The English version of the information notice is an internal translation provided for information purposes only. Please note that in case of divergences, it is the French version that prevails.
INTRODUCTION
In accordance with Articles 12, 13 and 14 of the EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereafter the “GDPR”), this Privacy Notice (hereafter “the Notice”) explains how the Luxembourg Centre for Educational Testing (LUCET) of the University of Luxembourg processes Personal Data in relation with the collection of the personal data of students in Luxembourg in the course of the Luxembourg school monitoring programme “Epreuves standardisées” (ÉpStan).
LUCET, as part of its mission, collects on an annual basis results of – paper or online – based tests and questionnaires from students in Luxembourg enrolled in grade levels 1 (C2.1/P1/Stage 1), 3 (C3.1/P3/Stage 3) and 5 (C4.1/P5/Stage 5) of primary education and in grade levels 7 (7ème/S1) and 9 (5ème/S3) of secondary education, together with some data provided by their parents via questionnaires, in the context of ÉpStan, in order to be able to assess the performance, fairness and long-term development of the Luxembourg school system.
1) WHO IS THE CONTROLLER?
The University of Luxembourg, as public higher education and research establishment, operating under the supervision of the Ministry of Research and Higher Education, processes your personal data as controller in the meaning of the GDPR for the purposes described below, acting on behalf of LUCET. LUCET is integrated to the University of Luxembourg.
The University has appointed a DPO reachable during working hours and an email address is available: dpo@uni.lu. Further information is provided on the website of the University Data Protection Office – University of Luxembourg I Uni.lu
2) WHY DO WE PROCESS YOUR PERSONAL DATA, WHAT CATEGORIES OF PERSONAL DATA ARE PROCESSED AND WHAT IS THE LEGAL BASIS?
In the context of ÉpStan, the University of Luxembourg proceeds to the annual collection of personal data of students enrolled in Luxembourg in grade levels 1, 3, 5, 7, and 9 on the basis of paper or tablet/computer-based competence tests and questionnaires. The personal data is collected via paper-based tests and a digital coding mask in grades 1, 3, and 5 of primary education and via the OASYS (online assessment system) platform for grades 7 and 9 of secondary education. The OASYS platform is hosted on the servers of the University of Luxembourg. Data is also collected from the parents of the students via a paper-based questionnaire.
In particular, the University of Luxembourg processes the following personal data:
- ÉpStan code (pseudonym)
- Results on competence tests performed in grade 1 (1/P1/Stage 1): mathematics; listening comprehension in Luxembourgish, German and French; early literacy in Luxembourgish, German and French)
- Results on competence tests performed in grade 3 (1/P3/Stage 3): mathematics; listening comprehension in German and French; Reading comprehension in German and French)
- Results on competence tests performed in grade 5 (1/P5/Stage 5): mathematics; reading comprehension in German and French)
- Results on competence tests performed in grade 7 (7ème/S1) and 9 (5ème/S3): mathematics; reading comprehension in German and French)
- Data from the student questionnaire: background characteristics (e.g. gender; language(s) spoken at home); motivation (e.g. academic self-concept and academic interest in general and related to a specific subject); anxiety in general and related to a specific subject;); school satisfaction (e.g. class climate); teacher-student relationship, etc.
- Data from the parent questionnaire: background characteristics (e.g. socio-economic; migration); educational pathway of the child; early care of the child, experiences and attitudes regarding the language of literacy acquisition etc.
The purpose of the personal data processing is to enable the external assessment of the quality of the educational system in terms of performance, fairness and long-term development of the Luxembourg school system. Moreover, the personal data collected may be important for further research projects related to the monitoring of the Luxembourg school system. A matching of data from different sources (e.g. data provided by ÉpStan and school grades) is possible only upon provision of the consent by the legal representatives of the students concerned.
The personal data relating to ÉpStan will be processed in accordance with GDPR and the Luxembourg Act of 1 August 2018 on Data Protection. The legal basis for the processing of personal data in the context of ÉpStan is laid down in Article 6 (1) GDPR:
e) processing is necessary for the performance of a task carried out by the University in the public interest; the results of ÉpStan will be useful for the monitoring of the performance of the Luxembourg school system. This school monitoring is part of the structural mission of LUCET. Indeed, the yearly data collection is part of the external evaluation of the quality of Luxembourg’s school system. Beyond the students’ performance and motivation, other (structural) factors that can impact the educational quality are reported, as well as the impact of major educational policy changes, and the (long-term) impact of educational decisions.
