Privacy statement

Articles 15 and 16 of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 apply to the processing of personal data carried out by the European Parliament[1].

  1. Who processes your personal data?
      • The European Parliament acts as the data controller[2] for the processing of personal data described in this statement and the entity responsible for processing this data is the Civil Society Outreach Unit of the Directorate-General for Communication of the European Parliament, represented by the head of unit.
      • You can contact the controller/entity at luxaward@ep.europa.eu.

 

  1. What is the purpose of processing your personal data?

We will process your personal data to:

      • count the votes and select the winner, who will either attend the LUX Audience Award ceremony or the European Film Awards;
      • send you information about the 2023 edition of the LUX Audience Award;
      • send you information about the 2024 European elections;
      • statistically evaluate the popularity of each film in each country.

 

  1. What is the legal basis for the processing of this data?
      • The Bureau’s decisions of 3 April 2006 (PE 371.152/BUR) and of 23 October 2019 (D (2019)35479).
      • Article 5(1)(d) of Regulation (EU) 2018/1725, which stipulates that the data subject must ‘give consent to the processing of his or her personal data for one or more specific purposes’.

 

  1. What personal data are processed?

Required

        • We collect your first name, surname, vote and email address.

Optional

        • Data regarding the country of the vote, including additional information regarding the place where you saw the film (cinema, screening organised by the European Parliament, video on demand, etc.), will by anonymised and stored for statistical purposes.

 

  1. How will your personal data be processed?

Access to your personal data is provided to authorised European Parliament staff members responsible for carrying out this processing operation in line with the ‘need to know’ principle. These employees abide by statutory, and when required, additional confidentiality agreements.

 

  1. For how long will your personal data be stored?

The retention period depends on the consent you give.

First type of consent (voting):

  • Your name, surname, vote and your email address will be erased in August 2022.

Second type of consent:

  • If you agree to receive information about the 2023 edition of the LUX Audience Award, only your email address will be kept after August 2022. It will be erased by January 2023, following the announcement of the nominated films.

Third type of consent:

  • If you agree to receive information about the next European elections, only your email address will be kept after August 2022. It will be erased in June 2024.

 

  1. Who are the recipients of your personal data?
  • The European Parliament does not transmit any data to third parties other than the aforementioned recipients. It does not share personal data with third parties for direct marketing purposes.
  • Only if requested by law or in the event of an audit or judicial procedure could your data be transferred to the competent authorities (the European Court of Auditors, the Court of Justice of the European Union, the European Data Protection Supervisor or the European Anti-Fraud Office).

 

  1. Will your personal data be shared with a non-EU country or international organisation?
      • No, your personal data will not be shared with or transferred to a non-EU country or any international organisation.

 

  1. Are any automated processes[3] and/or profiling[4] used to make decisions which could affect you?
      • No automated processes or profiling are used for this project.

 

  1. If personal data have not been provided by you, what is their source?
  • No external data sources are used for this project.

 

  1. What rights do you have?

You have specific rights as a ‘data subject’ under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725. As regards this processing operation, you can exercise the following rights:

  • the right to access your personal data;
  • the right to rectify your personal data if it is inaccurate or incomplete;
  • the right to erase your personal data;
  • where applicable, the right to restrict the processing of your personal data;
  • the right to data portability;
  • the right to object to the processing of your personal data lawfully carried out pursuant to Article 5(1)(a);
  • if you have given consent for the processing operation in question, the right to withdraw it at any time by notifying the data controller, without affecting the lawfulness of processing based on consent before its withdrawal.

Data subjects who wish to exercise their rights under Regulation (EU) 2018/1725 can send an email to luxaward@ep.europa.eu.

 

  1. Who should you contact if you have a query or complaint?

Your first point of contact is luxaward@ep.europa.eu.

You may contact, at any time, the European Parliament’s data protection officer (Data-Protection@europarl.europa.eu) if you have any concerns or complaints about the processing of your personal data.

The European Parliament’s data protection officer ensures the internal application of Regulation (EU) 2018/1725. The address of the data protection officer is as follows:

 

Data Protection Officer

European Parliament

2, rue Alcide De Gasperi

L-1615 Luxembourg

 

You have the right to lodge a complaint with the European Data Protection Supervisor (edps@edps.europa.eu) at any time concerning the processing of your personal data.

The European Data Protection Supervisor acts as an independent supervisory authority and ensures that all EU institutions and bodies respect people’s right to privacy when processing their personal data.

[1] Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

[2] A controller is defined as the public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data. The controller is represented by the head of the entity responsible for processing such data.

[3] Automated processes involve making a decision solely by automated means and without any human involvement. Hypothetical examples: (1) selecting certain options on a web page will automatically place you on various mailing lists so that you are sent the corresponding monthly newsletter; (2) using an automated system to mark multiple choice test answers and assign a pass mark according to the number of correct answers.

[4] Profiling analyses aspects of an individual’s personality, behaviour, interests and habits to make predictions or decisions about them. Profiling is typically used to analyse or predict aspects concerning the data subject’s performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, etc. Hypothetical example: when using social media tools, data is collected and your trends registered. This data is then used to form new and/or a number of different predictions about you.

Consent form