Protection of your personal data
Processing operation: Processing of personal data in the context of the EU Children’s Participation Platform (the Platform)
Data Controller: European Commission, Directorate-General for Justice and Consumers (DG JUST), Unit JUST.C.2
Record reference: DPR-EC-16688.1
For young participants
- We keep your name and contact details safe.
- We ask your permission (and your parents’) before taking photos/videos.
- You can say NO to being in pictures or surveys.
- Your data is deleted when we don’t need it anymore.
- If you’re worried or have questions, tell a trusted adult or email: cppsafeguarding@icf.com
Table of contents
The European Commission is committed to protecting your personal data and respecting your privacy. The Commission collects and further processes personal data pursuant to Regulation (EU) 2018/1725 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.
This privacy statement explains the reason for processing your personal data in the context of the EU Children’s Participation Platform (the Platform). It describes how we collect, handle and protect all personal data provided, how that information is used, and what rights you have in relation to your personal data. It also specifies the contact details of the responsible Data Controller, the Data Protection Officer, and the European Data Protection Supervisor.
The EU Children’s Participation Platform was established as a key deliverable of the EU Strategy on the Rights of the Child (COM(2021) 142 final), reflecting the EU’s obligation to promote and protect children’s rights under Article 3(3) of the Treaty on European Union (TEU) and Article 24 of the EU Charter of Fundamental Rights. The Platform connects child participation mechanisms at local, national, and EU levels and involves children in EU-level decision-making processes.
Purpose of the processing operation:
The European Commission collects and further processes your personal data to:
- Register children and representatives of organisations as members of the EU Children’s Participation Platform (the Platform)
- Organise Platform activities, including online and in-person meetings, consultations (online surveys, interviews, focus groups), and communication activities (video recording, photo taking, document review) for which special privacy statements will be issued with detail description of processing operation;
- Manage communication between the Platform Secretariat and member organisations;
- Ensure the safety and protection of child participants through the Platform’s safeguarding framework;
- Publish information on the Platform’s public website, including news items, reports, photos, and videos of activities;
- Report on the outcomes and achievements of the Platform’s activities;
- Research and analyse the Platform’s impact on policy-making.
Your personal data will not be used for any automated decision-making, including profiling.
Images of children (photos and videos) may be taken during Platform activities and published on the Platform’s website (eu-for-children.europa.eu), other Commission websites, the EU Learning Corner, the Newsletter on the Rights of the Child, and on official social media accounts of the European Commission, partner, and member organisations (LinkedIn, Instagram, Facebook). Written consent of children and their legal carers for taking the photos and videos and such publications is collected beforehand.
For safeguarding purposes, Child Protection Officers are responsible for risk assessment, supervision of activities, and incident reporting. They share their contact details with adult participants and create a WhatsApp group for accompanying adults. A safeguarding email address (cppsafeguarding@icf.com) and a direct phone number are also provided during events.
Processing in the public interest (Article 5(1)(a) of Regulation (EU) 2018/1725)
The processing of personal data linked to the organisation, management, follow-up, and promotion of the Platform’s activities is necessary for the performance of a task carried out in the public interest, as mandated by the Treaties. The specific legal basis is:
- Article 3(3) of the Treaty on European Union (TEU), which establishes the objective for the EU to promote the protection of the rights of the child;
- Article 24 of the EU Charter of Fundamental Rights;
- EU Strategy on the Rights of the Child (COM(2021) 142 final).
Processing based on consent (Article 5(1)(d) of Regulation (EU) 2018/1725)
Your explicit consent is required for the following:
- The use of your image (photos and/or videos) in communication and publication activities of the Platform;
- The processing of specific personal data (such as dietary requirements or health information) for the purpose of organising in-person events;
- The sharing of contact details with other Platform members or partner organisations;
- The processing of your personal data for future event invitations or newsletter subscriptions.
In cases where the data subject is a child below the age of 13 years, consent shall only be lawful if given by the holder of parental responsibility over the child, in accordance with Article 8(1) of Regulation (EU) 2018/1725.
Separate consent forms are used for children and their parents or legal guardians. Consent is obtained either electronically (embedded in registration forms) or on paper at events. It is not possible to complete registration without providing explicit consent where required.
