Scouten NidderaanwenLëtzebuerger Guiden a Scouten · Grupp Schetzel
Scouten Nidderaanwen

Privacy policy

Last Updated: November 2026

1. Introduction and Overview

Lëtzebuerger Scouten Gemeng Nidderaanwen, a.s.b.l. (Grupp Schetzel Nidderaanwen, hereinafter "we" or "us") is a non-profit association dedicated to promoting scouting for children and young people and is a member of the Lëtzebuerger Guiden a Scouten (LGS). We attach great importance to protecting your personal data and process it in full compliance with the European General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) and applicable Luxembourg data protection laws.

This privacy policy explains how we process personal data when you visit our website www.scouten.lu, use our online services (contact form, registration, shop, membership fees), participate in our scouting activities, or contact us.

2. Data Controller

The controller responsible for data processing within the meaning of Article 4(7) GDPR is:

Lëtzebuerger Scouten Gemeng Nidderaanwen, a.s.b.l.
RCS Luxembourg: F7727
Scoutshome
33, Zone Industrielle Breedewuess
L-1259 Senningerberg
Luxembourg

Email for privacy inquiries: gdpr@scouten.lu
Website: www.scouten.lu

3. Hosting and Content Management System (Hetzner and Payload CMS)

Our website is hosted on dedicated servers provided by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in an ISO/IEC 27001 certified data center within the European Union. We have concluded a Data Processing Agreement (DPA) with Hetzner in accordance with Article 28 GDPR.

We use Payload CMS, a modern open-source content management system based on Node.js and PostgreSQL that runs self-hosted directly on our Hetzner server. All data remains under our direct control on our own European servers.

When you visit our website, the web server automatically records information transmitted by your browser in server log files:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the requested pages or files
  • HTTP status code (e.g. successful request or error)
  • Browser type, browser version, and operating system of your device
  • Referrer URL (the page from which the request originated)

This data is technically necessary to ensure the stability, performance, and security of our systems (e.g. defending against cyberattacks and diagnosing errors). The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR. Server log files are automatically deleted after a maximum of 14 days.

4. Cookies and Local Storage

Our website does not use any tracking cookies, advertising cookies, or third-party analytics tools (such as Google Analytics or Meta Pixel).

We use only strictly necessary cookies and local browser storage functions:

  • site-locale: Stores your selected language (Luxembourgish, French, or English) so the website is displayed in your preferred language on subsequent visits (validity: 1 year).
  • Authentication (session token): Necessary for secure login and session management for leaders and committee members in protected areas (/gestion, /admin).
  • Shopping cart and active checkout state: Temporary storage of cart contents during an active shop order.

The legal basis for these strictly necessary functions is Article 6(1)(f) GDPR (legitimate interest in the technical provision of the website). Because no cookies are used for profiling or tracking, no cookie banner is required.

5. Data Collection via Forms and Online Services

A. Contact Form (/kontakt)

When you send us a message via the contact form, we collect your name, email address, and the text of your message. This data is used solely to respond to your inquiry (legal basis: Article 6(1)(f) GDPR, legitimate interest in communication, or Article 6(1)(b) GDPR for pre-contractual inquiries). Contact inquiries are deleted once resolved, and no later than after one year.

B. Branch Registration and Waiting List (/umeldung)

To register a child with the scouts or on our waiting list, we collect:

  • Parent contact details: Name and contact details of parents or legal guardians (email, phone number, address)
  • Child details: Child’s name, date of birth, and school class
  • Branch: Requested branch (Biber, Wëllef, AvEx, CaraPio, RaRo, Albatrossen)
  • Camps and meetings: Emergency contacts as well as medical information (allergies, chronic conditions, dietary needs, required medication)

This data is necessary for managing membership, ensuring children’s safety during activities, and communicating with families. The legal basis is the performance of the membership relationship (Article 6(1)(b) GDPR) and our legitimate interest as a youth organization (Article 6(1)(f) GDPR). For sensitive health and allergy data (Article 9 GDPR), we obtain explicit parental consent (Article 9(2)(a) GDPR). Medical forms are deleted or returned to parents after the respective camp.

C. Shop, Pre-orders, and Membership Fees (/shop, /cotisation)

When you place an order in our shop (e.g. for an Advent wreath) or pay a membership fee (cotisation), we collect your name, email address, phone number, delivery or pickup option, and order details. The legal basis is contract performance (Article 6(1)(b) GDPR) as well as statutory tax and accounting obligations under Luxembourg law (Article 6(1)(c) GDPR).

