Data Protection Notice for the EU Open for Business campaign and Digital Info Days 2020
Your personal data is processed in accordance with Regulation (EU) No 2018/17251 on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.
The data controller of the processing operation is:
Head of Unit A.1 COSME, Executive Agency for Small and Medium-sized Enterprises (EASME), EASME-COSME@ec.europa.eu
The following entities process your personal data on behalf of the data controller:
- ICF Next SA as data processor, campaign@euopen4business.eu, and
- Its approved third-party authorised subprocessors, Epresspack Sas, GetResponse SP. z o.o., B2MATCH, Voxco, LogmeInc., Interprefy, used to organise and support event activities on behalf of EASME and the European Commission.
The legal basis for the processing activities are Article 5(a) of Regulation EU 2018/1725 because processing is necessary for the performance of a task carried out in the public interest (or in the exercise of official authority vested in the Union institution or body)2 and Article 5(d) of Regulation EU 2018/1725 based on your explicit consent for your non- mandatory personal data indicated below.
The purpose of the processing of your personal data is to reply to questions sent through the contact form, to inform you about the EU Open for Business 2020 campaign, to register interested persons to the Digital Info Days. Your personal data is collected to identify you as participant, to register you to these events, to include you in the participants list, to answer users’ questions which will be made available via the conference website. In addition, your personal data may be used for networking among the participants (bilateral meetings). Finally, we shall use your personal data to inform participants about follow-up activities of the events or the campaign/related to the topic of the event or the campaign, including feedback collection and specific, related communication activities, such as emailing, to monitor and evaluate the campaign (either campaign or communication campaign).
The following personal data are collected: title, first name, last name, nationality, gender, year of birth, organisation name, organisation type (incl. description of the organisation and areas of activities), (professional/personal) e-mail address, country, city, IP address. Moreover, for speakers, their biographies and CVs are also collected. This information is mandatory for the purposes outlined above.
In addition, the following non-mandatory personal data may be collected based on your prior consent: phone number, job function, Twitter and LinkedIn accounts, profile photo you decide to upload, comments you decide to share, feedback, questions, contributions you did during the event. Also, all browser-generated information (website data, geolocation, cookies or other technologies used to analyse users’ activity) is subject to your consent excepted for necessary cookies.
Please note that the 2020 Info Days will be web streamed and only moderators and speakers will be recorded/filmed/photographed. This data will be used for online and offline communication activities related to the EU Open4business campaign. Moderators and speakers will be contacted by ICF Next to obtain their explicit consent to have their image recorded, used for the creation of offline communication material and published online on communication channels, such as social media accounts, image hosting sites and websites linked to the promotion of EASME’s activities3. In the absence of consent, moderators, and speakers have the possibility to remain unseen by not activating their video during the streaming.
The recipients of your data will be: authorised EASME and Commission staff in charge of the EU Open4business campaign, organisation of the Info Days and the follow-up communication activities, authorised staff of EASME partner organisations (Enterprise Europe Network), EASME’s contractor ICF Next (using approved third party tools GotoWebinar, , B2match, E-presspack, Interprefy, Voxco, GetResponse,), and bodies charged with monitoring or inspection tasks in application of EU law (e.g. internal audits, Court of Auditors, European Anti-fraud Office – OLAF). The name of your organisation, your function, your picture (if voluntarily uploaded) and your name and surname - are visible for other participants of the event after logging-in via the registration tool on the website. In addition, EASME will share the following personal data with the European Commission (DG GROW): your first name, last name and professional e-mail address. The purposes of this operation are: to potentially contact you for the purposes of overall EU Open for Business communication campaign evaluation (synthesis report 2015-2020) and to invite you to the EU Open for Business closing conference (planned at the beginning of 2021.
Third party tools used for the organisation of the EU Open for Business campaign and the 2020 Digital Info Days
For the purpose of hosting the EU Open for Business 2020 campaign hub, updating news, informing people about the Info Days 2020 organisation (agenda, speakers’ bio,…) and streaming recorded sessions, Epresspack, third party tool under ICF Next (contractor) responsibility collects email, title, first name, last name, country, company and job, phone number, IP address, and browser-generated information browser-generated information (including device information, operating system, device type, cookies or other technologies used to analyse users’ activity). It hosts the collected personal data within the European Union, with the following exceptions: Videos hosted by Epresspack's technology partner, Vimeo, in different parts of the world including the United States (more info on Vimeo’s privacy statement can be found here https://vimeo.com/privacy) and Google Analytics’ analysis data, in different parts of the world including the United States (more info on Google privacy statement can be found here https://policies.google.com/privacy?hl=en-US). For more information about how Epresspack uses cookies and processes personal data, please consult this link https://epresspack.com/privacy-policy/?lang=en.
