The European Union Agency for Cybersecurity (ENISA) and the Católica University of Portugal process your personal data to organise and manage the Annual Privacy Forum (APF) 2020, which will take place on 4 and 5 of June 2020 in Lisbon.

The joint data controllers are ENISA (Core Operations Department) and Católica University of Portugal, who are responsible for the overall organisation of the event, the communication with the participants before and after the end of the event, as well as the reimbursement of expenses of invited participants.  The Católica University of Portugal is also responsible for the online registration of the event’s participants through its website, the management of the event’s venue (local organiser), as well as the management of the payments of the event’s participants.

ENISA processes personal data in accordance with the Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.[1] The legal basis for the processing operation is article 5(1)(a) of Regulation (EU) 2018/1725, on the basis of Regulation (EU) 2019/881, in particular the provisions establishing the tasks of ENISA.

Católica University of Portugal processes personal data in accordance with the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation – GDPR)[2]. The legal basis is article 6(1)(e) GDPR.and Law no. 58/2009, 8 August.

The purpose of the processing of your personal data is: handling invitations and participation requests, reporting on the event, as well as event follow-up actions, such as sharing presentations among participants and feedback collection.

The following personal data are processed:

• Contact data, such as first name, last name, affiliation, country, e-mail address.
• Financial data: bank details and other legally required financial information for the payment of registration fees (processed under the responsibility of Católica University of Portugal) or related to the reimbursement of expenses of invited participants.

Please note that there will be photos taken during the event’s presentations (keynotes/panels) based on the prior consent of the speakers (presenters/panel participants). These photos may be published on ENISA’s and Católica University’s websites and/or relevant social media channels.

The focus of the photos will be on the speakers only and not on general views of the audience or specific views/pictures of workshop’s participants (other than speakers). 

Still, should your photo be taken in the context of this photo shooting, and you would like to have this photo removed, please contact ENISA at isdp@enisa.europa.eu or Católica University at: jsilva@fd.lisboa.ucp.pt and we will do so as soon as possible.

Access to your data is granted only to ENISA and Católica University staff, who are involved in the organisation of the workshop, event organisers contracted by ENISA or Católica University (involved in the reimbursement of expenses of invited participants), as well as competent financial institutions (for the payment of the registration fees).  Access to the data can also be granted to national and EU bodies charged with monitoring or inspection tasks in application of national or EU law (e.g. internal audits, European Anti-fraud Office – OLAF).   

The final participants list (name, surname, organisation, country) will be kept by the joint controllers for a maximum period of 5 years after the end of the event for auditing purposes. Your contact data will be kept for a maximum period of six months after the end of the event. Financial data related to the event will be kept for a maximum period of 10 years after the end of the event for auditing purposes. All data will be deleted after the end of their respective retention periods.

You have the right of access to your personal data and to relevant information concerning how we use it. You have the right to rectify your personal data. Under certain conditions, you have the right to ask that we delete your personal data or restrict its use. You have the right to object to our processing of your personal data, on grounds relating to your particular situation, at any time. We will consider your request, take a decision and communicate it to you. If you have any queries concerning the processing of your personal data, you may address them to ENISA at isdp@enisa.europa.eu or to the Católica University at: jsilva@fd.lisboa.ucp.pt . You may also contact at any time the ENISA DPO at dataprotection@enisa.europa.eu or to the Católica University DPO at: compliance.rgpd@ucp.pt .

You have right of recourse at any time to the competent supervisory authorities: European Data Protection Supervisor (https://edps.europa.eu) and Portuguese Data Protection Authority (https://www.cnpd.pt/).

[1] Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002.

[2] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).