Privacy statement | EU Digital Finance Platform

Protection of your personal data

1. Introduction

The European Commission (hereafter ‘the Commission’) is committed to protect your personal data and to respect your privacy. The Commission collects and further processes personal data pursuant to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (repealing Regulation (EC) No 45/2001).

This privacy statement concerns the EU Digital Finance Platform and activities related to the EU Digital Finance Platform (such as online participation on the platform). It explains the reason for the processing of your personal data, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you may exercise in relation to your data. It also specifies the contact details of the responsible Data Controller with whom you may exercise your rights, the Data Protection Officer and the European Data Protection Supervisor.

The European institutions are committed to protecting and respecting your privacy. The EU Digital Finance Platform is owned by the European Commission and is administrated by the European Commission’s Directorate-General for Financial Stability, Financial Services and Capital Markets Union (DG FISMA), in cooperation with the Directorate-General for Informatics (DG DIGIT). As these departments collect and further process personal data, specific data protection rules apply (Regulation (EU) 2018/1725).

The information in relation to the processing operation “EU Digital Finance Platform” undertaken by DG FISMA is presented below.

2. Why and how do we process your personal data?

The European Commission collects and uses your personal information in order to administer and manage the EU Digital Finance Platform and, in particular, in order to carry out the following purposes:

2.1 EU Login

The EU Digital Finance Platform will only be accessible to users registered with EU Login.

EU Login is part of the European Commission's Identity Access Management Service (IAMS), which is a personal data processing managed by the Directorate-General for Informatics of the European Commission allowing to provide a common way for users to register or be registered for access to a number of different Commission information systems or service.

The record concerning the IAMS data processing is registered under number DPR-EC-03187.1 and is available on the public register of the Data protection officer of the Commission here: https://ec.europa.eu/dpo-register/detail/DPR-EC-03187

The categories of personal data processed by DG DIGIT for operating EU Login are indicated in the IAMS Privacy statement available here: https://webgate.ec.europa.eu/cas/privacyStatement.html

2.2 Login page/form to the EU Digital Finance Platform

DG FISMA will collect and use personal data from user when they create an account in order to access the EU Digital Finance Platform for the first time.

2.3 Digital Finance Observatory

Furthermore, DG FISMA will collect and use your personal information where necessary, in order to carry out the following purposes:

2.3.1 European Fintech Map

The aim of this section is to make available information about European Fintech companies. It is intended to publish only general contacts (company email address and phone number) as contact information. However, companies might prefer to communicate personal data as contact information. In such case, the following personal data could be collected and processed: name, email address, phone number.

2.3.2 Events

The aim of this section is to: 1. display Commission events (webinars, online workshops, physical events, etc.) relevant to fintech companies and supervisors, 2. Create and host online events organised by the Commission, and 3. Provide information on relevant events organised by participants other than the Commission In case of an event organised by the European Commission, a specific privacy statement will be made available to inform about the personal data processing to be carried out in the context of this particular event. In case personal data are processed in the context of events organised by external participants to the DFP, separate privacy statements will be made available by these external participants on their own websites or through any other means.

2.3.3 Calls to action

The aim of this section is to: 1. showcase upcoming and ongoing digital finance related hackathons and similar competitions or calls to action organised by the Commission, other EU bodies, supervisors or others across the EU, and 2. display the results of recently completed hackathons run by the Commission.

If the organiser of the hackathon is not the European Commission, specific privacy statements will be provided by these external participants on their own websites or through any other means.

2.3.4 Sharing Knowledge

The aim of this section is to: 1. host research papers, studies, surveys, educational videos and other material designed to share and manage knowledge about market trends in the fintech sector, consumer behaviour, policy making etc., and 2. allow the Commission and supervisors, but also other users to upload content.

For this section of the EU Digital Finance Platform, the processing of the following personal data is necessary: Information related to the Author(s): Author(s) (name, academic title, organisation).

2.4 European Forum for Innovation Facilitators Gateway

2.4.1 European Forum for Innovation Facilitators

The aim of this section is to publish general information related to the European Forum for Innovation Facilitators (EFIF), including minutes of meetings. These minutes may contain limited personal data, based on informed prior consent to such publication by meeting participants.

