Privacy Policy

Data Protection Notice for Digital Skills and Jobs Platform (DSJP)

The European Health and Digital Executive Agency (HaDEA) processes your personal data in line with Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of personal data by the European Union's institutions, bodies and agencies and on the free movement of such data. 

Introduction 

This Data Protection Notice concerns the Digital Skills and Jobs Platform (“DSJP”) including the personal data we may collect and process from its visitors and from the registered users of the DSJP community tool. 

The Digital Skills and Jobs Platform, including the DSJP community tool, is developed, maintained and administered by the DSJP2 Contractors (Data Processors) on behalf of HaDEA, the European Health and Digital Executive Agency (Data Controller).

This specific DSJP data protection notice explains the reason and purpose for the processing, the way we collect, handle and ensure protection of all personal data gathered, stored, how that information is used and how you can exercise your rights in relation to your data.

General description of the processing, including the means:

The Digital Skills and Jobs Platform is composed of a publicly available portal area and a closed community area accessible via registration only (DSJP community tool).  The portal area contains information and resources for a variety of stakeholders. 

The DSJP community tool is primarily used to manage, animate, and expand the Digital Skills and Jobs community, facilitating the exchange of knowledge, content, and good practices between different stakeholders and enabling networking and discussions. It also provides a private networking space for the Digital Skills and Jobs National Coalitions. 

The community tool is being continuously improved. Its current functionalities include the below:   

• A member dashboard.  

• A member directory / profile.   

• An organisations directory / profile.  

• A pledging organisations directory.  

• Discussions and content sharing functionalities for events, blogs, news with additional features such as liking, commenting and tagging.  

• An advanced search system.  

• Collaborative groups.  

• Email notifications.  

• Direct messaging.

Based on the data we process, we are able to provide different types of user experiences for DSJP users. To get basic access to the DSJP community tool, all users need to give consent to a minimum set of data processing activities.  

In addition, registered users are given the option to opt-in of various sets of data processing activities to benefit (or not) from a range of smart features and more personalised user experiences including content recommendations. 

Smart features on the Platform: Based on the prior consent of the user, DSJP utilises an Artificial Intelligence (AI) system which enhances user experience by offering personalized recommendations on what content to read next.  These recommendations are generated by analysing textual similarities across content items and by tracking the user’s behavioural patterns on DSJP. The system considers user interactions such as pages visited, time spent on content, and engagement activities. (e.g. Commenting, subscribing) to tailor the suggestions dynamically. This allows users to receive relevant, context-aware recommendations that align with their interests and activities on DSJP. These AI features are designed to bring desired content closer to the user, enhancing their experience and increasing retention on the platform. Here’s how the system achieves this and why it stands out:

• Content Recommendations Engine: Using advanced Natural Language Processing (NLP) techniques, the AI system analyses textual similarities across thousands of content items. This enables the platform to recommend contextually relevant materials based on the content they have already engaged with.

• Personalized Recommendations Engine. The system dynamically tailors suggestions by analysing user interactions, such as: pages visited, time spent engaging with content, or actions taken, such as commenting, subscribing, bookmarking. By learning from these patterns, the AI adapts to evolving user interests over time being able to predict user preferences with high accuracy, generate context-aware recommendations without requiring specific programming for each use case and continuously learn and refine its suggestions based on user behavior and content trends.

• Real-time performance monitoring: through specially designed Key Performance Indicators (KPIs) such as the Accessed Ratio or Reading Time Ratio which reflect the user engagement regarding the served recommendations, the performance of the AI features is constantly monitored.

Registered users have the option to give additional consent and provide their behaviour data (e.g., actions through the platform) as per the below options:  

• give consent only to the basic data processing activities. 

• give consent to receiving recommendations based on platform behaviour tracking. 

• give consent to receiving recommendations based on their answers to the content preferences questions.

What is the purpose(s) of this processing activity?

The purpose for collecting and processing your personal information in the Digital Skills and Jobs Platform is to:

• Administer the Digital Skills and Jobs Platform, in particular the DSJP community tool and to manage various community tool functionalities.  

• Better understand what type of user you are and which needs you may have so that we can recommend to you the most relevant content or services.   

• Enable and improve the user experience within this and similar future projects developed by the European Commission.   

• Establish your membership within the Digital Skills and Jobs community, create your DSJP account, which allows you to participate in the DSJP community. 

• Contact you about a range of online and offline networking, capacity building and communication activities relating to the community and to ensure your participation therein.   

• Provide aggregated statistics related to user activity on the platform, such as number of and geographical spread of registered users, number of each type of activity created (e.g. number of blog articles, number of partnership requests, number of comments etc.), number of users engaged, and time spent by registered users for the purpose of evaluating usage patterns and user preferences/requirements. This will allow us to collect relevant information on performance vs KPIs and in general to the degree of appreciation of the community tool features.   

