Your personal data is processed in accordance with Regulation (EU) No 2018/1725[1] on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.
The data controller of the processing operation is the Head of Unit I.03 of the European Innovation Council and SMEs Executive Agency (EISMEA) –
EISMEA-CONS-PROCUREMENT@ec.europa.eu.
The following
entity process your personal data on our behalf:
VVA Brussels SPRL,
p.hausemer@vva.it - and its approved third-party authorised sub processors:
Alchemer.
The legal basis for the processing activities are:
- Article 5(1)(a) of Regulation (EU) 2018/1725 because processing is necessary for the performance of a
task carried out in the public interest (or in the exercise of official authority vested in the Union institution or body)[2] laid down in Union law;
- Article 5(1)(d) of Regulation (EU) 2018/1725 based on
your explicit prior consent for your non-mandatory personal data indicated below.
The purpose(s) of this processing are to:
- Collect replies to a survey on consumer education initiatives in the EU Member States
- Process and analyse the collected replies to gather information about existing consumer education initiatives and data on the needs of consumers and challenges for consumer education
The following of your personal data are collected: only your IP address will be collected automatically when using Alchemer. These data are
mandatory for the purpose(s) outlined above.
In addition, the following
mandatory personal data are collected: name, surname and e-mail address.
The recipients of your personal data will be the authorised staff of the EISMEA Agency and Commission in charge of the survey, EISMEA’s contractor VVA, and bodies in charge of monitoring or inspection tasks in application of Union or national law (e.g. internal audits, Court of Auditors, European Anti-fraud Office (OLAF), law enforcement bodies).
The following
third-party tool will be used for the collection of replies to the survey:
Alchemer. Detailed information on Alchemer’s data privacy policies is available here:
https://www.alchemer.com/privacy/
Your personal data
will not be transferred to third countries or international organisations. The processing of your data
will not include automated decision-making (such as profiling).
The following technical and organisational security measures are in place to safeguard the processing of your personal data:
- All personal data in electronic format (e-mails, documents, databases, uploaded batches of data, etc.) are stored on the servers of EISMEA, the European Commission (and of its contractors if contractors are engaged to assist the controller in the organisation and management of meeting(s) or event(s);
- All processing operations are carried out pursuant to Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission;
- In order to protect your personal data, EISMEA and the Commission has put in place a number of technical and organisational measures. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of given processing operations.
- EISMEA and Commission contractors are bound by specific contractual clauses for any processing operations of your personal data on their behalf and by the confidentiality obligations deriving from the General Data Protection Regulation (‘GDPR’ - Regulation (EU) 2016/679)
From the contractor side, the following technical and organisational security measures are in place to safeguard the processing of your personal data:
- All personal data in electronic format (e-mails, documents, databases, uploaded batches of data, etc.) are stored on the servers of VVA Brussels
- All processing operations are carried out pursuant to GDPR regulation
- In order to protect your personal data, VVA Brussels has put in place Computer and Network Security measures, System Access Control measures, Backup solutions, Virus scan and Firewalls
- VVA Brussels has implemented contractual clauses for personal data processing and privacy protection.
You can find further information at:
www.vva.it/privacy-notice/Your personal data will be kept for a maximum period of 3 years from 26 October 2022. Data will be deleted at the end of this period.
“
You have the right to access your personal data and to request your personal data to be rectified, if the data is inaccurate or incomplete; where applicable, you have the right to request restriction or to object to processing, to request a copy or erasure of your personal data held by the data controller. If processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on your consent before its withdrawal.
Your request to exercise one of the above rights will be dealt with without undue delay and within
one month. Your right to information, access, rectification, erasure, restriction or objection to processing, communication of a personal data breach or confidentiality of electronic communications may be restricted only under certain specific conditions as set out in the
applicable Restriction Decision in accordance with Article 25 of Regulation (EU) 2018/1725.”
If you have
any queries concerning the processing of your personal data, you may address them to the Head of Unit I.03 of the European Innovation Council and SMEs Executive Agency (EISMEA) - (entity acting as data controller) via
EISMEA-CONS-PROCUREMENT@ec.europa.eu.
You shall have the right of recourse at any time to the EISMEA Data Protection Officer at
EISMEA-DPO@ec.europa.eu and to the European Data Protection Supervisor at
https://edps.europa.eu.
References
[1] Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L295/39 of 21.11.2018).
[2] EISMEA Establishment Act: Commission Implementing Decision (EU)
2021/173 of 12 February 2021 establishing the European Climate, Infrastructure and Environment Executive Agency, the European Health and Digital Executive Agency, the European Research Executive Agency, the
European Innovation Council and SMEs Executive Agency, the European Research Council Executive Agency, and the European Education and Culture Executive Agency and repealing Implementing Decisions 2013/801/EU, 2013/771/EU, 2013/778/EU, 2013/779/EU, 2013/776/EU and 2013/770/EU (OJ L 50/9 of 15.2.2021)