ERASMUS+ privacy notice - Gulbenes novada vēstures un mākslas muzejs

Version: 2023/06/02

This page provides information about the processing and protection of your personal data in Erasmus+ and European Solidarity Corps programmes.

This processing is done in line with Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data. The data controller and the processors listed in this privacy statement follow the rules of the Regulation.

Other specific privacy statements, data processing records or important documents referred to in this privacy statement:

Introduction

The European Commission (hereafter ‘the Commission’) is committed to protecting your personal data and respecting your privacy. The Commission collects and further processes personal data according to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices, and agencies and on the free movement of such data (repealing Regulation (EC) No 45/2001).

This privacy statement explains the reasons for processing your personal data, how we collect, handle, and ensure the protection of all personal data provided, how that information is used and what rights you have concerning your personal data. It also specifies the responsible Data Controller’s contact details with whom you may exercise your rights, the Data Protection Officer, and the European Data Protection Supervisor’s contact details.

Why and how do we process your personal data?

We process your personal information for the following reasons:

Authentication and authorisation

provide access to IT tools with authentication mechanism EU Login; please check the specific privacy statement for EU Login for more details
manage access to IT tools with the authorisation mechanisms offered by the European Commission’s Identity and Access Management Service tools, such as EU Access and Secunda+
manage access to programme reporting tools for National Agency staff and National Authority representatives

Organisation registration

allow organisations to register so they may participate in the Erasmus+ and European Solidarity Corps actions managed by National Agencies; in this case, we collect information about the organisation’s contact persons, legal representatives and other individuals linked with organisations; in some cases, the organisation name may reveal identifiable data of a physical person
identify applicant organisations requesting an EU grant for a project under Erasmus+ and the European Solidarity Corps actions managed by National Agencies
send emails to contacts or authorised users of organisations registered in the Organisation Registration System – these emails include a confirmation of organisation registration, confirmation of adding or removing authorised users, confirmation of successful update of organisation information
allow National Agencies in charge of the management of Erasmus+ and the European Solidarity Corps to manage (for example, to add or modify) organisational data, including the personal data of contact persons and authorised users (based on consent)

Submission of application and management of grant applications and projects

facilitate the submission of applications for the different Erasmus+ and European Solidarity Corps actions managed by the National Agencies
manage details of the projects funded by its programmes Erasmus+ and European Solidarity Corps (such as mobility projects, cooperation projects, and policy support actions), including the achievement of the project objectives, the number and type of participants and budgetary and financial aspects; personal data used in this processing will include the contact persons and legal representatives of organisations taking part in projects, the project managers of the National Agencies supervising the project and other persons involved in the grant application submission, assessment and management
send emails to confirm submission of the grant application, confirmation of the award of the grant, invitation to the Beneficiary Module to manage the project and other automated notifications from the various IT systems of the European Commission or the National Agencies for Erasmus+ and European Solidarity Corps
manage the selection procedures under Erasmus+ and European Solidarity Corps actions managed by National Agencies
management of a pool of experts assessing grant applications
fulfil the obligations and responsibilities relating to monitoring, evaluation, reporting and auditing
make information about grant award results available to the public via publications on websites of the Erasmus+ and European Solidarity Corps National Agencies; this data may contain personal data of natural persons and informal groups of young people
assess the impact of Erasmus+ and European Solidarity Corps programme participation on beneficiary organisations and acquire a better knowledge of participating groups to fine-tune outreach strategies
disseminate the project results together with personal data of contact persons through the appropriate Erasmus+ and European Solidarity Corps IT tools (Project Results Platform); consent will be requested from the contact persons before publishing their contact data (see Project Results Platform specific privacy statement for more information)
data of persons marked as “learning managers” in the Beneficiary Module, who are responsible for the management of the language courses or assessments for the participants, will be transferred to the EU Academy platform and will be processed by the EU Academy after the person’s consent; all processing activities will be conducted in line with the privacy statement of the EU Academy platform (see EU Academy e-learning platform privacy statement for more information)
personal data of National Agencies’ users monitoring the activities of participants in language courses or assessments will be transferred to the EU Academy platform and will be processed by the EU Academy after the person’s consent; all processing activities will be conducted in line with the privacy statement of the EU Academy platform (see EU Academy e-learning platform privacy statement for more information)
transfer data on the Accreditation and Quality Label of the European Solidarity Corps to the European Youth Portal; consent will be requested from the contact persons before publishing their contact data (see European Youth Portal specific privacy statement for more information)

