Skip to main content
European Union flag
Global Gateway Platform

Privacy Statement

This privacy statement provides information about the processing and the protection of your personal data.

Introduction

The European Commission (hereafter ‘the Commission’) is committed to protect your personal data and to respect your privacy. The Commission collects and further processes personal data pursuant to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (hereafter ‘Regulation (EU) 2018/1725).

This privacy statement explains the reason for the processing of your personal data, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you have in relation to your personal data. It also specifies the contact details of the responsible Data Controller with whom you may exercise your rights, the Data Protection Officer and the European Data Protection Supervisor.

The Global Gateway Platform (hereafter referred to as “GG Platform”) is a restricted website of the European Commission (Directorate General for International Partnerships). It is an online working tool for Team Europe actors, and a digital repository of information regarding Global Gateway flagship projects and Team Europe Initiatives. It provides a snapshot of collective Team Europe efforts in a specific partner country or region. The information contained on the GG Platform relates to the Global Gateway (GG) flagship projects which are adopted in the annual list of GG flagship projects by the Council of the European Union, as well as Team Europe Initiatives (both those contributing to GG, and the non-GG ones), EU-only initiatives, and Member States’ initiatives that are contributing to GG and future or potential projects that will also contribute to GG.

Access to the platform is strictly limited to authorized users who must authenticate via EU Login(1), the European Commission’s secure sign-in system.

Within the GG Platform, the GG Investment Hub is a digital portal duplicating the above processing activities where Team National actors can submit, investment project proposals supporting the EU’s broader Global Gateway investment strategy involving EU Member States’ private sectors (EU companies, consortia, and financial partners).The platform hosting the Global Gateway Investment Hub uses a flexible and scalable user management system built around roles and permissions. This system allows us to assign multiple roles to users, enabling tailored access based on their responsibilities within the team or organization.

In the GG Platform, we currently use the following roles to manage access: 

  • Administrator – Full access to all system features and settings.
  • INVHUB - Program Manager – Oversees program-level activities and user coordination.
  • INVHUB - Program Editor – Can create and edit program-related content.
  • INVHUB - Program Approver – Responsible for reviewing and approving program content.
  • INVHUB - Program Viewer – Has read-only access to program content.
  • INVHUB - Organisation Editor – Can manage and update Organisation-related information.
  • INVHUB - Organisation Viewer – Has read-only access to Organisation data.

Each role is associated with a specific set of permissions, and users may be assigned multiple roles to reflect their responsibilities. Roles and access rights within the platform are managed by D1, acting as the Product Owner. However, before any roles are assigned or modified, they must first be approved by Unit INTPA E.3 “Private Sector Engagement & Employment” (hereafter referred to as ‘INTPA.E.3) who serves as the Process Owner (and may receive requests for access to the GG Investment Hub via INTPA-INVESTMENT-HUB@ec.europa.eu) . This ensures that access permissions align with established governance and operational procedures, maintaining consistency and accountability across the system.

(1) For further information please refer to DPO Public register (DPR-EC-03187)

Why and how do we process your personal data?

DG INTPA, Unit D1 “Effective Development Policy and Team Europe” (referred to hereafter as the Data Controller) collects and uses your personal information for two reasons: A) to grant you access to the GG Platform and B) to link each contribution provided in the Platform to the responsible organisation.

A record editor in the Global Gateway Platform is an assigned person from a Team Europe involved in the project (Commission services, the European External Action Service, the European Investment Bank, the European Bank for Reconstruction and Development and EU Member States; including their financial institutions, implementing agencies and export credit agencies, as well as Team Nationals, who enter or update information in the platform.

Team Europe Actors from the ‘Entity’ in the lead with editor rights, can edit information for Flagship Projects, Initiatives, Milestones, and Deliverables. They will also be able to add and update their indicative Financial Contributions. They are not able to see information (fields) that is classified as “sensitive information”. They are also able to encode and update MS-only initiatives.

For the GGIH only, a Team National editor is an assigned person from the entity in lead (EU Member States - including their finance institutions, implementing agencies and export credit agencies) - who update information in the GG Investment Hub. They submit data on behalf of third parties (private companies and referred as Sponsor) with their formal consent. Only Team Nationals can view their own contributions.

To be able to register to the GG Platform (incl. the GG Investment Hub), you will first need to selfregister by creating an EU Login account. This authentication process is managed within the European Commission by DG DIGIT (record reference: DPR-EC-03187). When you ask to become a registered user of the GG Platform, the privacy statement is sent to you by the organisation you are affiliated with or by the Data Controller, INTPA.D1. Furthermore, your personal data might be shared by yourself or by the Data Controller with INTPA.R5 “Data and Information Technology” in case specific needs for IT technical support arise.

The data for the GG Platform is hosted on an internal server managed directly by INTPA.R5 – using SharePoint on premises 2019. The platform and all data hosted on it will be migrated to the cloud solution Drupal, using the AWS framework managed by DIGIT in 2026.

