SPAMBEE PRIVACY POLICY

Effective Date: 2025-07-07

SPAMBEE is a joint initiative of BEE SECURE, CNPD, and Luxembourg House of Cybersecurity (LHC) through its National Cybersecurity Competence Centre Luxembourg (NC3).

This Privacy Policy explains how LHC and NC3 collects and processes personal data via the SpamBee website and tool (https://spambee.lu).

DATA CONTROLLER

The data controller responsible for processing your personal data is:

Luxembourg House of Cybersecurity g.i.e.,
122, Rue Adolphe Fischer, L-1521 Luxembourg Grand-Duchy of Luxembourg
Tel: (+352) 274 00 98 601
E-Mail: privacy[@]lhc.lu

WHAT PERSONAL DATA DO WE COLLECT ON OUR WEBSITE AND TO WHICH END?

Depending on how you use SpamBee, we may collect:

• Signal Reports: Content of reported emails (anonymized) or reported URLs.
  • Reported e-mails are automatically anonymized; recipient addresses are removed from headers (and where possible, the body of the e-mails).
• Website Logs: IP addresses, browser user-agent, URLs accessed, date and time (for security and technical purposes).
• Contact Information: When you contact us (e.g., name, email address, and message contents).

PURPOSES OF PROCESSING & LEGAL BASIS

• Analyzing Reports to Detect Spam and Phishing:

  When you submit a suspicious email or URL through SpamBee, we process this data based on your consent (Article 6(1)(a) GDPR) to analyze whether it is spam or a phishing attempt.

• Managing Reports and Facilitating Ticket Handling:

  If you contact us or require assistance, we process your contact details and related information to manage your case and provide support. This processing is carried out either because it serves the public interest in cybersecurity (Article 6(1)(e) GDPR) or because it is in our legitimate interests (Article 6(1)(f) GDPR) to ensure effective communication with our users.

• Ensuring Website Security and Performance:

  When you visit our website, we collect and process technical data, such as server logs, to maintain the security, stability, and functionality of the website. This processing is based on our legitimate interests (Article 6(1)(f) GDPR) in safeguarding our infrastructure and providing a secure online experience. No cookies or personal data is collected directly through our website.

• Complying with Legal Obligations:

  We may process and disclose your personal data only when it is necessary to comply with legal requirements or regulatory obligations as foreseen by Article 6(1)(c) GDPR.

DATA RETENTION

• Reports (emails/URLs) are stored for the time necessary to analyze them;
• Reports may be retained for up to 10 years for deeper analysis;
• Logs are kept for up to 24 months for security and technical troubleshooting.

SHARING OF DATA

We may disclose your personal data:

• To competent authorities if legally required or justified;
• Otherwise, only with your consent.

YOUR RIGHTS UNDER GDPR

You have the following rights:

• Access – Obtain a copy of your personal data.
• Rectification – Correct inaccurate or incomplete data.
• Erasure – Request deletion of your data under certain conditions.
• Restriction – Limit processing in specific cases.
• Objection – Object to processing based on legitimate interests.
• Data Portability – Receive your data in a structured, commonly used format.

To exercise your rights, contact privacy[@]lhc.lu

SECURITY MEASURES

We use state-of-the-art security measures (e.g., firewalls, daily backups, access controls) to protect your data from unauthorized access, disclosure, alteration, or destruction.

CHANGES TO THIS PRIVACY POLICY

We may update this policy to reflect changes in our practices or legal requirements. We will notify you of significant changes through our website or other appropriate means. The latest version will always be available at https://spambee.lu

CONTACT

For questions, concerns, or to exercise your rights:

Privacy Contact:
Luxembourg House of Cybersecurity
122, Rue Adolphe Fischer, L-1521 Luxembourg
Email: privacy[@]lhc.lu