Skip to main content
Header


Data Protection Notice for the NATIONAL MENTAL HEALTH TRAININIG PROGRAMME

 

Related to Task I.3 - Design of a European mental health multidisciplinary training programme to promote a comprehensive, prevention-oriented approach to mental health in the framework of the project “Capacity – building on mental health: multidisciplinary training programme and exchange programme for health professionals”

HADEA/OP/2023/0020 (EU-PROMENS Project)


Introduction

This Data Protection Notice describes the measures taken to protect your personal data with regard to the action involving the present data processing operation and what rights you have as a data subject. The European Health and Digital Executive Agency (HaDEA or Agency) protects the fundamental rights and freedoms of natural persons and in particular your right to privacy and the protection of your personal data. Your personal data1 are processed in accordance with Regulation (EU) No 2018/172522 on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.

 

1Personal data shall mean any information relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

2Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L295/39 of 21.11.2018). of participants and speakers;

What are the purposes of this processing activity?

The purpose is to organise onsite, online and hybrid training sessions on mental health for health and other professionals working in community settings and to inform participants and speakers about the processing activities related to their personal data.

Piloting will take place in six countries from May 2025 until September 2025, then the rollout phase to 24 European countries will be implemented in 2025 and 2026.

The processing activity covers:

  • Registration of participants to the training programme in the country where the training takes place and inclusion in participant lists to foster collaboration and networking during and after the training;
  • Registration of speakers to the training programme in the country where the training takes place and inclusion in speaker list;
  • Sending invitations and programme;
  • Administrative and financial management of travel, accommodation and reimbursement
  • Taking photos and videos of participants, speakers and members of the institutions using them for reporting to HADEA, as well as on websites of GFA and the hosting organisation and on Facebook;
  • Collection of anonymised post-event feedback via the GDPR compliant Lime Survey feedback form;
  • Collection of event statistics: No personal data will be collected. All statistics and reports never single out the answers of a single person or country. Statistics and reports contain solely general remarks from training and group-work.


Who is the Data Controller? 

The data controller is the Head of Unit A2, EU4Health/SMP Food at the European Health and Digital Executive Agency (HaDEA), managing the EU Contract No. HADEA/OP/2023/0020. 


Who is the Data Processor? 

The following entity processes your personal data on HaDEA’s behalf: 

GFA Consulting Group GmbH – Health Department 
Eulenkrugstraße 82, 22359 Hamburg - Germany (Hereinafter referred to as “Data Processor”). 


The Data Processor will: 

  • Collect the following personal data (see below) to organise and conduct the exchange visits in the hosting centres; 
  • Collect anonymised post-event feedback via Lime Survey. 

In addition, the following entities process your personal data as a subcontractor on GFA’s behalf:

  • The event management provider IDLOOM, which processes personal data of participants and speakers such as name, address, email address, account details and the place and date of birth on a registration platform.
  • The travel agency responsible for organising travel bookings.
  • For web surveys, GFA is using the online survey tool LimeSurvey.

 


Which personal data is collected? 

 

Personal data is collected in a two-step process:

• During the first step (registration of interest to participate in the training) the following personal data is collected: your first name, last name, age, gender, nationality, country of residence, e-mail address, mobile number, affiliation with a hosting organisation, professional profile, years of experience, motivation to participate in the training programme. All personal data are mandatory for the purpose outlined above.

• During a second step for the final selection of participants, the following additional personal data is collected for onsite and hybrid trainings: Dietary requirements, special needs (impairments/disabilities of participants; emergency contact and bank details for reimbursement of costs.


Moreover, the following non-mandatory personal data might be collected: 

It is also possible that photographs of you will be taken during the event and might be used for related communication purposes, i.e. for a report to be shared with HaDEA and DG SANTE, as well as on social media platforms (LinkedIn, Facebook, Instagram, project Website and Websites of Mental health Institutions). Upon registration, you can give your explicit consent to have your photo published on related communication channels. In the absence of your consent, the organiser will try to find suitable alternatives, so that you can fully take part in the event, e.g. by offering an alternative room to follow the event. Your photo will only be processed based on your explicit prior consent. 


Who has access to the personal data of data subjects and to whom can they be disclosed? 

Personal data mentioned above will be disclosed to the team members of GFA involved in the organisation of the training, to the team members of the local organisation hosting the training and to the event management provider IDLOOM.

The registration to the training is organised via the website and using IDLOOM event management software.

Your personal data will not be transferred to third countries or international organisations. GFA’s partner organisations Trimbos (Netherlands Institute of Mental Health and Addiction) and Mental Health Europe (MHE) will not receive your personal data. The processing of personal data will not include automated decision-making (such as profiling).


Which is the legal basis for processing your personal data? 

The legal basis for the processing activities are: 

  • Article 5(1)(a) of Regulation (EU) 2018/1725 because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body laid down in Union law. 
  • Article 5(1)(d) of Regulation (EU) 2018/1725 based on your explicit prior consent for your non-mandatory personal data. 


How do we protect and safeguard your personal data?

The collected personal data and all information related to the above-mentioned project are stored on the internal server computer of the Data Processor in Germany, which guarantees the security and confidentiality of the collected information. Received contributions will also be recorded in a secured and protected database hosted by the Data Processor. 


How to withdraw your consent and the consequences of doing this? 

If you want us to delete your photo from our website (the only data based on consent) - please write to datenschutz@gfa-group.de and we will delete it within 20 working days after your request. As to photos taken be the organising institution during the training you can contact the organiser directly or GFA will forward your request to him. Please note that withdrawing your consent does not affect the lawfulness of any processing based on your consent before this consent is withdrawn. Attention is drawn to the consequences of a delete request, which means that all your contact details will be lost.

How long do we keep your personal data? 

As part of the training programme database, your data will be kept by GFA until the end of the EU- Promens Project, scheduled on 31 December 2026. Data will be deleted within a maximum period of one (1) year following this period. Subcontractors of GFA (travel agencies and service provider) will process your personal data in accordance with national statutory retention requirements.

What are your rights regarding your personal data? 

You have the right to access your personal data and to request your personal data to be rectified, if the data is inaccurate or incomplete; where applicable, you have the right to request restriction or to object to processing, to request a copy or erasure of your personal data held by the data 
controller. If processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on your consent before its withdrawal. 
Your request to exercise one of the above rights will be dealt with without undue delay and within one month. 


If you have any queries concerning the processing of your personal data or wish to exercise any of the rights described above, you can contact HaDEA HoU (acting as data controller) via: 
HADEA-A2-DATA-PROTECTION@ec.europa.eu, with the contractor’s contact point for Data Protection in cc at: susanne.eggers@gfa-group.de. 

Please specify in your request what your query is and/or which right you wish to exercise. 

You shall have right of recourse at any time to the European Data Protection Supervisor at EDPS@edps.europa.eu. 
 

Version March, 2025