In the case of the GG Investment Hub, data regarding stakeholders from Team Nationals involved in projects, is stored in Drupal. This data is only accessible on a need-to-know basis and can be exported / used for evaluations that are managed by INTPA E3. Personal data (see Chapter 4) within the Investment Hub is stored exclusively in the backend and is used solely for access management purposes. This ensures that only a restricted group of authorised staff from D1 and R5 can view and manage these data. Importantly, no personal data is shared with other platform users, maintaining strict confidentiality and compliance with data protection standards.

Finally, within the GGIH Platform, your personal data is received by INTPA E3 and published on the List of Team National contact points for external use available on the Investment Hub website and in the List of Team National contact points for INTPA internal use (hereinafter referred as ‘lists of contacts’).

Your personal data will not be used for any automated decision-making, including profiling.

On what legal ground(s) do we process your personal data

We process your personal data, because:

  • Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body, in line with Article 5(1)(a) of Regulation (EU) 2018/1725;

The basis in Union law for the processing is:

- Articles 4(4), 208 and 211 of the Treaty on the Functioning of the European Union (TFEU)

More specifically, the Council conclusions on “Team Europe”, approved by written procedure on 23 April 2021, reaffirm the need for close cooperation and consultation, as well as proactive information sharing and flexibility by all Team Europe members (i.e., for the actors involved in the platform).

In the case of ‘list of contacts’, received by INTPA E3, your personal data is processed in line with Article 5(1)(a) of Regulation 2018/1725 and it has been lawfully received as per provisions applicable to Member states(2).

(2) Regulation (EC) 2016/679, Chapter V.

Which personal data do we collect and further process?

The Data Controller needs to collect the following personal data with mandatory fields as indicated below, to grant you access to the GG Platform, incl. to the GG Investment Hub:

  • First name;
  • Last name(s);
  • E-mail address - mandatory;
  • Affiliated organisation - mandatory;
  • EU Login (username) - mandatory;
  • Country (if the user is an official of an EU Member State, including employees of their finance institutions, implementing agencies and export credit agencies) - mandatory;
  • Editing history of platform entries (timestamps of the updates and new records created by the user);
  • IP address.

The following personal data is displayed to record editors:

  • First name;
  • Last name(s);
  • Email address;
  • Timestamp of the updates and new records created by record editor.

The assigned Team National editor may collect data of involved Team National actors. If so, this data may include the following fields:

  • First name;
  • Last name(s);
  • E-mail address - mandatory;
  • Affiliated organisation - mandatory;
  • EU Login (username) - mandatory;
  • Affiliated organisation - mandatory;
  • Name of the sponsor organisation - mandatory;
  • Name of the shareholder (if outside the European Union) - either as an individual or organisation and Country - mandatory;
  • Timestamp of the updates and new records created by record editor.

This personal data of Team National actors is also shown in the editing history of the platform entries(the Version History View), visible only to administrators. Users with viewing rights can only see the email address of the record editors.

Exclusively with regards to the GG Investment Hub, the personal data is either submitted directly in the GG Investment Hub or provided via email via INTPA-INVESTMENT-HUB@ec.europa.eu. : This data may include the following:

  • First name;
  • Last Name;
  • Project sponsor (lead company);
  • Counterpart, Consortium partners, Shareholder (if applicable);
  • Beneficiaries or Associated (if applicable);
  • Donors/Investors (if applicable);
  • Contact details (emails).

How long do we keep your personal data?

The Data Controller only keeps your personal data for the time necessary to fulfil the purpose of collection or further processing.

EU Login data

  • Personal data related to self-registered individuals are kept until the user personally deletes his/her EU Login account or requests the deletion, except for e-mail addresses that need to be kept for further user support and assistance (3).
  • Log files are kept for six months.
  • A fully detailed explanation about how long the European Commission keeps personal data in the context of EU Login is available in section 5 of the Privacy Statement for the European Commission's Identity Access Management Service (IAMS) available here.

Data collected when creating an account to access the GG Platform

  • Your personal data will be kept for as long as the Platform exists. However, the information concerning a person who has not used their account for five years will be automatically deleted. The five-year retention period starts from the last connection to the Global Gateway Platform.
  • Your personal data will also be deleted before the end of the five-year retention period upon request (see Contact Information under Heading 9 below)

Once INTPA.D1 receives a request from a candidate user or following the check performed by Unit E3, it checks that all the necessary personal data is provided and analyses the demand for access to the GG Platform. Once a positive answer is given, the above-mentioned personal data is stored on Commission servers.

Contact lists from Team National

Other than the information collected above for the GG Platform, INTPA.E.3 collects/receives updates of information about Team National contact points for the Investment Hub via INTPA INVESTMENT HUB (<INTPA-INVESTMENT-HUB@ec.europa.eu>). The information is used to keep the contact points updated on the activities of the Investment Hub. 

Based on the information provided two list of contacts s are kept up to date: 

• List of Team National contact points for external use (available on the Investment Hub website); 

• List of Team National contact points for INTPA internal use.

