European Voluntary Humanitarian Aid Corps Training - Data Protection Notice
The European Education and Culture Executive Agency ("EACEA") is committed to preserving your privacy. All personal data are dealt with in accordance with Regulation (EU) No 2018/1725 on the protection of personal data by the Union institutions, bodies, offices and agencies ("the data protection regulation").
The following Data Protection Notice outlines the policies by which the EACEA collects, manages and uses the personal data of the concerned individuals within the European Voluntary Humanitarian Aid Corps Training.
1. Who is responsible for processing your personal data (data controller)?
The controller is the European Education and Culture Executive Agency, BE-1049 Brussels
The person designated as being in charge of the processing operation is the Head of Unit A5 - Youth, EU Solidarity Corps and Aid Volunteers, Email: EACEA-SOLIDARITY-CORPS@ec.europa.eu
2. Which personal data are processed?
1. European Solidarity Corps registered users’ data indicated below are transferred from the European Youth Portal to EU Academy:
- Email
- EU Login username
- First name
- Last name
- Contact language
- Country of residence
- City (optional)
2. The following data available on EU Academy may be processed:
- Replies to self-assessment questionnaire,
- Course enrolment data,
- Course access and course completion data,
- Course progress data
- Replies to course survey
- Online test responses
- Data filled in training scheduler.
3. The following data, extracted from the scheduling solution on EU Academy, filled in by candidate volunteers for the purposes of logistical arrangements and follow-up related to the face-to-face training, will be processed:
- First name
- Last name
- Email address
- Mobile number
- Sex
- Date and place of birth
- Identity document details (type, number, validity and issuing authority)
- Place of departure
- Special dietary needs
- Special access requirements
- Special assistance needs due to personal health conditions or learning difficulties
- One emergency contact: name, relationship, telephone number
4. The following data will be processed by the travel agency organising the travel to the face-to-face training:
- Name and surname
- Date and place of birth
- Nationality
- Sex
- Identity document details (type, number, validity and issuing authority)
- Place of departure
- Information on health, dietary needs and special assistance, if relevant
5. Data collected via an expenses form for travel costs (to be filled only by those candidate volunteers who make an expense claim) will be processed:
- Name
- Address
- Telephone Number
- Email
- Name of Bank
- Name of Bank Account
- IBAN Number
- SWIFT/BIC Number
3. For which purpose do we process your data?
Data processing is necessary for the following purposes:
A. To ensure access for European Solidarity Corps registered users to the following contents on EU Academy and allow them to implement the related activities: the self-assessment questionnaire, the set of courses of the European Voluntary Humanitarian Aid Corps Training, the online test and the face-to-face training scheduler for those who passed the test.
B. To enable reporting for the European Solidarity Corps services of DG EAC and EACEA, as well as to be able to present an aggregated analysis of self-assessment responses, course usage and survey responses, by key characteristics of users, in statistical reports. The data is anonymised for this purpose.
C. To present an analysis of the online test’s responses and of the face-to-face training scheduler to EACEA, EAC and the contractor, including by key characteristics of respondents.
D. To enable the contractor to plan the face-to-face training, to book travel for successful candidates to travel to and from the training centre and to process travel reimbursements.
E. To provide information to the training providers about special needs related to health conditions or learning difficulties of participants, in order to ensure appropriate support during the face-to-face training.
4. Where the data is collected from?
From the European Youth Portal, EU Academy and from you directly.
5. Who has access to your personal data and to whom is it disclosed?
Access to personal data may be given on a need-to know basis to the following recipients:
- Designated staff of the European Commission, Directorate General Education and Culture (DG EAC);
- Designated staff of the European Commission, in particular at JRC (EU Academy team) and designated staff of EACEA;
- Authorised staff of the contractor of the Framework services contract n° SI2.3217 consortium led by Lattanzio Kibs and composed of Institut Bioforce, Fondazione Punto.Sud, Ruhr-Universität Bochum, Instituto de Estudios sobre Conflictos y Accion Humanitarian.
- ACI BLUETEAM S.p.A. (sub-contractor)
The transfer of data to other third parties is prohibited. Personal data collected will never be used for marketing purposes.