Management of Erasmus+ and European Solidarity Corps participants’ data

manage participating organisations in the project to ensure monitoring and follow-up;
provide reporting and accountability via statistics collected from the project and the answers provided by the beneficiary or participants
invite participants and manage the individual participant surveys and provide statistics on the answers provided, which is essential to demonstrate how the project funds have been used and how the programme objectives have been achieved
provide support to future participants in the programmes (based on consent, i.e., on a voluntary ‘opt-in’ basis)
provide testimonials on participation in the programmes to the general public (based on consent, i.e., on a voluntary ‘opt-in’ basis)
participation in online language courses: in this case, data of participants taking language courses or assessments will be transferred to the EU Academy platform and will be processed by the EU Academy based on the participant’s consent; registration for the course, tracking progress, awarding badges and other processing activities will be conducted in line with the privacy statement of the EU Academy platform (see EU Academy e-learning platform privacy statement for more information)

Communication with the National Agencies

Communication, including emails, instant communication, calls and webinars between the Commission and the NAs and vice versa for the implementation, management, monitoring and evaluation of the Erasmus+, European Solidarity Corps programme
Exchange of contact details of the staff of the National Agencies, including the field of expertise, with relevant staff of the European Commission on a need-to-know basis, and with other National Agencies for communication, consultation, guidance, participation in ad-hoc working groups, cooperation and exchange of practices between National Agencies and other activities related to implementation, management, monitoring and evaluation of the Erasmus+ and European Solidarity Corps programmes
Audio-visual recording of the meetings to draft minutes and summary records, recording of the training or presentation meetings within the scope of programme management and implementation and distributed to the National Agencies staff only (see “EC M365 environment” record for more information about audio/video recordings in EC M365 environment)

Programme evaluation

European Commission, National Agencies and National Authorities as mandated by Art.24(3) of Regulation (EU) 2021/817 of the European Parliament and of the Council of 20 May 2021 establishing Erasmus+: the Union Programme for education and training, youth and sport, are obliged to conduct evaluation of the programme. For this purpose, the participants, applicants and beneficiaries may be contacted by email or phone (in case the phone number data was collected) to obtain information about the programme and results of the programme participation.
For programme evaluation the European Commission, National Agencies and National Authorities may use subcontractors. The details of the subcontractors, if any, are available at the list of processors linked from this privacy statement.

Other processing activities

analytical and statistical reporting where the processing of personal data is required to analyse data on the level of individuals (participants, organisation contact persons, legal representatives, group leaders, etc.) or access control to the reports
manage access to work programmes, contribution agreements and annual reports for National Agencies
receive communication from other participants of Erasmus+ or European Solidarity Corps (based on consent, i.e., on a voluntary ‘opt-in’ basis)
facilitate participation in further studies regarding the programmes and EU issues (based on consent, i.e., on a voluntary ‘opt-in’ basis)
allow the Erasmus+ Student and Alumni networks or the contractor supporting their activities to contact Erasmus+ participants to take part in their activities (based on consent, i.e., on a voluntary ‘opt-in’ basis)
publish the name and email address together with the final participant report (or parts) for the general public (based on consent, i.e., on a voluntary ‘opt-in’ basis)
preserve user’s custom settings such as filters or selection of displayed information in Erasmus+ and European Solidarity Corps page (single entry point) and/or other applications
promote future calls and opportunities in the programmes among the past applicants, beneficiaries and partners via emails or other communication channels, if this processing falls within the data retention period defined elsewhere in this privacy statement

We will not use your personal data for automated decision-making, including profiling.

Your personal data is introduced directly by you or your organisation (e.g., the sending institution) in an IT tool to which access is given to different processors, as described later in this document. The access by another entity, such as the National Agency or receiving institution, to this data to ensure data quality and consistency is considered a ‘data transfer’. The types of transfers are described in other sections.

Your data will be processed by the European Commission’s IT systems and processors’ IT systems – the National Agencies for Erasmus+ and European Solidarity Corps and grant beneficiaries. The processing of your data by the processors is in line with Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018. The processors’ obligations are described in Articles 29, 30 and 31 of the Regulation.

On what legal ground(s) do we process your personal data?

