1. Overview
This Privacy Notice explains how the Luxembourg Institute of Science and Technology (LIST) processes personal data when you visit the ATHENA website. LIST processes personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) and applicable Luxembourg data-protection law.
2. Scope and data controller
This notice applies to visitors of the ATHENA website and to individuals who contact us about the website or the ATHENA project.
LIST is the data controller for the processing described in this notice:
Luxembourg Institute of Science and Technology (LIST)
5, Avenue des Hauts-Fourneaux
L-4362 Esch-sur-Alzette
Luxembourg
You can contact LIST's Data Protection Officer at dpo@list.lu. For questions about the website, contact Dr. Christoph Stahl at christoph.stahl@list.lu.
3. Personal data we process
Depending on how you use the website, LIST may process the following categories of data:
- technical data, such as IP address, browser and device information, request time and accessed resources, which may be recorded in server and security logs;
- contact data and the content of messages that you send to us by email or other means;
- the certificate identifier entered in the certificate-verification form and the corresponding response returned by the certificate-verification service; and
- technical data generated when your browser requests resources from third parties, such as Google Fonts.
4. Purposes and legal bases
LIST processes technical data to operate, secure and improve the website, prevent misuse and diagnose technical incidents. This processing is based on LIST's legitimate interests (Article 6(1)(f) GDPR).
LIST processes contact data and messages to respond to requests and manage correspondence. This processing is based on LIST's legitimate interests in communicating about the ATHENA project and managing its activities (Article 6(1)(f) GDPR).
Certificate identifiers are processed to provide the certificate-verification feature. This processing is based on LIST's legitimate interests in supporting the integrity and verifiability of ATHENA certificates (Article 6(1)(f) GDPR).
5. Recipients and third-party services
Personal data may be accessed by authorised LIST personnel and service providers acting on LIST's behalf to host, secure, maintain or support the website. They process data only as necessary for their assigned tasks and are subject to appropriate confidentiality and data-protection obligations.
The website loads Google Fonts. When your browser requests these fonts, Google may receive technical data such as your IP address. Google processes this data under its own privacy policies. The certificate-verification service and any linked third-party websites process data under their own privacy notices.
6. Cookies
At the date of this notice, the ATHENA website does not deploy analytics or advertising cookies. If non-essential cookies are introduced, this notice and an appropriate consent mechanism will be updated before they are enabled.
7. Retention
LIST retains personal data only for as long as necessary for the purposes described in this notice, to comply with legal obligations, resolve disputes or protect the security and integrity of the website. Technical logs are retained for a limited period appropriate to security and operational needs. Correspondence is retained for as long as needed to handle the request and related follow-up.
8. Security
LIST implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure. Access is limited to persons who need the data to perform their duties.
9. Your rights
Subject to the conditions and limits set out in the GDPR, you may request access to, rectification or erasure of your personal data; restriction of processing; objection to processing; and data portability. Where processing is based on consent, you may withdraw it at any time.
To exercise your rights, contact LIST's Data Protection Officer using the details above. You may also lodge a complaint with the Luxembourg supervisory authority, the Commission Nationale pour la Protection des Données (CNPD): https://cnpd.public.lu/.
10. Changes to this notice
LIST may update this Privacy Notice from time to time. The version published on this website is the version currently in force.
Last updated: 16 September 2026.