Privacy statement

Introduction

The protection of your personal data and privacy is of great importance to the EU institutions and bodies, including the European External Action Service (EEAS) with the Union Delegations and the Service for Foreign Policy Instruments of the European Commission (FPI).

You have the right under EU law to be informed when your personal data is processed, for example collected, used or stored, as well as about the purpose and details of that processing. When handling personal data, we respect the principles of the Charter of Fundamental Rights of the European Union, and in particular Article 8 on data protection.

Your personal data are processed in accordance with Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, aligned with Regulation (EU) 2016/679, the General Data Protection Regulation. In this privacy statement you find information about how the European Commission, the EEAS and EU Delegations process your personal data and what rights you have as a data subject.

Why we process your data

The EEAS, through the EU Delegation to the United Kingdom, and the Service for Foreign Policy Instruments (FPI) of the European Commission collect and further process your personal data to ensure the proper organisation and management of the 4th EU/UK Youth Dialogue Forum, to provide you with information about it, and to process your application for participation. This includes disseminating information among participants and to the public, enhancing cooperation, networking and facilitating exchange fora, often web based. It is also intended to further contact participants and to promote EU public diplomacy, engaging individuals in public diplomacy activities and other events. You can find information on the legal basis in section 7 of this statement.

Description of processing

The organisation and follow up of the event includes the management of contact and mailing lists for invitations, handling of participation requests and feedback, the preparation and distribution of preparatory material, meeting reports, news items and publications to the participants, as well as catering and travel arrangements, accommodation and entry to the premises with access control. In the framework of organising the event, the following processing may take place:

• Sending emails and invitation letters; collecting names, postal and email addresses and phone numbers by electronic or manual means; publishing participant lists and distributing them to participants and organisers
• Collecting and managing lists and mailing lists for meetings, news and publications
• Where relevant, handling dietary and special assistance needs, and following up the reimbursement of travel expenses and payment of daily allowances
• Publication and communication activity related to the event for dissemination purposes, including publishing information about the event on the EEAS and FPI intranet or websites, and facilitating photos, videos, web streaming, and audio or video recording during the event

What data we process

Personal data will be collected, handled and kept only to the extent necessary for the purposes above. Data, including personal data, that may be processed are the following:

Data related to your participation

• Identification and contact data, including name, title, profession, function, postal and email address, phone numbers and any other administrative information and contact details
• Biography or CV, if needed
• Login credentials, in the case of online registration
• Nationality, passport or identity card number and its date of issue and expiry may be collected, so that you may obtain access to the premises where the event is held
• Financial information, such as a payment card number or bank account, may be collected for possible reimbursements
• Dietary requests, if any, or specific access requirements
• Information provided during the event, including interventions, speeches and comments, and material such as recordings, videos and photographs

Data collected for informing the public

Data are also collected from the website and during the event, and processed for the purpose of informing the public and promoting EU public diplomacy in communications and publications:

• Photos, audio or video filming and web streaming of speakers, participants or organisers, as well as feedback, surveys, reports and other information about the event

Data collection by websites

When using online applications, websites may apply dynamic tools such as cookies for technical functioning, gathering statistics and providing a personalised experience for you as a user. More information about cookies can be found on the specific websites. This registration website sets no cookies of its own.

Data controller

The data controller determining the purpose and means of the processing is the EU Delegation to the United Kingdom. The EU Delegation to the United Kingdom is responsible for managing the personal data processing under the supervision of the Head of Delegation, and is the controller entity engaging the service provider GOPA Pro S.A., from which you receive communications about the event. The European Commission, Service for Foreign Policy Instruments (FPI), unit FPI.3, also acts as controller.

Controller

EU Delegation to the United Kingdom
events.eudeluk@gopa.eu

Co-controller

European Commission, Service for Foreign Policy Instruments (FPI), FPI.3

Processor

GOPA Pro S.A., service provider of the EU Delegation to the United Kingdom, including web services

Event partners

European Parliament Liaison Office in the UK, European Economic and Social Committee, British Council, Manchester European Society

Who has access to your data

Access to your personal data is provided to the FPI and EEAS staff responsible for carrying out this processing operation, and to other authorised Commission and EEAS staff according to the need to know principle. This includes, in particular:

• Designated organising staff of the EEAS and the EU Delegation
• FPI assigned staff and other European Commission staff members designated for the tasks to be implemented
• Assigned staff of other EU institutions and other assigned organiser team members, if required
• Security and other partners, contractors and service providers on behalf of the organiser
• Participants, interpreters and technical staff, if relevant
• EEAS staff and other EEAS intranet users, if data is published on the EEAS intranet
• The general public, if data is made public on the internet, the EEAS website or social media platforms
• GOPA Pro S.A., the service provider, including web services, of the EU Delegation to the United Kingdom

Transfers to the United Kingdom

Personal data is intended to be transferred to a third country or an international organisation to provide access to the recipients described above. Transfers to the EU Delegation to the United Kingdom are based on the European Commission adequacy decision for the United Kingdom of 28th June 2021, under Article 47 of Chapter V of Regulation (EU) 2018/1725. Data protection clauses, based on the Standard Contractual Clauses approved by the Commission, form part of the contract with any third country processor.

