Data Protection Notice — Cluster meeting OG&UV back-to-back event, 04–05/02/2027

The European Education and Culture Executive Agency ("EACEA") is committed to preserving the protection of your personal data. This notice provides information on your rights in relation to data protection and on how your personal data are processed by EACEA in accordance with Regulation (EU) 2018/1725 on the protection of personal data by the Union institutions, bodies, offices and agencies ("the Data Protection Regulation").

On 04–05/02/2027, EACEA is organising an on-site event, the Cluster meeting – OG&UV back-to-back event. It will take place in the premises of Nhow Brussels Bloom, Rue Royale 250, 1210 Brussels, Belgium. The event will take the form of a meeting; coffee breaks and lunches and a networking drink are foreseen. An external contractor, VO Europe, will facilitate some organisational aspects of the event and will be present onsite. Participants to the meeting will be personnel of EACEA and of the European Commission and beneficiaries of the CERV calls Union Values (CERV-2024-CITIZENS-VALUES) and Operating grant (CERV-2026-OG-SGA).

1. Who is responsible for processing your personal data (data controller)?

The controller is EACEA, BE-1049 Brussels. The person designated as being in charge of the processing operation is the Head of Unit EACEA B.3 – Citizens and EU Values.

The contact email address is: EACEA-CERV@ec.europa.eu

2. For which purpose do we process your data?

Your personal data are collected and used to:

• Organise the on-site event (which includes sending invitations to the event and collection of registration data from participants through the use of the platform);
• Share the registration data with the external contractor (VO Europe) selected as they will be responsible for the pre-event and on-site participants management, to prepare event badges displaying names and functions in the organisations, in order for participants to get to know each other and network;
• Share the registration data (names, email addresses, organisation, functions/roles in the organisation) with other participants of the event, ahead of the meeting, to allow organisation of bilateral meetings during the event and contact sharing;
• Collect, on an optional basis, your dietary and accessibility requirements in order to accommodate your needs during the event (e.g. catering, accessibility of the venue). This information is used for that purpose only;
• Use an online audience interaction tool (SLIDO) in accordance with its privacy policy to collect opinions and reply to polls during said event, in order to have more interaction with the participants;
• Record and take photos of the event: the event will be audio and video recorded;
• Participants who do not want to be photographed or filmed will be able to follow the event in a non-photographed / non-recorded area at the venue of the event;
• Photos and videos taken during the event of the participants (including speakers/moderators) may be published on EACEA's and/or the European Commission's intranet. The recorded images may be used by EACEA and the European Commission for communication purposes;
• Webex might be used to make the meeting accessible to online participants via a Webex meeting link, in case of force majeure events that will impede in-presence attendance.

This is because EACEA is mandated by the European Commission to implement the CERV Programme. Your personal data will not be used for automated decision-making, including profiling.

3. Which personal data are processed?

In order to carry out the processing operation, the following data may be processed:

• Names, surnames;
• Function;
• Contact details (e-mail address, organisation);
• Dietary and/or accessibility requirements (optional data) and related consents;
• Photos, videos, and related consents (optional data).

Dietary and accessibility requirements may reveal information about your health or your religious or philosophical beliefs. This is special category data under Article 10 of the Data Protection Regulation. We process it only on the basis of your explicit consent (Article 10(2)(a)), which you give by ticking the box in the registration form. Please share only what is strictly necessary to accommodate your needs. You do not have to specify the underlying health condition or belief.

The data will also be used to prepare badges so participants can access the event and easily be recognised to network.

The provision of your name, function and contact details is mandatory. If you do not provide your personal data, possible consequences are the impossibility to attend the event. The provision of dietary and accessibility requirements, photos and videos is optional and is not a condition for attending the event. If you do not provide them, the only consequence is that we may not be able to accommodate your specific needs.

4. Who has access to your personal data and to whom is it disclosed?

The following recipients may access your personal data:

• EACEA authorised staff responsible for carrying out this processing operation. Such staff abide by statutory confidentiality obligations;
• Authorised staff of the European Commission: relevant DGs, in particular the Directorate-General for Justice and Consumers (DG JUST), Secretariat-General (SG), etc.;
• DG DIGIT acting as processor for EACEA and its contractor (CISCO) for the use of the Webex web conference service;
• Staff of other Executive Agencies for data published on EACEA's and the European Commission's intranet;
• Personnel employed by VO Europe (our contractor acting as data processor), which is responsible for services linked to the organisation of the event and which only processes the personal data listed above;
• Public access for images which may be used by EACEA and the European Commission for communication purposes.

Your data may also be processed via EU Survey in line with the following privacy statement: ec.europa.eu/eusurvey/home/privacystatement

The following corporate tools and services are used:

• Webex, with its applicable privacy statement, and SLIDO, to allow participants to interact (see the privacy policy under ec.europa.eu/dporegister/detail/DPR-EC-06687). Participants not willing to share their personal data with the selected tool can simply reply anonymously. SLIDO was acquired by Cisco Systems, Inc. For Webex (Cisco) and SLIDO, data may be transferred to the U.K. and the U.S. in certain circumstances as specified in the above privacy statements. These transfers are based on the Adequacy Decisions adopted by the European Commission with the U.K. and the U.S., respectively.

