- PRIVACY STATEMENT
Privacy statement for the external portal hosting the public online survey on future euro banknote designs
This privacy statement contains information on which data are collected and tracked whenever someone uses the external portal hosting the public online survey on future euro banknote designs.
What is our legal framework?
All personal data are processed in accordance with European Union data protection law, that is to say in line with Regulation (EU) 2018/1725 (the EUDPR).
Why do we process personal data?
The survey is run on the ECB’s behalf by 7 Points Ltd. (the processor within the meaning of Article 29 of the EUDPR), using Cloudflare’s content delivery network.
Some data processed via the platform – such as session/device identifiers set by cookies, which are required to ensure the functionality of the survey – may constitute personal data. Responses on sociodemographic aspects (age range, gender, country, education, knowledge of the redesign process) are collected with a respondent’s consent in such a way that the ECB cannot single out individuals. The ECB does not use this data to identify participants.
What is the legal basis for processing your data?
Your personal data are processed by the ECB:
- in the performance of a task carried out in the public interest, based on Article 5(1)(a) of the EUDPR;
- because you consented to this processing by providing the personal data requested. You may withdraw your consent at any time via the below-mentioned contact point. All processing of your personal information will stop once you withdraw your consent; however, any processing that has already taken place remains lawful.
Who is responsible for processing your data?
The ECB is the controller for the processing of your personal data. The Banknotes Service Section of the Directorate Banknotes is responsible for this processing. A limited number of ECB personnel in the Directorate General Communications who are involved in analysing the data may also process some of your personal data in line with their respective tasks.
Who will be the recipients of your data?
The recipients of your personal data (including entities who have access to that personal data) are:
- ECB personnel in the ECB’s Directorate Banknotes responsible for running the public online survey;
- designated ECB personnel in the ECB’s Directorate Banknotes and Directorate General Communications, to analyse the collected responses;
- a limited number of personnel in the ECB’s Directorate Information Systems, to provide technical support;
- designated 7 Points Ltd. personnel, to provide access to the collected data and technical support in running the public online survey;
- external experts and contractors working on behalf of the ECB for the purpose of analysing the collected data and reporting on aggregated findings.
What categories of data are collected?
The ECB processes the following personal data:
- gender;
- age range;
- country of residence;
- highest level of completed education;
- timestamps of when the survey was taken and when a respondent progressed to the next page of the survey or concluded it;
- the country from which the survey was accessed.
Your gender, age range, country of residence and highest level of completed education are obtained through self-declaration as part of the survey questionnaire. The other data are collected by 7 Points Ltd. and Cloudflare using technical means.
Essential and functional cookies are used to allow the use of the Public Online Survey, for the purposes outlined below:
Cookie name | Purpose | Expiration | Provider | Type | |
_SLsid_app | Maintains the respondent’s session while completing the survey (links page-to-page navigation). | 14 days | SurveyLab | Strictly necessary | |
CSLSM<survey-id> | Stores the response key so that a partially completed survey can be resumed and prevents repeated participation by a single user. | 12 months | SurveyLab | Functional | |
CSLSM<survey-id>sampling | Makes a record when a respondent is excluded by survey sampling. | 24 hours | SurveyLab | Functional | |
cf_bm | Cloudflare bot management distinguishes humans from automated traffic. | 30 minutes | Cloudflare | Strictly necessary | |
_cfuvid | Cloudflare – supports per-visitor rate-limiting rules. | Session | Cloudflare | Strictly necessary | |
cf_clearance | Cloudflare – stores the result of a security/challenge check. | Up to 1 year | Cloudflare | Strictly necessary | |
Users can remove any of these cookies themselves by accessing the browser settings of their respective device(s).
Will your personal data (in a clear or encrypted form) be processed (e.g. transferred, accessed or stored) in third countries or by international organisations?
The ECB does not foresee any transfer of your personal data to third countries or international organisations. However, your personal data might exceptionally be processed in third countries/international organisations based on the derogations for specific situations set out in Article 50(1) of the EUDPR.
How long will the ECB keep personal data?
Your personal data will be stored for a maximum of ten years following the completion of the public online survey before being deleted. For technical reasons, 7 Points Ltd. retains personal data for up to two years before they are deleted.
What are your rights?
You have the right to access your personal data and correct any data that is inaccurate or incomplete. You also have (with some limitations) the right to delete your personal data and to object to or to restrict the processing of your personal data in line with the EUDPR. The ECB may restrict your rights to safeguard the interests and objectives referred to in Article 25(1) of the EUDPR.
Who can you contact for queries or requests?
You can exercise your rights by contacting the ECB contact persons(s) for the public online survey (neweurobanknotes@ecb.europa.eu). You can also directly contact the ECB’s Data Protection Officer at dpo@ecb.europa.eu for all queries relating to your personal data.
Addressing the European Data Protection Supervisor
If you consider that your rights under the EUDPR have been infringed as a result of the processing of your personal data, you have the right to lodge a complaint with the European Data Protection Supervisor at any time.