Data Protection Notice - FRA e-learning platform
The European Union Agency for Fundamental Rights (FRA or Agency) processes the personal data of a natural person in compliance with Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.
This data protection notice explains FRA’s policies and practices regarding its collection and use of your personal data, and sets forth your privacy rights. We recognise that information privacy is an ongoing responsibility, and we will update this notice where necessary.
1. Why do we process personal data?
The purpose of the processing of personal data is to provide FRA’s e-learning platform with necessary information to help you manage your learning experience.
The eLearning platform is a digital tool used to deliver and manage online learning content. It contains educational content, such as courses, videos, quizzes, and other interactive materials, to users. The platform aims to provide a flexible and engaging way for individuals to learn, whether for professional development, academic pursuits, or personal enrichment.
The personal information collected is for the purpose of providing training and showing your progress through the activities offered in the e-learning platform (e.g. courses, quizzes and activities taken).
FRA’s e-learning platform uses Moodle software to provide the Virtual Learning Environment (VLE). Moodle software is installed on web servers which are managed by FRA’s hosting contractor at their data centres in Spain. The VLE software itself is maintained and customised by FRA’s webservices contractor. FRA records and uses your personal information to:
- Provide you an account on, and identify you within the VLE system
- Provide you access to courses/sites within Moodle
- Provide you the ability to upload, amend and delete certain information within Moodle
- Provide you access to the information, resources and activities uploaded to Moodle
- Control access to different parts of the system
- Help support Moodle users
- For system administration and bug tracking
- Report on course, resource and activity access, activity completion, course completion and course data (such as grades, scores, submissions and content uploaded)
- For producing usage statistics for management and planning purposes
Individual courses within Moodle may collect additional personal information in order to:
- Provide services to the users
- Facilitate and support business processes
- Support users in their use of Moodle
2. What kind of personal data does the Agency process?
When you register with the e-learning platform, you will be asked to provide personal data, which will serve to identify you as a user in the system. This includes information necessary to create your user profile: a valid email address, a personal username which will be your user ID, and your first name and surname. Other information, non-mandatory to use the e-learning platform, can be provided by you in your “profile settings”. This information can be modified or deleted at any time by you. The fields in profile settings are the default set of fields in Moodle which come with the standard download package. They have not been customized by FRA.
- General personal data
- Mandatory information:
- Personal details – Username, Password, email address, First name, Last name
- Last IP address
- Moodle Session cookies
- YouTube cookies if you access a page with a YouTube video embedded on it (please refer to their privacy policy for more information).
- Actions taken by the user when on the e-Learning platform for example when a user completes a quiz or accesses a module. This is used to generate statistics about course usage.
- Optional information
- Contact details – City/town, country, description, user picture, additional names, ID, Phone, Mobile phone, Address, Skype ID, Web page
- Employment details – Institution, Department
- Financial details (e.g. financial identification form, bank account information)
- Family, lifestyle and social circumstances - interests
- Mandatory information:
Optional information is not part of the registration form but can be added by the user in their profile.
3. How do we collect and process your personal data?
Personal data for your user profile mentioned in section 2 above is collected during the registration process. The data collected is on your learning experience, how far you advance in each course, the quizzes and activities you take and your performance in such course elements.
3a. Information you provide us
Personal data for your user profile mentioned in section 2 above is collected during the registration process. The data collected is on your learning experience, how far you advance in each course, the quizzes and activities you take and your performance in such course elements.
3b. Information we collect about you
When you use the e-learning platform, cookies are used to remember your username between pages and to store any settings you may have saved. The session cookie is called MoodleSession and is stored until you close the session by logging out or closing the browser. If you access a page with a YouTube video embedded on it, YouTube will also set cookies on your computer or mobile device. The platform also collects the last IP address. This address is used to identify spam or malicious user creation.
Moodle logs contain detailed information about user activity within each course, including the date and time of when course-specific information was viewed and/or updated, the address of the machine from which the access was made, the browser identification information and information about the referring web page. Logs are used to create summary statistics which may be made publicly available. Summary statistics do not include personal data.
Information about contributions to courses, including contributions to chat rooms and discussion forums, ownership of resources, assignment/file submissions, text matching scores and evidence of participation in other Moodle-based activities is held within the Moodle system.
Information and data related to users, including grades, feedback comments, scores, completion data, access rights and group membership is also recorded.
4. Who is responsible for processing your personal data?
The Agency is the legal entity responsible for the processing of your personal data and determines the objective of this processing activity. The Head of Communications & Awareness Raising Unit is responsible for this processing operation.
The data is also processed by:
- FRA’s external contractor (Eworx) which acts as processor for software development tasks.
- FRA’s hosting contractor as the data is stored on secure servers in the EU by MainStrat in consortium with Sarenet S.A.U.
- YouTube for videos viewed in the platform (for more information, you can consult the privacy policy), as a separate controller.
5. Which is the legal basis for this processing operation?
The processing of your personal data is necessary for the management and functioning of the Agency, namely, to ensure the proper functioning of FRA’s online tools. As part of its tasks, Article 4.1.(h) of FRA Founding Regulation (EC) No 168/2007 (amended by Regulation (EU) No 2022/555) states that FRA should develop a communication strategy in order to raise public awareness of fundamental rights and actively disseminate information about its work. Ensuring that the FRA’s e-learning tool fits the needs of its target audience contributes to the achievement of this task.
In addition, cooperation with civil society is one of the tasks assigned to the Agency in Articles 4.1(h), 10 and 15.4(l) of Regulation (EC) 168/2007, amended by Council Regulation (EU) 2022/555 establishing a European Union Agency for Fundamental Rights. One of the objectives of the e-learning platform is to raise public awareness of fundamental rights and actively disseminate information about its work to civil society.
