Privacy Notice

For merchants, customers, partners and suppliers, you will find our privacy policy here.

Version 3.1, date of publication July 31, 2023

Edenred Luxembourg attaches great importance to the protection of the personal data that it has to process as controller in the course of its activities.

The processing covers all operations applied to the data that directly or indirectly helps identify a natural person, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

This document is intended to provide the data subjects with the information required by the applicable regulations and in particular by Regulation (EU)2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation or “GDPR”).

Edenred Luxembourg, a public limited company whose registered office is located at L-1855 Luxembourg, Avenue John F. Kennedy, 46a with RCS number B42434 and VAT number LU 154 77706 (hereinafter “Edenred Luxembourg”), represented by its Chief Executive Officer, Mr Olivier Bouquet, is responsible for the processing of personal data as part of its activity of issuing vouchers for the private sector.

The different processing operations are as follows:

• The management of Ticket Restaurant ;
• The management of Ticket Compliments ;
• The use of the website https://www.myedenred.lu (hereinafter the ‘the Myedenred Website’) and/or the application My Edenred Luxembourg (herinafter ‘the Myedenred Application’) ;
• The use of the website “http://www.edenred.lu” (hereinafter referred to as “the Edenred Website”), social networks and contact not included in the scope of other processing operations ;
• Security ;
• Statistics.

The persons whose personal data are processed by Edenred Luxembourg in its capacity as controller are hereinafter referred to individually as “the User” or collectively as “the Users”.

Avenue John F. Kennedy, 46a
L-1855 Luxembourg
Email: dpo.luxembourg@edenred.com
Tel.: +352 25 29 90 – Fax: +352 25 16 58

For any request relating to personal data, and in particular to exercise the rights referred to in Article V below, the User may contact:

Edenred Luxembourg
Privacy team
Avenue John F. Kennedy, 46a
L-1855 Luxembourg
Online form
Tel.: +352 25 29 90 – Fax: +352 25 16 58

1. Purpose

Edenred Luxembourg processes personal data for purposes relating to the management of electronic or paper meal vouchers published by it under the brand Ticket Restaurant (hereinafter “Ticket Restaurant”).

The management of Ticket Restaurant covers the following aspects:

• The management of Ticket Restaurant orders ;
• The publishing of Ticket Restaurant vouchers and their provision to the beneficiaries of Ticket Restaurant (hereinafter “the Beneficiaries of Ticket Restaurant”) ;
• The provision and activation of the card support allowing beneficiaries to use the electronic Ticket Restaurant vouchers (hereinafter ‘the Edenred Card’) ;
• The notification to the Beneficiaries of Ticket Restaurant every time the electronic Ticket Restaurant is loaded, and about the approaching expiry date, the available balance and the transactions made using electronic Ticket Restaurant ;
• The provision of information regarding the use of the Ticket Restaurant vouchers to the Beneficiaries of Ticket Restaurant in electronic form ;
• The secure use of Ticket Restaurant vouchers including the provision of various means to block the Edenred Card in case of loss or theft ;
• the processing of transactions made using Ticket Restaurant (following the “first in, first out” principle for electronic vouchers) and the reimbursement of merchants affiliated to the Edenred Luxembourg network who have accepted them as payment.

2. Legal basis of the processing

This processing is necessary for the legitimate interests pursued by Edenred Luxembourg and by the companies which have ordered Ticket Restaurant.

3. Data source

The personal data concerned are communicated by:

• The employer when ordering Ticket Restaurant vouchers for Beneficiaries of Ticket Restaurant ;
• the Beneficiaries of Ticket Restaurant themselves when using the Ticket Restaurant voucher ;
• the individuals authorised by the employers to use their Employer Space on the Myedenred Website or to communicate with Edenred Luxembourg as part of the management of Ticket Restaurant vouchers ;
• the individuals authorised by the merchants affiliated to the Ticket Restaurant network to use their Merchant Space on the Myedenred Website or to communicate with Edenred Luxembourg as part of the management of Ticket Restaurant vouchers.

