Data Protection Notice: Digital conferencing and platforms services for the State of Asylum Conference [2026]

Introduction

The European Union Agency for Asylum (hereinafter ‘the EUAA’ or ‘the Agency’) is committed to protecting your privacy. The EUAA collects and further processes personal data pursuant to Regulation (EU) 2018/1725  1(hereinafter ‘the EUDPR’).

This Data Protection Notice explains inter alia the reasons for the processing of your personal data, the way we collect, handle and ensure protection of your personal data and what rights you have in relation to your personal data. It also specifies the contact details of the responsible Data Controller with whom you may exercise your rights, as well as of the Data Protection Officer (DPO) and the European Data Protection Supervisor (EDPS) to which you may have recourse as well to exercise the said rights.

Why and how do we process your personal data?

Your personal data are processed for the purpose of facilitating the organisation of the EUAA State of Asylum Conference 2026, including to manage registrations (both in-person and online), making available a customised mobile application on the Apple App and Google Play stores (optional), including the receipt of Conference-related push notifications, as well as to an access-controlled web portal that includes a live stream for remote participants to follow the Conference online. Conference participants are invited to register using one of two links (depending on whether they have been invited to attend in-person).

Participants attending in-person will receive a QR code (both in their registered email account and in the optional mobile app), enabling the Agency to verify their registration and check them in on the day and learn more about the content of the different Conference discussions, keynote speakers and panellists. In-person participants making use of the mobile app can, after installing it from the Apple or Google Play stores, opt to enable push notifications. Push notifications will provide updates from the Conference floor during the day and may include the names and biographies of keynote speakers and panellists.

For online attendees, the Conference will be hosted within a secured environment that is accessible to registrants only. The names and biographies of the keynotes speakers and panellists will be available within the online environment. Ahead of the event, online registrants will receive a hyperlink by email that pre-fills their username and system-assigned password, to enable them to log in seamlessly on the day. The content of the Conference will be streamed using the Agency’s YouTube account. 

For more information on the Agency’s personal data processing practices in the context of the wider organisation of meetings and events including in the context of hybrid meetings, readers are directed to the specific privacy notice, which applies in parallel to certain categories of data subjects2.

It is noted that to organise the event, the Agency has acquired the support of Let’s Get Digital B.V., a specific service provider engaged by Meeting Points Events Ltd. (MPE), contractor and data processor for the EUAA. Let’s Get Digital B.V. acts as data processor for the personal data processed through the mobile application.  

It is further noted that the optional mobile application has been published on the App Stores provided by Apple Inc. (i.e., Apple App Store) and Google Inc. (i.e., Google Play Store) using mobile apps developer accounts managed the Publications Office of the EU (i.e., “European Union Apps”). For the online retail platforms offered by Apple and Google Inc., the European Commission acts an independent data controller for the personal data included in the download transaction between the platform’s customer and the merchant-of-record. The European Commission’s privacy policy in respect of the European Union’s mobile app development accounts is available here .   

On what legal ground(s) do we process your personal data?

We process your personal data on the basis of Article 2(1) point (a) and 2(2) of Regulation (EU) 2021/2303 3 (hereinafter ‘the EUAA Regulation’), insofar as processing is necessary for the EUAA to organise the EUAA State of Asylum Conference 2026, by facilitating the registration, check-in and participation of attendees.

The Conference, which is the Agency’s main annual stakeholder relations event, provides an important opportunity to facilitate, coordinate and strengthen practical cooperation and information exchange among representatives of EU Member States on their asylum and reception systems as well as more broadly communicate the work of asylum and migration management and, as such, is an essential in fulfilling one of the main tasks provided in the EUAA Regulation. Consequently, the processing operation is lawful under Article 5(1) point (a) of the EUDPR.

Where the collection of your personal data is based on your explicit consent (see Section 4 below), we process on the basis of Article 5(1) point (d) as well as Article 10(2) point (a) of the EUDPR, applying to special categories of personal data.

Which personal data do we collect and further process? 

The Agency processes different categories of personal data according to the ‘step’ at which the event registrant finds themselves, e.g., event registration (in-person or online), mobile app download, mobile app use (see Section 2 of this notice).

For in-person attendees:

The Agency processes the following categories of personal data at the registration stage:

• First Name;
• Last Name;
• Email address;
• Organisation name and role;
• Affiliation to a Member State / Third country national authority;
• Phone number;
• Dietary requirements

The Agency does not process any personal data at the mobile app purchase / download stage. The European Commission acts as an independent controller for this data.