Editing history of platform entries

  • Your editing history of platform entries will be kept for 5 years after the closure of the platform.

(3) For further information please refer to DPO Public register (DPR-EC-03187)

How do we protect and safeguard your personal data?

All personal data in electronic format (e-mails, documents, databases, uploaded batches of data, etc.) are stored on the servers of the European Commission. All processing operations are carried out pursuant to the Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission.

The Commission’s contractors are bound by specific contractual clauses for any processing operations of your personal data on behalf of the Commission, and by the confidentiality obligations deriving from the transposition of the General Data Protection Regulation in the EU Member States (‘GDPR’ Regulation (EU) 2016/679).

In order to protect your personal data, the Commission has put a number of technical and organisational measures in place. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.

Who has access to your personal data and to whom is it disclosed?

Access to your personal data, as described in heading 2, is provided to the duly authorised Commission staff responsible for the process of granting access to the GG Platform on a “need to know” basis.

Moreover, contact points or records editors, as described in heading 2, have access to limited personal data as well, while users with viewing rights have access only to email addresses of record editors.

Finally, for the operational management, maintenance and development of the GG Platform the European Commission contracts external support. Therefore, your personal data may be shared also with the following service providers:

  • MALT Community SR,( Avenue Louise 231,1050 Brussels, Belgium, email: hello.digit2@malt.com)
  • NTT DATA Belgique, S.R.L (Rue de Spa 8, 1000 Brussels – Belgium, Email: people.belgium@nttdata.com)
  • PRICEWATERHOUSECOOPERS EU SERVICES (Culliganlaan 5, 1831, Machelen, Belgium). 

A changing pool of Individual external agents contracted by DG DIGIT through service contract DIGIT TM II.

Please note that pursuant to Article 3(13) of Regulation (EU) 2018/1725, public authorities (e.g. Court of Auditors, EU Court of Justice) which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients. The further processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

The information we collect will not be given to any third party, except to the extent and for the purpose we may be required to do so by law.

Cookies

Cookies are short text files stored on a user’s device (such as a computer, tablet or phone) by a website. Cookies are used for the technical functioning of a website (functional cookies) or for gathering statistics (analytical cookies).

The cookies employed by the Commission on the user’s device will be covered by the cookie policy of the Commission, which is available here: https://ec.europa.eu/info/cookies_en.

When you visit the Global Gateway Platform, we will keep the browser history of your visit for a maximum of 13 months, in line with the Commission’s cookie policy. This information will then be deleted. The collection, aggregation and anonymising operations are performed in the data center of the European Commission under adequate security measures.

Cookies are stored by Europa Analytics, the corporate service which measures the effectiveness and efficiency of the European Commission's websites on EUROPA. More information is available in the Record of Processing DPR-EC-00685 (Europa Analytics).

Enabling these cookies is not strictly necessary for the website to work but it will provide you with a better browsing experience. You can delete or block these cookies, but if you do that, some features of the Global Gateway Platform may not work as intended.

The cookie-related information is not used to identify data subjects personally and the pattern data is fully under the Commission’s control. These cookies are not used for any purpose other than those described here.

Should you wish to opt your personal data out of our anonymised, aggregated statistics, you can do so on our cookies page. In particular, you can control and/or delete those cookies as you wish.

What are your rights and how can you exercise them?

You have specific rights as a ‘data subject’ under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular the right to access, rectify or erase your personal data and the right to restrict the processing of your personal data. Where applicable, you also have the right to object to the processing or the right to data portability.

You have the right to object to the processing of your personal data, which is lawfully carried out pursuant to Article 5(1)(a).

You can exercise your rights by contacting the Data Controller, or in case of conflict the Data Protection Officer. If necessary, you can also address the European Data Protection Supervisor.

Their contact information is given under Heading 9 below.

Where you wish to exercise your rights in the context of one or several specific processing operations, please provide their description (i.e. their Record reference(s) as specified under Heading 10 below) in your request.

Contact information

The Data Controller

If you would like to exercise your rights under Regulation (EU) 2018/1725, or if you have comments, questions or concerns, or if you would like to submit a complaint regarding the collection and use of your personal data, please feel free to contact the Data Controller: INTPA.D1, at EU-GLOBAL-GATEWAY-PLATFORM@ec.europa.eu and/or INTPA-D1@ec.europa.eu.

The Data Protection Officer (DPO) of the Commission

You may contact the Data Protection Officer (DATA-PROTECTION-OFFICER@ec.europa.eu) with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725.

The European Data Protection Supervisor (EDPS)

You have the right to have recourse (i.e. you can lodge a complaint) to the European Data Protection Supervisor (edps@edps.europa.eu) if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data by the Data Controller.

Where to find more detailed information?

The Commission Data Protection Officer (DPO) publishes the register of all processing operations on personal data by the Commission, which have been documented and notified to him. You may access the register via the following link: http://ec.europa.eu/dpo-register.

This specific processing operation has been included in the DPO’s public register with the following Record reference: DPR-EC-23049.3