Privacy statement regarding protection of personal data in relation to the online contact form available on

All personal data are dealt with in compliance with Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (Regulation (EC) 45/2001).

The following data protection information notice outlines the criteria by which the data is collected, managed and used in relation to the online contact form on GSA’s website

Identity of the controller:
Controller: Head of Communications Department.

Purpose of processing:
The purpose of the processing is the provision of a response to the queries submitted by web users.

Data concerned:
Name, surname, email address.

Legal basis:
Data subject’s consent.

Recipients of the data processed:

    The access to the personal data is granted on the basis of the ‘need to know’ principle to a limited number of:
  • duly appointed GSA staff;
  • staff of GSA contractor in charge of communication services.

Any recipient shall be reminded of its obligation not to use the data received for other purposes than the one for which they were transmitted.

Lawfulness of processing:
The lawfulness of the processing is based on Article 5(d) of Regulation (EC) No 45/2001. Data subjects unambiguously give their consent by submitting the online contact form.

    Information on the retention period of personal data:
  • Personal data are kept as long as follow-up actions to the email are necessary with regard to the purpose of the processing of personal data but no longer than three months from the date of submission of the email.
  • Personal data are stored in the servers of GSA’s contractor, and managed by another GSA’s contractor, both abiding the necessary security provisions.
    The data subject’s rights:
  • Data subjects have the right of access and rectification of their personal data at any time. Requests shall be addressed to the Head of Communications at
  • Data subjects have the right to withdraw the consent to the treatment of their personal data at any time.
  • Data subjects are entitled to lodge an appeal at any time with the European Data Protection Supervisor (EDPS) at should they consider that the processing operations do not comply with Regulation (EC) No 45/2001.
    Contact information:
  • Regarding the processing of your personal data:
  • Regarding the interpretation, application or breach of Regulation (EC) 45/2001: GSA Data Protection Officer (DPO) at