Privacy Notice - FRA e-Media Toolkit
Privacy Notice - FRA e-Media Toolkit
This Privacy Notice explains what kind of personal data the European Union Agency for Fundamental Rights ('the Agency') collects from you when you register to access the e-Media toolkit and how the Agency uses that data.
The European Union Agency for Fundamental Rights (FRA) processes the personal data of a natural person in compliance with Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.
This privacy notice explains FRA's policies and practices regarding its collection and use of your personal data, and sets forth your privacy rights. We recognise that information privacy is an ongoing responsibility, and we will update this notice where necessary.
1. Why do we collect personal data?
The Agency collects and processes personal data only to the extent necessary to provide services or content you have requested. This information is collected for the purposes of providing training and showing your progress through the activities offered in the e-Media Toolkit (e.g. courses, quizzes and activities taken).
Information may be processed in anonymised form to produce reports on course progress with a view to optimising technical and content improvements.
2. What kind of personal data does the Agency collect through the e-Media Toolkit?
When you register with the e-Media Toolkit, you will be asked to provide personal data, which will serve to identify you as a user to the system. This includes information necessary to create your user profile: a valid email address, a personal username which will be your user ID, and your first name and surname. Other information, non-mandatory to use the e-Media Toolkit, can be provided by you in your "profile settings". This information can be modified or deleted at any time by you.
The purpose of the processing of personal data is to provide the e-Media Toolkit with necessary information to help you manage your learning experience. For this purpose, the e-Media Toolkit collects information about your progress in the platform (including your last IP address - visible however only to system administrators) to allow you to take a break from taking a course and to continue another time where you left off.
In addition the toolkit uses the following cookies:
MoodleSession - A Moodle session cookie which is set by the toolkit and is deleted after the session expires. This cookie ensures that a user's session is maintained when navigating through the website.
The other 4 cookies are the following YouTube cookies which are saved if the user accesses a page which has embedded videos which are hosted on YouTube:
- GPS - Registers a unique ID on mobile devices to enable tracking based on geographical GPS location. - Duration 1 day
- REF - Registers a unique ID that is used by Google to keep statistics of how the visitor uses YouTube videos across different websites. - Duration 8 months
- VISITOR_INFO1_LIVE - Tries to estimate the users' bandwidth on pages with integrated YouTube videos - Duration 179 days
- YSC - Registers a unique ID to keep statistics of what videos from YouTube the user has seen. - Deleted after end of session.
3. How do we collect your personal data?
Personal data for your user profile is collected during the registration process. The data collected is on your learning experience, how far you advance in each course, the quizzes and activities you take and your performance in each.
When you use the e-Media Toolkit, cookies are used to remember your username between pages and to store any settings you may have saved. The session cookie is called MoodleSession and is stored until you close the session by logging out or closing the browser. If you access a page with a YouTube video embedded on it YouTube will also set cookies on your computer or mobile device.
4. Who is responsible for the processing your personal data?
The Agency is the legal entity responsible for the processing of your personal data and determines the objective of this processing activity. The Head of Communications & Events Unit is responsible for this processing operation.
The data is also processed by the FRA's hosting contractor as the data is stored on secure servers in the EU by Sarenet S.A.U.
5. Which is the legal basis for this processing operation?
The lawfulness of the processing of personal data is found under Article 5(a) of the Regulation (EU) No 2018/1725.
In addition, since enrolling in the e-Media Toolkit is not mandatory, the processing of personal data is also in accordance with Article 5(d) of Regulation (EU) No 2018/1725.
6. Who can see your data?
During this process, your personal data can be accessed by:
- The selected FRA staff of the relevant units;
- The authorised staff of the FRA web development and hosting contractors based in EU countries.
7. Do we share your data with other organisations?
Personal data is processed by the Agency.
For the purposes of hosting, administering and developing the platform data will be shared with the Agency staff and the contractors specifically selected for these purposes.
8. Do we intend to transfer your personal data to Third Countries/International Organizations?
The data stored in YouTube cookies are accessible by YouTube.
9. When will we start the processing operation?
The date when you register on the website. Once registered, you can provide additional data in your user's profile. This additional data is not mandatory and can be modified or deleted by you at any time. The purpose of the additional data is linked to your wish to be identified by your name-surname by other users.
