Privacy statement for applicants for the design contest for the future euro banknotes

The following privacy statement outlines how the ECB will process personal data collected through the design contest portal.

What is our legal framework?

All personal data are processed in accordance with European Union data protection law, that is to say in line with Regulation (EU) 2018/1725 (“EUDPR”).

Why do we process personal data?

Personal data are processed for purposes related to the management and administration of the design contest.

What is the legal basis for processing your personal data?

Your personal data are processed by the ECB:

• in the performance of a task carried out in the public interest, based on Article 5(1)(a) of the EUDPR, in conjunction with Decision (EU) 2016/245, as well as any subsequent legal acts replacing or amending that Decision;
• based on a legal obligation to which the ECB is subject, as detailed in Decision (EU) 2016/245, as well as any subsequent legal acts replacing or amending that Decision;
• because they are necessary for the performance of contractual obligations between you and the ECB, as detailed in Decision (EU) 2016/245, as well as any subsequent legal acts replacing or amending that Decision.

Who is responsible for processing your personal data?

The ECB is the controller for the processing of your personal data. The Central Procurement Division of the Directorate General Corporate Services and the procuring business area Directorate Banknotes, as well as a limited number of nominated experts from the national central banks (NCBs) of the European System of Central Banks (ESCB), are responsible for this processing. A limited number of ECB personnel in the Directorate Internal Audit who are involved in performing audits or conducting specific inquiries related to procurement procedures may also process some of your personal data in line with their mandate.

Who will be the recipients of your personal data?

The recipients of your personal data (including entities with access to your personal data) are listed below.

• ECB personnel in the ECB’s Central Procurement Division and designated ECB personnel in the procuring business area Directorate Banknotes.
• Designated ECB personnel providing opinions and advice in specific cases in relation to procurement procedures, e.g. in the Directorate General Legal Services or Budgeting and Controlling Division of the Directorate Finance.
• Designated ECB personnel who deal with appeal procedures.
• A limited number of ECB personnel in the Directorate Internal Audit who are involved in performing audits or conducting specific inquiries related to procurement procedures.
• Nominated experts from the NCBs of the ESCB.
• External experts and contractors working on behalf of the ECB for the purpose of managing the design contest and tender evaluation.
• EU institutions and bodies responsible for monitoring or inspecting the application of Union law (e.g. the European Commission, internal auditors, the European Anti-Fraud Office).
• Other tenderers or candidates participating in the design contest and executing their right to request information.
• Members of the general public once a contract has been awarded. Some personal data of the winning tenderer (name, address, the amount awarded and the subject matter of the contract) will be published in the Supplement to the Official Journal of the European Union and/or on the ECB’s website in accordance with Articles 34 and 36 of Decision (EU) 2016/245.

What categories of personal data are collected?

The ECB processes the following personal data:

• names;
• contact details and address;
• employment details;
• certificates confirming academic qualifications and professional experience, and certificates of criminal record, which will be requested when successful applicants are considered for progression to phase 2 of the design contest.

Will your personal data (in a clear or encrypted form) be processed (e.g. transferred, accessed or stored) in third countries or by international organisations?

The ECB’s design contest portal is provided by Avature as a solution service. Avature’s servers are located within the European Economic Area. For the provision of technical support outside European working hours, Avature personnel located in Argentina have access to the personal data stored on the platform. This means that your personal data will also be processed in third countries based on an adequacy decision of the European Commission (pursuant to Article 47 of the EUDPR), which can be found on the European Commission’s website.

How long will the ECB keep personal data?

Your personal data will be stored for a maximum of ten years following the completion of the design contest before being deleted. For technical reasons, Avature retains personal data for a limited number of months before they are deleted, according to the privacy statement on its website.

What are your rights?

You have the right to access your personal data and correct any data that are inaccurate or incomplete. You also have (with some limitations) the right to delete your personal data and to object to or restrict the processing of your personal data in line with the EUDPR. The ECB may restrict your rights to safeguard the interests and objectives referred to in Article 25(1) of the EUDPR.

Who can you contact for queries or requests?

You can exercise your rights by contacting the ECB contact person for the design contest (dc@ecb.europa.eu). You can also contact the ECB’s Data Protection Officer directly at dpo@ecb.europa.eu for all queries relating to your personal data.

Addressing the European Data Protection Supervisor

If you consider that your rights under the EUDPR have been infringed as a result of the processing of your personal data, you have the right to lodge a complaint with the European Data Protection Supervisor at any time.