D. Payment Providers (SumUp and In-Person Payment)

  • SumUp (Online card payment): For online payments in the shop, we use the licensed payment service provider SumUp (SumUp EU Payments UAB, Konstitucijos ave. 21B, 08130 Vilnius, Lithuania). When you pay online by card, your payment details are transmitted directly to SumUp via an encrypted connection. We do not store any credit card numbers or card details on our servers. SumUp processes this data as an independent controller in accordance with strict PCI-DSS security standards and the GDPR.
  • In-person payment: If you select the "Pay in person" option, you pay for your order upon pickup at the Scoutshome (in cash or by terminal). In this case, no payment data is collected online.

6. Photos and Photo Archive

  • Publication on the website: To illustrate the activities of Grupp Schetzel Nidderaanwen and present our scouting work to the public, we occasionally publish photos from camps, outings, and events. Processing is based on our legitimate interest (Article 6(1)(f) GDPR) in documenting our association’s life as well as your optional consent given at registration.
  • Internal photo archive on private Synology NAS: Our historical photos are stored on a private, encrypted Synology NAS located exclusively at our Scoutshome with no public access. Access is restricted to authorized leaders managing the group archive. Any local photo-sorting features are used strictly internally, and no data is shared externally.
  • Right to request removal of photos: Any member or parent has the right at any time to request the deletion or blurring of a photo of themselves or their child. Simply contact us at gdpr@scouten.lu, and the image will be removed promptly.

7. Email and Member Communications

We maintain internal member lists to plan meetings, camps, and activities and to keep families informed about scouting life. Email communication takes place via our secured mail server or internal distribution lists. Contact details are treated as strictly confidential, are never used for commercial purposes, and are not shared with unauthorized third parties (legal basis: Article 6(1)(b) and (f) GDPR).

8. Data Security Measures

We implement appropriate technical and organizational measures pursuant to Article 32 GDPR to protect your personal data against loss, manipulation, and unauthorized access:

  • Transport encryption: All data traffic between your browser and our website is encrypted using modern SSL/TLS technology (HTTPS).
  • Server and database security: Our servers at Hetzner run in certified European data centers and are protected by regular security updates, firewall rules, and encrypted backups.
  • Access control: Access to personal data (such as registrations and member lists) is strictly limited to those leaders and committee members who need the information to perform their duties.

9. Data Retention

We store personal data only as long as necessary to fulfill the stated purposes or as required by law:

  • Contact inquiries: deleted once processed, and no later than after 1 year.
  • Member data: stored for the duration of active membership. After leaving, personal data is deleted unless there is a legitimate archival interest for the group chronicle or a statutory obligation.
  • Medical forms and emergency contacts for camps: securely deleted or destroyed after the end of the camp.
  • Order and payment records: retained in accordance with Luxembourg statutory tax and accounting retention periods (10 years).
  • Server log files: automatically deleted after a maximum of 14 days.

10. Your Rights under the GDPR

Under the General Data Protection Regulation, you have the following rights vis-à-vis the data controller:

  • Right of access (Art. 15 GDPR): You may request confirmation and a free copy of the personal data we hold about you.
  • Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate data or the completion of incomplete data.
  • Right to erasure (Art. 17 GDPR): You may request the deletion of your personal data, e.g. where the data is no longer needed for its original purpose or where you withdraw consent.
  • Right to restriction of processing (Art. 18 GDPR): You may request the restriction of processing in the cases provided for by law.
  • Right to data portability (Art. 20 GDPR): You have the right to receive data you have provided to us in a structured, commonly used, and machine-readable format.
  • Right to object (Art. 21 GDPR): You may object at any time to processing based on our legitimate interests (Art. 6(1)(f) GDPR).
  • Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on your consent (e.g. health data or specific photos), you may withdraw that consent at any time with effect for the future.

To exercise your rights, simply send an email to gdpr@scouten.lu.

Right to Lodge a Complaint with the Supervisory Authority

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority in Luxembourg:

Commission Nationale pour la Protection des Données (CNPD)
15, Boulevard du Jazz
L-4370 Belvaux, Luxembourg
Phone: (+352) 26 10 60 - 1
Website: https://cnpd.public.lu

11. Updates to This Privacy Policy

We reserve the right to update this privacy policy when our services, systems, or legal requirements change. The current version is always available on this page.

Contact for Privacy Inquiries

Lëtzebuerger Scouten Gemeng Nidderaanwen, a.s.b.l.
RCS Luxembourg: F7727
Scoutshome, 33, Zone Industrielle Breedewuess, L-1259 Senningerberg
Email: gdpr@scouten.lu