Privacy statement for credit rating reports

In the context of procurement procedures, the ECB consults credit rating reports provided by specialised companies to verify if a candidate or tenderer is bankrupt, being wound up, subject to administration or in any similar situation.

This privacy statement concerns only the processing of personal data contained in credit rating reports provided by specialised companies.

A separate privacy statement is available on the ECB's website in respect of personal data processed for the management and administration of procurement procedures.

What is our legal framework?

All personal data are processed in accordance with European Union data protection law, that is to say in line with Regulation (EU) 2018/1725 (‘EUDPR’).

Why do we process personal data?

Personal data are processed in order to check if a candidate or tenderer is bankrupt, being wound up, subject to administration or in any similar situation in the context of procurement procedures conducted by the ECB. In this regard, the ECB consults credit rating reports provided by specialised companies.

What is the legal basis for processing your personal data?

Your personal data are processed by the ECB in the performance of a task carried out in the public interest, based on Article 5(1)(a) EUDPR, in conjunction with Article 30(5)(a) of Decision (EU) 2016/245 (ECB/2016/2) .

Who is responsible for processing your personal data?

The ECB is the controller for the processing of your personal data. The Central Procurement Office and the procuring business area are responsible for this processing.

Who will be the recipients of your personal data?

The recipients of your personal data (including entities who have access to that personal data) are staff members of the Central Procurement Office in the Directorate General Corporate Services and the procuring business area.

What categories of personal data are collected?

The ECB processes the following personal data:

• Name
• Date of birth
• Address
• Nationality

The personal data listed above are included in credit rating reports.

Will your personal data (in a clear or encrypted form) be processed (e.g. transferred, accessed or stored) in third countries or by international organisations?

Your personal data will not be shared with recipients in third countries or international organisations.

How long will the ECB keep personal data?

Your personal data will be stored for a maximum of 10 years from the date on which the procurement procedure is finalised.

What are your rights?

You have the right to access your personal data and correct any data that is inaccurate or incomplete. You also have (with some limitations) the right to delete your personal data and to object to or to restrict the processing of your personal data in line with the EUDPR. The ECB may restrict your rights to safeguard the interests and objectives referred to in Article 25(1) EUDPR.

Who can you contact for queries or requests?

You can exercise your rights by contacting Central Procurement Office at procurement@ecb.europa.eu. You can also directly contact the ECB’s Data Protection Officer at dpo@ecb.europa.eu for all queries relating to your personal data.

Addressing the European Data Protection Supervisor

If you consider that your rights under the EUDPR have been infringed as a result of the processing of your personal data, you have the right to lodge a complaint with the European Data Protection Supervisor at any time.