4. Categories of data processed

The personal data communicated by the employer concerning Beneficiaries of Ticket Restaurant, as part of a personalized order, include:

• identification data:
  – necessary data: last name, first name, address ;
  – complementary data: landline and/or mobile phone number, email address ;
• personal characteristics:
  – necessary data: birth date, birth place, language ;
  – complementary data: title ;
• data relating to Ticket Restaurant vouchers associated with a Beneficiary of Ticket Restaurant: quantity, face value, validity period, point of distribution/delivery.

5. Data recipients

The personal data are exclusively intended for:

• the individuals and organisations in direct contact with Edenred Luxembourg requiring the data as part of the management of Ticket Restaurant ;
• the employers of the Beneficiaries of Ticket Restaurant as part of the management of Ticket Restaurant for members of their staff ;
• the Beneficiaries of Ticket Restaurant as part of the management of their Ticket Restaurant vouchers ;
• the authorities that require such data.

They are not shared with third parties.

The processors of Edenred Luxembourg include:

• for the management of Ticket Restaurant® : EDENRED Belgium SA, a company incorporated under Belgian law, whose registered office is located at 1160 Auderghem (Brussels) (Belgium), Boulevard du Souverain, 165-9 and registered under the Crossroads Bank for Entreprises under the number 0407.034.269.

6. Data transfer

Edenred Luxembourg ensures that your personal data collected for the previously stated purposes will not be transferred outside the European Union in the absence of an adequacy decision by the European Commission (article 45 of the GDPR) or the establishment of appropriate and adequate safeguards ensuring the security and protection of your personal data, in this case, standard contractual clauses (article 46 of the GDPR).

7. Decision based exclusively on automated processing, including profiling

The processing does not involve any decision based exclusively on automated processing, including profiling.

8. Retention period

Personal data are archived and access is limited as soon as they are no longer required for the management of Ticket Restaurant.

Personal data are kept for a period of 10 years after the closure of the employer’s file and, in the event of legal proceedings brought during this period, until all legal remedies have been exhausted.

9. Purpose

Edenred Luxembourg processes personal data for purposes relating to the management of electronic or paper gift vouchers published by it under the brand Ticket Compliments (hereinafter “Ticket Compliments”).

The management of Ticket Compliments covers the following aspects:

• the management of Ticket Compliments orders ;
• the publishing of Ticket Compliments gift vouchers and providing them to the beneficiaries of Ticket Compliments (hereinafter “the Beneficiaries of Ticket Compliments”) ;
• The provision and activation of the card support allowing beneficiaries to use the electronic Ticket Compliments gift vouchers (hereinafter ‘the Edenred Card’) ;
• The notification to the Beneficiaries of Ticket Compliments every time the electronic Ticket Compliments is loaded, and about the approaching expiry date, the available balance and the transactions made using electronic Ticket Compliments ;
• The provision of information regarding the use of the Ticket Compliments gift vouchers to the Beneficiaries of Ticket Compliments in electronic form ;
• The secure use of Ticket Compliments gift vouchers including the provision of various means to block the Edenred Card in case of loss or theft ;
• the processing of transactions carried out using Ticket Compliments (following the “first in, first out” principle for electronic vouchers) and the reimbursement of merchants affiliated to the Edenred Luxembourg network who have accepted them as payment.

10. Legal basis of the processing

This processing is necessary for the legitimate interests pursued by Edenred Luxembourg and by the companies which have ordered Ticket Compliments.

11. Data source

The personal data concerned are communicated by:

• The company when ordering Ticket Compliments for the Beneficiaries of Ticket Compliments ;
• The Beneficiaries of Ticket Compliments themselves when using the Ticket Compliments gift vouchers ;
• the individuals authorised by the company granting the Ticket Compliments gift vouchers to use their Customer Space on the Myedenred Website or to communicate with Edenred Luxembourg as part of the management of Ticket Compliments gift vouchers ;
• the individuals authorised by the merchants affiliated to the Ticket Restaurant network to use their Merchant Space on the Myedenred Website or to communicate with Edenred Luxembourg as part of the management of Ticket Compliments gift vouchers.

