THE EUROPEAN ASSOCIATION FOR THE PRESERVATION AND PROMOTION OF JEWISH CULTURE AND HERITAGE (AEPJ), ASBL, registered with the Luxembourg Trade and Companies Register (Registre de Commerce et des Sociétés – RCS) under number F725, with its registered office at 119, Avenue Gaston Diderich, L-1420 Luxembourg, Grand Duchy of Luxembourg (hereinafter, “AEPJ”, “we”, “us” or “our”), is committed to protecting the privacy and personal data of users and visitors of the website www.jewisheritage.org (hereinafter, the “Website”).

For the purposes of Regulation (EU) 2016/679 (the General Data Protection Regulation – GDPR) and applicable Luxembourg data-protection legislation, AEPJ acts as the data controller in respect of the personal data processed as described in this Privacy Policy.

This Privacy Policy explains how and why AEPJ collects, uses, stores and otherwise processes personal data relating to users and visitors of the Website, as well as the rights available to individuals in relation to their personal data.

AEPJ may amend or update this Privacy Policy from time to time, in particular to reflect changes in applicable law, our processing activities or the operation of the Website. Any updated version will be published on the Website and will indicate the date on which it was last updated.

AEPJ may collect personal data from Users and visitors to the Website in the following circumstances:

• Contact forms: when a User contacts AEPJ through the Website, we may collect identification and contact information such as the User’s name, surname, email address and any other personal data voluntarily included in the message.
• Newsletter subscriptions: when a User subscribes to an AEPJ newsletter or other electronic communications, we may collect the information required to manage the subscription, including the User’s email address and, where requested, their name or other information provided through the subscription form.
• Website browsing and cookies: when a User accesses or browses the Website, certain technical information may be collected through cookies and similar technologies. Strictly necessary cookies may be used without prior consent where permitted by law. Other cookies and similar technologies will only be used where the User has provided the required consent. Further information about the cookies used, their purposes and how Users can manage their preferences is available in our Cookie Policy.

Data collection forms: Where personal data are collected through forms on the Website, Users will be provided with the information required under applicable data-protection law, including, as appropriate, the purposes of the processing, the legal basis relied upon, the recipients or categories of recipients of the data, the applicable retention period or the criteria used to determine it, and whether the provision of the requested information is mandatory or optional.

Personal data submitted through contact forms will be processed for the purpose of responding to the User’s request, enquiry or communication and, where necessary, managing any subsequent correspondence relating to it.

AEPJ will send newsletters, information about its activities, initiatives or other electronic communications only where the User has subscribed to or otherwise validly requested such communications. Users may withdraw their consent and unsubscribe at any time using the unsubscribe mechanism included in the relevant communication or by contacting AEPJ.

AEPJ does not sell Users’ personal data. Personal data may, however, be accessed or processed by third-party service providers acting on behalf of AEPJ, such as providers of website hosting, IT, email or newsletter distribution services, where this is necessary for the purposes described in this Privacy Policy. Personal data may also be disclosed where required by law or by a competent public authority.

Personal data will be retained only for as long as necessary for the purposes for which they were collected and processed, taking into account any applicable legal, accounting or administrative retention requirements. Where processing is based on consent, data will no longer be processed for that purpose once consent has been withdrawn, unless another lawful basis applies.

Technical data and log files: When a User accesses the Website, certain technical information may be automatically recorded in server log files. This information may include the User’s IP address, the date and time of access, the pages or resources requested, browser and device information, and other technical data relating to the connection.

Such information may constitute personal data and may be processed where necessary for purposes such as ensuring the security, stability and proper functioning of the Website, detecting and preventing misuse or technical incidents, troubleshooting, and producing aggregated statistics concerning use of the Website.

AEPJ does not use server log data for the purpose of directly identifying individual Users unless this is necessary for security, fraud-prevention or other legitimate purposes, or where required by applicable law. Log data will be retained only for as long as reasonably necessary for the purposes for which they are processed.

Cookies and similar technologies: The Website may also use cookies and similar technologies to store or access information on a User’s device. Strictly necessary cookies may be used without prior consent where permitted by applicable law. Non-essential cookies will only be placed or accessed after the User has provided the required consent.

Further information concerning the cookies used by the Website, their purposes, duration, providers and the options available to Users for managing their preferences is provided in the Cookie Policy.

Users are requested to ensure that the personal data they provide to AEPJ through the Website, including through contact forms and newsletter subscription forms, are accurate, complete and, where necessary, kept up to date.

Users may inform AEPJ of any changes or inaccuracies affecting their personal data so that the information can be corrected or updated where appropriate.

Where a User provides AEPJ with personal data relating to another individual, the User should ensure that they are authorised to provide such information and that its disclosure to AEPJ is lawful.

Where appropriate, the User should inform the individual concerned that their personal data may be provided to AEPJ and direct them to this Privacy Policy.

