Summary
All EU institutions have the legal obligation to keep a central register of records of activities processing personal data (Article 31 of Regulation 2018/1725).
For more information or to see more EUDA personal data protection records, please visit the EUDA data protection records page.
Data protection record
|
Nr. |
Item |
Response |
|
1. |
Last update of this record |
12-03-2026 |
|
2. |
Reference number: |
DPO-060 |
|
3. |
Name and contact details of controller |
Controller: EUDA, Praça Europa 1, 1249-289 Lisboa, Portugal Contact: Jane Mounteney, EUDA; jane.mounteney@euda.europa.eu |
|
4. |
Name and contact details of DPO |
Gonçalo Felgueiras e Sousa, EUDA: dpo@euda.europa.eu |
|
5. |
Name and contact details of joint controller (where applicable) |
NA |
|
6. |
Name and contact details of processor (where applicable) |
European Commission (DIGIT) as provider of the EU Survey platform and Documenta (document management) system; and Microsoft as provider of MS Teams platform. |
|
7. |
Purpose of the processing |
Managing the European Web Survey on Drugs (EWSD) network to execute the 2027 campaign, including the use of MS Teams, for allowing the participation in online meetings and trainings and of Documenta, for drafting, co-editing and securely sharing documents. |
|
8. |
Description of categories of persons whose data EUDA processes and list of data categories |
Categories of persons: EWSD country representatives Data categories: a) identification details: name, surname, institution affiliated, country of institution affiliated b) contact details: e-mail address c) event details: calls for tender, expression of interest, meeting data, log files, timestamps and other access data, audio-video streams, photographs. |
|
9. |
Time limit for keeping the data |
The identification and contact details (as per above) is kept for the duration of the appointment of each EWSD country representative. The event details will be kept until the end of the project, i.e. 31 December 2027. |
|
10. |
Recipients of the data |
EUDA staff directly involved in the EWSD as well as staff working in the P&I unit, which coordinates the collaboration with the NFPs. |
|
11. |
Are there any transfers of personal data to third countries or international organisations? If so, to which ones and with which safeguards? |
NA |
|
12. |
General description of security measures, where possible. |
The information collected is stored in electronic format on designated EUDA equipment. Participants list shared on the Connect platform is only accessible to users registered by the EUDA and is protected with two-factor authentication. |
|
13. |
For more information, including how to exercise your rights to access, rectification, object and data portability (where applicable), see the data protection notice: |
See the Data protection notice below. |
Data protection notice
Data Protection Notice
on managing the European Web Survey on Drugs network to execute the 2027 campaign
Last updated: February 2026
1. Introduction / Why do we process your personal data?
This data protection notice explains how the EUDA process your personal data for the purposes of managing the European Web Survey on Drugs (EWSD) network to execute the 2027 campaign, namely as your country representative in such network, including the use of Teams for allowing the participation in online meetings and trainings. In particular, this notice explains the way the EUDA collects, handles and ensures protection of all personal data provided, how that information is used and what rights you may exercise in relation to your data and how can you exercise them.
2. Who is responsible for the processing of your personal data (the controller) and under which legal grounds is it processed?
The EUDA, Praça Europa 1, 1249-289 Lisboa, Portugal, is the controller of your personal data for the purposes described above. For more information on the EUDA: www.euda.europa.eu/index_en. The data controller[1] is the Head of the Substance use, harms and responses unit, Jane Mounteney (Jane.Mounteney@euda.europa.eu).
The legal basis of the processing is the Regulation (EU) 2023/1322 of the European Parliament and of the Council, of 27 June 2023 on the EUDA and repealing Regulation (EC) Nº 1920/2006. Any data collected or information provided in the framework described under point 1 above will be processed in accordance with Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.
3. What personal data do we collect and further process?
The following personal data are processed:
a) identification details: name, surname, institution affiliated, country of institution affiliated
b) contact details: e-mail address
c) event details: calls for tender, expression of interest, meeting data, log files, timestamps and other access data, audio-video streams, photographs.
4. Who has access to your personal data and to whom is it disclosed?
Your personal data may be disclosed to the following: EUDA staff directly involved in the EWSD, as well as staff working in the P&I unit – which coordinates the collaboration with the NFPs – who will need to have access to identification and contact details (as per above).
5. Are your personal data subject to any international transfers?
No personal data are subject to international transfers.
6. For how long do we keep your personal data?
The identification and contact details (as per above) is kept for the duration of your appointment as EWSD representative for your country. As soon as you are no longer a country representative your name will be removed from the list of EWSD country representatives. The event details will be kept until the end of the project, i.e. 31 December 2027.
7. How do we protect your personal data?
Any personal data we collect is kept in restricted access servers, available only to authorised staff through adequate IT security measures. In general, technical measures include appropriate actions to address online security, protect server hardware, software and the network from accidental or malicious manipulations and risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Internal emails within the EWSD network of country representatives will be sent to you via BCC to ensure that other recipients’ addresses remain undisclosed.
8. What are your rights regarding your personal data?
a) How can you verify, modify or delete your personal data?
As the individual to whom the personal data relate, you can exercise the following rights, all recognised under Regulation (EU) 2018/1725 (point 2 above):
1. access to your personal data under its Article 17;
2. rectify your personal data under its Article 18;
3. erase your personal data under its Article 19;
4. restrict the processing concerning yourself under its Article 20; or
5. exercise the right to data portability under its Article 22.
In addition, you can object to the processing of your personal data under Article 23 for reasons relating to your particular situation. When you contact us to exercise this right, please explain these reasons. We will remove your personal data, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms.
b) How can you withdraw consent and the consequences of doing this?
Consent can be withdrawn at any time by notifying the EUDA. Withdrawing consent does not affect the lawfulness of processing based on consent before the withdrawal.
9. How long do you have to wait to receive our reply to your data subject rights’ request?
After receiving your request, we have one month to provide information on action taken on your request. We may extend this period by two further months, taking into account the complexity and number of the requests. In those cases, we will inform you of the extension and its reasons within one month of receipt of your request.
10. Who can you contact to ask questions or exercise your rights?
In case of any difficulties or questions relating to the processing of your personal data, you may contact the DPO of the EUDA, Gonçalo Felgueiras e Sousa, at the following address: dpo@euda.europa.eu
11. Who can you lodge a complain with about the processing of your personal data
We encourage you to always contact us, as data controllers, first as described under point 10 above to raise your questions or concerns. In any case, if you believe that your rights under Regulation (EU) 2018/1725 have been infringed, you remain entitled to send a complaint to the EDPS, as a supervisory authority, using the following contact information:
European Data Protection Supervisor (EDPS)
Rue Wiertz 60 B-1047 Brussels,
Belgium
[1] Article 3 (8) of Regulation (EU) 2018/1725 defines controller as: ’the Union institution or body or the directorate-general or any other organisational entity which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by a specific Union act, the controller or the specific criteria for its nomination can be provided for by Union law.’