12. Categories of data processed

The personal data communicated by the employer concerning Beneficiaries of Ticket Compliments®, as part of a personalized order, include:

• identification data:
  – necessary data: last name, first name, address, national register number ;
  – complementary data: landline and/or mobile phone number, email address ;
• personal characteristics:
  – necessary data: birth date, birth place, language ;
  – complementary data: title ;
• data relating to the Ticket Compliments gift vouchers associated with a Beneficiary of Ticket Compliments: quantity, face value, validity period, point of distribution/delivery.

13. Data recipients

The personal data are exclusively intended for:

• the individuals and organisations in direct contact with Edenred Luxembourg requiring the data as part of the management of Ticket Compliments gift vouchers ;
• the companies offering Ticket Compliments gift vouchers as part of the management of Ticket Compliments for members of their staff or their business relations ;
• the Beneficiaries of Ticket Compliments gift vouchers as part of the management of their Ticket Compliments gift vouchers ;
• the authorities that require such data.

They are not shared with third parties.

The processors of Edenred Luxembourg include:

• for the management of Ticket Compliments : EDENRED Belgium SA, a company incorporated under Belgian law, whose registered office is located at 1160 Auderghem (Brussels) (Belgium), Boulevard du Souverain, 165-9 and registered under the Crossroads Bank for Entreprises under the number 0407.034.269.

14. Data transfer

Edenred Luxembourg ensures that your personal data collected for the previously stated purposes will not be transferred outside the European Union in the absence of an adequacy decision by the European Commission (article 45 of the GDPR) or the establishment of appropriate and adequate safeguards ensuring the security and protection of your personal data, in this case, standard contractual clauses (article 46 of the GDPR).

15. Decision based exclusively on automated processing, including profiling

The processing does not involve any decision based exclusively on automated processing, including profiling.

16. Retention period

Personal data are archived and access is limited as soon as they are no longer necessary for the management of Ticket Compliments.

Personal data are kept for a period of 10 years after the closure of the employer’s file and, in the event of legal proceedings brought during this period, until all legal remedies have been exhausted.

17. Purpose

Edenred Luxembourg processes the personal data of Users of the Myedenred Website and/or the Myedenred Application in order to enable the User to create a personal account that gives him access to the balance of Ticket Restaurant and/or Ticket Compliments from which he benefits as well as to the history of transactions made using his Edenred Card (hereinafter ‘the Myedenred Personal Account’). The User can manage his Edenred Card there and in particular block it in the event of loss or theft as well as manage his profile and rectify, if necessary, his personal data.

The Myedenred Website and the Myedenred Application also allow Users to locate affiliates accepting the Edenred Card as payment and to benefit from the promotional offers displayed on it.

18. Legal basis of the processing

This processing is based on the User’s prior consent given by registering on the MyEdenred Website and/or through the Myedenred Application.

The use of the Myedenred Website and/or the Myedenred Application is in no way subject to the acceptance of any form of promotional communication.

The User has the right to unsubscribe and therefore delete his Myedenred Personal Account at any time, by contacting Edenred Luxembourg.

The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof.

19. Data source

The personal data concerned are communicated by the Users of the Myedenred Website and/or the Myedenred Application when registering and using the Myedenred Website and/or the Myedenred Application.

20. Categories of data processed

The personal data communicated by the Users of the Myedenred Website and/or the Myedenred Application include, as the case may be:

• identification data: last name, first name, address, landline and/or mobile number, email address, username, password ;
• personal characteristics: birth date, title, language ;
• electronic identification data: IP addresses, cookies ;
• data relating to the behaviour and habits of Users when using the Myedenred Website and/or the Myedenred Application ;
• data relating to incidents that may occur while using the Myedenred Website and/or the Myedenred Application.

21. Data recipients

The personal data are exclusively intended for:

• the individuals and organisations in direct contact with Edenred Luxembourg requiring the data to manage the Myedenred Website and/or the Myedenred Application ;
• the Users of the Myedenred Website and/or the Myedenred Application ;
• the authorities that require such data.

They are not shared with third parties.

The processors of Edenred Luxembourg include:

• For application development and support, for hosting information systems and the Help Centre accessible on the Edenred Website: EDENRED Belgium SA, a company incorporated under Belgian law, whose registered office is located at 1160 Auderghem (Brussels) (Belgium), Boulevard du Souverain, 165-9 and registered under the Crossroads Bank for Entreprises under the number 0407.034.269.