2.4.2 Cross-border testing

Under the cross-border testing section of the EU Digital Finance Platform, a standardised common form is available to companies willing to involve multiple national competent authorities in the testing process for new products. This section allows companies to submit their interest by using a common standardised form. No information filled in this form is published and the European Commission has no access to such information. Information filled in the standardised common form is only accessible to the relevant national competent authorities.

The standardised common form will allow national competent authorities to collect information about companies' contact persons. It also contains at text box where firms shall elaborate on reasons for interest in involving multiple national competent authorities in testing activities. Although this is not intended, firms could mention personal data in this field (as in any open text field).

Firms are informed that "The processing by the relevant NCAs of any personal data submitted by the firm for the purposes of the testing activities will be carried out in accordance with General Data Protection Regulation (GDPR). Please refer to the website of the relevant NCAs for the privacy statements".

In order to allow national competent authorities to access to the information submitted by companies through the standardised common form and collaborate with each other on a specific case using a dedicated cooperation tool, it is necessary for the European Commission to collect personal data about national competent authorities' authorised staff: Name (first name, family name) and email. This information will not be published.

In the context of the personal data processing related to the EU Digital Finance Platform, your personal data will not be used for any automated decision-making including profiling.

3. On what legal ground(s) do we process your personal data?

We process your personal data, because you (as data subject under Regulation EU 2018/1725) have given your consent to the processing of your personal data for one or more specific purposes described under section 2.

4. Which personal data do we collect and process?

In order to carry out this processing operation, the European Commission collects the following categories of personal data:

Mandatory fields to be filled in when you create an EU Login account

The EU Digital Finance Platform will only be accessible to users registered with EU Login. This means that you will first need to register and create an EU Login account.

EU Login is part of the European Commission's Identity Access Management Service (IAMS), which is a personal data processing managed by DG DIGIT allowing to provide a common way for users to register or be registered for access to a number of different Commission information systems or service.

The categories of personal data processed by DG DIGIT for operating EU Login are indicated in the IAMS Privacy statement available here: https://webgate.ec.europa.eu/cas/privacyStatement.html

Login page/registration form to the EU Digital Finance Platform

Username
Password
Name (first name, family name)
Email
Category, with the following boxes to tick and fill in:
- Financial firm – text field: position, name and address of headquarters of the firm, including country;
- Public authority – text field: position, name and address of the authority, including country;
- Academic/Researcher – text field: position, name and address of research institution including country;
- Citizen – free text field (optional);
- Other – text field: position, name and address of institution/firm/NGO/other organisation, including country. These data become part of your user account.

Your consent to the processing of your personal data for the purposes of the EU Digital Finance Platform is collected by a box to tick.

Digital Finance Observatory

European Fintech Map/Contacts
- No personal data is explicitly asked for, though users may choose to enter name, email address, phone number.
Sharing knowledge
- Information related to the Author(s): Author(s) (name, academic title, organisation).

European Forum of Innovation Facilitators (EFIF) gateway

Innovation facilitators
Minutes of the meetings of the European Forum for Innovation Facilitators (EFIF) will be published on the EU Digital Finance Platform. These may contain personal data, based on informed prior consent to such publication by meeting participants.
Cross-border testing
- Company contact person: name (family name, first name), email, organisation.
- Any personal data provided by the users in the text box provided within the standardised common form.
- In order to allow national competent authorities to access to the information submitted by companies through the standardised common form, it is necessary for the European Commission to collect personal data about authorised staff from the national competent authorities: Name (first name, family name) and email.
- None of these data are published on the website.

Cookies policy

DG FISMA will make use of cookies in the context of the EU Digital Finance Platform in strict respect of the European Commission’s cookies policy, available here: https://ec.europa.eu/info/cookies_en

5. How long do we keep your data?

DG FISMA only keeps your personal data for the time necessary to fulfil the purpose of collection or further processing, namely the operation of the EU Digital Finance Platform and its related management.

