Privacy Statement for the processing of personal data related to the selection of researchers for participation in the Alberto Giovannini Programme (former EMIR Bridge Programme)

1. Data protection legal framework applicable to the European Systemic Risk Board and the European Central Bank

The European Systemic Risk Board (ESRB) and the European Central Bank (ECB) are subject to and process personal data in accordance with EU Data Protection Law.^[1]

Regulation (EU) 2018/1725

2. The European Systemic Risk Board and the European Central Bank as joint controllers of processing personal data

For the purposes of Regulation (EU) 2018/1725, the ESRB and the ECB are the joint controllers for the processing of personal data related to the selection of researchers for participation in the Alberto Giovannini Programme.The ESRB Secretariat and Central Procurement Division of the ECB are the organisational units responsible for processing these data.

For the purposes indicated below only, the ESRB and the ECB may transfer personal data to third parties supporting the ESRB and the ECB in the procurement process, including external contractors, national central banks or other partner organisations.

3. Purposes for processing personal data by the European Systemic Risk Board and the European Central Bank

The ESRB and the ECB collect and process personal data of applicants during the selection process for participation in the Alberto Giovannini Programme.

4. Lawfulness of the data processing operations of the European Systemic Risk Board and the European Central Bank

The legal basis for processing your personal data is Article 5.1 (d) of Regulation (EU) 2018/1725. By submitting an application for participation in the Alberto Giovannini Programme, data subjects consent to the collection and processing of their personal data. Applicants may withdraw that consent at any time by contacting info@esrb.europa.eu . Any further processing of personal data will cease once consent has been withdrawn. Processing of personal data that took place prior to a withdrawal of consent will remain lawful.

5. Categories of personal data processed by the European Systemic Risk Board and the European Central Bank

The following categories of personal data may be processed in relation to the selection of researchers for participation in the Alberto Giovannini Programme:

• personal details (e.g. full name, date of birth, ID/passport number);
• contact details (e.g. email address, postal address, business/mobile telephone number, fax number);
• education and training details; (e.g. expertise, technical skills, languages, educational background, professional experience, test results);
• employment details (e.g. company, organisational unit, your position/function);
• financial details (e.g. bank account details, VAT number);

6. Access to personal data collected and processed by the European Systemic Risk Board and the European Central Bank

Access to personal data may be given to the following persons:

• a limited number of ECB staff members (including staff of the ESRB Secretariat);
• external contractors working on behalf of the ECB who support the procurement procedure.

7. Retention periods for personal data

Personal data of rejected applicants are retained for a period of 2 years, whereas personal data of successful applicants is retained for a period of 5 years following the end of the contractual relationship.

8. Your rights as a data subject

You have the right to access your personal data and correct any data that is inaccurate or incomplete. You have also the right to delete your personal data, to restrict or object to the processing of your personal data in accordance with Regulation (EU) 2018/1725.

9. Contact information in case of queries and requests

For more information or to exercise your rights as referred to in section 8, please contact info@esrb.europa.eu . For all queries relating to personal data, please contact the ECB’s Data Protection Officer at dpo@ecb.europa.eu .

10. Addressing the European Data Protection Supervisor

If you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data, you have the right to lodge a complaint with the European Data Protection Supervisor at any time.