We process your personal data because:

processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body (Article 5(1)(a) of the Regulation);
processing is necessary for compliance with a legal obligation to which the controller is subject (Article 5(1)(b) of the Regulation), according to the relevant programme legal bases:
1. Regulation (EU) 2021/817 of the European Parliament and of the Council of 20 May 2021 establishing Erasmus+: the Union Programme for education and training, youth and sport and repealing Regulation (EU) No 1288/2013
2. Regulation (EU) 2021/888 of the European Parliament and of the Council of 20 May 2021 establishing the European Solidarity Corps Programme and repealing Regulations (EU) 2018/1475 and (EU) No 375/2014
3. Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union
processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject before entering into a contract (participants’ agreement, grant agreement signed by your organisation with a National Agency) (Article 5(1)(c))
processing is based on consent to manage the organisational data (including personal data) by the National Agencies (Article 5(1)(d) of the Regulation) and for the other processing activities described above

What personal data do we collect and further process?

Organisation’s contact person, authorised users, and legal representatives

Personal data collected about a registered organisation’s contact person and authorised users, as well as personal data collected about the legal representative and the contact persons of the organisations applying for funding or taking part in a project:

EU Login account ID
gender
first name
last name
department
position in the organisation
professional email
main phone
street name and number

The provision of this personal data is mandatory to register your organisation and process requests for funding.

The staff of Erasmus+ and European Solidarity Corps National Agencies

Personal data of National Agency staff accessing IT tools for Erasmus+/European Solidarity Corps programme management:

EU Login account ID
title
first name
last name
gender
department
position
phone number
email address

The provision of this personal data is required for the management of grant applications by National Agencies.

Representatives of national authorities

Personal data of national authorities’ staff:

EU Login account ID
title
first name
last name
department
position
phone number
email address

This personal data is required to monitor the programme’s implementation and audit of National Agencies.

National experts

Personal data of experts evaluating submitted applications:

EU Login account ID
title
first name
last name
email address
phone number

The provision of this personal data is required for the assessment of grant applications.

Participants of Erasmus+ and European Solidarity Corps

Personal data of participants in Erasmus+ activities or the European Solidarity Corps project:

participant id
participant registration number (if already registered in the European Solidarity Corps portal)
title
first name
last name
date of birth (for learners)
gender
nationality
fewer opportunities/inclusion support (yes/no) – this is collected when it could have an impact on the additional amounts received as part of the grant and for statistics

We process the information required to evidence barriers faced by people with fewer opportunities. Such processing is necessary for a substantial public interest, based on Union law, which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. This is collected only when it could have an impact on the arrangements that are necessary to enable the applicant to take part in the project or the additional amounts received as part of the grant and for statistics (following Chapter V of Regulation 2021/817 and article 16 of Regulation 2021/888).

The provision of these personal data is mandatory for the management of projects and associated activities/mobilities.

How long do we keep your personal data?

DG EAC only keeps your personal data for the time necessary to fulfil the purpose of collection or further processing.

Main processing activities

For the EU Login retention policy, please check the EU Login privacy statement
Organisation registration: personal data linked to organisations participating in projects will be deleted ten years after the end of the year of the closure of the last project in the relevant programme (defined by the last financial transaction between NA and the beneficiary organisation) unless the organisation is participating in another programme. In addition, every three years, data of organisations that have neither applied for funding nor participated in a project in that period will be deleted.
Submission of application forms: personal data will be deleted five years after the submission deadline of the relevant call for proposals
The National Agencies will remove the publication of grant award decisions two years after the end of the financial year in which the funds were awarded. The same applies to personal data referring to legal persons for whom the official title identifies one or more natural persons
Management of applications and projects: personal data will be anonymised ten years after the end of the year of the closure of the last project in the relevant programme (defined by the last financial transaction between NA and the beneficiary organisation)
We will remove the personal data of experts (external or internal to the National Agencies) involved in the quality assessment process ten years after the call year of the submission of applications. User settings, such as filters used in Assessment Module, will be removed two years after the last user login.
Management of mobilities: DG EAC processes your personal data for the duration of your grant project, which can be up to 36 months maximum. After that, DG EAC must retain your personal data as long as it is required by EU law for audit purposes because checks or fraud investigations are routinely carried out after the completion of actions, and the data must be available so that we can rule out issues such as fake participation and double funding. Ultimately, we will delete data a maximum of ten years after the end of the year of closure of the agreement between the National Agency and the Commission from which the project in which you participated was funded.
For the dissemination platform, please check the Project Results Platform specific privacy statement
User’s custom settings such as filters or selection of displayed information in Erasmus+ and European Solidarity Corps page (single entry point) will be automatically removed six months after the user’s last successful login
Analytical and statistical purposes for the use of the individuals’ data in the reports – 10 years after the end of the year of closure of the agreement between the National Agency and the Commission from which the project in which the data subject is listed was funded
Analytical and statistical purposes for user access control are kept until the user’s account deactivation. The obligation to evaluate the impact of the programmes, as provided in the regulations establishing Erasmus+ and the European Solidarity Corps, does not require personal data to be maintained.

