News, events, publications

EDA-DPR-083 - EDA Incubation Forum for Circular Economy in European Defence (IF CEED)

Records and compliance checklist

Under Article 31 of the new Regulation, EUIs have to keep records of their processing operations. This template covers two aspects:

1.Mandatory records under Article 31 of the new rules (recommendation: publicly available)
2.Compliance check and risk screening (internal).

The header and part 1 should be publicly available; part 2 is internal to the EUI. By way of example, column 3 contains a hypothetical record on badges and physical access control in a EUI.
Nr Item Explanation
Header - versioning and reference numbers (recommendation: publicly available)
1. Last update of this record 05-09-2022
2. Reference number EDA-DPR-083 - EDA Incubation Forum for Circular Economy in European Defence (IF CEED)
part 1 - article 31 record (recommendation: publicly available)
3. Name and contact details of controller
European Defence Agency

Rue des Drapiers 17-23
B-1050 Brussels
Belgium
4. Name and contact details of DPO

Data Protection Officer

[email protected]

5. Name and contact details of joint controller (where applicable)
N/A
6. Name and contact details of processor (where applicable)

For the IF CEED Annual General Conference:

B2Match GmbH,

Taborstraße 20/18, AT-1020

Vienna, Austria,

Company Number 396478g

For IF CEED meetings & conferences: external contractors (e.g. venue hosting the event or hotels for accommodation during the event) may be used to perform tasks on behalf of EDA. All contractors are contractually obliged to ensure data protection compliance when processing personal data on behalf of EDA.

7. Purpose of the processing
A) For the IF CEED Activities

EDA has concluded a Contribution Agreement with the European Commission’s DG Environment on the Incubation Forum for Circular Economy in European Defence (IF CEED).

In the context of achieving the objectives of IF CEED under the Contribution Agreement, EDA collects and processes personal data of Experts/PoCs to manage their participation and contribution in these activities, to set up an IF CEED network of stakeholders, and to facilitate contacts and exchange of information among these Experts/PoCs.  

 Processing of personal data includes:

  • registration and admission to meetings, accommodation arrangements, reimbursement of expenses, and where applicable recording of image and video.
  • collection of input and contributions on IF CEED for the development of studies, policies and guidelines. 

B) For the Annual General IF CEED Conference

To fulfil the objectives of the Incubation Forum for Circular Economy in European Defence (IF CEED), EDA organises on yearly basis the Annual General IF CEED Conference.

For the preparation, organisation, delivery and follow-up of the Annual General IF CEED Conference, EDA collects and processes personal data of participants.

In particular, the processing of personal data is necessary:

  • for the registration and admission of participants and to accommodate their preferences and requirements.
  • to distribute any information related to the event.

 To facilitate the establishment of bilateral contacts and networking opportunities between the participants of the Annual IF CEED Conference, EDA allows the registered participants to exchange their contact details through the registration platform.

To promote the Annual IF CEED Conference in the IF CEED network of stakeholders, sessions may be subject to image and video recording.

B2MATCH is the data Processor entrusted by EDA to support the organization of the Annual General IF CEED Conference.  B2MATCH facilitates the registration of participants to the Annual IF CEED conference through a dedicated web-platform and processes personal data only to support the above-mentioned purposes. 
8. Description of categories of persons whose data EDA processes and list of data categories

(a) Categories of data subjects:

IF CEED Experts and PoCs, participating to IF CEED activities or to the Annual General IF CEED Conference. Such Experts and PoCs may originate from:

  • EU, agencies and bodies,
  • EU MS (either from the MoDs or other public bodies),
  • Industry, Research-and-Technology Organisations (RTOs),
  • Academia,
  • EU-level platforms,
  • Other international private and public bodies, or third countries,
  • Any other stakeholder having expressed interest in receiving information or taking part in IF CEED-related activities.

(b) Categories of personal data processed:

(A) for the IF CEED Activities:

  • Title
  • Last name, (full)
  • First name,
  • Email-address,
  • Telephone number;
  • Organisation;
  • Nationality;
  • Country of residence;
  • Job Title/Department;
  • Image, audio or video recording or livestreaming in the context of a meeting/conference (opt-in required as per separate consent form);
  • Dietary requirements (for in person meetings, opt-in required as per separate consent);
  • Accessibility requirements (for in person meetings, opt-in required as per separate consent).

