European Climate, Infrastructure and Environment Executive Agency

CINEA

In accordance with Regulation (EU) 2018/1725 of 23 October 2018 on data protection (hereinafter the Regulation), the European Climate, Infrastructure and Environment Executive Agency (hereafter CINEA) collects your personal data only to the extent necessary to fulfil the precise purpose related to its tasks.

1. The controller is:

   The European Climate, Infrastructure and Environment Executive Agency (CINEA)
   Chaussée de Wavre 910 - BLS2 05/259
   1049 Brussels
   Belgium
   CINEA Unit D.3 - Sustainable Blue Economy
   Person responsible for the processing: Head of Unit D.3
   Email: CINEA-EMFAF-CONTRACTS@ec.europa.eu

2. The purpose of the processing is for the controller and its contractor(s) EurA AG¹ (EU4Algae coordinator) to promote the EU4Algae initiative under the European, Maritime, Fisheries and Aquaculture Fund (EMFAF) programme to relevant target audiences. This includes collecting data on algae production across Europe, to support the development of the algae sector and to ensure appropriate policy and funding. The processes to fulfil this aim may include:

   1. Targeted surveys to algae producers;
   2. Production and dissemination of data and statistics on algae production in Europe;
   3. Compiling a database of stakeholders active in the algae sector;
   4. Use of IT tools and software to support reporting, statistics, algae production data aggregation and their encryption.

3. The data subjects concerned by this notice are:

   1. Members of the European Algae Biomass Association;
   2. Identified algae producers.

4. The categories of personal data collected and used for the processing operations are:

   1. Identification data: name, surname
   2. Contact details: email address
   3. Responses to surveys related to algae production data that would include personal data as the case may be.

   The responses will be anonymised, with the only exception being the country of production which is essential for the analysis.

   Personal data will not be used for automated decision-making including profiling.

5. All recipients are on a "need to know" basis. The recipients to whom the personal data will or might be disclosed are:

   1. Authorised staff of CINEA and the European Commission (DG MARE) in charge of the actions described under section 2.
   2. CINEA contractor’s authorised staff, the European Algae Biomass Association² in charge of performing and managing the tasks described under section 2.

   Access to the database of algae producers and to their replies is strictly limited to authorised project staff and CINEA/DG MARE officials involved in the EU4Algae initiative.

   In case of reviews, proceedings, personal data may be provided to CINEA’s Internal Controller, DPO, etc.

   In addition, data may be disclosed to public authorities in accordance with Union and Member State law such as the European Court of Justice or a national judge as well as the lawyers and the agents of the parties in case of a legal procedure, Investigation and Disciplinary Office of the European Commission (IDOC), the competent Appointing Authority in case of a request or a complaint lodged under Articles 90 of the Staff Regulations, European Anti-Fraud Office (OLAF), the Internal Audit Service of the Commission, the Court of Auditors, the European Ombudsman, the European Data Protection Supervisor and the European Public Prosecutor’s Office.

   The contractors will not share your personal data with any third parties without your express consent, except where we may be required to do so by law.

6. Data Subjects rights

   You have the right at any time to access, rectify, erase (’right to be forgotten’) your personal data. You are also entitled to object to the processing or request for the restriction of the processing.

   When processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing before such a withdrawal.

   Depending on the on-line service you are accessing, you can either:

   • Access, check, modify, update, and delete your personal profile online yourself at any time;
   • Ask the data controller for the removal of your account.

   You can exercise your rights by sending an email with the requested change(s) to the controller via the functional mailbox indicated here above in Section 1.

   In any case, your data will be modified or removed accordingly and as soon as practicable (maximum within 15 working days).

   However, these rights can be restricted in line with Decision SC (2020) 26 of the Steering Committee of 14 October 2020 (OJEU L 45 on 9.2.2021, p. 80) on internal rules concerning restrictions of certain rights of data subjects in relation to the processing of personal data. This is to safeguard the rights of other data subjects and to respect the principles of equal treatment among applicants and the secrecy of deliberations.

   In order to grant or not the data subjects rights, CINEA will carry out a case-by-case assessment of each individual request and give the reasons underlying its decision, considering the type of information held and whether any exceptions of the internal rules are applicable.

   The restrictions will continue applying as long as the reasons justifying them remain applicable and may be lifted if these reasons would no longer apply, if the exercise of the restricted right would no longer negatively impact the applicable procedure or adversely affect the rights or freedoms of the data subjects.

7. How does CINEA protect and safeguard your data?

   All personal data in electronic format (emails, documents, databases, uploaded batches of data, etc.) are stored on the servers of the European Commission, CINEA or of its contractors (and possibly their subcontractors).

   All processing operations are carried out pursuant to Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission.

   In order to protect your personal data, CINEA has put in place a number of technical and organisational measures. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.

   The processors contractors are bound by a specific contractual clause for any processing operations of your personal data on behalf of the data controller. The processors have put in place appropriate technical and organisational measures to ensure the required level of security.

   For the processing purposes described above the following third-party tools will be used. They may collect personal data and have their own cookies and privacy policies. They abide by specific data protection terms, which may be outside of the control of the controller. We encourage you to read their privacy statements. These include:

   • EU Survey (for surveys)
   • Tally (for surveys, storage and encryption of replies)

   Where applicable, the cookies used by the Controller are covered by the cookie policy of the Commission. Cookies are stored by Europa Analytics, the corporate service which measures the effectiveness and efficiency of the European Commission’s websites on Europa domain. More information is available on Europa Analytics privacy policy page. Enabling these cookies is not strictly necessary and is only used to ensure a better browsing experience. Cookie-related information is not used to identify data subjects personally and the pattern data is fully under the Commission’s control. These cookies are not used for any purpose other than the browsing quality.

8. The legal basis of the processing is:

   In accordance with Article 5(1)(a) of the Regulation (processing is necessary for the performance of a task carried out in the public interest including for the management and functioning of CINEA) and Article 5(1)(d) of the Regulation (consent of the data subject), notably:

   1. Council Regulation 58/2003 of 19 December 2002, laying down the Statute for executive agencies to be entrusted with certain tasks in the management of EU programmes;
   2. Regulation (EU) 2021/1139 of the European Parliament and of the Council of 7 July 2021 establishing the European Maritime, Fisheries and Aquaculture Fund and amending Regulation (EU) 2017/1004;
   3. Regulation (EU, Euratom) 2024/2509 of the European Parliament and of the Council of 23 September 2024 on the financial rules applicable to the general budget of the Union (recast);
   4. Commission Implementing Decision (EU) 2021/173 of 12 February 2021 establishing the European Climate, Infrastructure and Environment Executive Agency, and repealing Implementing Decisions 2013/801/EU;
   5. Commission Decision C(2021)947 of 12 February 2021 delegating powers to the European Climate, Infrastructure and Environment Executive Agency³

9. The time limits for keeping the data are the following:

   CINEA keeps data in accordance with the 2022 Retention List of the Commission⁴ (2 years for website related data and communication activities). Your personal data will remain in the contractors databases only for the duration of the tasks to be performed or maximum one year after their conclusion and will be deleted afterwards.

10. Contact information

    In case you have any questions about the collection/processing of your personal data, you may contact the data controller who is responsible for this processing activity by using the email address mentioned here above in Section 1.

    You may contact at any time the Data Protection Officer of CINEA (CINEA-DPO@ec.europa.eu). You have the right of recourse at any time to the European Data Protection Supervisor (edps@edps.europa.eu).