The Agency processes the following categories of personal data when using the optional mobile app:

• First Name;
• Last Name;
• Organisation name and role;
• Profile photo (if submitted, not compulsory)
• Social Media profile (i.e., LinkedIn – if made manifestly public by panellists and speakers)

To enable the use of information notifications on the smartphone devices of participants attending the Conference in-person, so-called “Push notifications”, the Agency processes the following categories of personal data, based on your consent.

• Device information;
• IP Address;

Apple Distribution International Ltd. and Google Ireland Ltd. act as sub-processors for this activity.

For online attendees:

The Agency processes the following categories of personal data at the registration stage:

• First Name;
• Last Name;
• Email address;
• Organisation name and role;

How long do we keep your personal data?

In respect of the Agency’s collaboration with Let’s Get Digital, the personal data are stored from the moment an in-person or online attendee registers to participate in / follow the EUAA State of Asylum Conference 2026. The personal data are then stored on this platform, until 31 December 2026 before being hashed4. However, system data relating to event logistics, organisation, design and visual identity are recoverable at the explicit request of the Agency. Personally identifiable information is not recoverable.

Notwithstanding the above, the Agency regularly exports the personal data collected by Let’s Get Digital and stores them on its internal document management system to facilitate inter alia the reimbursement of expenses to eligible participants in line with EDD/2024/079.

How do we protect and safeguard your personal data?

The Agency has put several technical and organisational measures in place, to protect and safeguard your personal data, as required under Article 33(1) of the EUDPR.

Technical measures include inter alia system access control, data access control, separation of data and pseudonymization. Organisational measures include physical access control and workplace confidentiality control. Additionally, as required by Article 37 of the EUDPR on the security of electronic information, the Agency has put in place appropriate measures to protect information collected from users’ terminal equipment, in the context of the use of the State of the Asylum mobile application.

For more information on the organisation and technical measures that the EUAA has put in place in the context of organising meetings and events, please refer to the specific privacy notice. 

Who has access to your personal data and to whom are they disclosed?

The following (categories of) recipients have access to your personal data:

• Personnel of the European Union Agency for Asylum (EUAA) responsible for tasks related to the organisation of meetings or other events, including the processing of reimbursements;
• A limited number of staff from Let’s Get Digital B.V. supporting the organisation of the Conference, in line with the organisational measures outlined above;
• Apple Distribution International Ltd. and Google Ireland Ltd. will have access to device information, as explained in Section 4, for the purposes of enabling push notifications.

It is noted that in line with the privacy notice on meetings and events, audio and video materials may be shared on the Agency’s social media accounts and as such, the personal data of keynotes speakers, panellists and Agency staff may be accessed by the broad public, including individuals from third countries.

Do we transfer any of your personal data to third countries or international organisations (outside the EU/EEA)?

Let’s Get Digital B.V. mainly processes personal data in data centres located in the EU/EEA. It has, however, engaged a series of sub-processors located outside the EU/EEA. Among these, Apple Distribution International Ltd. and Google Ireland Ltd. (see Section 4 and 7 of this notice). More information on these sub-processors and the transfer mechanisms that are in place  is available on Let's Get Digital website .

Does this processing involve automated decision-making, including profiling?

This processing activity does not involve automated decision-making, including profiling.

What are your rights and how can you exercise them? 

According to the EUDPR, you are entitled to access your personal data and to rectify them in case the data are inaccurate or incomplete. If your personal data are no longer needed by the EUAA or if the processing operation is unlawful, you have the right to erase your data. Under certain circumstances, such as if you contest the accuracy of the processed data or if you are not sure if your data are lawfully processed, you may ask the Data Controller to restrict the data processing. You may also object, on compelling legitimate grounds, to the processing of data relating to you. Additionally, you have the right to data portability which allows you to obtain the data that the Data Controller holds on you and to transfer it from one Data Controller to another. Where relevant and technically feasible, the EUAA will do this work for you.

Should you have any queries/questions concerning the processing of your personal data or should you wish to exercise your rights, please contact the Data Controller, i.e. the Head of the Communication and Public Relations Unit, by sending an e-mail to asylum-conference@euaa.europa.eu . 

You may always submit queries, remarks or complaints relating to the processing of your personal data to the Data Protection Officer (DPO) of the EUAA using the following e-mail address: dpo@euaa.europa.eu . 

In case of conflict, complaints can be addressed to the European Data Protection Supervisor (EDPS) using the following e-mail address: supervision@edps.europa.eu .  

Adopted: (18 September 2026)