Lëtz Cybersecurity Challenge Data Protection Notice

January 2025

Scope of the Notice

This Lëtz Cybersecurity Challenge Data Protection Notice (hereafter the "Notice") outlines how LetzPwn (hereafter "LetzPwn" or "we") collects, processes, and protects personal data in relation to the online Capture The Flag event (hereafter ‚Äúthe CTF Event‚Äù) in accordance with the Regulation (EU) 2016/679 ("GDPR").

Data Subjects

This Notice is intended for the participants having registered to the CTF Event (hereinafter the "Participants") via the CTF Platform.

Data Controller

The Data Controller of the processing operation for the purposes of organising the CTF Event is:

LetzPwn a.s.b.l.
11, rue de l'église, L-9382 Moestroff
Email: info@letzpwn.lu

Data Processors

The Data Processors for the personal data processing related to registration are:

  • Hetzner Online GmbH
    25, Industriestr., 91710 Gunzenhausen, Germany.
  • Luxembourg House of Cybersecurity g.i.e.
    122, Rue Adolphe Fischer, L-1521 Luxembourg.

Purposes and Legal Basis for Processing

  • Event management: LetzPwn collects personal data to process applications solely for participation in the CTF Event. This processing is based on LetzPwn's legitimate interest.
  • Invitations to future events: Processing is based on consent (Art. 6(1)(a) GDPR). Consent can be withdrawn by contacting LetzPwn at info@letzpwn.lu.

Categories of Personal Data

  • Contact details (pseudonym, email address)
  • Age group

Retention Period

Personal data will be retained for two years after the CTF Event.

Transfers of Personal Data

Personal data processing in this context does not involve transfers outside the EU/EEA.

Data Subjects's Rights

Data Subjects may exercise the following rights under GDPR:

  • Right to access: Obtain confirmation on processing and a copy of data.
  • Right to rectification: Request correction of inaccurate or incomplete data.
  • Right to erasure: Request deletion of data under specific conditions (Art. 17 GDPR).
  • Right to restriction of processing: Under conditions specified in Art. 18 GDPR.
  • Right to data portability: Receive a copy of provided data in a structured format (Art. 20 GDPR).
  • Right to object: Object to processing under conditions set out in Art. 21 GDPR.
  • Right to withdraw consent: Withdraw consent at any time without affecting prior processing.
  • Right to lodge a complaint: File a complaint with the Commission Nationale pour la Protection des Données (CNPD).

Amendments to the Notice

LetzPwn reserves the right to amend this Notice to reflect changes in laws, data collection, and processing practices. Participants are encouraged to review this Notice regularly.

For any questions regarding this Notice, contact info@letzpwn.lu.