• Evaluate and support the security and correct operation of the platform, and the lawfulness of its use.

Who is the data controller? 

The data controller of the processing operation is the Head of Unit. B.2 DIGITAL of the European Health and Digital Executive Agency (“HaDEA”), Place Charles Rogier 16, 1210 Saint-Josse-ten-Noode, Belgium.

Contact details: HADEA-DEP-DIGITAL@ec.europa.eu 

The following entities process your personal data on our behalf: 

The consortium (“DSJP2 Contractors”) consisting of:   

• EUN Partnership aisbl (“European Schoolnet”), Rue de Trèves, 61, 3rd floor, 1040 Brussels, Belgium. Consortium coordinator and lead on business analysis, content production and research, reachable at: privacy@eun.org.
• Tremend by Publicis Sapient, Splaiul Unirii, 165, 4th Floor, Building offices TN Office 2, District 3, Bucharest 030134, Romania. Consortium partner and lead on web application development, reachable at ps-cee-data-management@publicissapient.com.
• DIGITALEUROPE aisbl, Rue de la Science 37, 1040 Brussels, Belgium. Consortium partner and lead on community management and communications activities, reachable at DPO@digitaleurope.org.  
• LIKTA, Dzirnavu street 91 – 3, Riga, LV-1011, Latvia. Consortium Partner and contributor to community management and content production activities, reachable at office@likta.lv.
• European DIGITAL SME Alliance aisbl, Rue Marie Thérèse 21, bte. 5, 1000 Brussels, Belgium. Consortium partner and contributor to community management and content production activities, reachable at privacy@digitalsme.eu.
• Public Libraries 2030 aisbl, Rue Maximilien 16, 1050 Brussels, Belgium.  Consortium partner and contributor to community management and content production activities, reachable at ilona@pl2030.eu.

The European Commission services:

• The European Commission’s Directorate-General for Informatics (“DIGIT”) provides the IT hosting service for the platform. reachable at DIGIT-DATA-PROTECTION-COORDINATOR@ec.europa.eu. 

The following entities are sub-processors:

• EU Turn, Rue Charles Legrelle 17, 1040 Etterbeek, Belgium. Sub-contractor for communication and promotion activities, reachable at info@eu-turn.com.  

• Empirica Gesellschaft für Kommunikations- und Technologieforschung, Oxfordstr. 2, 53111 Bonn, Germany. Sub-contractor for business analysis activities, reachable at: info@empirica.com.

Selected contractors/sub-contractors are bound by a specific contractual clause to ensure that confidentiality obligations and data processing operations of your data are aligned with standards and rules imposed by the contracting authority in accordance with Regulation 2018/1725.  

Which personal data is collected?

The following of your personal data are collected when you visit the DSJP website: 

• IP address (only for logged in users and visitors using the content and contact submission form).  

Mandatory fields to be filled by you when contacting the DSJP2 contractors for general enquiries via the contact form: 

• Name,
• Email address

Mandatory fields to be filled by you when suggesting new platform content via the content suggestion form:

• Name,
• Email address  

Mandatory fields to be filled in when you create a DSJP user account:  

• First name and last name of the user (via EU Login), 
• Email address of the user (via EU Login)
• Country (users with editorial/community manager roles only). 

These data become part of your DSJP user account. To create an account, you need to submit personal data via the EU Login authentication service. Personal data entered in EU Login for authentication (first name, last name, and email address) are then automatically transferred to the Digital Skills and Jobs Platform. The EU Login service is subject to its own record (see DPR-EC-03187 Identity & Access Management Service - IAMS) and privacy statement. 

Optional fields that may be added by you in your DSJP user profile:  

• Organisation name,   
• Organisation’s and/or user Bio URL (e.g. linkedin profile, company website),
• City,
• Job title, 
• Profile picture (e.g. user’s photo, company logo, 
• Student and job seeker status, 
• Language preference, 
• Geographical sphere. 

Mandatory fields to be filled in when you create an organisation account:   

• Organisation name, 
• Organisation description, 
• Contact person for the organisation,
• Contact email address for the organisation.  

Optional fields that may be added by you in your organisation account:   

• Contact person for pledges,
• Contact email address for pledges.  

Additionally, you may spontaneously provide other, non-mandatory personal data in free text fields within your profile or in community discussions which aim to contribute to an enhanced community building/networking experience.

Other information may be collected when you choose to join a specific community group. For instance, you may be asked to provide information about your motivation to join and your professional background and experience which are relevant for a particular community. 

Users of the platform can in any case voluntarily contribute with content, some of which may contain personal data: 

• Articles, blogs and news (i.e. author’s name is visible, data in the text itself).   
• Comments. 
• Pictures, text files. 
• Links (e.g. to videos).

As previously indicated, we also collect and analyse data related to user activity on the platform, via tracking usage frequency, search behaviours, preferences and settings. 