22. Data transfer

Edenred Luxembourg ensures that your personal data collected for the previously stated purposes will not be transferred outside the European Union in the absence of an adequacy decision by the European Commission (article 45 of the GDPR) or the establishment of appropriate and adequate safeguards ensuring the security and protection of your personal data, in this case, standard contractual clauses (article 46 of the GDPR).

23. Decision based exclusively on automated processing, including profiling

The processing does not involve any decision based exclusively on automated processing, including profiling.

24. Retention period

Personal data are archived and access is limited as soon as the User unsubscribes.

Personal data are kept for a period of 10 years after the closure of the employer’s or granting Ticket Compliments’s file and, in the event of legal proceedings brought during this period, until all legal remedies have been exhausted.

25. Purpose

Edenred Luxembourg processes the personal data of the Users of the Edenred Website as well as any User who deals with the company through any of the offered channels to optimise browsing on the Edenred Website or to best meet the requests of the persons contacting it for processing activities other than those specified above.

Edenred Luxembourg processes the personal data of Users of social networks who follow the pages of Edenred Luxembourg and who publish personal data designated as public or who come into contact with Edenred Luxembourg through these social networks.

26. Legal basis of the processing

This processing is necessary for the legitimate interests pursued by Edenred Luxembourg, whose legitimate interest is to meet the expectations of Users as effectively as possible.

27. Data source

The personal data concerned are communicated by the Users of the Edenred Website and/or communication channels offered by Edenred Luxembourg and/or the Edenred Luxembourg’s pages on social networks.

28. Categories of data processed

The personal data communicated by the Users of the Edenred Website and/or the channels offered by Edenred Luxembourg and/or Edenred Luxembourg’s pages on social networks, are, as the case may be:

• identification data : last name, first name, address, landline and/or mobile number, email address, function, employer ;
• personal characteristics: title, language ;
• electronic identification data: IP addresses, cookies ;
• data relating to the behaviour and habits of Users when using the Edenred Website ;
• personal data designated as public on social networks ;
• data relating to incidents that may occur while using the Edenred Website and/or the communication channels offered by Edenred Luxembourg.

29. Data recipients

The personal data are exclusively intended for:

• the individuals and organisations in direct contact with Edenred Luxembourg requiring the data for the management of the Edenred Website and/or the communication channels offered by Edenred Luxembourg and/or Edenred Luxembourg’s pages on social networks, and to respond to the requests made ;
• the Users of the Edenred Website and/or communication channels offered by Edenred Luxembourg and/or Edenred Luxembourg’s pages on social networks ;
• the authorities that require such data.

They are not shared with third parties.

The processors of Edenred Luxembourg include:

• For application development and support, for hosting information systems and the Help Centre accessible on the Edenred Website: EDENRED Belgium SA, a company incorporated under Belgian law, whose registered office is located at 1160 Auderghem (Brussels) (Belgium), Boulevard du Souverain, 165-9 and registered under the Crossroads Bank for Entreprises under the number 0407.034.269.

30. Data transfer

Edenred Luxembourg garantit que vos données personnelles collectées pour les finalités précédemment énoncées ne seront pas transférées en dehors de l’Union européenne en l’absence d’une décision d’adéquation de la Commission européenne (article 45 du RGPD) ou de la mise en place de garanties appropriées et adéquates assurant la sécurité et la protection de vos données personnelles, en l’occurrence des clauses contractuelles types (article 46 du RGPD).

31. Decision based exclusively on automated processing, including profiling

The processing does not involve any decision based exclusively on automated processing, including profiling.

32. Retention period

The personal data of Users with whom Edenred Luxembourg has no contractual relationship are kept, and access to these data is limited, for a period of 5 years from the last contact.

The personal data of Users with whom Edenred Luxembourg has a contractual relationship are kept, and access to these data is limited, for a period of 10 years and, in the event of legal proceedings brought during this period, until all legal remedies have been exhausted.

33. Purpose

Edenred Luxembourg processes the personal data of Users of the Myedenred Website and/or the Myedenred Application to promote its own products and/or services.

