(only available in English)

Your personal data will be processed in this research project in compliance with the GDPR, that is, the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. In this notice we provide you with the details about that.

Identity of the data controller

The data controller is the entity who determines the purposes and means of processing of your personal data. In the case of this research project the data controller are jointly:

Luxembourg Institute of Science and Technology (LIST) with offices located at 5, avenue des Hauts Fourneaux in L-4362 Esch-sur-Alzette, Grand-Duché de Luxembourg. The Data Protection Officer of LIST can be contacted via email: dpo@[at]list.lu. The Principal Investigators in charge of the project are M. Daniel Koster (daniel.koster[at]list.lu) and Dr Yannick Naudet (yannick.naudet[at]list.lu).

CREOS Luxembourg S.A., with offices located at 105 rue de Strassen, L-2555 Luxembourg, Grand-Duché de Luxembourg. The Data Protection Officer of CREOS can be contacted via email: dpo[at]creos.net. The Principal Investigator in charge of the project is M. Nicolas Back (nicolas.back[at]creos.lu).

University of Luxembourg / SnT, with offices located at 2, Avenue de l'Université, L-4365 Esch-sur-Alzette, Grand-Duché de Luxembourg. The Data Protection Officer of SnT can be contacted via email: dpo[at]uni.lu. The Principal Investigator in charge of the project is Dr Gilbert Fridgen (gilbert.fridgen[at]uni.lu).

Categories of personal data we collect

Please find here below a list of personal data we will collect and process about you:

• E-mail address, username, password, household composition, geographical information (commune), building surface area;
• Smart meters data related to your Smarty+ account (if you decide to take part in the Smarty+ campaign and authorize CREOS to transfer us this data);
• Technical data: Smarty+ UserID, access logs including access times;
• Survey answers about electrical devices: appliances and usage, heating system, electric vehicles, photovoltaic systems.;

Purpose and legal basis for processing

Your personal data will be processed for the following purposes:

• scientific research for the purpose of better understanding households’ energy consumption behaviour and their energy flexibility potential, for better future integration in operators’ electricity grid management policy.
• providing you access to the smart meter data platform to visualize and/or download your own consumption data and the analysis results (for example, regarding the load disaggregation);
• to follow-up and contact you, if necessary, to inform you on changes of the privacy notice and/or related procedures to handle your personal data, to renew your consent, if needed, and/or to inform you of new functions of the smart meter data platform or of the progress of the smarty+ campaign.

The legal basis for such processing is:

• For CREOS, analysis of the grid user sensitivity to the grid distribution flexibility and efficiency is part of the response to a legal obligation for the grid operator, with the obligation to propose tariffs that will promote the flexibility as per articles 5 (4) and 18 from "Règlement ILR/E20/22 du 26 mai 2020".

Consent provided by the research participant: we request your consent in specific cases, that are (i) when you decide to participate in the Smarty+ campaign and provide us with the smart meters data related to your account in the Smarty+ app, (ii) when you authorize us to process your personal data in the framework on the project, including the analysis of the smart meter data, (iii) to update you on the progress of the smarty+ campaign in our project and when new functions and insights are available for you.

Share of your personal data with third parties

Your personal data will be shared among the research team of the project, only. Other parties with access to some of your data are:

• the University of Luxembourg / SnT will receive your smart meter data and the replies your provided to the survey in a pseudonymous way, which means that the Partner will not be able to directly identify you.

During the Project, your personal data will not be transferred outside the European Economic Area.

Ensuring personal data security and integrity

We have put in place appropriate technical and organisational measures to prevent or act upon any unauthorised and unlawful processing or disclosure, accidental loss, modification or destruction of your personal data. See below the measures implemented in this project:

• Direct identification data (e-mail and password, associated to your Smarty+ ID) is kept separated from the other data and used only during the project to re-contact you or to implement your rights on personal data access and removal. Researchers working with your smart meter data have no direct access to direct identification data.
• Encryption of data in transit and at rest.
• The project has a data management plan that describes how data are managed during and after a project.
• Access controls are in place to ensure restriction of access to your personal data to the research team. All databases are password protected and direct access to databases is not possible to external users.
• The research team has received training on the GDPR and is under a responsibility of professional secrecy.
• The system has logging in place to establish who collects, modifies, and deletes personal data.
• Independent audits regularly evaluate the efficiency of the technical and organisational measures put in place by the controller.
• The different datasets collected by the different processes are stored in a distributed fashion on different locations and using different technologies.

Data retention periods

Your direct identification data (meaning the device identifier of your smarty+ dongle, your e-mail address, your user IDs) will be retained for the whole duration of the Project; after its end, the data will be deleted.

Your smart meters data as well as your replies to the survey will be retained for the whole duration of the Project and for two years beyond its end for publication of scientific articles and related necessary review and verifications. After the end of the mentioned retention period, these data will be anonymised.

Your rights and how to exercise them

With regards to your personal data collected and processed, you may exercise at any time the following rights:

• Right to access:  You have the right to receive confirmation about whether or not your personal data is being processed. If that is the case, you have the right to know what data is being collected and processed and to obtain a copy of it;
• Right to rectification: If the personal data we hold about you is inaccurate or incomplete, you have the right to request to have it rectified;
• Right to erasure: Subject to certain conditions specified in art. 17 of the GDPR, you have the right to have your personal data deleted;
• Right to restriction of processing: Subject to certain conditions specified in art. 18 of the GDPR, you have the right to obtain restriction of the processing of your personal data performed;
• Right to data portability: Subject to certain conditions specified in art. 20 of the GDPR, you have the right to obtain a copy of the personal data you provided in a structured, commonly used and machine-readable format and to request the transfer of these data to another data controller;
• Right to object: You have the right to object the processing of your personal data when the conditions set out in art. 21 of the GDPR apply;
• Right to withdraw consent: If processing your personal data is based on your consent, you have the right to withdraw that consent at any time. The withdrawal of such consent shall not affect the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD). More information on how to lodge a complaint are available on CNPD’s website:
• https://cnpd.public.lu.

You may exercise any of these rights by contacting our Data Protection Officer (DPO):

• by e-mail at the following address: dpo[at]list.lu,
• or by post at:

Luxembourg Institute of Science and Technology
Attn. Data Protection Officer
5, Avenue des Hauts-Fourneaux
L-4362 Esch-sur-Alzette, Luxembourg.

Please kindly note that your rights are not absolute and they may be withheld in accordance with applicable data protection laws. In such event, LIST will provide you with the reasons for not complying with your request. In such case, you may lodge a complaint with the CNPD and seek a judicial remedy against such decision.

For any further questions and concerns, you can contact the Principal Investigators of the project.

(last change: 20/07/2023)