Data protection

• Introduction
• Why does Eurofound process your personal data?
• What types of personal data we process?
• What legal bases justify the processing of your personal data?
• Who has access to your personal data?
• How long do we keep your data?
• What are your rights?
• Complaint to the European Data Protection Supervisor
• Investigations by the DPO

Introduction

European data protection rules are all about empowering people, to give them control over how their personal data are used. At Eurofound we take this obligation seriously. Data protection and privacy are embedded in our daily work, from our communication activities to our European-wide surveys and research publications.

On this page you will find information on the reasons why we may process personal data and what types of data we process, as well as on your rights and contact details should you have any question.

Why does Eurofound process your personal data?

Eurofound may process your personal data (also known as personal information) for a number of reasons: from dealing with public requests for information, visitor information, handling of complaints, inviting you to a meeting or to one of our research projects, or simply because you submit them when subscribing to publications or events on our website. Regardless of the reason, processing is always carried out in accordance with Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018.

All purposes of processing can be found in our Data Protection Register, or in our data protection notices. Both are updated regularly, so we advise you to consult them periodically.

What types of personal data we process?

The types of personal data depend on the purpose of processing. They may include your name and contact details, your CV and any certifying documents (when applying for a job or traineeship), your dietary and mobility requirements (when attending an event organised by Eurofound), or the acceptance of cookies.

The exact categories of personal data are identified in the applicable data protection notice.

What legal bases justify the processing of your personal data?

In most of the situations, Eurofound processes your personal data for the performance of a task carried out in the public interest, for compliance with a legal obligation, or based on your consent. Other legal bases might apply, though. Detailed information on the legal basis is always provided in the applicable Data Protection Notice.

Who has access to your personal data?

Unless otherwise stated in a specific Data Protection Notice, access to your personal data will be given exclusively to our staff members, who need to comply with statutory obligations of confidentiality.

How long do we keep your data?

For each processing operation there is a defined retention period that specifies the period for which your personal data are kept. Depending on the processing operation, the retention period can vary. The exact retention period is specified in the applicable data protection notice.

What are your rights?

Regulation (EU) 2018/1725 grants you, as data subject, the possibility to exercise the following rights:

• know when your personal data is being processed
• access your personal data
• have a copy of your personal data
• rectify your personal data should it be inaccurate or incomplete
• have your data deleted
• restrict the processing of your data
• object to the processing of your data
• port your data, and
• not be subject to automated decisions (i.e., made solely by machines) affecting you.

The exercise of these rights is free. However, where requests are manifestly unfounded or excessive, Eurofound may refuse to act on the request. Should this be the case, you will be informed accordingly.

To exercise any of these rights, please send your request by email or by post in a sealed envelope. See Contacts below. You should make clear in your request what right(s) you are exercising.

You must also provide a copy of an identification document, for example an ID card or passport. The following data should be visible: name, identification number, country of issue, period of validity, and date of birth. Any other data (e.g., photo or signature) may be blacked out. We will use these data exclusively to verify your identity. Once your request has been dealt with, we will securely destroy the document. In principle, we will not accept any other means of evidence of your identity. Should you wish to propose alternatives, we will assess their adequacy on a case-by-case basis.

Complaint to the European Data Protection Supervisor

In addition to the rights listed above, you can also complain to the EDPS, our supervisory authority, in case you feel Eurofound has infringed provisions of Regulation (EU) 2018/1725 when processing your personal data. You will find more information on this on the EDPS website.

Investigations by the DPO

Eurofound’s Data Protection Officer (DPO) may, at the request of any individual, investigate matters and occurrences directly relating to his/her tasks. Should you wish to avail of this opportunity, please send your request for an investigation to DataProtectionOfficer@eurofound.europa.eu.

The DPO will send an acknowledgement of receipt within 15 working days and will verify whether the request falls under the DPO's responsibility and whether or not it shall be treated as confidential.

The DPO will report back to the person who commissioned the investigation no later than three months following receipt of the request, unless in the case of obvious misuse of this right, in which case no report will be done. This deadline may, however, be suspended until the DPO has obtained any information deemed necessary to conclude the investigation.

The following specific data protection notices apply to the processing of personal data by Eurofound.