For users opting in to the smart features providing more personalised user experiences, we will collect and process additional user behaviour data.

The tracked user behaviour consists of user interactions and parameters linked to a limited number of content types (event, training offer, news, funding opportunity, good practice, research, resources, pledges, learning content, European initiative, National strategies), then used to build a content profile for the user so relevant content can be recommended/suggested to the user. Such interactions and parameters are:

• Like/unlike content and comments.
• Indications about being interested in content.
• Keywords used when searching content.
• Page metadata of visited pages.
• Page reading time.
• Posting of comments.
• Rating of content.
• Subscribe to/unsubscribe from content. 
• Feedback on content recommendations via ‘Not interested’ button.

The user behaviour data collected can be linked to an individual registered user via the User profile (account).

Content preferences questions in My User profile allow users to express preferences in their user profile through controlled vocabularies regarding the type of content they are interested in (such as country, geographical sphere of content, technology interest, skill level interest, training opportunities interest or funding opportunities interest).

Cookies 

Europa Analytics is used as general web analytics service to evaluate the effectiveness and efficiency of the platform. The service uses cookies to function. When opening a page where Europa Analytics is enabled, the browsing experience is registered by the service. Simultaneously a dedicated banner may appear, asking the visitor to accept or refuse cookies. If cookies are refused, the Europa Analytics service will also stop registering the browsing experience. More information on Europa Analytics.

DIGIT provides the IT hosting service for the platform; therefore, the use of cookies on this platform is also subject to the following notice: Cookies and similar technologies - European Commission.

Please note that HaDEA, as Data Controller, does not request that participants to the DSJP include (i) special categories of data under Article 10(1) of Regulation 2018/1725 (that is “personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation”) or (ii) personal data related to criminal convictions and offences as provided for in Article 11 of Regulation 2018/1725, related to themselves or to third persons in their contributions to the Digital Skills and Jobs Platform. Any inclusion of special categories of personal data voluntarily provided by the registered users and/or visitors in free text fields in contact form or content suggestion form, as well as in voluntary contributions through articles, comments, as explained in this section is the responsibility of the user. HaDEA will disregard any such personal data. Such personal data can be deleted by the data subject either directly or upon the data subject’s request.

Who has access to the personal data of data subjects and to whom can they be disclosed?

The recipients of your personal data will be the relevant European Commission and HADEA staff that deal with the management of this file, as well as the authorised staff members of the abovementioned data processors and sub-processors.

Within HaDEA: 

• Authorised staff, in particular HaDEA Unit. B2 staff in charge of the DSJP2 project. 

Outside HaDEA: 

• DSJP2 Contractors (website administrators and authorised staff involved in the processing operation.

• European Commission staff (DIGIT) in charge of IT hosting service for the platform.

• European Commission staff (DG CNECT) Unit G.2 as collaborator on the implementation of the project. 

• On a need-to-know basis and in line with the data minimization principle a subset of your personal data can be provided to identified subcontractors (EU Turn and Empirica).

Apart from data collected and processed to administer the DSJP community tool, a wider range of editorial processes and mechanisms have been put in place on the platform to give visibility to the full range of relevant content authorship to give these users/content creators a more active role in the platform’s content management cycle. 

Content and text (e.g. articles) published through the DSJP community tool may appear on the public side (website) of the platform. Content and text published on the platform may also appear on the National Coalition websites connected to this platform, as they may republish this content in their national official languages. Equally, content and text published on the National Coalition websites may be republished on the platform.

As a registered user, information you provide may be accessible to other platform users in the following ways:   

• DSJP user account data: mandatory information (i.e. first name, last name, email, country) will be visible within the DSJP community only to other registered users.

• DSJP user profiles data: optional information you may have filled in (e.g. bio, job title, profile picture, city, etc.), except your student or job seeker status, will be visible within the DSJP community to other registered users.  

• Organisation account data:

  • mandatory information (e.g. contact person for the organisation, etc.) will be published on the DSJP platform and available to all visitors.

  • optional information you may have filled in (i.e. contact name and email for pledges) will be published on the DSJP platform and available to all visitors. 

• If you post content including blogs, articles or news items your first and last name as ‘author’ will be visible to the groups having access to the content.  

• Content you contribute to: 

  • within public community groups is accessible by all other users (registered or not registered).

  • within private community groups is accessible by other registered users who have been given access to this private group by the platform administrators.

  • within the open discussion space will be accessible by all platform visitors, including those who have not registered. To participate and comment in the open discussion space you have to log in as a user.

Comments you submit in response to public articles will be accessible to all visitors. You can configure the privacy settings of your account in your DSJP Dashboard.

On a need-to-know basis and in compliance with the relevant current legislation, bodies charged with monitoring or inspection tasks in application of EU law (e.g. EC internal audit, Court of Auditors, European Anti-fraud Office (OLAF), the European Ombudsman, the European Data Protection Supervisor, the European Public Prosecutor).

