Privacy statement - Online form

The personal data you provide in the EEA online contact form is processed in accordance with regulation (EU) No 2018/17251 of the European Parliament and of the Council of 23 October 2018 on the protection of natural person with regard to the processing of personal data by the EU institutions, bodies, offices and agencies.  

Processing operations are under the responsibility of the EEA Communication Programme, acting as Data Controller, regarding the collection and processing of personal data. The Data Controller may be contacted via the following email address: DPO@eea.europa.eu.  

1. Purpose(s) of processing 

Your personal data is collected and further processed for the purpose of the management and follow-up of your request for information and only to the extent necessary to reply to your query. Your data can be accessed by the team managing the enquiry service. It will not be disseminated outside the boundaries of the EEA and its relevant services.  

2. Recipients of the data processed  

In order to answer your enquiry, access to your personal data is given to a limited number of staff within the EEA Communication Programme that are responsible for coordinating the answers given to enquiries. In exceptional circumstances, it may be necessary to divulge your name (if provided) and/or email address to EEA thematic experts in order to evaluate the level of complexity of the EEA’s answer. Disclosure of personal data to another EU institution may only occur if the reply to the enquiry relates to an issue for which the EEA has no or limited competence. Correspondence with competent Commission staff member is done via internal e-mail. No personal data is shared with third parties for direct marketing purposes.  

3. Categories of data processed  

The only personal data collected and further processed is the information you encode yourself in the online form. The only obligatory fields are your email address and your enquiry; optionally, you may provide your name and your main area of occupation. The personal data collected is the strict minimum required to ensure that the EEA can reply to your enquiry.  

4. Modalities for the processing operation  

Personal data is provided via a submission form available online. It is an automated processing operation whereby you input the data directly in the form which is then stored in a database with a given case number. The data will be used for answering your enquiry via email. The further mail conversation is stored and linked to the case in the database. 

5. Safeguarding of data processed 

The data is stored securely in a database with encryption in transit (TLS). Access to the enquiries database is available to a limited number of EEA staff upon credentials.

All consequent mail communication is also encrypted in transit via STARTTLS and sent via Office365 mail servers located in the EU. 

6. Right of access and rectification  

If you wish to exercise your rights as a data subject and access, modify or delete your personal data in the database, please address your request to DPO@eea.europa.eu.  

6. Legal basis and legality of processing  

The processing of your personal data is necessary for the performance of tasks in the public interest or the exercise of official authority vested in the EEA as assigned by the following regulations:  

• Regulation (EC) No 401/2009 of 23 April 2009 on the EEA and Eionet, and in particular Article 2(m) thereof;
• Regulation (EC) No 1367/2006 of the European Parliament and of the Council of 6 September 2006 on the application of the Aarhus Convention on access to information, public participation in decision-making and access to justice in environmental matters to Community institutions and bodies; and
• Code of Good Administrative Behaviour (Commission decision 2000/633/EC, ECSC, Euratom). 

7. Data retention  

Personal data linked to an enquiry will be deleted after termination of the legal period for conservation of electronic documents. A retention period of maximum five years is applied in order to allow potential consultation with other services of the European Commission.  Nevertheless, the data is anonymised as much as possible when the requests are closed.

Moreover, if you wish exercising your deleting rights before the data retention period has passed, you can send a request via our online form.

8. Right to appeal  

You are entitled to have recourse at any time to the European Data Protection Supervisor (http://www.edps.europa.eu; EDPS@edps.europa.eu) if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data by the EEA. 

You may also contact the EEA’s Data Protection Officer (DPO) in case of any difficulties or for any questions relating to the processing of your personal data at the following e-mail address: DPO@eea.europa.eu.