EU Login data

Personal data related to self-registered individuals are kept until the user personally deletes his/her EU Login account or requests the deletion, with the exception of e-mail addresses that need to be kept for further user support and assistance.
Log files are kept for six months.
A fully detailed explanation about how long the European Commission keeps personal data in the context of EU Login is available in section 5 of the Privacy Statement for the European Commission's Identity Access Management Service (IAMS) available here: https://webgate.ec.europa.eu/cas/privacyStatement.html

Data collected when creating an account to access the EU Digital Finance Platform

Your personal data will be kept for as long as the Platform exists. However, the information concerning a person who has not used their account for two years will be deleted. In such case, the user will be warned and will have the opportunity to express interest in remaining a registered user.
Your personal data will also be deleted before the end of the two-year retention period upon request (see Contact Information in section below)

6. How do we protect and safeguard your data?

All data in electronic format (e-mails, documents, uploaded batches of data, etc.) are stored either on the servers of the European Commission or of its contractors. All processing operations are carried out pursuant to the Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission.

The Commission’s contractors are bound by a specific contractual clause for any processing operations of your data on behalf of the Commission, and by the confidentiality obligations deriving from the transposition of the General Data Protection Regulation (GDPR) in the EU Member States (Regulation (EU) 2016/679).

In order to protect your personal data, the Commission has put a number of technical and organisational measures in place. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.

7. Who has access to your data and to whom is it disclosed?

Access to your personal data is provided to the Commission staff responsible for carrying out this processing operation and to authorised staff according to the “need to know” principle. Such staff abide by statutory, and when required, additional confidentiality agreements.

The authorised recipients of the personal data collected for the purposes of the EU Digital Finance Platform are:

European Commission, Directorate-General for Informatics, Unit D.3, for EU Login data,
European Commission, Directorate-General for Financial Stability, Financial Services and Capital Markets Union, Unit B.5 - Digital Finance, for data submitted through login and online forms on the EU Digital Platform.
Only National supervisors or national competent authorities have access to the personal data submitted by firms interested in using the cross-border testing framework via the ‘standardised common form’.

The only sections of the EU Digital Finance Platform where personal data is or might be published and made available to other users are the European Fintech Map, Sharing Knowledge and minutes of EFIF meetings.

8. What are your rights and how can you exercise them?

You have specific rights as a ‘data subject’ under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular the right to access, your personal data and to rectify them in case your personal data are inaccurate or incomplete. Where applicable, you have the right to erase your personal data, to restrict the processing of your personal data, to object to the processing, and the right to data portability.

You can exercise your rights by contacting the Data Controller, or in case of conflict the Data Protection Officer. If necessary, you can also address the European Data Protection Supervisor. Their contact information is given under Heading 9 below.

Where you wish to exercise your rights in the context of one or several specific processing operations, please provide their description (i.e. their Record reference(s) as specified under Heading 10 below) in your request.

9. Contact information

The Data Controller

If you would like to exercise your rights under Regulation (EU) 2018/1725, or if you have comments, questions or concerns, or if you would like to submit a complaint regarding the collection and use of your personal data, please feel free to contact the Data Controller,

Directorate-General for Financial Stability, Financial Services and Capital Markets Union (DG FISMA)

Unit B.5 - Digital Finance

Building SPA 2

B-1049 Brussels

Email: EU-DIGITAL-FINANCE-PLATFORM@ec.europa.eu

The Data Protection Officer (DPO) of the Commission

You may contact the Data Protection Officer (DPO) of the European Commission (DATA-PROTECTION-OFFICER@ec.europa.eu) with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725.

The European Data Protection Supervisor (EDPS)

You have the right to lodge a complaint with the European Data Protection Supervisor (edps@edps.europa.eu) if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data by the Data Controller.

10. Where to find more detailed information?

The Commission Data Protection Officer (DPO) publishes the register of all processing operations on personal data by the Commission, which have been documented and notified to him. You may access the register via the following link: http://ec.europa.eu/dpo-register.

This specific processing operation has been included in the DPO’s public register with the following Record reference: DPR-EC-12108.