Your personal data shall not be transferred to third countries or international organisations. Any transfer of personal data under the contract to third countries or international organisations shall fully comply with the requirements laid down in Chapter V of Regulation (EU) 2018/1725. Subset of personal data (e.g. your first and last name as ‘author’ of platform content on the public area or in discussion forums) may be accessible to other registered users located abroad (through private community groups) or other visitors located abroad (through public community groups, open discussion space or comments the visitors submit in response to public articles). 

Subject to your prior consent, the processing of your data will encompass evaluation and profiling, with a specific focus on your preferences and interests, facilitated by the platform's smart features [user’s behaviour tracking] to deliver personalized, content-aware recommendations, as detailed in the section entitled ‘General description of the processing, including the means.’ This processing will not generate decisions that produce legal effects concerning you or that similarly significantly affect you as a data subject. 

Which is the legal basis for processing your personal data?

The legal basis for the processing activities is Article 5(1)(d) of Regulation EU 2018/1725 based on your explicit consent for your personal data indicated above.

How to withdraw your consent and the consequences of doing this

If you want to withdraw your consent to the processing of your data or you want us to delete your personal data, please contact us and we will do it maximum within one month after your request. Furthermore, please note that every piece of content (discussion posts, user comments, etc.) is moderated by the staff of the DSJP-2 contractors. If for any reasons you wish to delete a publication authored by you, please contact us and we will remove the content as soon as possible and no later than a month after your request.

Please note that withdrawing your consent does not affect the lawfulness of any processing based on your consent before this consent is withdrawn. Attention is drawn to the consequences of a delete request, which means that all your contact details will be lost.

How long do we keep your personal data?

Your personal data will be kept for a maximum period of 5 years after your last interaction with the platform. Then your personal data will be deleted, unless you renew your interest in being a registered user of the platform. Your name as ‘author’ of content such as articles will be replaced by the wording anonymous. Your personal data will be deleted from the platform before the end of the 5-year retention period upon your explicit request. 

How do we protect your personal data?

All data in electronic format (e-mails, documents, uploaded sets of data, etc.) are stored either on the servers of the European Commission, HaDEA (Data Controller) or the DSJP contractors (Data Processors) as specified in this notice. Personal data is not stored in servers outside the EU.

In order to protect your personal data, European institutions and its bodies and the DSJP2 contractors and subcontractors processing data on behalf of HaDEA have put in place a number of technical and organisational measures. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.

Subcontractors (sub-processors) working on behalf of and under contractual agreements with DSJP2 Contractors are granted access to personal data collected through platform activities on a 'need to know' basis, enabling them to fulfil their contractual obligations and responsibilities. The contracts with these subcontractors include specific clauses to ensure that data processing operations are conducted, and confidentiality requirements are met, in accordance with the provisions of the framework service contract signed between HADEA (Data Controller) and the DSJP2 contractors (Data Processors).

Procurement award procedures between the EU Institutions, its bodies and the Contractors (Data Processors) - incorporate personal data protection clauses pursuant to Regulation 2018/172.

What are your rights regarding your personal data?

You have a number of rights as articulated in Regulation 2018/1725, such as:    

Article 17 - Right of access by the data subject.   

Article 18 - Right to rectification.   

Article 19 - Right to erasure (right to be forgotten).   

Article 20 - Right to restriction of processing.    

Article 21 - Notification obligation regarding rectification or erasure of personal data or restriction of processing.   

Article 22 - Right to data portability.   

Article 23 - Right to object.   

Article 24 - Rights related to automated individual decision making, including profiling.   

As a registered user, you can modify your personal data in the DSJP user profile section of your DSJP Dashboard. You can also modify or delete your posted content. You may also ask the platform team to remove your profile and accompanying personal data by contacting them at Contact | Digital Skills and Jobs Platform. If you do as such, your created content on the platform will be anonymised. As a registered user, you can also withdraw your consent at any time of previously opted-in advanced user experiences and smart features requiring the provision of additional user data by unticking the relevant boxes in your DSJP user profile.

Your request to exercise one of the above rights will be dealt with without undue delay and within one month.

If you have any queries concerning the processing of your personal data or wish to exercise any of the rights described above, you contact the DSJP2 Contractors at Contact | Digital Skills and Jobs Platform or via info@digitalskillsjobs.eu. Your query will be transferred to the Data Controller if applicable. You can also contact the Data Controller directly.

The HaDEA Data Protection Officer is at your disposal for any clarification you might need on your rights under Regulation (EU) 2018/1725 at the following e-mail address: HADEA-DATA-PROTECTION@ec.europa.eu.

You shall have right of recourse at any time to the European Data Protection Supervisor at EDPS@edps.europa.eu.