Privacy statement for the ECB survey to gather feedback on the banking supervision website

What is our legal framework?

All personal data are processed in accordance with European Union data protection law, i.e. in line with Regulation (EU) 2018/1725 (the EU’s data protection regulation – EUDPR).

Why do we process personal data?

Individuals will fill in this survey on a voluntary basis. The information collected will be used for the following purposes:

• Gathering feedback: to improve our banking supervision website and user experience.
• Recruiting volunteers: to identify and contact individuals interested in participating in user testing initiatives.

What is the legal basis for processing your personal data?

The legal basis for processing your personal data is your consent, as provided by your voluntary participation in this survey. You may withdraw your consent at any time by contacting the below-mentioned contact point. All processing of your personal information will stop once you withdraw your consent; however, any processing that has already taken place remains lawful.

Who is responsible for processing your personal data?

The ECB is the controller for the processing of your personal data. The Design and Digital Division and the Strategic Communication Section (both within the Directorate General Communications) are responsible for this processing.

Who will be the recipients of your personal data?

The recipients of your personal data are ECB staff members in the Directorate General Communications. The scope of this data collection is limited to improving website performance.

What categories of personal data are collected?

Personal information: your name and email address are collected for the purposes of gathering feedback and recruiting volunteers for user testing.

Will your personal data (in a clear or encrypted form) be processed (e.g. transferred, accessed or stored) in third countries or by international organisations?

The ECB does not foresee any transfers of your personal data to third countries or international organisations. However, your personal data might exceptionally be processed in third countries/ international organisations based on the derogations for specific situations set out in Article 50(1) EUDPR.

How long will the ECB keep personal data?

Your personal data will be stored for a maximum of 14 months (starting from the moment at which the data are collected) before being deleted.

What are your rights?

You have the right to access your personal data and correct any data that are inaccurate or incomplete. You also have (with some limitations) the right to delete your personal data and to object to or restrict the processing of your personal data in line with the EUDPR. The ECB may restrict your rights to safeguard the interests and objectives referred to in Article 25(1) EUDPR.

Who can you contact for queries or requests?

You can exercise your rights by contacting the Webmaster team. You can also directly contact the ECB’s Data Protection Officer for all queries relating to your personal data.

Addressing the European Data Protection Supervisor

If you consider that your rights under the EUDPR have been infringed as a result of the processing of your personal data, you have the right to lodge a complaint with the European Data Protection Supervisor at any time.