Data Protection Notice for the EU Open for Business campaign 2020

Your personal data is processed in accordance with Regulation (EU) No 2018/17251 on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.

The data co-controllers of the processing operation are:

The Head of Unit GROW R.2.  Communication and Document Management of DG Internal Market, Industry, Entrepreneurship and SMES, European Commission GROW-R2@EC.EUROPA.EU and the Head of Unit A.1 COSME, Executive Agency for Small and Medium-sized Enterprises (EASME), EASME-COSME@ec.europa.eu 

The following entities process your personal data on behalf of the data controller:

  • ICF Next SA as data processor, and
  • its approved third-party authorised sub-processors: campaign@euopen4business.eu, Epresspack Sas GetResponse Sp. z o.o., and Streamdis BVBA, used to organise and support event activities on behalf of DG GROW and the European Commission.

These entities process your personal data in accordance with Regulation (EU) No 2018/1725 or Regulation (EU) 2016/679, respectively.

The legal basis for the processing activities are Article 5(a) of Regulation EU 2018/1725 because processing is necessary for the performance of a task carried out in the public interest (or in the exercise of official authority vested in the Union institution or body)2 and Article 5(d) of Regulation EU 2018/1725 based on your explicit consent for your non- mandatory personal data or for specific purposes indicated below.

The purposes of this processing operation are: to reply to questions sent through the contact form; to register and manage your participation at the Info Days of the EU Open for Business campaign 2020; to provide you with access to the event venue; include you in the list of participants and allow networking among participants, upon your specific consent; to inform the participants about follow-up activities of the events/related to the topic of the events, including feedback collection and specific, related communication activities, such as emailing, to monitor and evaluate the communication campaign.

What personal information do we collect and through which technical means?

  • The following of your personal data are collected through the contact form: your first name, last name, e-mail address, are mandatory for the purpose outlined above.
     
  • The following of your personal data are collected for the Info Days registration: your first name, last name, gender, title, organisation, function, professional e-mail address, phone number, office address are mandatory for the purpose outlined above.
     
  • In addition, the following non-mandatory personal data may be collected in case of your participation at the Info Days: your photo and videos, mobile phone number, fax number, your social media accounts, food preferences and restrictions, networking preference. These can only be processed based on your explicit prior consent. It is indeed possible that photographs and video of you will be taken during the event and might be used for related communication purposes, including web streaming, on Internet and social media such as LinkedIn, Twitter and Facebook3. Upon registration, you can give your explicit consent to have your images recorded and published on related communication channels. In the absence of your consent, the organiser will offer suitable alternatives, so that you can fully take part in the event.

    We could use your email address or your phone number (according to your choice) to further contact you in the context of the EU activities, only upon your specific consent-by ticking the optional opt-in box in the registration form.
     
  • We use a third-party provider, Epresspack, for the purpose of hosting the campaign hub and registration for Info Days events.

    When you are using the campaign hub and registration platform, Epresspack may automatically receive and record information from your browser or device, which may include your IP address, device identification information, cookies, the type of browser and/or device you’re using to access the platform, and the page or feature you requested. For more information about how Epresspack processes data, please visit Epresspack Cookie Policy available at (link). Please also see Epresspack privacy policy at: https://epresspack.com/privacy-policy/?lang=en.

    Epresspack hosts the collected personal data within the European Union, with the following exceptions:
     
    • Videos hosted by Epresspack's technology partner, Vimeo, in different parts of the world including the United States (more info on Vimeo’s privacy statement can be found here https://vimeo.com/privacy).
       
    • Google Analytics’ analysis data, in different parts of the world including the United States (more info on Google privacy statement can be found here https://policies.google.com/privacy?hl=en-US)
       
  • We use a third-party provider, GetResponse, for the purpose of sending campaign e-mails. GetResponse automatically also collects IP address, subscription preferences, website data, geolocation, and browser-generated information, cookies or other technologies used to track your activity. GetResponse hosts the collected personal data within European Economic Area4 servers.

    For information on how GetResponse uses cookies, please see GetResponse Cookie Policy available at https://www.getresponse.com/legal/cookie-policy.html. Please also see GetResponse privacy policy at: https://www.getresponse.com/legal/privacy.html.
  • We use a third-party provider, Streamdis, for the purpose of video web streaming Info Days events.
     
  • Streamdis hosts the collected personal data within the European Union, with the following exceptions:
     
    • Live and recorded video streams hosted by Streamdis' technology partner, Livestream, in different parts of the world including the United States.For information on how Streamdis uses cookies, please see Streamdis Cookie Policy available at (link). Please also see Streamdis privacy policy at: https://www.streamdis.eu/privacy/StreamdisDataPrivacyPolicy.pdf .

The recipients of your personal data will be EASME and Commission staff in charge of the management of the EU Open for Business campaign, staff of ICF Next SA in charge of the campaign and the events and its approved third-party authorised sub-processors, staff of the Enterprise Europe Network (as co-organiser of the campaign and the events), agents of the security personnel, participants of the event as well as the bodies charged with monitoring or inspection tasks in application of EU law (e.g. internal audits, Court of Auditors, European Anti-fraud Office (OLAF)). 

Your name and e-mail will be included on the event participants list to be shared among other event participants, upon your specific consent in the optional opt-in box in the registration form.

The personal data listed just hereunder will be transferred to the United States for these specific purposes :

  • Videos hosted by Epresspack's technology partner, Vimeo, in different parts of the world including the United States.
     
  • Google Analytics’ analysis data, in different parts of the world including the United States

The following safeguards are in place for this transfer: These two recipients are located in a third country covered by an Adequate decision of the European Commission (Privacy Shield self-certification). Regarding the technical and organizational measures recipients put in place, please refer to their privacy statements.

The processing of your data will not include automated decision-making (such as profiling).

Your personal data will be kept for a maximum period of 3 years starting from 27/05/2020. Data will be deleted at the end of this period.

You have the right to access your personal data and to request your personal data to be rectified, if the data is inaccurate or incomplete; where applicable, you have the right to request restriction or to object to processing, to request a copy or erasure of your personal data held by the data controller. If processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on your consent before its withdrawal.

Your request to exercise one of the above rights will be dealt with without undue delay and within one month.

If you have any queries concerning the processing of your personal data, you may address them to GROW-R2@EC.EUROPA.EU (entity acting as data controller).

You shall have right of recourse at any time to the Commission Data Protection Officer at GROW-DATA-PROTECTION-COORDINATOR@ec.europa.eu and to the European Data Protection Supervisor at https://edps.europa.eu.





_______________________________________________________________________________________
1 Regulation (EU) 2018/1725 of the European Parliament and of the  Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L295/39 of 21.11.2018).

2 Act of Establishment: Commission Implementing Decision C(2013/771/EU) of 17 December 2013 establishing the 'Executive Agency for Small and Medium-sized Enterprises' and repealing Decisions 2004/20/EC and 2007/372/EC.  
Regulation (EU) No 1287/2013 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 11 December 2013 establishing a Programme for the Competitiveness of Enterprises and small and medium-sized enterprises (COSME) (2014 - 2020) and repealing Decision No 1639/2006/EC.

3 European Commission, Executive Agency for Small and Medium-sized Enterprises (EASME), Enterprise Europe Network social media accounts and web pages, EU Open for Business Info Days’ registration page, and Info Days participants’ social media accounts.

4 European Economic Area countries include Austria, Belgium, Bulgaria, Croatia, Republic of Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden and the United Kingdom.