3) HOW DO WE PROTECT YOUR PERSONAL DATA?
In order to protect the confidentiality of the students’ data, all students receive a one-off number or letter code for each test that does not in any way reveal their identity. Only this code will be used by the University of Luxembourg to evaluate test and survey data. To follow student development over time, without jeopardising the students’ anonymity in the process, every student also receives a unique identification number that does not change over the school years. The “key” that enables identification numbers to be allocated to students is securely stored by the company itrust consulting s.à r.l. as a trusted third party (TTP). This ensures that neither LUCET is able to access students’ identities, nor can the Ministry of Education access test results of individual students. In order for class and subject teachers to be able to allocate results to the students in their classes, they receive a list before the ÉpStan administration enabling them to link the respective number or letter code to their students. Neither LUCET nor the Ministry of Education have access to this list, as it is provided by itrust and can only be accessed via a secured digital platform by the school/cycle coordinator responsible for the management of the ÉpStan in the schools.
In case of use of the personal data in further research projects in a similar area, it will be ensured that the concerned research team will not have access to the “key” that allows the identification of the students.
4) WHO ARE THE RECIPIENTS OF YOUR PERSONAL DATA?
The pseudonymised data are accessible only via the LUCET team of the University working on ÉpStan.
Only itrust consulting s.à r.l. will have access to the “key” enabling identification numbers to be allocated to students.
The class and subject teachers will have access both to this “key” and to the results of their students.
In case of use of the data for further research projects, the concerned research team of the University of Luxembourg will have access to the data in an anonymised or pseudonymised format.
5) DO WE TRANSFER YOUR PERSONAL DATA OUTSIDE OF THE EUROPEAN UNION?
The Personal Data is processed only within the European Union.
6) HOW LONG DO WE STORE YOUR PERSONAL DATA?
The retention period of the personal data is 15 years as from the last testing point in grade 9, including class repetitions.
7) WHAT ARE YOUR RIGHTS WITH REGARD TO THE PROCESSING OF YOUR PERSONAL DATA?
According to the GDPR, you benefit notably from the following rights if the conditions for their exercise are met: right to be informed, right to access to your personal data, right to rectification, right to erasure, right to restrict the scope of the processing, right to object, right to data portability, right to lodge a complaint.
If you wish to have access to your child’s ÉpStan results related to the ongoing school year, you should contact the current teacher of the class (or the régent if your child is in secondary education).
If you wish to have access to your child’s Épstan results related to previous ÉpStan assessments (older than the ongoing school year), you should fill and sign this template of request and send it to the teacher of the class (or to the régent). The teacher/régent will verify your eligibility as a legal representative to access the results and will then forward your request to the ÉpStan coordinator of the school/cycle who will transfer it to itrust. Itrust as administrator of the ÉpStan TTP platform can then link your child’s personal data to his/her ÉpStan identification number and notify LUCET. LUCET will retrieve the requested feedback documents based on this identification number and transfer them to the current teacher/régent who will then forward them to you. Please note that your written consent is required for itrust to process your personal data.
If you want to exercise your other rights, please contact the DPO of MENJE at dpo@men.lu.
8) HOW CAN YOU LODGE A COMPLAINT?
If you consider that the processing of personal data relating to you infringes the GDPR, you will have the right – without prejudice to any other administrative or judicial remedy – to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.
In Luxembourg, the competent authority is the Commission Nationale pour la Protection des Données (CNPD).
Contact of the CNPD:
Commission Nationale pour la Protection des Données
15, Boulevard du Jazz
Service des réclamations
L-4370 Esch-sur-Alzette
Tel. : (+352) 26 10 60 -1
You can also use their contact form at: https://cnpd.public.lu/fr/support/contact.html
9) APPLICABLE LAW – JURISDICTION
The present Notice shall be governed and construed in accordance with the Luxembourgish law.
Any dispute concerning the existence, interpretation or performance of this Notice which cannot be settled amicably, shall fall within the jurisdiction of the Courts of Luxembourg City, without prejudice to the rights of the Data Subjects to bring the matters before the court where he or she has her place of residence as well as its right to lodge a complaint with the supervisory authority.
Version of 15 December 2025