Effective Date: June 23, 2026
Last Updated: June 23, 2026
1. Introduction & Commitment to Privacy
Twin Cities Luxembourg American Society (“TCLAS,” “we,” “us,” “our”) is a 501(c)(3) nonprofit organization dedicated to preserving and celebrating the Luxembourg heritage of the Twin Cities community. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at twincities.lu (the “Site”) and participate in our programs and services.
Please read this policy carefully. If you do not agree with our practices, do not use the Site or our services.
2. Information We Collect
A. Information You Provide Directly
Newsletter Signup
- Email address — to send bimonthly newsletters, events, and updates
- Name (optional) — to personalize communications
Citizenship Eligibility Quiz
- Family tree data — ancestor names, birth years, places of origin (to determine eligibility under Luxembourg law)
- Email address — to share quiz results and provide pathway information
- Optional: Contact information — if you choose to submit for further assistance
Membership Account
- Name, email, address, phone — for account creation and billing
- Payment information — processed securely via Paid Memberships Pro; we do not store credit card details
- Membership tier (Individual, Household, Student/Senior, Benefactor)
- Member profile data (optional): biography, photo, ancestral commune(s)
- Referral link/code — if you use our member referral program
Event Registration & Attendance
- Event preferences — via The Events Calendar
- Registration information (if applicable)
Contact Form / Inquiries
- Name, email, message — to respond to your inquiry
Mapbox Usage (Ancestral Map)
- Commune lookup history — which ancestral communes you search
- Interaction data — clicks, zooms, searches on the map (for analytics only; Mapbox also logs limited data per their terms)
B. Information Collected Automatically
Cookies & Tracking
- Essential cookies — to keep you logged in, maintain session, security
- Analytics cookies (via Google Analytics, if enabled) — page views, user flow, bounce rate
- Marketing cookies (via Brevo) — email engagement tracking (opens, clicks)
Server Logs
- IP address, browser type, operating system, referrer URL, pages visited
- Timestamps and duration of use
- Collected automatically for site security and performance monitoring
Device Information
- Device type (mobile, desktop, tablet)
- Screen resolution (for responsive design purposes)
Third-Party Services
- Mapbox logs limited interaction data (map searches, zoom level, clicks)
- Google Fonts may log basic usage data (font requests)
- Brevo (email platform) logs email opens, clicks, unsubscribes
3. How We Use Your Information
A. Primary Uses
- Newsletter & Communications — deliver bimonthly news, events, member updates (with your consent)
- Membership Management — account creation, billing, member access to restricted areas
- Citizenship Quiz — determine eligibility, provide pathway information, email results
- Member Directory & Profiles — display member information (name, photo, ancestry) to other logged-in members only
- Event Management — register members for events, send reminders
- Referral Program — track referrals and attribute new members to referring members
- Site Analytics — improve user experience, identify technical issues, understand usage patterns
B. Legal Basis (GDPR Compliance)
- Consent — newsletter signup, quiz, optional profile data
- Contractual obligation — membership account, payment processing
- Legitimate interest — site improvement, member community building, fraud prevention
- Legal obligation — nonprofit compliance, fundraising records (if applicable)
C. What We DON’T Do
- We do NOT sell or rent your data to third parties
- We do NOT use your data for commercial advertising (except our own newsletter)
- We do NOT track you across other websites (no cross-site tracking)
- We do NOT share member ancestry data with external genealogy services (members control this via profile settings)
4. Third-Party Services & Data Sharing
We use trusted third-party services to operate the Site. These partners process your data on our behalf under data processing agreements:
A. Email Marketing (Brevo)
- Data shared: email address, name, newsletter signup preferences
- Purpose: send newsletters, event announcements, membership communications
- Retention: kept until you unsubscribe
- Brevo Privacy Policy