You can also find more information about why DG EAC must retain your personal data in Art. 132(1) of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union.

Archiving activities

Erasmus+ and European Solidarity Corps National Agencies, the processors in this processing activity, may need to preserve personal data from projects granted in their countries longer than described in this privacy statement due to respective national laws on archiving data. You can obtain more information by contacting the data controller. Please refer to the “Contact Information” section for contact details at the end of this document.

The European Commission is obliged to preserve a sample of data which includes personal data (defined in this privacy statement in paragraph “What personal data do we collect and further process”), to archive for the public interest.

The European Commission fully adheres to the safeguards of processing personal data for archiving purposes as outlined in Article 13 of the Regulation. The archiving requirements come from the internal regulation of the European Commission referred to as the “Common Commission-level retention list for European Commission files” (SEC(2019/900/3). You can obtain more information from the Register of Commission Documents.

How do we protect and safeguard your personal data?

The European Commission stores all data in a datacentre located inside the EU. National Agencies will process personal data in internal IT systems of the National Agencies. This is considered a ‘data transfer’. The types of transfers are described in the next section of this document.

All processing operations by the Commission are carried out according to the Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission.

A specific contractual clause binds the Commission’s contractors for any processing operations of your data on behalf of the Commission and by the confidentiality obligations deriving from the transposition of the General Data Protection Regulation in the EU Member States (‘GDPR’ Regulation (EU) 2016/679).

The Commission has put several technical and organisational measures in place to protect your personal data. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to personal data solely to authorised persons with a legitimate need to know for this processing operation.

National Agencies and all other processors are required to adopt appropriate technical and organisational security measures regarding protecting personal data as explained in Article 33 of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October.

Finalised projects apply the data pseudonymisation technique limiting the risk of processing to the data subjects (see Article (3), (27) and (33) of Regulation 2018/1725). The pseudonymisation applies to the data of project participants.

Who has access to your personal data, and to whom is it disclosed?

The transfer of your personal data is necessary for the conclusion or performance of an agreement concluded in your interest between the controller (European Commission) and another natural or legal person (National Agencies in the EU Member States, EEA countries, as well as programme countries Turkey, Serbia, and North Macedonia). The transfer is done by providing access to your personal data to different organisations, as described below.

Who has access to your personal data and to whom it is disclosed depends on where your personal data are transferred?

There are currently two types of data transfers, which ensure different levels of protection:

Data transfers to the European Union Member States, to countries of the European Economic Area, or to countries for which the Commission adopted an adequacy decision ensuring an adequate level of protection.
Data transfers to third countries for which there is no Commission adequacy decision and the level of protection of your rights concerning your personal data might not be equivalent to the EU legislation.

In case of transfers of personal data inside EU/EEA and to countries with an adequacy decision:

Access to your personal data is provided to the European Commission staff responsible for carrying out this processing operation and authorised staff according to the “need to know” principle. Such staff abide by statutory and, when required, additional confidentiality agreements.

The European Commission acts as a controller in this processing.

Outside the European Commission, access to your personal data is provided to the following categories of processors and recipients (role indicated in parentheses):

Organisations in Erasmus+ or European Solidarity Corps projects:

Authorised staff of beneficiary organisations managing the grant project, mobilities and other project activities such as cooperation projects (processor)
Authorised staff of project partner organisations (recipient)

Alumni organisations:

Relevant volunteers from organisations that are part of the Erasmus+ Student and Alumni Alliance (ESAA), and staff from the consortium appointed by the European Commission to support ESAA (recipient)

