Privacy Policy

The European Commission (hereafter ‘the Commission’) is committed to protecting your personal data and respecting your privacy. The Commission processes personal data pursuant to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC

This privacy statement explains the reason for the processing of your personal data, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you have in relation to your personal data. It also specifies the contact details of the responsible Data Controller with whom you may exercise your rights, the Data Protection Officer and the European Data Protection Supervisor.

This privacy statement relates to Service Contract on Physical Obstacles to Vaccination (EU4HealthAWP2021) Contact Form for HADEA/2021/OP/0010 – Service contract to identify obstacles to vaccination of physical, practical or administrative nature and develop recommendations.

This project is carried out by a consortium contracted by the European Health and Digital Executive Agency (HaDEA) on behalf of the European Commission (hereafter ‘DG SANTE’) for this purpose. DG SANTE is the Data Controller. The consortium consists of, Verian, European Health Management Association (EHMA), the Foundation for the Promotion of Health and Biomedical Research of Valencia Region (Fisabio), ifok, the European Academy of Paediatrics (EAP), and European Regional and Local Health Authorities (EUREGHA). Kantar Public, as consortium lead, along with its sub-contractor Touch4IT are the Data Processors.

Purpose of the processing operation

The purpose of processing your personal data is to:

1. Respond to project related queries and build knowledge base of users who would like to know more about the project.
2. Report, for statistical purposes, the performance of the website and to better understand the needs of the users to enhance services and features.

Personal data may be processed in this situation: 

• contact form
• cookies 

The processing of personal data for the situations mentioned above is carried out by Verian and its subcontractor Touch4IT, acting on behalf of DG SANTE.

The processing operations on personal data (referred in section 2 points (a) and (b) are necessary for the management and functioning of the Commission, as mandated by the Treaties. Those provisions are in particular, Article 11 of the Treaty on European Union and Article 15 of the Treaty on the Functioning of the European Union. 

Consequently, those processing operations are lawful under article 5 of Regulation (EU) 2018/1725, namely:

• Article 5(1) (a), where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body. 
• Article 5(1)(d) of Regulation EU 2018/1725 based on your consent.  For the purpose of this activity we will process your name and surname, and email address. This information is collected on a voluntary basis when completing the website contact form. Consent is provided when you have manually clicked the consent box in the contact form or accepted the website cookies upon entering the website.

Your consent for these services can be withdrawn at any time by writing to the DG SANTE: SANTE-CONSULT-B4@ec.europa.eu 

We process the following personal data: 

• Name and surname: This information is collected from the contact form and used for correspondence to address user queries.
• Email address: This information is collected from the contact form and used for correspondence to contact the user.

Personal data is kept only for the time necessary to fulfil the purpose of the processing operation, or until you withdraw your consent (see above), and in any case not longer than 12 months from the closure of the website (2027).

All personal data in electronic format (e-mails, documents, databases, uploaded batches of data, etc.) are stored on servers located in the EU.

All processing operations are carried out pursuant to the Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission.

The consortium and its subcontractor are based in the European Union and is bound by a specific contractual clause for any processing operations of your personal data on behalf of the Commission, and by the confidentiality obligations deriving from the transposition of the General Data Protection Regulation in the EU Member States (‘GDPR’ Regulation (EU) 2016/679).

In order to protect your personal data, the Commission has put in place a number of technical and organisational measures. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.

Access to your personal data is provided to:

• HaDEA, the contracting authority and Commission staff who have oversight of the implementation of the project HADEA/2021/OP/0010. Your personal data will only be shared when, for example, a question or enquiry submitted through the contact form, is specific to the contracting authority (HaDEA) and/or other projects managed by HaDEA.  
• Other authorised Commission staff according to the “need to know” principle. Such staff abide by statutory, and when required, additional confidentiality agreements.
• Verian staff (contractor), who on a professional basis, support website content and incoming queries via the website contact form.
• Touch4IT (sub-contractor) technical support team responsible for the maintenance and performance of the website.
• The anonymised data may be shared with the Health Authorities in charge of the vaccination schedule for analysis purposes.

Personal data processed will not be given to any third party, except to the extent and for the purpose we may be required to do so by law.

Cookies are short text files stored on a user’s device (such as a computer, tablet or phone) by a website. Cookies are used for the technical functioning of a website (functional cookies) or for gathering statistics (analytical cookies).

When you visit the website, we will keep the history of your visit for a maximum of 13 months in accordance with the cookie expiration date presented in the table below. Information collected from the website contact form will be stored for up to 12 months after the closure of the website (2027), after which the information will then be deleted. The collection, aggregation and anonymising operations are performed by Touch4IT based in Bratislava (Slovakia), and Verian, who are based in Brussels, Belgium.

Enabling these cookies is not strictly necessary for the website to work but it will provide you with a better browsing experience. You can delete or block these cookies, but if you do that, some features of the meeting/event website may not work as intended.

The cookie-related information is not used to identify data subjects personally and the pattern data is fully under the Commission’s control. These cookies are not used for any purpose other than those described here.

Should you wish to opt your personal data out of our anonymised, aggregated statistics, you can do so on our cookies page. In particular, you can control and/or delete those cookies as you wish.

A full list of cookies collected are presented on our Cookies page.

You have specific rights as a ‘data subject’ under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular the right to access your personal data and to rectify them in case your personal data are inaccurate or incomplete. Where applicable, you have the right to erase your personal data, to restrict the processing of your personal data, to object to the processing, and the right to data portability.

You have consented to provide your personal data to the European Commission, DG SANTE for the present processing operation. You can withdraw your consent at any time by notifying DG SANTE: SANTE-CONSULT-B4@ec.europa.eu.

The withdrawal will not affect the lawfulness of the processing carried out before you have withdrawn the consent.

You can exercise your rights by contacting the DG SANTE, or in case of conflict the Data Protection Officer. If necessary, you can also address the European Data Protection Supervisor. Their contact information has been provided below under 'Contact information'.

Where you wish to exercise your rights in the context of one or several specific processing operations, please provide their description (i.e. their Record reference(s) as specified under 'Where to find more detailed information') in your request.

The Data Controller:
If you would like to exercise your rights under Regulation (EU) 2018/1725, if you have comments, questions or concerns, or if you would like to submit a complaint regarding the collection and use of your personal data, please feel free to contact DG SANTE: SANTE-CONSULT-B4@ec.europa.eu. 

The Data Protection Officer (DPO) of the Commission:
You may contact the Data Protection Officer (data-protection-officer@ec.europa.eu) with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725.

The European Data Protection Supervisor (EDPS):
You have the right to have recourse (i.e. you can lodge a complaint) to the European Data Protection Supervisor (edps@edps.europa.eu) if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data by the Data Controller.

The Commission Data Protection Officer (DPO) publishes the register of all processing operations on personal data by the Commission, which have been documented and notified to him. You may access the register via the following link: http://ec.europa.eu/dpo-register.

This specific processing operation has been included in the DPO’s public register with the following Record reference: DPR-EC-21013.1