Where AEPJ receives personal data relating to an individual from a source other than that individual, AEPJ will provide the information required under Article 14 of the GDPR where applicable, unless an exemption provided for by applicable data-protection law applies.

Legal basis for processing

AEPJ processes personal data only where there is a valid legal basis under applicable data-protection law.

Depending on the purpose of the processing, the applicable legal basis may include:

• Consent: where the User has freely given specific, informed and unambiguous consent to a particular processing activity, such as subscribing to an AEPJ newsletter or consenting to the use of non-essential cookies. Where processing is based on consent, the User may withdraw that consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
• Steps taken at the User’s request: where processing is necessary in order to respond to a request made by the User or to take steps at the User’s request before entering into an agreement, where applicable.
• Legitimate interests: where processing is necessary for the legitimate interests pursued by AEPJ or a third party, provided that such interests are not overridden by the rights and freedoms of the individual concerned. Such interests may include maintaining the security and proper operation of the Website, responding to enquiries and protecting AEPJ’s systems and activities.
• Compliance with legal obligations: where processing is necessary for AEPJ to comply with an obligation imposed by applicable law.

Where AEPJ relies on consent, the request for consent will be clearly distinguished from other information and will relate to the specific purpose for which consent is sought.

Personal data will be retained only for as long as necessary to fulfil the purposes for which they were collected and processed.

The applicable retention period will depend on the nature and purpose of the processing. In determining the appropriate period, AEPJ will take into account the duration for which the information is required for the relevant purpose, any applicable legal or regulatory retention obligations, and the period during which the data may reasonably be required for the establishment, exercise or defence of legal claims.

Once the applicable retention period has expired, personal data will be securely deleted or anonymised, unless their continued retention is required or permitted by applicable law.

Where processing is based on the User’s consent, AEPJ will cease processing the personal data for that purpose when consent is withdrawn, unless another lawful basis justifies their continued retention.

Your data-protection rights

Under the GDPR, Users may exercise the following rights in relation to their personal data, subject to the conditions and limitations established by applicable law:

1. Right of access: the right to obtain confirmation as to whether AEPJ processes personal data concerning you and, where this is the case, to obtain access to those data and information concerning their processing.
2. Right to rectification: the right to request the correction of inaccurate personal data and, where appropriate, the completion of incomplete personal data.
3. Right to erasure: the right to request the deletion of personal data concerning you where one of the grounds provided for by applicable data-protection law applies, subject to any applicable exceptions.
4. Right to restriction of processing: the right to request that the processing of your personal data be restricted in the circumstances provided for by the GDPR, including where the accuracy of the data is contested, the processing is unlawful, or the data are required for the establishment, exercise or defence of legal claims.
5. Right to object: where AEPJ processes personal data on the basis of its legitimate interests, you have the right to object to such processing on grounds relating to your particular situation. AEPJ will cease processing the data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where processing is necessary for the establishment, exercise or defence of legal claims.
6. Right to data portability: where processing is based on your consent or on a contract and is carried out by automated means, you may have the right to receive the personal data you have provided to AEPJ in a structured, commonly used and machine-readable format and, where technically feasible, to have those data transmitted directly to another controller.
7. Right to withdraw consent: where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before its withdrawal.
8. Right to lodge a complaint: you have the right to lodge a complaint with the Commission nationale pour la protection des données (CNPD), the Luxembourg data-protection supervisory authority, or with another competent supervisory authority where applicable.

If you consider that AEPJ’s processing of your personal data infringes applicable data-protection law, or that your data-protection rights have not been respected, you have the right to lodge a complaint with the Commission nationale pour la protection des données (CNPD), the Luxembourg data-protection supervisory authority.

Complaints may be submitted through the CNPD’s online complaint form or by post to:

Commission nationale pour la protection des données (CNPD)
Service des réclamations
15, Boulevard du Jazz
L-4370 Belvaux
Luxembourg

Further information and the online complaint form are available on the CNPD website at cnpd.public.lu.

You may also have the right to lodge a complaint with another competent data-protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement.

AEPJ implements appropriate technical and organisational measures designed to ensure a level of security appropriate to the risks associated with the processing of personal data.

These measures are intended to protect personal data against accidental or unlawful destruction, loss or alteration, as well as against unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed.

In determining the appropriate level of security, AEPJ takes into account, as applicable, the nature, scope, context and purposes of the processing, the risks to the rights and freedoms of individuals, the state of the art and the costs of implementation.

AEPJ regularly reviews and, where appropriate, updates the technical and organisational measures implemented to protect personal data.

AEPJ may amend or update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, relevant case law, AEPJ’s processing activities, or the operation of the Website.

Any updated version of the Privacy Policy will be published on the Website and will indicate the date on which it was last updated. Where required by applicable law, AEPJ will provide additional notice of material changes or obtain renewed consent where necessary.