Legal Notice

These terms govern the use of the website https://applications.nc3.lu.

Intellectual Property

This site is published by Luxembourg House of Cybersecurity g.i.e. Unless explicitly stated otherwise, this site and its content are the intellectual property of Luxembourg House of Cybersecurity, with all rights reserved.

The interface uses Figtree, currently served by fonts.bunny.net, alongside system fallback fonts. Loading the hosted font makes a request to that service and exposes network information such as your IP address to it.

The application source code is available under the GNU Affero General Public License v3.0; see the project's LICENSE. The source-code licence is separate from rights in submitted content.

You may download or print content for personal use, ensuring copyright or proprietary notices remain intact. Reproduction, modification, or commercial use of the website content is prohibited without prior written consent.

Law and Jurisdiction

By using this site, you agree that any disputes are governed by Luxembourg law and fall under the exclusive jurisdiction of Luxembourg courts.

Links

Luxembourg House of Cybersecurity is not responsible for the content of external websites linked from https://applications.nc3.lu.

Terms of Service

Your Permission to Use the Website

Luxembourg House of Cybersecurity grants you permission to use the website, which is non-transferable. Others must agree to these terms to use the site.

Acceptable Use

Do not break the law.
Do not use another’s account without permission.
Do not trade in usernames or unique identifiers.
Do not send advertisements or gather addresses for commercial mailing lists.
Do not automate access or monitoring of the site, except for public search engines.
Do not use the site for unsolicited group emails.
Do not imply false affiliation with Luxembourg House of Cybersecurity.
Do not hyperlink to non-hypertext content on the website.
Do not remove proprietary marks from downloaded materials.
Do not use <iframe> to display the site on other websites.
Do not bypass security restrictions.
Do not overload the website infrastructure.
Do not encourage or assist in violations.
Do not impersonate others on the website.

Feedback

Feedback and suggestions are welcome. Luxembourg House of Cybersecurity can use your feedback without notification, permission, or compensation. Do not submit confidential feedback.

Disputes

Luxembourg law governs all disputes related to these terms.

Contact

Email: info@lhc.lu
Notifications may be sent to the provided account email or posted on the website.

Changes

Terms were last updated on 30 January 2023. Updates will be posted on the website.

Privacy Policy

This notice describes the data used by the NC3 Submission Platform. Contact the data controller below for the retention period and legal basis that apply to a particular form.

Processing of Personal Data

Definition: Personal data refers to information identifying you, directly or indirectly. Processing includes any operations performed on personal data, such as collection, storage, and destruction.
Data Controller: Luxembourg House of Cybersecurity g.i.e., 122, Rue Adolphe Fischer, L-1521 Luxembourg, Grand-Duchy of Luxembourg.
- Tel: (+352) 274 00 98 601
- Email: privacy@lhc.lu

Data Collection and Purpose

Web Server Logs: Collects IP addresses, user agents, URLs, and timestamps for security and technical management.
Accounts: Name, email address, password hash, optional profile photo and two-factor authentication settings support authentication and account management.
Forms and responses: Form answers and uploaded files are stored for the purpose stated by the form owner. Signed-in users can save drafts. Guest responses are stored when submitted.
Access and API activity: Form assignments, access links, API token hashes and lifecycle/activity metadata support access control and security monitoring. API submissions also record the client IP address.
File scanning: Uploaded attachments may be sent to the organization's configured malware scanning service. Download access is restricted while scanning is pending or has failed when scan blocking is enabled.

Personal data is processed lawfully, transparently, and only for legitimate purposes.

Use of Cookies

This website uses only essential cookies that are strictly necessary for the website to function properly. No tracking, analytics, or third-party cookies are used.

Essential Cookies We Use

Cookie Name	Purpose	Duration	Type
Session Cookie	Maintains your login session and stores temporary data needed for your visit	Session (expires when browser closes) or up to 2 hours of inactivity	First-party, Essential
XSRF-TOKEN	Protects against Cross-Site Request Forgery attacks by validating that form submissions originate from our website	Session	First-party, Essential

Why These Cookies Are Essential

Session Cookie: Required to keep you logged in and remember your actions during a browsing session (e.g., form submissions, authentication state).
XSRF-TOKEN: Helps reject forged requests that could change your data without your intent.

Your Rights Regarding Cookies

Under GDPR, essential cookies are exempt from the consent requirement as they are strictly necessary for the website to function. However, you have the right to:

Be informed about cookie usage (this policy)
Manage cookies through your browser settings
Request information about data processing

Retention Period

Retention of completed responses, audit logs and encrypted backups depends on the organization's policy and the purpose of each form; this application does not automatically erase completed responses after a fixed period. Contact the form owner or privacy contact for the applicable period.

Unreferenced temporary uploads expire after the configured period (48 hours by default) and are removed by scheduled maintenance. Empty, untouched drafts older than 30 days are also removed. Drafts containing answers are preserved.

Deleting a submitter account removes its link to stored responses. It does not necessarily remove personal data written in the answers or attachments. Form owners must transfer their forms before account deletion; contact the privacy address below for requests concerning the response contents or backups.

Data Security

We implement appropriate measures to prevent unauthorized access to personal data, including encrypted traffic between the site and your browser.

Your Rights

You have rights to access, update, or erase your personal data. You can restrict or object to processing. Contact us at privacy@lhc.lu with proof of identity to exercise these rights. Complaints can also be directed to Luxembourg House of Cybersecurity.

For further questions, email privacy@lhc.lu.