34. Legal basis of the processing

This processing is based on the User’s consent that he gives in advance by checking the opt-in box specifically dedicated to such processing.

The use of the Ticket Restaurant, the Tickets Compliments, the Myedenred Website, the Myedenred Application is in no way subject to the acceptance of any form of promotional communication.

The User has the right to withdraw his consent at any time.

It is as easy for the User to withdraw as to give consent. To withdraw his consent, the User may simply uncheck the box used to confirm his opt-in. This box is in his/her Myedenred Personal Account provided for customers on the Myedenred Website where a User can manage his/her account.

The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof.

An unsubscribe link is included in each electronic communication sent to the User.

35. Data source

The personal data concerned are communicated by the Users of the Myedenred Website and/or the Myedenred Application when registering and using the Myedenred Website and/or the Myedenred Application.

36. Categories of data processed

The personal data communicated by the Users of the Myedenred Website and/or the Myedenred Application  include, as the case may be:

• identification data: last name, first name, address, landline and/or mobile number, email address, username, password ;
• personal characteristics: birth date, title, language ;
• electronic identification data: IP addresses, cookies ;
• data relating to the behaviour and habits of Users  when using the Myedenred Website and/or the Myedenred Application ;
• data relating to incidents that may occur while using the Myedenred Website and/or the Myedenred Application.

37. Data recipients

The personal data are exclusively intended for:

• the individuals and organisations in direct contact with Edenred Luxembourg requiring the data to promote the products and/or services of Edenred Luxembourg ;
• the Users of the Myedenred Website and/or the Myedenred Application ;
• the authorities that require such data.

They are not shared with third parties.

The processors of Edenred Luxembourg include:

• For promotional communications : EDENRED Belgium SA, a company incorporated under Belgian law, whose registered office is located at 1160 Auderghem (Brussels) (Belgium), Boulevard du Souverain, 165-9 and registered under the Crossroads Bank for Entreprises under the number 0407.034.269.

38. Data transfer

Edenred Luxembourg ensures that your personal data collected for the previously stated purposes will not be transferred outside the European Union in the absence of an adequacy decision by the European Commission (article 45 of the GDPR) or the establishment of appropriate and adequate safeguards ensuring the security and protection of your personal data, in this case, standard contractual clauses (article 46 of the GDPR).

39. Decision based exclusively on automated processing, including profiling

The processing does not involve any decision based exclusively on automated processing, including profiling.

40. Retention period

Personal data are archived and access is limited as soon as the User withdraws his consent to the processing by Edenred Luxembourg of his personal data to promote his own products and/or services.

Personal data are stored for a period of 2 years and, in the event of legal proceedings during this period, until all legal remedies have been exhausted.

41. Purpose

Edenred Luxembourg processes the personal data of Users of the Myedenred Website and/or the Myedenred Application to promote the products and/or services of third-party partners.

42. Legal basis of the processing

This processing is based on the User’s consent that he gives in advance by checking the opt-in box specifically dedicated to such processing.

The use of the Ticket Restaurant, the Tickets Compliments, the Myedenred Website, the Myedenred Application is in no way subject to the acceptance of any form of promotional communication.

The User has the right to withdraw his consent at any time.

It is as easy for the User to withdraw as to give consent. To withdraw his consent, the User may simply uncheck the box used to confirm his opt-in. This box is in the Myedenred Personal Account provided for customers on the Myedenred Website where the User can manage his/her account. The User may also contact Edenred Luxembourg for this purpose.

The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof.

An unsubscribe link is included in each electronic communication sent to the User.

43. Data source

The personal data concerned are communicated by the Users when registering and using the Myedenred Website and/or the Myedenred Application.

44. Categories of data processed

The personal data communicated by the Users of the Myedenred Website and/or the Myedenred Application include, as the case may be:

• identification data: last name, first name, address, landline and/or mobile number, email address, username, password ;
• personal characteristics: birth date, title, language ;
• electronic identification data: IP addresses, cookies ;
• data relating to the behaviour and habits of Users  when using the Myedenred Website and/or the Myedenred Application ;
• data relating to incidents that may occur while using the Myedenred Website and/or the Myedenred Application.