- Opt-out: Click “Unsubscribe” in any email, or contact us
B. Payment Processing (Paid Memberships Pro / Stripe)
- Data shared: name, email, address, payment information
- Purpose: process membership dues, billing
- Retention: retained per PCI-DSS requirements (typically 7 years for nonprofit records)
- Note: We do NOT store full credit card numbers (PCI-DSS compliant)
- Stripe Privacy Policy
C. Map & Geographic Data (Mapbox)
- Data shared: IP address, commune searches, interaction data
- Purpose: power the Ancestral Map (interactive Luxembourg commune lookup)
- Retention: per Mapbox’s standard analytics retention (typically 30 days)
- Mapbox Privacy Policy
- Note: Member-only feature; non-members cannot access
D. Content Delivery (Google Fonts)
- Data shared: device info, IP address (minimal)
- Purpose: serve typography (Ancizar Serif, Source Sans 3)
- Google Fonts Privacy Policy
E. Event Management (The Events Calendar)
- Data shared: event registration preferences, attendance
- Purpose: event listing, registration, reminders
- The Events Calendar Privacy Policy
F. Website Analytics (Google Analytics, if enabled)
- Data shared: aggregated, anonymized user behavior
- Purpose: understand site usage, improve design
- Retention: typically 26 months (configurable)
- Google Analytics Privacy Policy
- Opt-out: Google Analytics Opt-out Extension
G. Security & Monitoring (SiteGround)
- Data shared: IP logs, security event data
- Purpose: site security, DDoS protection, uptime monitoring
- SiteGround Privacy Policy
5. Member Data & Access Controls
A. Member Directory & Profiles (Private)
- Members-only area: Your profile (name, photo, bio, ancestral commune) is visible only to other logged-in members
- Non-members see nothing: The directory requires login and is not indexed by search engines
- You control your data: Edit your profile anytime in Member Hub > Profiles
- Ancestral data: Linking your profile to a specific commune is optional; you can keep your ancestry private
B. Story Submissions (“My Story”)
- Gallery is members-only: Stories are visible only to logged-in members
- Author attribution: We display your name and photo with your story (per your submission)
- You can request deletion: Email us to remove your story from the gallery at any time
C. Quiz & Eligibility Data
- Private: Your quiz responses and family tree data are NOT shared with other members
- Retained: We keep quiz results to help you track your research progress
- Deletion available: Request deletion of your quiz history anytime
6. Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Newsletter signup | Until unsubscribe | Compliance with email laws (CAN-SPAM, GDPR) |
| Membership account | For membership duration + 7 years | Nonprofit accounting/tax records |
| Payment/billing | 7 years | Tax compliance (US 501(c)(3)) |
| Quiz responses | Until account deletion | Research tracking for member |
| Member profiles | Until account deletion or update | Member directory functionality |
| Event registration | 2 years post-event | Event administration & historical records |
| Site analytics | 26 months (Google Analytics default) | Aggregate usage analysis |
| Server logs/cookies | 13 months | Security, fraud prevention, performance |
7. Your Privacy Rights
A. GDPR Rights (EU Residents & Visitors)
If you are in the EU, you have the right to:
- Access: Request a copy of your personal data
- Correction: Correct inaccurate or incomplete data
- Deletion (“Right to be Forgotten”): Request deletion of your data (with exceptions for legal/tax obligations)
- Restriction: Limit how we process your data
- Portability: Receive your data in a portable format (e.g., CSV)
- Object: Opt out of marketing communications or analytics
- Lodge a complaint: With your national data protection authority if you believe we’ve violated GDPR
To exercise these rights, email us at: [contact@twincities.lu] with “GDPR Request” in the subject line.
B. California Consumer Privacy Act (CCPA)
If you are a California resident, you have the right to:
- Know what personal information we collect
- Delete personal information (with exceptions)
- Opt out of the sale or sharing of personal information (we don’t sell your data)
To submit a CCPA request, email: [contact@twincities.lu]
C. Canada & Other Jurisdictions
We comply with applicable privacy laws including PIPEDA (Canada) and other regional regulations. Contact us with any privacy concerns.