Persons in programme implementation, support and other services:

the internal staff of the National Agencies in charge of the management of Erasmus+ and the European Solidarity Corps to access the data (processor)
the internal staff of the National Agencies in charge of the management of Erasmus+ and the European Solidarity Corps, for management (modification) of organisational data, including personal data of contact persons and authorised users (based on consent) (processor)
Authorised users in external companies contracted by the European Commission or by the National Agencies for the delivery of services, for example, development and support of IT tools (processor)
Authorised staff of the European Education and Culture Executive Agency (EACEA) maintaining the School Education Gateway course catalogue service (more information in School Education Gateway privacy statement) (processor)

Auditors, persons monitoring and evaluating the programme, law enforcement authorities:

When an audit or investigation takes place, external auditors may need access to your data to ensure the legality and regularity of the project implementation (recipient)
The staff of the Finnish National Agency for Education – EDUFI, Internationalisation Services for Youth, Culture, Sport, where is acting in their role as coordinator of the Research-based Analysis of Erasmus+ Youth in Action (RAY) Network (recipient)
Personal data collected for the programme may be provided to law enforcement authorities, such as police, tax office, and judiciary when a formal request is made to the controller (based on Article 5(1)(b) and Article 9)

National authorities

Authorised staff in National Authorities, as defined in Article 2(26) of Regulation (EU) 2021/817 of the European Parliament and of the Council of 20 May 2021 establishing Erasmus+: the Union Programme for education and training, youth and sport, may process personal data of applicants, beneficiaries and participants in Erasmus+ programme for the purpose of programme evaluation

Other persons:

EU Delegation in the participant’s sending countries (recipient)

General public:

Guests of websites of Erasmus+ and European Solidarity Corps National Agencies publishing results of the grant award decision to the public

The information we collect will not be given to any third party, except to the extent and for the purposes which may be required to do so by national law.

In case of transfers of personal data to third countries:

Your personal data is transferred to a third country outside EU/EEA for which there is no adequacy decision (including to programme countries – Turkey, Serbia, and North Macedonia) if you are in one of the following situations:

If you represent an applicant, beneficiary, or partner organisation:

you are the contact person or authorised user of a registered organisation or the contact person or legal representative of an organisation which applies or participates in a project managed by the National Agencies from Turkey, Serbia, and North Macedonia;
you are the contact person or legal representative of an organisation which wrongly applied to a National Agency in EU/EEA Member States while the applicant should have submitted it to the National Agency in Turkey, Serbia, and North Macedonia; in this case, the application (including your personal data) is redirected towards these National Agencies;
you are the contact person or legal representative of an organisation from Turkey, Serbia, or North Macedonia that applies or participates in a KA2 project managed by a National Agency in EU/EEA;
you are the contact person or the legal representative of an applicant organisation which provided access to the application to an authorised person from a third country

If you are the participant:

you carry out mobility to the third country
you participate in a project with a partner organisation from a third country
you participate in a project managed by the National Agencies in Turkey, Serbia, or North Macedonia
you participate in a project with a beneficiary organisation or coordinator (for schools-to-schools projects only) from Turkey, Serbia, or North Macedonia

Other situations:

you are a staff of the Erasmus+ or European Solidarity Corps National Agency;
the beneficiary organisation provides access to the project data to an authorised person from a third country

Access to your personal data is provided to the following organisations from the third country:

Authorised staff of the National Agencies from Turkey, Serbia, and North Macedonia (processors) if you are:
- the contact person or authorised user of a registered organisation or the contact person or legal representative of an organisation which applies or participates in a project managed by those National Agencies
- the contact person or legal representative of an organisation which wrongly applied to a National Agency in Turkey, Serbia, or North Macedonia, while the applicant should have submitted it to the National Agency in EU/EEA Member States
- the contact person or legal representative of an organisation from Turkey, Serbia, or North Macedonia which applies or participates in a KA2 project managed by a National Agency in EU/EEA
- participating in a project managed by the National Agencies from these countries
- a National Agency staff member to access the data
- a National Agency staff member for management (modification) of organisational data, including personal data of contact persons and authorised users (based on consent)
An authorised person from a third country organisation (recipient), if:
- you are the contact person or the legal representative of an applicant organisation which provided access to the application to an authorised person from a third country
- a beneficiary organisation in your project has provided access to your personal data
The staff of beneficiary organisations from Turkey, Serbia, or North Macedonia manage the grant project, mobilities and other project activities such as cooperation projects (if you participate in a project with a beneficiary organisation or coordinator from these countries) (processor)
Authorised staff of project partner organisations from a third country (if you participate in a project with a partner organisation from a third country) (recipient)
• Authorised staff in National Authorities from Turkey, Serbia, and North Macedonia, as defined in Article 2(26) of Regulation (EU) 2021/817 of the European Parliament and of the Council of 20 May 2021 establishing Erasmus+: the Union Programme for education and training, youth and sport, may process personal data of applicants, beneficiaries and participants in Erasmus+ programme for the purpose of programme evaluation

In this case, the level of protection of your personal data will depend on the law or practice of that third country. However, your rights as regards data protection might not be equivalent to those in an EU/EEA country or a country with an adequacy decision.

