Privacy statement regarding protection of personal data in relation to the online contact form available on

All personal data are dealt with in compliance with the applicable rules on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (currently Regulation (EU) No 2018/1725).

The following data protection information notice outlines the criteria by which the data is collected, managed and used in relation to the online contact form on GSA’s website

Identity of the Data Controller and Data Protection Officer:
Controller: European Global Navigation Satellite Systems Agency (GSA), Head of the Communications Department;

DPO: European Global Navigation Satellite Systems Agency (GSA), Data Protection Officer; 

Purpose of processing:

The purpose of the processing is the provision of a response to the queries submitted by web users.

Data/Categories of data concerned:
Name, surname, email address, reason for contacting the GSA and message to the GSA (free-text box)

Recipients/Categories of recipients of the data processed:

The access to the personal data is granted on the basis of the ‘need to know’ principle to:

  • a limited number of GSA staff managing the website’s contact form;
  • data processors: GSA engages the following external contractors which are bound by personal data protection rules equal to those applying to the GSA:
    1. a limited number of staff of the GSA contractors in charge of communication services.
    2. a limited number of staff of the GSA contractors in charge of the provision of hosting services for the GSA’s servers.

Any recipient shall be reminded of its obligation not to use the data received for other purposes than the one for which they were transmitted.

Legal basis/Lawfulness of processing:
Processing is based on the consent of the data subject (Art. 5(1)(d) of Regulation 2018/1725): data subjects unambiguously give their consent to the processing of their personal data by filling in and submitting the consent form, which is a mandatory step in order to submit the online contact form.

Information on the retention period of personal data:

  • Personal data is kept as long as follow-up actions to the email are necessary but no longer than three months from the date of submission of the email.
  • Personal data is stored electronically on the servers of GSA contractors mentioned above, which are located in the EU and abiding by the necessary security provisions.

The data subject’s rights:

Data subjects have the right:

  • to obtain confirmation as to whether or not his or her personal data is being processed, access the data and obtain detailed information on the processing;
  • of rectification of inaccurate personal data;
  • of erasure of personal data if the statutory provisions are met;
  • of restriction of processing if the statutory provisions are met;
  • to data portability;
  • to withdraw the consent to personal data processing at any time without affecting the lawfulness of the processing before the consent’s withdrawal;
  • to lodge a complaint to the European Data Protection Supervisor at should they consider that the processing operations do not comply with Regulation (EU) No 2018/1725.

Any request for the exercise of any of the abovementioned rights shall be addressed to the GSA Communications Department at; data subjects are kindly requested to describe their requests explicitly.

Contact information:

  • Regarding the processing of your personal data:
  • Regarding the interpretation, application or breach of Regulation (EU) 2018/1725: GSA Data Protection Officer (DPO) at