8. Data Security
A. Protection Measures
- HTTPS encryption — all data transmitted to/from the Site is encrypted
- Secure password storage — passwords are hashed and salted (never stored in plaintext)
- Limited access — only authorized TCLAS staff can access member data
- No credit card storage — payment processing is delegated to PCI-DSS-compliant processors (Stripe)
- Regular backups — data is backed up regularly and tested for recovery
- Firewalls & monitoring — SiteGround security features (malware scanning, DDoS protection, intrusion detection)
B. Data Breach Notification
In the unlikely event of a data breach, we will:
- Investigate the breach promptly
- Notify affected individuals within 30 days (GDPR requirement)
- Provide details of what data was compromised, steps we’re taking, and recommended actions
- Notify regulatory authorities if required by law
9. Children’s Privacy
The Site is not directed to children under 13. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided us with personal data, we will delete it promptly.
Parents/guardians: If you believe your child has provided data to us, contact us immediately.
10. Cookies & Tracking Technologies
A. Types of Cookies We Use
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential | Keep you logged in, site functionality | Session or 1 year |
| Analytics (Google Analytics) | Understand user behavior, improve Site | 26 months |
| Marketing (Brevo) | Track email engagement | Until unsubscribe |
| Security (Cloudflare, if enabled) | Detect threats, prevent DDoS | Varies |
B. Cookie Management
- Accept/Reject: Complianz banner lets you accept/reject non-essential cookies on first visit
- Change preferences: You can update cookie settings in your browser or contact us
- Browser controls: Most browsers allow you to delete cookies or block them by default
11. Do Not Track (DNT)
Some browsers include a “Do Not Track” (DNT) feature. Currently, there is no industry standard for recognizing DNT signals, and we do not respond to DNT browser signals. However, you can use other tools (like browser cookie controls) to limit tracking.
12. International Data Transfers
TCLAS is based in the United States (Minneapolis, MN). Your data may be transferred to, stored in, and processed in the US or other countries where we operate.
For EU/EEA residents: We rely on Standard Contractual Clauses (SCCs) and appropriate safeguards to ensure your data is protected when transferred outside the EU.
13. Contact Us
For privacy questions, requests, or complaints:
- Email: contact@twincities.lu
- Mailing address: 5865 Neal Ave N PMB 135, Stillwater, MN 55082, United States
- Response time: We aim to respond within 30 days
For GDPR/CCPA requests specifically, include “GDPR Request” or “CCPA Request” in the subject line.
14. Policy Changes
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:
- Posting the updated policy on the Site with a new “Last Updated” date
- Sending an email notification (for significant changes)
- Requesting your consent (if legally required)
Your continued use of the Site after changes means you accept the updated Privacy Policy.
15. Additional Information
A. Links to Third-Party Sites
The Site may contain links to external websites (e.g., Luxembourg genealogy resources, event partners). We are not responsible for their privacy practices. Review their privacy policies before sharing data.
B. Nonprofit Status
As a 501(c)(3) nonprofit, TCLAS is required to maintain certain records (membership rosters, donor records) for legal and tax compliance. These records are kept confidential and are not shared publicly.
C. Opt-Out Summary
| Preference | How to Opt Out |
|---|---|
| Marketing emails | Click “Unsubscribe” in any email |
| Analytics tracking | Google Analytics Opt-out Extension |
| Non-essential cookies | Adjust Complianz banner preferences |
| Brevo marketing | Unsubscribe from email or update profile |
Acknowledgments
This Privacy Policy is crafted to be compliant with:
- General Data Protection Regulation (GDPR) — EU/EEA
- California Consumer Privacy Act (CCPA) — California
- Personal Information Protection and Electronic Documents Act (PIPEDA) — Canada
- CAN-SPAM Act — US Email Marketing
- COPPA (Children’s Online Privacy Protection Act) — US