45. Data recipients

The personal data are exclusively intended for:

• the individuals and organisations in direct contact with Edenred Luxembourg requiring the data to promote the products and/or services of third-party partners ;
• the Users of the Myedenred Website and/or the Myedenred Application ;
• the authorities that require such data.

They are not communicated to third parties, including third-party partners.

The processors of Edenred Luxembourg include, as the case may be:

• For promotional communications : EDENRED Belgium SA, a company incorporated under Belgian law, whose registered office is located at 1160 Auderghem (Brussels) (Belgium), Boulevard du Souverain, 165-9 and registered under the Crossroads Bank for Entreprises under the number 0407.034.269.

46. Data transfer

Edenred Luxembourg ensures that your personal data collected for the previously stated purposes will not be transferred outside the European Union in the absence of an adequacy decision by the European Commission (article 45 of the GDPR) or the establishment of appropriate and adequate safeguards ensuring the security and protection of your personal data, in this case, standard contractual clauses (article 46 of the GDPR).

47. Decision based exclusively on automated processing, including profiling

The processing does not involve any decision based exclusively on automated processing, including profiling.

48. Retention period

Personal data are archived and access is limited as soon as the User withdraws his consent to the processing by Edenred Luxembourg of his personal data to promote the products and/or services of third party partners.

Personal data are then stored for a period of 2 years and, in the event of legal proceedings during this period, until all legal remedies have been exhausted.

49. Purpose

Edenred Luxembourg processes personal data of Users to guarantee the security of their personal data and in particular for the purpose of prevention, detection and circumvention of faults and fraud.

50. Legal basis of the processing

This processing is necessary for the legitimate interests pursued by Edenred Luxembourg, whose legitimate interest is to guarantee the security of the personal data for which it is responsible.

51. Data source

The personal data concerned are communicated by the Users.

52. Categories of data processed

The personal data communicated by the companies granting Ticket Restaurant and/or Tickets Compliments concerning the beneficiaries thereof, as the case may be:

• identification data:
  – necessary data: last name, first name, address, national register number ;
  – complementary data: landline and/or mobile phone number, email address ;
• personal characteristics: birth date, birth place, title, language ;
• data relating to Ticket Restaurant and/or Tickets Compliments associated with a Beneficiary of these Vouchers and/or Services: quantity, face value, validity period, point of distribution/delivery ;

The personal data communicated directly by the Users, that is, as the case may be:

• identification data : last name, first name, address, landline and/or mobile number, email address, username, password ;
• personal characteristics: birth date, title, language ;
• electronic identification data: IP addresses, cookies ;
• data relating to transactions made using Ticket Restaurant and/or Tickets Compliments ;
• data relating to the behaviour and habits of Users when using the Edenred Luxembourg’s websites, platforms and applications;
• data relating to incidents that may occur while using the Edenred Luxembourg’s cards, websites, platforms and applications.

53. Data recipients

The personal data are exclusively intended for:

• the individuals and organisations in direct contact with Edenred Luxembourg requiring the data to guarantee the security of the personal data of Users ;
• the Users ;
• the authorities that require such data.

They are not shared with third parties.

The processors of Edenred Luxembourg include:

• For the management of Ticket Restaurant® and Ticket Compliments®, as well as for the application development and support, for hosting information systems and the Help Centre accessible on the Edenred Website: EDENRED Belgium SA, a company incorporated under Belgian law, whose registered office is located at 1160 Auderghem (Brussels) (Belgium), Boulevard du Souverain, 165-9 and registered under the Crossroads Bank for Entreprises under the number 0407.034.269.

54. Data transfer

Edenred Luxembourg ensures that your personal data collected for the previously stated purposes will not be transferred outside the European Union in the absence of an adequacy decision by the European Commission (article 45 of the GDPR) or the establishment of appropriate and adequate safeguards ensuring the security and protection of your personal data, in this case, standard contractual clauses (article 46 of the GDPR).

55. Decision based exclusively on automated processing, including profiling

The processing does not involve any decision based exclusively on automated processing, including profiling.

