference: platform code, email or none
• Report content: category, description, period, location, persons involved, attachments
• Technical data: hashed IP (SHA-256, never stored in clear), browser user agent, language preference (cookie lxg_wb_lang)

From third parties named in the report

• Names, functions and any information you provide about persons concerned by the alleged breach

3. Purposes & legal basis

Compliance with legal obligations · Art. 6(1)(c) GDPR

Operate a confidential reporting channel as required by EU Directive 2019/1937 and Luxembourg law of 16 May 2023.

Public interest task · Art. 6(1)(e) GDPR

Investigate and process reports of breaches of EU law.

Legitimate interest · Art. 6(1)(f) GDPR

Audit log of platform access for security and traceability (art. 18 Directive).

4. Confidentiality & access

Your identity is strictly confidential (art. 16 Directive 2019/1937). It is accessible only to:

• The consultant(s) of Luxgap assigned to the whistleblowing mandate of the concerned organisation
• Luxgap's CEO/admin for oversight
• External authorities only if you consent in writing or if disclosure is required by law

The identity of persons concerned by the report is equally protected (art. 22 GDPR + art. 16 Directive).

5. Retention period

• Open reports : until closure of the investigation
• Closed reports : 5 years from closure (legal proof + audit), then anonymisation or deletion
• Audit log : 5 years from closure
• Attachments : stored on EU servers, deleted with the report
• IP hash : deleted at closure

6. Your rights

Under the GDPR you have the rights of access (art. 15), rectification (art. 16), erasure (art. 17, with limits — investigation needs), restriction (art. 18), portability (art. 20), objection (art. 21).

To exercise these rights : email dpo@luxgap.com with your reference code. Anonymous reporters can use the reference code to access their report at any time.

If you believe your rights have not been respected, you can file a complaint with the Luxembourg supervisory authority : Commission nationale pour la protection des données (CNPD) — 15, boulevard du Jazz, L-4370 Belvaux — cnpd.public.lu.

7. Security measures

• EU hosting : servers located in France (OVHcloud)
• TLS 1.3 encryption for all communications
• SHA-256 hashed IPs — never stored in clear
• Reference code ~95 bits of entropy (URL-safe), never re-issued
• Strict access control by consultant assignment per organisation
• Full audit log of all consultations and changes (art. 18 Directive)
• AI processing : the optional translation feature (admin side only) uses Anthropic Claude API. The personal data of the reporter is not sent; only the textual content of the report. Anthropic's privacy policy.
• Public chat assistant : uses Anthropic Claude API for general questions on the platform. Conversation is stateless and not stored. No personal data should be entered.

8. International transfers

Personal data is processed within the EU. The Anthropic Claude API (used for admin translation and chat assistant) may transfer data to the United States. This transfer is covered by Standard Contractual Clauses (SCC) approved by the European Commission and the EU-US Data Privacy Framework (when applicable). No personal data of the reporter is sent to Anthropic for translation — only the textual content of the report itself.

9. Cookies

This platform uses strictly necessary cookies only :

• lxg_wb_lang — your language preference, 1 year, HttpOnly + SameSite=Lax

No tracking cookies, no third-party analytics, no advertising.

10. Automated decision-making

None. All reports are reviewed by a human consultant. Some optional tools assist the consultant (machine translation, drafting suggestions) but no decision concerning you is automated.

11. Updates to this notice

This notice may be updated to reflect changes in law or processing. The current version is dated above. Material changes will be communicated to active reporters via the platform.

12. Contact

For any question on processing : dpo@luxgap.com

For any question on the platform or to report a bug : whistleblowing@luxgap.com