(B) For the Annual IF CEED Conference:

  • Title;
  • Gender;
  • Last name; (full)
  • First name;
  • Email-address;
  • Telephone number;
  • Nationality;
  • Job Title/Department;
  • Academic title;
  • Language(s) spoken;
  • Image, audio or video recording or livestreaming in the context of a meeting/conference (opt-in required as per separate consent form);
  • Dietary requirements (opt-in required as per separate consent);
  • Accessibility requirements (opt-in required as per separate consent).
  • Option to share contract details with other participants for networking purposes .

9. Time limit for keeping the data

A) For the IF CEED Activities

Contact data of IF CEED Experts/PoCs are maintained by EDA during their tenure. 

Contact data of Experts/PoCs that no longer represent a Member State or other entity in the respective group is deleted within 6 months. Time limit for storing this data is reviewed annually.

Contact data of IF CEED Experts/PoCs that have expressed their interest to participate to the IF CEED stakeholder network are maintained by EDA until the data subject withdraws its consent. EDA will erase personal data processed for the IF CEED stakeholder network no later than 12 months after IF CEED activities are terminated.

Personal data, other than contact details, are retained for auditing purposes for a period of 5 years after the year of termination of IF CEED activities, in accordance with the Regulation (EU) 2024/2509.

Anonymised statistics may be kept beyond the retention period. This is to inform EDA data on participant numbers and analyse the relative success of each of the events.

B) For the Annual General IF CEED Conference

Data will be retained by EDA for the duration of the Annual General IF CEED Conference for the purposes outlined above under point 3 and will be used in this period for the activities related to the follow-up of the Annual General IF CEED Conference.

Data is deleted at the latest within 6 months after the Annual General IF CEED Conference activities are finished.

Personal data, other than contact details, are retained for auditing purposes for a period of 5 years after the year of termination of IF CEED activities, in accordance with the Regulation (EU) 2024/2509.

B2MATCH is entitled to perform anonymized analysis on transmitted data for statistical purposes.


10. Recipients of the data
A) For the IF CEED Activities
  • EDA staff members responsible for IF CEED activities.
  • European Commission staff members that are overseeing the implementation of the IF CEED Contribution Agreement.
  • Other Experts/PoCs of the corresponding IF CEED networks, groups and Member States and participants of corresponding meetings.

The personal data will not be communicated to third parties unless necessary for the purpose of processing. In such cases, data subjects will be informed accordingly. 

B) For the Annual General IF CEED Conference

Personal data entered when signing up to the Conference will be accessible to:

  • EDA staff responsible for tasks relevant to the organization of the Annual General IF CEED Conference.
  • B2MATCH, the entity acting as Processor of EDA, entrusted with organisational arrangements of the Annual General IF CEED Conference and its responsible staff.
  • Other registered participants to the event, whose registration in the web platform has been validated by EDA.

Certain categories of personal data processed may be disclosed to the venue hosting the Annual General IF CEED Conference as necessary for the admission of participants.

In case EDA undertakes to facilitate the accommodation arrangements for registered participants, personal data will be disclosed to the accommodation providers (hotels) as necessary. All EDA contractors are contractually obliged to ensure data protection compliance when processing personal data on behalf of EDA.

Personal data of registered participants may be made available to the national authorities of the Member State where the Annual General IF CEED Conference is hosted, to the extent that national authorities may request and obtain access to perform tasks carried out in the public interest, or in the exercise of official authority vested in them, pursuant to Article 9 of Regulation (EU) 2018/1725.

11. Are there any transfers of personal data to third countries or international organisations? If so, to which ones and with which safeguards?
Such transfers are not envisaged. However, participation to the Annual Conference is in principle open to data subjects from third countries or international organisations which may have access to limited personal data (name, affiliation, contact details) of other participants which are displayed in the context of meetings/conferences for the purpose of facilitating networking opportunities between participants. 
12. General description of security measures, where possible.

Data are stored in EDA’s IT system and under the internal IF CEED platform. EDA has implemented appropriate technical and organisational measures (firewalls, checkpoints, antivirus) to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected. Such measures have been taken in particular to prevent any unauthorised disclosure or access, accidental or unlawful destruction or accidental loss, or alteration and to prevent all others unlawful forms of processing.

EDA external contractors are obliged by the respective contracts to adopt appropriate technical and organisational security measures regarding the risks inherent in the processing and the nature of the personal data concerned.

13. For more information, including how to exercise your rights to access, rectification, object and data portability (where applicable), see the privacy statement

Additional information is available by following the links to:

(A) The privacy statement for IF CEED Activities, here; and

(B) The privacy statement for the (B) Annual General IF CEED Conference, here.