Personal data is transferred to a third country or an international organisation only if you consent to sharing your personal data in the list of attendees. There may be participants from third countries and international organisations not providing the level of protection of your personal data that exists in the EU. These participants may share your data with their employers or other organisations, including national security agencies.

Third parties

We will not communicate your personal data to third parties, except to the extent and for the purposes described above or when we are required to do so by law. Under certain conditions outlined in law, we may disclose your information to third parties, such as the European Anti Fraud Office, the Court of Auditors or law enforcement authorities, if it is necessary and proportionate for lawful, specific purposes. Data will not be shared with third parties for direct marketing.

Service providers abide by contractual clauses for the protection of your data, and will process data on documented instructions and on behalf of the EEAS, the EU Delegation or FPI in accordance with Article 29 of Regulation (EU) 2018/1725. More information on how the provider processes personal data is available on the website of the contracted organisation.

Social media

The EEAS and FPI use social media to promote and inform about events and meetings through widely used and contemporary channels. In addition to the EEAS and FPI web pages, videos may be uploaded to the EEAS YouTube channel, and links from these websites can appear on EEAS X, Instagram, Flickr and Facebook, and on FPI X. The use of social media does not in any way imply endorsement of the privacy policies of the social media providers. We recommend that users read the X, Flickr, Facebook, Instagram and YouTube privacy policies, which explain their data processing, use of data, users' rights and the ways users can protect their privacy when using these services.

Social media accounts that will be used are: X at @eu_eeas and @EU_FPI; LinkedIn, the European External Action Service page; Facebook, EuropeanExternalActionService; and Instagram, @eudiplomacy.

Your rights

You have the right of access to your personal data and the right to correct your inaccurate or incomplete personal data, taking into account the purpose of the processing. The right of rectification can only apply to factual data processed. Under certain conditions, you have the right to ask for the deletion of your personal data or to restrict their use, as well as to object at any time to the processing of your personal data on grounds relating to your particular situation.

Right of access

You may request access to the personal data we hold about you.

Right to rectification

You may correct inaccurate or incomplete factual data.

Right to erasure

Under certain conditions, you may ask for the deletion of your data.

Right to restriction

Under certain conditions, you may ask that the use of your data is restricted.

Right to object

You may object at any time to processing on grounds relating to your particular situation.

Right to withdraw consent

If you have consented to the recording of a session, you may withdraw that consent by notifying the data controller. The EEAS and FPI will make every effort to remove your contribution from the recording. Withdrawal does not affect the lawfulness of processing carried out before it.

We will consider your request, take a decision and communicate it to you without undue delay, and in any event within one month of receipt of the request. That period may be extended by two further months where necessary. For more detailed legal references, see Articles 14 to 21, 23 and 24 of Regulation (EU) 2018/1725. In specific cases, restrictions under Article 25 of the Regulation may apply.

Legal basis

Lawfulness of the data processing

The processing of personal data linked to the organisation, management, follow up and promotion of the event is necessary for the performance of a task carried out in the public interest, under Article 5(1)(a) of Regulation (EU) 2018/1725, as mandated by the Treaties, in particular Articles 5, 11, 20, 21 to 40, 42 and 43 of the Treaty on European Union (TEU) and Articles 2(4), 2(5), 205, 220, 221 and 326 to 334 of the Treaty on the Functioning of the European Union (TFEU).

The processing of personal data of speakers with whom a contract is concluded is carried out in line with the contractual provisions. That processing is necessary and lawful under Article 5(1)(c) of Regulation (EU) 2018/1725, as processing necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.

Consent based processing, Article 5(1)(d)

Your consent according to Article 5(1)(d) of Regulation (EU) 2018/1725 is required for:

• The processing of your personal data relating to your dietary requirements and access requirements
• The sharing of the event attendee list containing your name and affiliation among participants, in order to create working groups to continue the collaborative work launched during the event with the EEAS and the FPI units in charge of this event. Your attention is drawn to the fact that there may be participants from third countries and international organisations not providing the level of protection of your personal data that exists in the EU. These participants may share your data with their employers or other organisations, including national security agencies
• The processing of your personal data relating to the audio-visual materials of the event, including recordings, videos and photographs
• The processing of your personal data for inviting you to future events and activities the data controller may organise
• The processing of your personal data for managing a permanent contact list created and shared internally among EEAS services and FPI for the purpose of promoting EU activities and events and disseminating information. You can find more information about how your personal data are processed in this case in the EEAS privacy statement on events and meetings and in the Record of Processing DPR-EC-03928 on the management of subscriptions

If you opt in, you are giving us your explicit consent under Article 5(1)(d) of Regulation (EU) 2018/1725 to process your personal data for those specific purposes. You give your consent via a clear affirmative act by ticking the relevant boxes on the online registration form.