For the purpose of hosting and streaming online meeting rooms and plenary sessions, GotoWebinar (services provided by Logmeininc), third party tool under ICF Next (contractor) responsibility, collects from sessions organisers, moderators, participants and speakers the following personal data: title, position, the first name, last name, email address, IP address, website data, geolocation, and browser-generated information, browser-generated information (including device information, operating system, device type, cookies or other technologies used to analyse users’ activity). Moreover, it hosts the collected personal data on servers in Europe or the United States. For information on how GotoWebinar uses cookies and how processes personal data, please see Logmeininc privacy policy at: https://www.logmeininc.com/fr/legal/privacy/international.
For the purpose of registration for Info Days 2020 events, hosting the digital event and managing the different side activities, including networking, sending emails, virtual exhibitions, Q&A, quizzes, and polls, surveys, etc., B2match.com, third party tool under ICF Next (contractor) responsibility, collects from sessions organisers, moderators, speakers and participants: their title, first name, last name, age range, gender, job position, professional and personal e-mail address, professional and personal phone number(s), Twitter and LinkedIn accounts, areas of interest (for networking), profile picture, IP address, website data, geolocation, and browser-generated information (including device information, operating system, device type, cookies or other technologies used to analyse users’ activity). Moreover, B2match.com also collects the following information: time zone, organisation name, organisation description, logo and website, organisation address, city and country. It hosts the collected personal data on servers in Germany. For information on how B2match.com uses cookies and processes personal data, please consult this link https://www.b2match.com/privacy-policy.
For the purpose of interpretation and translation, Interprefy, third party tool under ICF Next (contractor) responsibility, collects from sessions organisers, moderators and speakers the following personal data: first and last name, , email address, phone number, or other contact information, IP address, language, website data, geolocation, and browser-generated information browser-generated information (including device information, operating system, device type, cookies or other technologies used to analyse users’ activity). It hosts the collected personal data on servers in Europe or in the United States. For information on how Interprefy uses cookies and how Interprefy processes personal data, please consult this link https://www.interprefy.com/privacy-policy.
For the purpose of surveys, Voxco, third party tool under ICF Next responsibility, collects from sessions organisers, moderators, speakers and participants: IP address, website data, geolocation, cookies, and browser-generated information (including device information, operating system, device type, cookies or other technologies used to analyse users’ activity). It hosts the collected personal data on servers in the European Economic Area. For information on how Voxco uses cookies and processes personal data, please consult this link https://www.voxco.com/privacy-policy/.
For the purpose of sending campaign mailings to sessions organisers, moderators, speakers and participants, GetResponse, third party tool under ICF Next responsibility, collects the following personal data: title, first name, last name, organisation, work country, job position, (professional/personal) e-mail address, IP address, website data, geolocation, and browser-generated information. Moreover, it hosts the collected personal data on servers in the European Economic Area. For information on how GetResponse uses cookies, please see GetResponse Cookie Policy available at https://www.getresponse.com/legal/cookie-policy.html. Please also see GetResponse privacy policy at: https://www.getresponse.com/legal/privacy.html.
The following safeguards are in place in case of international transfers: for recipients which process personal data outside the EEA4, we put in place appropriate Standard Contractual Clauses. Regarding the technical and organizational measures recipients put in place, please refer to their privacy statements. The processing of your data will not include automated decision-making (such as profiling).
Your personal data will be kept for a maximum period of 3 years starting from 10 September 2020. Data will be deleted at the end of this period.
You have the right to access your personal data and to request your personal data to be rectified, if the data is inaccurate or incomplete; where applicable, you have the right to request restriction or to object to processing, to request a copy or erasure of your personal data held by the data controller. If processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on your consent before its withdrawal.
Your request to exercise one of the above rights will be dealt with without undue delay and within one month.
If you have any queries concerning the processing of your personal data, you may address them to EASME-COSME-DP@ec.europa.eu (entity acting as data controller).
You shall have right of recourse at any time to the Commission Data Protection Officer at DATA-PROTECTION-OFFICER@ec.europa.eu and to the European Data Protection Supervisor at https://edps.europa.eu. or edps@edps.europa.eu
1 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L295/39 of 21.11.2018).
2 Act of Establishment: Commission Implementing Decision C(2013/771/EU) of 17 December 2013 establishing the 'Executive Agency for Small and Medium-sized Enterprises' and repealing Decisions 2004/20/EC and 2007/372/EC
3 European Commission, Executive Agency for Small and Medium-sized Enterprises (EASME), Enterprise Europe Network social media accounts and web pages, EU Open4 business Info days’ web page, and Info Days participants’ social media accounts.
4 European Economic Area countries include Austria, Belgium, Bulgaria, Croatia, Republic of Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden and the United Kingdom.
