Protection of your personal data
This privacy statement provides information about the processing and the protection of your personal data.
Processing operation: EU Energy and Raw Materials Platform for the collection and exchange of market data about demand and supply, aggregation and/or matching of energy-related products and strategic raw materials.
Data Controller: Director Energy Security and International Relations - DG ENER
Record reference: DPR-EC-33028.1
Last update: 17/07/2025
The European Commission (hereafter 'the Commission') is committed to protect your personal data and to respect your privacy. The Commission collects and further processes personal data pursuant to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (repealing Regulation (EC) No 45/2001).
This privacy statement explains the reason for the processing of your personal data, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you have in relation to your personal data. It also specifies the contact details of the responsible Data Controller with whom you may exercise your rights, the Data Protection Officer and the European Data Protection Supervisor.
The information in relation to processing operation: EU Energy and Raw Materials Platform undertaken by the Data Controller is presented below.
The Data Controller processes your personal data to operate the Platform for the collection and exchange of market data about demand and supply, aggregation, matching and/or joint purchasing of energy-related products and strategic raw materials. The Platform will host and support mechanisms dedicated to specific energy products or raw materials, as provided for in Articles 42 and 52 of Regulation 2024/1789 and Article 25 of Regulation 2024/1252. The core activities of the Platform entail primarily the collection, exchange and processing of commercial data such as information about the participating organisations, demand requests or supply offers that they will submit, information about their projects for the supply of energy products and raw materials.
However, to enable the Platform to operate, the processing of certain personal data is necessary. The Platform collects and processes your personal data to:
- Identify users, manage user access to the restricted parts of the Platform, and prevent unauthorised access. Users (natural persons representing the participating organisations) will have to register and use the Platform. Therefore, personal data of individual users will be processed to identify users and manage their access.
- Enable users and participating organisations to share their contact information with other users and participating organisations as needed to perform one of the core activities of the Platform (matching). To this end, users fill in contact cards containing personal data (name, surname, email address, phone number, job and department) belonging to them or to other persons in their organisations. In the latter case, users will inform the persons in their organisation whose personal data are included in the contact cards.
Your personal data will not be used for an automated decision-making, including profiling.
We process your personal data, because processing is necessary to establish and operate the market development, demand aggregation and joint purchasing mechanisms for hydrogen, strategic raw materials, and natural gas, as mandated, respectively, by Article 52 of Regulation 2024/1789, Article 25 of Regulation 2024/1252, and Article 42 of Regulation 2024/1789. This represents the performance of a task carried out by the Commission in the public interest or in the exercise of official authority vested in the Union institution in accordance with Article 5(1)(a) of Regulation 2018/1725.
In order to carry out this processing operation, the Data Controller obtains your personal data from the EU Login system and the Platform (data you have entered at registration stage or to fill in the contact card). In particular, we process the following personal data for the purpose described above:
From your EU Login:
- Your surname
- Your given name
- Your EU Login ID
- Your professional email address
For further information, please refer to the privacy statements of “EU Login” reference number in the public Data Protection Officer register: https://ec.europa.eu/dpo-register/detail/DPR-EC-03187
From the registration stage for Administrator Users:
- Scanned ID document if you cannot use e-IDAS compliant Qualified Electronic Signature
- Your telephone number
- Your job title and department
- Signed declaration on honour
- Signed power of attorney
From the contact card for Users or other persons in the organisation:
- Your surname
- Your given name
- Your professional email address
- Your telephone number
- Your job title and department
The identity server (login service) uses cookies to keep users in the logged-in state and to protect against cross site request forgery (CSRF) attacks. Personal data stored in cookies contain the internal identificator of users and the internal identificator of the authentication-session. The IP address is not stored.
The Data Controller only processes and keeps your personal data for the time necessary to fulfil the purpose of identifying users, managing user access, enabling matching, as well as for auditing purposes. Therefore, your personal data will be deleted after two years starting from the date when the Platform, or the relevant individual mechanism, ceases to operate.
All personal data in electronic format (e-mails, documents, databases, uploaded batches of data, etc.) are stored on the servers of the European Commission. For the operation of the ticketing system of the Platform, the email address of users will be stored in the servers of Sféra (Commission's contractor). All processing operations are carried out pursuant to the Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission.
With regard to cloud services, the Platform uses cloud accounts opened by the European Commission (DG DIGIT) on Amazon Web Services under the Cloud II framework. Cloud instances are located in the EU.
In order to protect your personal data, the Commission has put in place a number of technical and organisational measures in place. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.
Access to your personal data is provided to the Commission staff and to the staff of the Commission's contractor PWC/Sféra responsible for carrying out this processing operation and to authorised staff according to the “need to know” principle. Such staff abide by statutory, and when required, additional confidentiality agreements.
Your personal data contained in the contact card will be made available on certain restricted sections/areas of the Platform to enable other users, representing a participating organisation with which your organisation has been matched, to contact you. Access to these parts of the Platform is limited to users of registered participants.
Please note that users may fill in contact cards containing personal data (name, surname, email address, phone number, job and department) belonging to other persons in their organisations. In such cases, it is the users' responsibility to inform the persons in their organisation whose personal data are included in the contact cards and to direct them to this privacy statement.
You have specific rights as a 'data subject' under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular the right to access, rectify or erase your personal data and the right to restrict the processing of your personal data. Where applicable, you also have the right to object to the processing or the right to data portability.
You can exercise your rights by contacting the Data Controller, or in case of conflict the Data Protection Officer. If necessary, you can also address the European Data Protection Supervisor. Their contact information is given under Contact information below.
Where you wish to exercise your rights in the context of one or several specific processing operations, please provide their description (i.e. their Record reference(s) as specified under Where to find more detailed information?) in your request.
The Data Controller
If you would like to exercise your rights under Regulation (EU) 2018/1725, or if you have comments, questions or concerns, or if you would like to submit a complaint regarding the collection and use of your personal data, please feel free to contact the Data Controller,
European Commission - DG ENER F1 - Diversification strategy and joint purchasing - E-mail: ENER-F1-SECRETARIAT@ec.europa.eu
The Data Protection Officer (DPO) of the Commission
You may contact the Data Protection Officer (DATA-PROTECTION-OFFICER@ec.europa.eu) with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725.
The European Data Protection Supervisor (EDPS)
You have the right to have recourse (i.e. you can lodge a complaint) to the European Data Protection Supervisor (edps@edps.europa.eu) if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data by the Data Controller.
The Commission Data Protection Officer (DPO) publishes the register of all processing operations on personal data by the Commission, which have been documented and notified to him. You may access the register via the following link: http://ec.europa.eu/dpo-register.
This specific processing operation has been included in the DPO's public register with the following Record reference: DPR-EC-33028.1.