Your consent can be withdrawn at any time. For withdrawing consent concerning dietary requirements, the attendee list, audio-visual materials, future invitations or the permanent contact list, please contact the controller at events.eudeluk@gopa.eu. If you do not wish some personal data, including photos, to be published on the web, you also have the option not to provide consent. You can give consent to only one or more of the data processing activities, and withdraw it at any time, through the functional mailbox given in section 6.

The processing is also necessary for archiving purposes. Archiving is proportionate to the aim pursued, respects the essence of the right to data protection, and provides for suitable and specific measures to safeguard the fundamental rights and interests of the data subject.

Further references

• Treaty on European Union (Lisbon Treaty), Article 2, Official Journal of the European Union C 83/17, 30th March 2010
• Articles 1 (Nature and Scope), 2 (Tasks) and 3 (Cooperation) of the Council Decision of 26th July 2010 establishing the organisation and functioning of the EEAS (2010/427/EU), OJ L 201, 3rd August 2010, p. 30
• Shared Vision, Common Action: A Stronger Europe, the Global Strategy for the European Union's Foreign and Security Policy of June 2016, and the Council Conclusions of October 2016, in which the Council of the European Union emphasises the need to join up efforts in the field of public diplomacy, including strategic communication, inside and outside the EU, to speak with one voice and ultimately promote its core values
• Article 3(5) of the Lisbon Treaty, which defines the European Union's objectives in its external relations: in its relations with the wider world, the Union upholds and promotes its values and interests and contributes to the protection of its citizens, to peace, security, the sustainable development of the Earth, solidarity and mutual respect among peoples, free and fair trade, the eradication of poverty and the protection of human rights, in particular the rights of the child, as well as to the strict observance and development of international law, including respect for the principles of the United Nations Charter

Data retention and security

Our aim is to keep your personal data no longer than necessary for the purposes for which we collect them. The data controller only keeps your personal data for the time necessary to fulfil the purpose of collection or further processing. After the event, your data are kept as long as follow up actions to the event are required. Reports and other material containing personal data are archived according to the e-Domec policy.

Personal data may, however, be part of a contact list shared internally among EEAS and FPI services for the purpose of promoting future EU activities and disseminating information. The privacy statement on public diplomacy initiatives is also available on the EEAS website. More information on recordings is available in the Record of Processing DPR-EC-01937, Audio-visual recording of meetings.

Personal data may be kept for information and historical, statistical or scientific purposes for a longer period of time, including publication on the EU Delegation web page, the EEAS intranet or the EEAS website, with appropriate safeguards in place.

Selected service providers for organisational purposes, such as caterers, travel agents or event management organisations, are contractually bound to process personal data on behalf of and in line with the instructions of the data controller, to keep confidential any data they process, and to protect it from unauthorised access, use and retention.

Security of data

The EEAS, the EU Delegation and FPI strive to ensure a high level of security for your personal data. Appropriate organisational and technical measures are ensured according to Article 33 of Regulation (EU) 2018/1725. The collected personal data are stored on servers that abide by pertinent security rules. Data is processed by assigned staff members. Files have authorised access. Measures are provided to prevent unauthorised entities from accessing, altering, deleting or disclosing data. General access to personal data is only possible for recipients with a user ID and password. Physical copies are stored in a secured manner.

Where a service provider is contracted as a processor, the collected data may be stored electronically by the external contractor, who has to guarantee the data protection and confidentiality required by Regulation (EU) 2018/1725. These measures also provide a high level of assurance for the confidentiality and integrity of the communication between you and the EEAS, the EU Delegation and FPI. Nevertheless, a residual risk always exists for communication over the internet, including email exchange. The EEAS relies on services provided by other EU institutions, primarily the European Commission, to support the security and performance of the EEAS website.

Data Protection Officers

If you have enquiries, you can also contact the EEAS Data Protection Officer at data-protection@eeas.europa.eu, or, for FPI, the Data Protection Officer of the European Commission at data-protection-officer@ec.europa.eu.

Recourse

You have, at any time, the right to have recourse to the European Data Protection Supervisor at edps@edps.europa.eu.