The following third-party tools and services are used:

• Netigate, to send the satisfaction survey after the event (Netigate privacy statement);
• Stageflow, used for event registration by our contractor VO Europe (Stageflow privacy policy).

In addition, data may be disclosed to public authorities in accordance with Union and Member State law, such as the European Court of Justice, the relevant national judge as well as the lawyers and the agents of the parties in case of legal proceedings, the Investigation and Disciplinary Office of the European Commission (IDOC), the competent Appointing Authority in case of a request or a complaint lodged under Article 90 of the Staff Regulations, the European Anti-Fraud Office (OLAF), the Internal Audit Service of the Commission (IAS), the Court of Auditors, the European Ombudsman, the European Data Protection Supervisor (EDPS) and the European Public Prosecutor's Office (EPPO).

5. How long do we keep your personal data?

EACEA only keeps your personal data for the time necessary to fulfil the above-mentioned purpose and follows the Common Retention List of the European Commission (CRL). Mandatory data relating to the registration process of the event will be kept for a maximum of 12 months after the closure of the event planned for 04–05/02/2027 and will be deleted afterwards. Dietary and accessibility requirements are deleted immediately after the event.

6. How do we protect and safeguard your personal data?

Relevant organisational and technical measures are taken by EACEA to ensure the security of your personal data.

Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed.

Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation. Access to your data is done via an authentication system on an individual basis through user-ID and password. Your data resides on the servers of the European Commission or relevant clouds, which abide by strict security measures implemented by the European Commission (DG DIGIT) to protect the security and integrity of the relevant electronic assets. EACEA is bound by Commission Decision 2017/46 of 10/1/17 on the security of communications and information systems in the European Commission.

Contractors are bound by specific contractual clauses and requirements (confidentiality, etc.) for any processing operations of your data on behalf of EACEA, and by data protection obligations deriving from the application of the Regulation and of the General Data Protection Regulation in the EU Member States ("GDPR", Regulation (EU) 2016/679).

7. What are your rights concerning your personal data and how can you exercise them?

Under the provisions of the Data Protection Regulation, you have the following rights:

• to request from the controller access to the personal data that EACEA holds about you;
• to have your personal data rectified in case your personal data are inaccurate or incomplete;
• to request the erasure of your personal data, when applicable;
• to request the restriction of the processing of your personal data, when appropriate.

When processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing before such a withdrawal. The withdrawal will have effect from the moment of your retraction. The processing based on your consent before this withdrawal will thus remain lawful.

However, the data controller may restrict the rights of the data subjects based on Article 25 of the Data Protection Regulation (in exceptional circumstances and with the safeguards laid down in the Regulation). Such restrictions are provided for in the internal rules adopted by EACEA and published in the Official Journal of the European Union.

Such a restriction will be proportionate, limited in time and respect the essence of the above-mentioned rights. It will be lifted as soon as the circumstances justifying the restriction are no longer applicable. In principle, you will be informed of the principal reasons for a restriction unless this information may cancel the effect of the restriction. A more specific data protection notice may apply in such case.

8. Contact information

If you have questions or wish to exercise your rights under the Data Protection Regulation, or if you want to submit a complaint regarding the processing of your personal data, you are invited to contact the data controller (see contact details above).

You can also contact the Data Protection Officer of EACEA at the following email address: eacea-data-protection@ec.europa.eu.

You may lodge a complaint with the European Data Protection Supervisor: www.edps.europa.eu.

9. On which legal basis are we processing your personal data?

We process your personal data because:

• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body (as laid down in Union law);
• the data subject has given consent to the processing of his or her personal data for one or more specific purposes.

The legal grounds to process your data are:

• Council Regulation 58/2003 of 19 December 2002 laying down the Statute for executive agencies to be entrusted with certain tasks in the management of EU programmes;
• Commission Implementing Decision (EU) 2021/173 of 12 February 2021 establishing the European Education and Culture Executive Agency;
• Commission Decision C(2021) 951 of 12 February 2021 delegating powers to the European Education and Culture Executive Agency with a view to the performance of tasks linked to the implementation of Union programmes in the field of education, audiovisual and culture, citizenship and solidarity;
• Regulation (EU, Euratom) 2024/2509 of the European Parliament and of the Council of 23 September 2024 on the financial rules applicable to the general budget of the Union (recast);
• Regulation (EU) 2021/692 of the European Parliament and of the Council of 28 April 2021 establishing the Citizens, Equality, Rights and Values Programme and repealing Regulation (EU) No 1381/2013 of the European Parliament and of the Council and Council Regulation (EU) No 390/2014.

Consent will apply:

• for sharing participant lists with the other participants;
• for publication of audio and video recording of the event on the relevant websites, intranet and/or social media accounts;
• for photos and videos of participants during the event, and publication on relevant websites, intranet and/or social media accounts;
• for invitations to future similar events organised by EACEA.

The following special categories of personal data are being processed:

• health data (dietary requirements, accessibility requirements) to enter into a building.

Source: EACEA Data Protection Notice, electronically signed on 08/10/2026 in accordance with Article 11 of Commission Decision (EU) 2021/2121.