Suppose you are an Erasmus+ or European Solidarity Corps participant, and your sending institution is located in an EU/EEA country. In that case, the transfer must comply with the conditions laid down in Chapter V of Regulation (EU) 2018/1725.

Please note that according to Article 3(13) of Regulation (EU) 2018/1725, public authorities (e.g., Court of Auditors, EU Court of Justice) may receive personal data in the framework of a particular inquiry following Union or Member State law shall not be regarded as recipients. The further processing of those data by those public authorities shall follow the applicable data protection rules according to the purposes of the processing.

The information we collect will not be given to any other party in a third country outside the EU/EEA, except to the extent and purpose the national law may require of the country in question.

What are your rights, and how can you exercise them?

You have specific rights as a ‘data subject’ under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular, the right to access your personal data and to rectify them in case your personal data are inaccurate or incomplete. Where applicable, you have the right to erase your personal data, restrict the processing your personal data, and object to the processing.

You have the right to object to processing your personal data, which is lawfully carried out pursuant to Article 5(1)(a) on grounds relating to your particular situation.

You have a right to withdraw your consent for management (modification) of your data included in the organisational data by the National Agencies; this applies to the processing of personal data of organisations’ contact persons and authorised users.

Your rights may be restricted based on objectives of public interest of the Union, in particular the objectives of the financial interest of the Union, including budgetary matters. In addition, your rights may be restricted to safeguard monitoring, inspection, or regulatory function connected to the exercise of official authority of the Union body based on Art. 132(1) of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union.

Archiving sample data, which includes your personal data, beyond the retention period provides the controller with derogations from the rights referred to in Articles 17 (right of access by the data subject), 18 (right to rectification), 20 (right to restriction of processing), 21 (notification obligation regarding rectification or erasure of personal data or restriction of processing), and 23 (right to object) subject to the conditions and safeguards referred to in Article 13 (safeguards relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes).

You can exercise your rights by contacting the Data Controller or, in case of conflict, the Data Protection Officer of the European Commission. If necessary, you can also address the European Data Protection Supervisor. We provide their contact information in the section below.

Where you wish to exercise your rights in the context of one or several specific processing operations, please provide their description (i.e., their Record reference(s) as specified under the section below) in your request.

Contact information

The Data Controller

Directorate-general for Education, Youth, Sport and Culture, Unit B.4 – Erasmus+ Coordination

If you would like to exercise your rights under Regulation (EU) 2018/1725 or if you have comments, questions or concerns related to the processing of your personal data, or if you would like to submit a complaint regarding the collection and use of your personal data, please send an email to the Data Controller at eu-erasmus-esc-personal-data@ec.europa.eu.

Please note that you should direct questions and support for participation or application to Erasmus+ or European Solidarity Corps to the National Agencies. You can find the contact details on the following websites:

Erasmus+ National Agencies: https://erasmus-plus.ec.europa.eu/contacts/national-agencies
European Solidarity Corps National Agencies: https://europa.eu/youth/solidarity/organisations/contact-national-agencies_en

Further to the above, you can contact:

The Data Protection Officer (DPO) of the European Commission

You may contact the Data Protection Officer at data-protection-officer@ec.europa.eu concerning issues related to processing your personal data under Regulation (EU) 2018/1725.

The European Data Protection Supervisor (EDPS)

You have the right to have recourse (i.e., you can complain) to the European Data Protection Supervisor if you consider that your rights under Regulation (EU) 2018/1725 have been infringed because of the processing of your personal data by the Data Controller.

Where to find more information?

The Commission Data Protection Officer (DPO) publishes the register of all processing operations on personal data by the Commission, which have been documented and notified to him. You may access this information via the Register of the Data Protection Officer.

You can find more information about processing personal data in Erasmus+ and European Solidarity Corps on the Erasmus+ and data protection page.