You may withdraw your consent at any time by contacting the Data Controller at EU-CHILDPARTICIPATION@ec.europa.eu. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.
Depending on your role in relation to the Platform, the following categories of personal data may be collected and processed:
Registration for Platform membership
- Identity and contact data of the adult submitting the application on behalf of a child:
- Function/title, first name, last name, name of organisation, city, country of residence, email address, telephone number;
- Function/title, first name, last name, name of organisation, city, country of residence, email address, telephone number;
- Identity and contact data of the child (provided by the trusted adult):
- Title, first name, last name, city, country of residence, contact email address, telephone number of the person holding legal responsibility and the accompanying adult;
- Title, first name, last name, city, country of residence, contact email address, telephone number of the person holding legal responsibility and the accompanying adult;
- Contact details of the safeguarding officer or person responsible for safeguarding within the applicant organisation:
- Function/title, first name, last name, name of organisation, city, country of residence, email address, telephone number.
Communication and content management
- Email address, name, and organisation of the point of contact person and content moderators for the Member Workspace website (using EU Login), to manage access and communication within the system;
- Contact details used for mailing lists and event-related communications (adults only).
- Participation in online meetings of the Communication co-creation team
- For adults: Email address, first and last name and organisation for coordinating with the children and to accompany them in the meetings
- For children: First and last name, age and organisation for team membership, plus first name and photo for profiles published on the public website (following written consent)
Public website and communication activities
- For adults: Information on professional and academic experience may be published;
- For children: First names, countries of residence, and/or ages may be published in the context of Platform activities, news items, and reports.
- Photos and videos of participants taken at events, published following written consent.
Safeguarding reports
- Contact details of children who submit a safety report via the online form:
- First and/or last name, country of residence, email address, telephone number. This information is received directly by the Platform’s safeguarding officers (cppsafeguarding@icf.com), used only for follow-up purposes, and deleted within one year.
Note on criminal records: Contractors are contractuallyrequired to verify criminal records of all employees, subcontracted staff, volunteers, and trainees who will be in contact with children as part of Platform activities. The Commission does not collect or have access to this information. Member organisations are also required to carry out their own checks in accordance with their safeguarding policies and applicable national law.
The Data Controller only keeps your personal data for the time necessary to fulfil the purpose of collection or further processing. The following retention periods apply:
| Category of data | Retention period | Start date |
| Identity and contact data of adults | 10 years | Date of registration |
| Identity and contact data of children | 2 years | Date of registration |
| Dietary and health data (events) | No later than 1 month after the event | End of event |
| Safeguarding reports submitted by children | 1 year | Date of submission |
| Member Workspace access data (point of contact) | Duration of role: deleted upon account closure | Account activation |
| Audio-visual recordings of in-person or online events | 3 months after the event | Date of recording |
| Audio-visual materials (audio, video, images) used for publishing purposes (print, digital) | Duration of the publication | Date of publishing |
| Audio-visual materials removed from publication | 3 months after removal | Date of removal from publication |
After the administrative retention period has elapsed, files (and personal data contained therein) may be transferred to the Historical Archives of the European Commission for historical purposes, in accordance with the Commission-level retention list (SEC(2025)600) and the Record of Processing DPR-EC-00837.
All personal data in electronic format are stored on the servers of the European Commission or those of its contractors. All storage locations are within the EU.
All processing operations are carried out pursuant to Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission.
Technical and organisational measures include:
- Appropriate actions to address online security, protect server hardware, software, and the network against accidental or malicious manipulation and risk of data loss, alteration, or unauthorised access.
- Access to personal data is restricted to authorised personnel with a legitimate need to know.
The Platform also has its own child safeguarding framework, overseen by two Child Protection Officers. The framework includes:
- An anti-harassment and anti-bullying protocol,
- A code of behaviour,
- Incident reporting procedures,
- A parental guide on child safety,
- Risk assessment templates conducted before every meeting.
The full safeguarding framework is available at: eu-for-children.europa.eu/about/safeguarding.
Contractors engaged by the Commission are bound by specific contractual clauses for any processing operations of personal data on behalf of the Commission, and by confidentiality obligations under Regulation (EU) 2016/679 (GDPR).