56. Retention period

Personal data are retained, and access to these data is limited, for a period of 5 or 10 years, depending on the applicable limitation period and, in the event of legal proceedings brought during this period, until all legal remedies have been exhausted.

57. Purpose

Edenred Luxembourg processes the personal data of Users for research and statistical purposes, including marketing.

58. Legal basis of the processing

This processing is necessary for the legitimate interests pursued by Edenred Luxembourg, whose legitimate interest is to improve the quality of its services to Users.

59. Data source

The personal data concerned are communicated by the Users.

60. Categories of data processed

The personal data communicated by the companies granting Ticket Restaurant and/or Tickets Compliments concerning the beneficiaries thereof, as the case may be:

• identification data:
  – necessary data: last name, first name, address, national register number ;
  – complementary data: landline and/or mobile phone number, email address ;
• personal characteristics: birth date, birth place, title, language ;
• data relating to Ticket Restaurant and/or Tickets Compliments associated with a Beneficiary of these Vouchers and/or Services: quantity, face value, validity period, point of distribution/delivery.

The personal data communicated directly by the Users, that is, as the case may be:

• identification data : last name, first name, address, landline and/or mobile number, email address, username, password ;
• personal characteristics: birth date, title, language ;
• electronic identification data: IP addresses, cookies ;
• data relating to transactions made using Ticket Restaurant and/or Tickets Compliments ;
• data relating to the behaviour and habits of Users when using the Edenred Luxembourg’s websites, platforms and applications;
• data relating to incidents that may occur while using the Edenred Luxembourg’s cards, websites, platforms and applications.

61. Data recipients

The personal data are exclusively intended for:

• the individuals and organisations in direct contact with Edenred Luxembourg requiring the data to guarantee the security of the personal data of Users ;
• the Users ;
• the authorities that require such data.

They are not shared with third parties.

The processors of Edenred Luxembourg include:

• For the management of Ticket Restaurant® and Ticket Compliments®, as well as for the application development and support, for hosting information systems and the Help Centre accessible on the Edenred Website: EDENRED Belgium SA, a company incorporated under Belgian law, whose registered office is located at 1160 Auderghem (Brussels) (Belgium), Boulevard du Souverain, 165-9 and registered under the Crossroads Bank for Entreprises under the number 0407.034.269.

62. Data transfer

Edenred Luxembourg ensures that your personal data collected for the previously stated purposes will not be transferred outside the European Union in the absence of an adequacy decision by the European Commission (article 45 of the GDPR) or the establishment of appropriate and adequate safeguards ensuring the security and protection of your personal data, in this case, standard contractual clauses (article 46 of the GDPR).

63. Decision based exclusively on automated processing, including profiling

The processing does not involve any decision based exclusively on automated processing, including profiling.

64. Retention period

Personal data are retained, and access to these data is limited, for a period of 5 or 10 years, depending on the applicable limitation period and, in the event of legal proceedings brought during this period, until all legal remedies have been exhausted.

Edenred Luxembourg may not refuse to comply with Users’ requests under this Article V unless it can demonstrate that it is unable to identify the User concerned.
The identification of the User may in particular be carried out by means of a copy of his identity document.

As soon as possible and at the latest within one month from the receipt of the request, Edenred Luxembourg provides the User exercising one or more of the rights referred to below, with information on the measures taken following the request. The one-month period can be extended by two months, given the complexity and the number of requests. In the latter case, Edenred Luxembourg informs the User of the extension and the reasons justifying it.

When the User makes his request in electronic form, the information is provided by Edenred Luxembourg electronically where possible and unless the User requests otherwise.

If Edenred Luxembourg does not respond to the User’s request, it shall promptly inform the User, at the latest within one month from receipt of the request for reasons of this refusal and the possibility for the User to lodge a complaint with the data protection authority and a judicial appeal.

The requests under this Article V shall be free of charge except where a User’s requests are manifestly unfounded or excessive, in particular because of their repetitive nature. In the latter case, Edenred Luxembourg may require the payment of reasonable fees that take into account the administrative costs related to these requests or refuse to act on them.

Where Edenred Luxembourg has reasonable doubts concerning the identity of the User making the request, may request the provision of additional information necessary to confirm the identity of the data subject.