In addition, in case of control or dispute, personal data can be shared with and processed by the bodies charged with a monitoring or inspection task in application of Union law in compliance with the applicable data protection rules and within the scope of their tasks entrusted by the relevant legislation. This includes, in particular, the following recipients:
- The European Court of Justice or a national judge as well as the lawyers and the agents of the parties in case of a legal procedure;
- The European Anti-Fraud Office (OLAF);
- The Internal Audit Service of the Commission
- The Investigation and Disciplinary Office of the Commission (IDOC)
- The European Court of Auditors
- The European Ombudsman
- The European Public Prosecutor’s Office
- EU courts and national authorities
6. How long do we keep your personal data?
For the purposes set out in 3 A, the period of storage, including access logs, is defined by the retention period of the European Youth Portal. Personal data contained within user accounts of the European Solidarity Corps will be deleted three years after they reach the upper age limit of eligibility for participation in the Corps, unless the user has agreed to join any alumni scheme that may be in place at that time, has expressed via email an interest / consent in keeping the user account or has benefited from EU funding through participating in the programme in which case the data is kept for 5 years from the last financial transaction according to the common retention list.
The retention policy of EU Academy applies to the retention of personal data in the EU Academy environment for the purposes defined in 3 A, B and C.
The personal data processed for purposes 3 D and E will be deleted from the data processors’ and sub-processors’ servers within the 6 months following the completion of the last specific contract under Framework Contract SI2.3217.
7. What are your rights concerning your personal data and how can you exercise them?
Under the provisions of the data protection regulation, you have the right to:
• Request to access the personal data EACEA holds about you;
• Request a rectification of your personal data where necessary;
• Request the erasure of your personal data;
• Request the restriction of the processing of your personal data;
• Request to receive or to have your data transferred to another organisation in commonly used machine readable standard format (data portability).
As this processing of your personal data is based on point of Article 5(1)(a) of the data protection regulation, please note that you have the right to object to processing of your personal data on grounds relating to your particular situation under the provisions of Article 23 of the data protection regulation.
In addition, as this processing of your personal data is based on your consent [Article 5(1)(d) and/or Article 10(2)(a) of the data protection regulation], please note that you can withdraw it at any time, and this will have effect from the moment of your retraction. The processing based on your consent before its withdrawal will remain lawful.
Article 25 of Regulation (EU) 2018/1725 provides that, in matters relating to the operation of EU institutions and bodies, the latter can restrict certain rights of individuals in exceptional circumstances and with the safeguards laid down in that Regulation. Such restrictions are provided for in internal rules adopted by EACEA and published in the Official Journal of the European Union (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021Q0317%2801%29).
Any such restriction will be limited in time, proportionate and respect the essence of the above-mentioned rights. It will be lifted as soon as the circumstances justifying the restriction are no longer applicable. You will receive a more specific data protection notice when this period has passed.
As a general rule you will be informed on the principal reasons for a restriction unless this information would cancel the effect of the restriction as such.
You have the right to make a complaint to the EDPS concerning the scope of the restriction.
8. Your right to have recourse in case of conflict on any personal data issue
In case of conflict on any personal data protection issue you can address yourself to the Controller at the above mentioned address and functional mailbox.
You can also contact the Data Protection Officer of EACEA at the following email address: eacea-data-protection@ec.europa.eu.
You may lodge a complaint with the European Data Protection Supervisor at any time: http://www.edps.europa.eu.
9. On which legal basis are we processing your personal data?
art. 5(1)
(a) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body (to be laid down in Union Law), (a2) including processing of personal data necessary for the management and functioning of the Union Institutions or bodies [Recital 22].
The main legal basis of the processing of personal data is:
• Regulation (EU) 2021/888 of the European Parliament and of the Council of 20 May 2021 establishing the European Solidarity Corps Programme and repealing Regulations (EU) 2018/1475 and (EU) No 375/2014.
(d) the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
For processing of health related data:
Article 10, paragraph 2, b of Regulation (EU) No 2018/1725: the data subject has given explicit consent to the processing of those personal data for one or more specified purposes.