Privacy notice | ENISA Careers

PRIVACY STATEMENT ON PERSONAL DATA IN RELATION TO SELECTION AND RECRUITMENT

CATEGORIES OF: TEMPORARY AGENTS, CONTRACT AGENTS, SECONDED NATIONAL EXPERTS AND TRAINEES AT ENISA

Your personal data shall be processed in accordance with Regulation (EU) No 2018/1725 of the European Parliament and of the Council (OJ L 295, 21.11.2018, p. 39–98) on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.

The data controller of the processing operation is the European Union Agency for Cybersecurity (ENISA), ENISA, Corporate Support Services Unit (HR), recruitment@enisa.europa.eu

The legal basis for the processing operation is Article 5(1) (a) of Regulation (EU) 2018/1725 on the basis of the Staff Regulations of Officials (SR) and the Conditions of Employment of Other Servants of the European Communities (CEOS), in particular Articles 27-34 (SR), 12-15 and 82-84 (CEOS) thereof.

In addition, ENISA has adopted the following relevant Decisions:

MB Decision 2016/12 on the general implementing provisions on the procedure governing the engagement and use of the temporary agents under Article 2(f) of the CEOS thereof;
MB Decision 2019/14 adopting Implementing rules on the general provisions for implementing Article 79(2) of the Conditions of Employment of Other Servants of the European Union, governing the conditions of employment of contract staff employed under the terms of Article 3a thereof
MB Decision 2013/15 laying down rules on the secondment of national experts (SNE); ED Decision 92/2018 on the rules governing the traineeship programme at ENISA.

The data processor of the processing operation is Adequasys (https://adequasys.com/) providing the Adequasys HRMS recruitment platform under specific service contract with ENISA. A specific Data Processing Agreement forms part of the service contract. All personal data processing takes place within EU.

The purpose of this processing operation is to administer staff selection procedures, to manage applications of candidates at different stages, and to facilitate the recruitment of different categories of staff (e.g., temporary agents, contract agents, seconded national experts and trainees), in view of filling vacant posts and establishing reserve lists for potential future recruitments. For this scope, the applicants’ personal data will be processed to facilitate the management of the recruitment process and any subsequent legal challenge to that process.

The following personal data are being processed:

Identification details – information provided by the applicants to allow themselves to be identified and contacted by ENISA (e. g. name, surname, email address, phone number etc.);
Eligibility and selection criteria information – information provided by the applicants to allow verification of their fulfilment of the criteria laid down in the vacancy notice (e.g., nationality, knowledge of languages, information on educational and professional experience, information relevant to military service and criminal records);
Information related to interviews conducted at ENISA’s premises or remotely via ENISA's videoconferencing platform (further information on the processing of personal data via ENISA’s videoconferencing platform will be provided in the case of interviews or written tests conducted remotely), written tests, tests conducted in assessment centre. Candidates may also undertake online psychometric tests (further information on the processing of personal data in the context of online psychometric tests shall be provided to candidates in such cases);
Evaluation of candidates undertaken by the appointed selection board(s) in different stages of the selection process (e.g., applications, pre-selection screening, interviews, tests, etc.).
Information related to pre-medical visits for recruited candidates (e.g., fit to work medical certificate);
Information related to support claims for the reimbursement of travel costs for interview or medical visits.

Access to your data will be granted only to delegated ENISA staff involved in different stages of the selection process; members of appointed selection board(s); delegated ENISA contractor involved in different stages of the selection process (data processor). The data may also be available to EU bodies charged with monitoring or inspection tasks in application of EU law (e.g., internal audits, European Anti-fraud Office – OLAF).

Personal data will be kept up to a maximum period of:

In relation to recruited applicants (Temporary Agents, Contract Agents and SNEs) whose data is stored in their personal file as per Article 26 of the Staff Regulations, the data is retained in ENISA for a period of up to 10 years after the termination of employment or the last pension payment.
In relation to non-recruited personnel (Temporary Agents, Contract Agents and SNEs), the data is retained for a period of maximum of 2 years following the completion of the recruitment process.
In relation to applicants placed on the reserve list and not recruited (Temporary Agents, Contract Agents and SNEs), the retention period for data relating to the "reserve lists for appointment" is to be determined in terms of the validity and the actual extension of the respective reserve lists.
In relation to trainees completing a traineeship programme at ENISA, the data will be retained for no longer than five years following the completion of the traineeship program. Once the above 5 years period is completed, only the data necessary for providing a copy of the trainee certificate e.g. information on the duration of the traineeship, the department to which the trainee was assigned, the name of supervisor and the nature of work performed will be stored.
In relation to non-recruited trainees, the data is kept for one year from the closure of the call.

You have the right to of access to your personal data and to relevant information concerning how we use it. You have the right to rectify your personal data. Under certain conditions, you have the right to ask that we delete your personal data or restrict its use. You have the right to object to our processing of your personal data, on grounds relating to your particular situation, at any time. We will consider your request, take a decision and communicate it to you. If you have any queries concerning the processing of your personal data, you may address them to ENISA at recruitment@enisa.europa.eu.

You may also contact at any time the ENISA DPO at dataprotection@enisa.europa.eu.

You shall have right of recourse at any time to the European Data Protection Supervisor at https://edps.europa.eu.