Therefore, the processing is lawful under Article 5.1.(a) of the Regulation (EU) No 2018/1725.
Specific data subject to consent will be collected and stored. Therefore, the processing of the personal data is also in accordance with Article 5.1 (d) of Regulation (EU) No 2018/1725.
6. Who can see your data?
Staff in the web team can access the platform as administrators. Access for administrators is covered by two-factor authentication. Other staff members will have access to the courses as course managers and their access is also covered by two-factor authentication.
Restricted personnel of the Agency’s external web development contractor Eworx S.A might exceptionally have access to the host and usage information if required in case of technical issues.
The data is also processed by the FRA’s hosting contractor as the data is stored on secure servers in the EU by MainStrat.
7. Do we share your data with other organisations?
Personal data is processed by the Agency only. In case that we need to share your data with third parties, you will be notified to whom your personal data has been shared with.
8. Do we intend to transfer your personal data to Third Countries/International Organizations?
FRA will not transfer your personal data to third countries or international organisations.
9. When will we start the processing operation?
We will start the processing operation on the date when you register on the e-learning platform. Once registered, you can provide additional data in your user´s profile. This additional data is not mandatory and can be modified or deleted by you at any time. The purpose of the additional data is linked to your wish to be identified by your name-surname by other users.
10. How long do we keep your data?
The user can request deletion of their account at any time.
This request will be dealt with by the web team within 2 weeks. Due to specific features of the online Learning Environment (forum posts and ongoing courses), the user record is deleted from the Moodle user management interface but is not deleted from the database but instead it is anonymised.
When a user's data is deleted, any forum posts are blanked and replaced with a sentence stating that the post has been removed, their username is changed to a combination of their email address and a timestamp from when the account was deleted. Moreover, an encrypted version of the username is stored as the email address. This is the standard behaviour of Moodle software and has been implemented to balance the need to retain certain data for courses and the requirements for data retention and anonymisation.
Users who have been inactive for more than 12 months will be notified that they should log in to maintain their account. If they do not log in during a period of 2 weeks after the notification has been sent out their account will be deleted.
11. How can you control your data?
Under Regulation 2018/1725, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. You are not required to pay any charges for exercising your rights except in cases were the requests are manifestly unfounded or excessive, in particular because of their repetitive character.
We will reply to your request without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.
You can exercise your rights described below by sending an email request to webfeedback@fra.europa.eu.
11.1. The value of your consent
Since your participation is not mandatory, we need proof that you consented to the processing of your personal data. Consent will be collected when you register on the e-learning platform. You have the right to withdraw your consent at any time, and we will delete your data or restrict its processing. All processing operations up until the withdrawal of consent will still be lawful.
11.2. Your data protection rights
- Can you access your data?
You have the right to receive information on whether we process your personal data or not, the purposes of the processing, the categories of personal data concerned, any recipients to whom the personal data have been disclosed and their storage period. Furthermore, you can have access to such data, as well as obtain copies of your data undergoing processing.
The user may request a copy of all of their personal data at any time via the platform. Once the request is approved, they will receive a notification to inform them that their personal data may be downloaded from their Data requests page. The user has by default one week to download their data before the download link expires.
- Can you modify your data?
You have the right to ask us to rectify your data you think is inaccurate or incomplete at any time.
- Can you restrict us from processing your data?
You have the right to ask us to rectify your data you think is inaccurate or incomplete at any time.
- Can you delete your data?
You have the right to ask us to delete your data when the personal data are no longer necessary for the purposes for which they were collected, when you have withdrawn your consent or when the processing activity is unlawful. In certain occasions we will have to erase your data in order to comply with a legal obligation to which we are subject.
We will notify to each recipient to whom your personal data have been disclosed of any rectification or erasure of personal data or restriction of processing carried out in accordance with the above rights unless this proves impossible or involves disproportionate effort from our side.
Are you entitled to data portability?Data portability is a right guaranteed under Regulation 1725/2018 and consists in the right to have your personal data transmitted to you or directly to another controller of your choice.
In this case, this does not apply for two reasons: I) in order for this right to be guaranteed, the processing should be based on automated means, however we do not base our processing on any automated means; II) this processing operation is carried out in the public interest, which is an exception to the right to data portability in the Regulation.
Do you have the right to object?When the legal base of the processing is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body” which is the case in most of our processing operations, you have the right to object to the processing. In case you object, we have to stop the processing of your personal data, unless we demonstrate a compelling reason that can override your objection.
Do we do automated decision making, including profiling?No.
12. What security measures are taken to safeguard your personal data?
The Agency has several security controls in place to protect your personal data from unauthorised access, use or disclosure. We keep your data stored on our internal servers with limited access to a specified audience only. Organisational measures taken by FRA include a strict information security policy, control of access to electronically held information, data storage system, data management policy, training of FRA staff on data protection and confidentiality, data retention rules. The Agency’s technical measures comprise physical security, cybersecurity, a strict password policy, secure disposal, pseudonymisation and encryption, internet activity monitoring. In addition, FRA obliges data processors to apply corresponding security measures.
Platform administrators and course managers must use two-factor authentication in order to access the platform.
13. What can you do in the event of a problem?
- The first step is to notify the Agency by sending an email to webfeedback@fra.europa.eu and ask us to take action.
- The second step, if you obtain no reply from us or if you are not satisfied with it, contact our Data Protection Officer (DPO) at dpo@fra.europa.eu.
- At any time you can lodge a complaint with the EDPS at http://www.edps.europa.eu, who will examine your request and adopt the necessary measures if any.
14. How do we update our data protection notice?
We keep our data protection notice under regular review to make sure it is up to date and accurate.