The User has the right to lodge a complaint with the data protection authority of the Grand-Duchy of Luxembourg (CNPD – Commission Nationale pour la Protection des données) (Art. 77 GDPR). A form is available on the website of the CNPD: https://cnpd.public.lu/en/support/contact.html
The User shall then send the complaint by post to the CNPD address : 1, avenue du Rock’n’Roll à 4361 Esch-sur-Alzette.

The User has the right to obtain from Edenred Luxembourg confirmation as to whether or not the personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients outside the European Economic Area or in international organisations;
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• the existence of the right to request from Edenred Luxembourg rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
• the right to lodge a complaint with the data protection authority;
• where the personal data are not collected from the data subject, any available information as to their source;
• the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the User.

Where the personal data are transferred to a country outside the European Economic Area or to an international organisation, the User shall have the right to be informed of the appropriate safeguards relating to the transfer.

The User has the right to obtain, free of charge, from Edenred Luxembourg a copy of the personal data being processed. This right, however, may not affect the rights and freedoms of others, including the trade secrets of Edenred Luxembourg or its intellectual property rights.
Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
Edenred Luxembourg may require the payment of reasonable fees based on the administrative costs, fixed at EUR 25.00, for any additional copies requested by the data subject.

The User shall have the right to obtain, free of charge, from Edenred Luxembourg the rectification of inaccurate personal data concerning him or her, without any undue delay.

Taking into account the purposes of the processing, the User shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

The User shall have the right to obtain from Edenred Luxembourg the erasure of personal data concerning him or her without undue delay and Edenred Luxembourg shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• the User withdraws consent on which the processing is based and where there is no other legal ground for the processing;
• the User objects to the processing pursuant hereto;
• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation to which Edenred Luxembourg is subject;
• the personal data have been collected in relation to the offer of information society services to children.

Where Edenred Luxembourg has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, Edenred Luxembourg, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the User has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing to which Edenred Luxembourg is subject;
• for the establishment, exercise or defence of legal claims;
• for statistical purposes in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing.

The User shall have the right to obtain from Edenred Luxembourg restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the User, for a period enabling Edenred Luxembourg to verify the accuracy of the personal data;
• the processing is unlawful and the User opposes the erasure of the personal data and requests the restriction of their use instead;
• Edenred Luxembourg no longer needs the personal data for the purposes of processing, but they are required by the User for the establishment, exercise or defence of legal claims;
• the User has objected to processing based on Edenred Luxembourg’s legitimate interests pending the verification whether these interests override those of the User.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the User’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

A User who has obtained restriction of processing shall be informed by Edenred Luxembourg before the restriction of processing is lifted.

Edenred Luxembourg shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance herewith to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. Edenred Luxembourg shall inform the User about those recipients if the data subject requests it.

Subject to the rights and freedoms of third parties, the Users shall have the right to receive the personal data concerning them, which they have provided to Edenred Luxembourg, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from Edenred Luxembourg, where:

• the processing is based on consent, or on a contract; and
• the processing is performed using automated means.

In exercising his or her right to data portability, the User shall have the right to have the personal data transmitted directly from Edenred Luxembourg to another controller, where technically feasible.

The exercise of the right to portability of personal data is without prejudice to the provisions on the right to erasure. This right shall not apply to processing necessary for the performance of a task carried out in the public interest.

The User shall have the right to object, on grounds relating to his particular situation, at any time to processing of personal data concerning him which is based on legitimate interests pursued by Edenred Luxembourg.

Edenred Luxembourg shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the User or for the establishment, exercise or defence of legal claims.

The User shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or similarly significantly affects him, except when the decision:

• is authorised by the regulations to which Edenred Luxembourg is subject and which also lays down suitable measures to safeguard the User’s rights and freedoms and legitimate interests; or
• is necessary for entering into, or performance of, a contract between the User and Edenred Luxembourg; or
• is based on the explicit consent of the User.

In the last two cases, Edenred Luxembourg shall implement suitable measures to safeguard the User’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of Edenred Luxembourg, to express his point of view and to contest the decision.