10. How long do we keep your data?
The user can request deletion their account at any time. This request will be dealt with by the project manager within 2 weeks. Due to specific features of a Learning Management System (forum posts and ongoing courses), the user record is deleted from the Moodle user management interface but is not deleted from the Maria DB database instead it is anonymised. When a user's data is deleted, any forum posts are blanked and replaced with a sentence stating that the post has been removed. However, due to an issue with the LMS, if the user started any discussions, their name is still shown on the forum page. When an account is deleted, the MD5 hash of the username is stored as the email address. The email address + timestamp for when the account was deleted is stored as the username.
Users who have been inactive for more than 12 months will be deleted manually once per month.
The user may request a copy of all of their personal data at any time via the platform. Once the request is approved, they will receive a notification to inform them that their personal data may be downloaded from their Data requests page. The user has by default one week to download their data before the download link expires.
11. How can you control your data?
You can access, modify or delete your personal data by sending an email request to email@example.com. More details are provided below.
11.1. How valuable is your consent for us?
Since the processing is lawful because "the data subject has unambiguously given his or her consent". Therefore, you have the right to withdraw your consent at any time, and we will delete/anonymise your data or restrict its processing.
11.2. Your data protection rights
Under data protection law, you have rights that we need to make you aware of.
The rights available to you depend on the aim of processing of your information. You are not required to pay any charges for exercising your rights.
a. Can you access your data?
You have the right to receive confirmation whether or not we process your personal data. Furthermore, you can have access to such data, as well as obtain copies of your data undergoing processing, at any time and free of charge, by sending an email request to firstname.lastname@example.org or by making a data request from the User Profile screen. The Agency will address the request within 15 working days from the receipt of the request.
b. Can you modify your data?
You have the right to modify or delete your data by yourself under your "profile", once logged into the e-Media Toolkit. You can also ask us to rectify the data you think is inaccurate or incomplete at any time by sending an email request to email@example.com.The Agency will address the request within 15 working days from the receipt of the request.
c. Can you restrict us from processing your data?
You have the right to block the processing of your personal data at any time by sending an email request to firstname.lastname@example.org, when you contest the accuracy of your personal data or when the Agency no longer needs the data for completing its tasks. You can also block the processing activity when the operation is unlawful, and you oppose to the erasure of the data. The Agency will address the request within 15 working days from the receipt of the request.
d. Can you delete your data?
You can request deletion of your account at any time and free of charge, by sending an email request to email@example.com or by making a data request from the User Profile screen. This request will be dealt with by the project manager within 2 weeks. Due to specific features of a Learning Management System (forum posts and ongoing courses), the user record is not deleted from the database instead it is anonymised. When a user's data is deleted, any forum posts are blanked and replaced with a sentence stating that the post has been removed. However, due to an issue with the LMS, if the user started any discussions, their name is still shown on the forum page. When an account is deleted, the MD5 hash of the username is stored as the email address. The email address + timestamp for when the account was deleted is stored as the username.
e. Can you request the transfer of your data to a third party?
This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.
f. Do you have the right to object?
Yes, you have the right to object at any time by sending an email request to firstname.lastname@example.org when you have legitimate reasons relating to your particular situation. Moreover, you will be informed before your information is disclosed for the first time to third parties, or before it is used on their behalf. The Agency will address your requests within 15 working days from the receipt of the request.
g. Do we do automated decision making, including profiling?
12. What security measures are taken to safeguard your personal data?
The Agency has several security controls in place to protect your personal data from unauthorised access, use or disclosure. We keep your data stored on computer systems with limited access to a specified audience only.
13. What can you do in the event of a problem?
a) The first step is to notify the Agency by sending an email to email@example.com and ask us to take action.
b) The second step, if you obtain no reply from us or if you are not satisfied with it, contact our data protection officer (DPO) at firstname.lastname@example.org.
c) At any time you can lodge a complaint with the EDPS at http://www.edps.europa.eu, who will examine your request and adopt the necessary measures if any.
14. How do we update our privacy notice?
We keep our privacy notice under regular review to make sure it is up to date and accurate.