Access to your personal data is provided to Commission staff responsible for carrying out this processing operation (JUST.C.2 unit) and to other authorised Commission staff according to the “need to know” principle. All such staff abide by statutory and, where required, additional confidentiality agreements.
The following processors may also have access to your personal data, strictly for purposes related to the organisation and management of the Platform:
- ICF SA (Avenue Marnix 17, 1000 Brussels, Belgium) – Platform Secretariat contractor;
- Cecoforma SA (Rue de la Loi 42, 100 Brussels, Belgium) – Logistics contractor.
Contact details of Platform member organisations and Rise and Reflect Alumni group (adults only) may be shared with other Platform members where necessary for networking purposes.
Contact information of member organisations are also published on the Platform’s public website: EU Children’s Participation Platform | European Union (europa.eu).
Contact details of accompanying adults are shared with Child Protection Officers and logistics contractors responsible for travel and accommodation. For safeguarding purposes, accompanying adults are invited to join a WhatsApp group set up by the Child Protection Officer.
No personal data is transferred to countries outside the EU or EEA, nor to international organisations.
Social media and third-party tools
The Platform uses official social media accounts of the European Commission (LinkedIn, Instagram, Facebook) and of partner and member organisations to share photos, videos, and news about Platform activities. Such sharing of children’s images is always based on prior written consent.
For general information on the Commission’s use of social media, see Record of Processing DPR-EC-00073.
You have specific rights as a data subject under Chapter III (Articles 14–25) of Regulation (EU) 2018/1725:
- Right of access (Article 17): You may request a copy of the personal data we hold about you.
- Right to rectification (Article 18): You may request correction of inaccurate or incomplete personal data.
- Right to erasure (Article 19): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected.
- Right to restriction of processing (Article 20): You may request that we limit the processing of your personal data in certain circumstances.
- Right to data portability (Article 22): You may request to receive your personal data in a structured, commonly used format.
- Right to object (Article 23): You may object, on grounds relating to your particular situation, to processing based on Article 5(1)(a) of Regulation (EU) 2018/1725.
Where processing is based on consent (Article 5(1)(d)), you have the right to withdraw your consent at any time by contacting the Data Controller. Withdrawal will not affect the lawfulness of processing carried out prior to withdrawal.
To exercise your rights, please contact the Data Controller or the Data Protection Officer using the contact details provided in Section 9 below. Please indicate the relevant Record reference (DPR-EC-16688.1) in your request.
The Data Controller
European Commission, DG Justice and Consumers, Unit JUST.C.2 For correspondence with data subjects: EU-CHILDPARTICIPATION@ec.europa.eu
The Data Protection Officer (DPO) of the Commission
You may contact the Data Protection Officer (DATA-PROTECTION-OFFICER@ec.europa.eu) with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725.
For internal communications: EC-DPO-INTERNAL@ec.europa.eu Data Protection Coordinator for DG JUST: JUST-DATA-PROTECTION-COORDINATOR@ec.europa.eu
The European Data Protection Supervisor (EDPS)
You have the right to lodge a complaint with the European Data Protection Supervisor (edps@edps.europa.eu) if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data by the Data Controller.
The Commission Data Protection Officer (DPO) publishes the register of all processing operations on personal data by the European Commission, which have been documented and notified to the DPO. You may access the register via: http://ec.europa.eu/dpo-register.
This processing operation has been included in the DPO’s public register with the following reference: DPR-EC-16688.1.
Additional privacy statements applicable to specific activities of the Platform are available as follows:
- Meetings and events: DPR-EC-01063
- Online subscriptions and newsletters: DPR-EC-03928
- Consultations: DPR-EC-01011
- EU Login (Identity & Access Management): DPR-EC-03187
- EUSurvey: DPR-EC-01488
- Social media: DPR-EC-00073
- Audio-visual recording of meetings: DPR-EC-01937
- Commission Physical Access Control System (PACS): DPR-EC-00655
- Historical Archives: DPR-EC-00837
For further information on the safeguarding framework of the Platform, please visit: https://eu-for-children.europa.eu/about/safeguarding.