Privacy notice regarding the processing of personal data contained in Entry Materials submitted for the Effie Awards competition (“Competition”)

Please read this Privacy Notice carefully before submitting the Entry Materials required for participation in the Competition.

This Privacy Notice applies to individuals who, on behalf of the Entrant, provide personal data to the European Association of Communications Agencies (company registration number: BE 0422.332.060; registered office: Rue Defacqz 78, 2nd Floor, 1060 Brussels, Belgium; hereinafter: the “Controller”) in connection with the submission of Entry Materials attached to the EFFIE® AWARDS: AUTHORIZATION & VERIFICATION AGREEMENT (“AVA”) concluded between the Controller and the Entrant.

The Controller processes personal data contained in the Entry Materials in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”).

In compliance with Article 13 of the GDPR, the Controller provides the following information regarding the processing of personal data.

1. THE CONTROLLER AND THE CONTROLLER’S CONTACT DETAILS

European Association of Communications Agencies (company registration number: BE 0422.332.060; registered office: Rue Defacqz 78, 2nd Floor, 1060 Brussels, Belgium, e-mail: privacy@eaca.eu).

2. CATEGORIES OF PERSONAL DATA PROCESSED

In connection with participation in the Competition, the Controller processes personal data contained in the Entry Materials submitted pursuant to Section 52 of the AVA.

This includes:

(i) the contact details of the Entry contact person; and

(ii) the personal data of the contact persons of the companies identified in the Entry, as well as the individuals listed in the credits, including their name, employer, job title, role and contact details.

Personal data also includes any information contained in the Entry Materials that can be linked to the individuals identified above, including information relating to their contribution, involvement or role in the creation of the submitted Entry.

3. PURPOSE OF THE PROCESSING OF PERSONAL DATA AND LEGAL BASIS FOR THE PROCESSING

The Controller processes personal data contained in the Entry Materials for the following purposes:

(i) the personal data of the contact person is processed for the purpose of communication regarding the Entry and the Competition; and

(ii) the personal data of the contact persons of the companies identified in the Entry, as well as the individuals listed in the credits, is processed for the purpose of administering and evaluating the Entry, promoting the Competition Purposes defined in Section 41 of the AVA, and announcing and promoting shortlisted and winning Entries.

The legal basis for the processing of personal data is the Controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR, namely the legitimate interest in organising, administering, evaluating, promoting and documenting the Competition and the submitted Entries, including the publication of credits and case studies, and the announcement and promotion of shortlisted and winning Entries.

4. RECIPIENTS OF PERSONAL DATA

The Controller may share personal data contained in the Entry Materials with Informa PLC, Informa Festivals, and their respective affiliates and service providers involved in the administration, operation, promotion, publication, archiving, or organisation of the Competition and related Effie Awards programmes, including for the publication of credits and case studies.

Where personal data is transferred to recipients located outside the European Economic Area, such transfer shall be carried out in accordance with applicable data protection laws and appropriate safeguards.

The transfer of personal data to recipients located in the United Kingdom is based on the adequacy decision adopted by the European Commission under Article 45 GDPR, pursuant to which the United Kingdom ensures an adequate level of protection for personal data pursuant to Commission Implementing Decision (EU) 2021/1772 of 28 June 2021.

5. RETENTION PERIOD OF PERSONAL DATA

The Controller retains personal data for as long as necessary to fulfil the purposes for which the personal data was collected, including the administration of the Competition, communication regarding the Entry, the publication of credits and case studies, and the promotion and archiving of awarded Entries.

Personal data related to contact persons is generally retained for the duration of the Competition and for a reasonable period thereafter in order to manage any follow-up communication or administrative matters.

Where personal data is included in credits, case studies, or other materials relating to awarded or shortlisted Entries, such data may remain publicly available for as long as the relevant Entry, case study, or archival material continues to be published or maintained by the Controller or the relevant competition partners.

The Controller may also retain personal data where necessary to comply with legal obligations, resolve disputes, or establish, exercise, or defend legal claims.

6. SOURCE OF PERSONAL DATA

The Controller generally receives personal data directly from the Entrant submitting the Entry Materials on behalf of the participating companies and individuals.

The Entrant is responsible for ensuring that any personal data included in the Entry Materials has been collected and disclosed to the Controller in compliance with applicable data protection laws, including providing any necessary information to the relevant individuals.

7. WHETHER THE PROVISION OF PERSONAL DATA IS MANDATORY

The provision of the personal data specified in Part C of the AVA is mandatory. Without the provision of such personal data, the Controller will not be able to accept the Entrant’s submission and participation in the Competition. The Entrant shall ensure that relevant individuals have been informed of the processing of their personal data in accordance with applicable data protection laws.

8. RIGHTS OF DATA SUBJECTS

Under the GDPR, data subjects whose personal data is processed by the Controller are entitled to:

(i) request access to their personal data;

(ii) request the rectification of inaccurate or incomplete personal data;

(iii) request the erasure of their personal data;

(iv) request the restriction of processing;

(v) object to the processing of personal data based on the Controller’s legitimate interests; and

(vi) lodge a complaint with a competent supervisory authority.

Where the processing of personal data is based on the Controller’s legitimate interest pursuant to Article 6(1)(f) GDPR, data subjects have the right to object to such processing on grounds relating to their particular situation.

Requests relating to the exercise of data subject rights may be submitted to the Controller using the contact details provided in Section 1 above.

For the purposes of exercising their rights or lodging a complaint, data subjects may also contact the competent supervisory authority.

The competent supervisory authority of the Controller is:

Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit)

Rue de la Presse 35 / Drukpersstraat 35

1000 Brussels, Belgium

Telephone: +32 (0)2 274 48 00

Email: contact@apd-gba.be

Website: www.dataprotectionauthority.be

Data subjects also have the right to lodge a complaint with the supervisory authority of the EU Member State of their habitual residence, place of work, or the place of the alleged infringement.

9. AUTOMATED DECISION-MAKING

The Controller does not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR, based on the personal data contained in the Entry Materials.

10. LEGITIMATE INTEREST

The Controller has assessed that the processing of personal data described in this Privacy Notice is necessary for the purposes of the legitimate interests pursued by the Controller and that such interests are not overridden by the interests or fundamental rights and freedoms of the data subjects.

The legitimate interests pursued by the Controller include the organisation, administration, evaluation, documentation, promotion and archiving of the Competition and the submitted Entries, including the publication of credits, case studies, shortlisted Entries and winning Entries.