Privacy notice

When you read the site

Each page you open and each search you send is a request from your browser to this site's server. The request carries your device's IP address, the address of the page and the technical details every browser sends. A search's words travel in the body of the request, never in the request's address; a link that keeps a search holds it in the part after the “#”, which your browser never sends.

Microsoft, which hosts the site, carries each request to the server and its answer back to you, and handles the connection data this needs under its own terms.

The server uses the request to answer it and to count it (see below), and writes nothing of it anywhere: it keeps no access log and no record of what is read or searched. This is tested on the server's own code, before it is deployed: the server is run with requests carrying marked values (a search phrase, an IP address, a browser's name), and none of them may appear in anything it writes. The hosting is set up from a template that adds no log store and no monitoring service that would keep requests; the hosting's settings, once deployed, are not tested this way.

So that no single IP address can overload the server, the server counts the requests that come from each IP address. For this it holds, in its working memory only, a fingerprint of the IP address beside a count of its recent requests. The fingerprint is computed with a secret key that is drawn at random, never written down and replaced every day; the IP address itself is not kept. Neither the fingerprint nor the count is ever written down, and both are forgotten at the latest about two minutes after the last request from that IP address, or when the server restarts. An IP address that sends too many requests at once or in a minute is asked to wait a moment.

Lex has no accounts and no sign-up, so it never knows who you are. Since it records nothing about a visit, and forgets the count above within minutes, it holds nothing about you that it could later show, correct or erase.

No cookies, no trackers, no other sites

The site sets no cookie and writes nothing to your browser's storage (see the cookies page). It loads nothing from another site: no audience measurement, no advertising, and no fonts, scripts or images from elsewhere.

Links to the publishers' sites, such as Legilux and EUR-Lex, are ordinary links. If you follow one, your browser asks that site directly, under that site's own privacy notice; Lex asks your browser not to tell it which page you came from.

People named in published acts

Some published acts name people, for example a law granting nationality. Lex reproduces texts as the official journals publish them, the Journal officiel du Grand-Duché de Luxembourg and the Official Journal of the European Union, so that the law can be read at a date and checked against its official source.

Search engines may index the page of an act only once a check has found that the act names no private person; the page of any other act asks them not to.

Your rights

You may lodge a complaint with the Commission nationale pour la protection des données (CNPD), cnpd.public.lu.