Introduction
This Data Protection Notice describes the measures taken to protect your personal data with regard to the action involving the present data processing operation and what rights you have as a data subject.
European Health and Digital Executive Agency (HaDEA or Agency) protects the fundamental rights and freedoms of natural persons and in particular your right to privacy and the protection of your personal data.
Your personal data are processed in accordance with Regulation (EU) No 2018/1725[1] on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.
[1] Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L295/39 of 21.11.2018).
Why and how do we process your personal data?
In the context of the implementation of the service contract n. 20197105 “AlHaMBRA Project” concluded between European Health and Digital Executive Agency (HaDEA), on the one part and the General Directorate for Intervention on Addictive Behaviours and Dependencies in Portugal (SICAD), SICAD, with logistic support from the event organizer company Cevents (https://cevents.es/en/) is organizing, among others, the Thematic Capacity Workshop on the topic “Alcohol and Workplace”, in the frame of the prevention strand of Europe’s Beating Cancer Plan. The thematic workshop aims to support European Member States in knowledge gathering, sharing best practice and capacity building for evidence-based alcohol policy and harm-reduction across multiple sectors.
The purposes of this processing activity of personal data are the following:
-
obtain informed consent for processing the data
-
process registrations to the workshop,
-
manage access to the online workshop platform,
-
short-list selected participants in order to ensure a balanced representation among the workshop’s participants in terms of geographical origins and sectors to optimise the workshop capacity-building and perspective-sharing activities,
-
evaluate satisfaction of participants and measure the impact of the workshop in terms of relevance, scope and contents,
-
inform on existing or new dissemination outputs, activities and events related to the AlHaMBRA Project, subject to explicit permission,
-
analysing aggregate data for reporting purposes to the contracting authority, HaDEA, in terms of compliance with the specifications of the service contract,and DG SANTE of the European Commission in terms of public health policy impact of the workshop.
Your personal data will not be used for an automated decision-making including profiling.
Your personal data will not be transferred to third countries or international organisations.
Who is the ‘data controller’?
The data controller, is the Head of Unit A2 at the European Health and Digital Executive Agency (HaDEA), managing the EU Contract No. 20197105. (AlHaMBRA Project - Alcohol Harm – Measuring and Building Capacity for Policy Response and Action).
Who is the ‘data processor’?
The data processors are:
-
The General Directorate for Intervention on Addictive Behaviours and Dependencies in Portugal (SICAD), leader of the joint contractors in the EU Contract No. 20197105. (AlHaMBRA Project - Alcohol Harm – Measuring and Building Capacity for Policy Response and Action).
-
Clínic Foundation for Biomedical Research (FCRB, in Barcelona, Spain), member of the joint contractors in the EU Contract No. 20197105. (AlHaMBRA Project - Alcohol Harm – Measuring and Building Capacity for Policy Response and Action).
The following entities process your personal data on our behalf (sub-processors):
-
Cevents (https://cevents.es/en/) subcontracted event organizer company.
Third party tools used for the organisation of Thematic Capacity Workshop on the topic “Alcohol and Workplace”
The event will be organised partially online using the following tools:
For the purpose of the online registration to the workshop, the Jotform (https://www.jotform.com/) business account of FCRB (Spain) is used. Jotform stores the registration forms and the data collected in their EU DataCenter (https://www.jotform.com/help/871-how-to-store-your-data-on-eu-servers/).
The subcontracted event organizer company, Cevents, will have access to the name and e-mail address of the workshop participants in order to set up the online workshop platform using their Zoom business account set to route their meetings and webinars through the Zoom data centre based in the European region (https://support.zoom.us/hc/en-us/articles/360042411451-Selecting-data-center-regions-for-meetings-webinars).
Moreover, Cevents hosts the collected personal data on servers in the EU. For information on how Zoom uses cookies and how it processes personal data, please see at: https://explore.zoom.us/en/gdpr/.
Which is the legal basis for processing your personal data?
The legal basis for the processing activities are
-
Article 5(1)(d) of Regulation (EU) 2018/1725: the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
How to withdraw your consent and the consequences of doing this
If you want us to delete the personal data related to your identification or your geographical origin, profession and expertise, please contact us via e-mail to deep-seas@clinic.cat, and we will comply with this request within 7 working days of your request.
Please note that withdrawing your consent does not affect the lawfulness of any processing based on your consent before this consent is withdrawn. Attention is drawn to the consequences of a delete request, which means that all your contact details will be lost to this research team in relation to the AlHaMBRA Project Workshop on Alcohol and the Workplace.
Which personal data do we collect and further process?
In order to carry out this processing operation, the sub-processor, Cevents, and processor, FCRB, acting for HaDEA, collects the following categories of personal data:
-
identifiers: first name, family name, e-mail address;
-
professional details: organisation, position, country of professional affiliation (to ensure geographical balance); geographical level of work;
-
personal information: gender (to ensure balance); years working on alcohol-related topics (for reporting, in aggregate form)
These are mandatory data, collected directly from you through the pre-registration form whose link is made available in the invitation letter to the workshop, for the purposes outlined above. If you do not provide your personal data, we cannot process your workshop pre-registration. When proceeding with the registration you give us permission to store and use your data.
We do not process special categories of personal data.
How long do we keep your personal data?
FCRB, acting for HaDEA only keeps your personal data for the time necessary to fulfil the purpose of collection or further processing, namely for the duration of the AlHaMBRA Project (ending February 2023) and 6 further months for reporting and dissemination purposes, given your explicit permission.
How do we protect and safeguard your personal data?
All personal data in electronic format are stored either on the server of FCRB, a member of the Agency’s joint contractors, and Cevents, the sub-contracted entity to process selected data (name and e-mail address), as described above. Cevents will only store your data for the time strictly necessary for the logistic support to the organisation of the workshop.
In order to protect your personal data, a number of technical and organisational measures in place. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.
Who has access to your personal data and to whom is it disclosed?
The recipients of your personal data will be:
-
authorised FCRB staff
-
authorised Cevents staff
Such staff abide by statutory, and when required, additional confidentiality agreements.
On a need-to-know basis and in compliance with the relevant current legislation, bodies charged with monitoring or inspection tasks in application of EU law (e.g., EC internal audit, Court of Auditors, European Anti-fraud Office (OLAF), the European Ombudsman, the European Data Protection Supervisor, European Public Prosecutor’s Office (EPPO)).
The information we collect will not be given to any third party, except to the extent and for the purpose we may be required to do so by law.