Skip to main content
European Union flag
The independent public prosecution office of the EU
Report a crime

Data Protection Notice – Use of Contact Webform

The European Public Prosecutor’s Office (“EPPO”) is committed to ensuring that you have all the information you need in order to understand how your personal data are being processed, understand your rights, and how to exercise them. Below you can find all the details of the processing of personal data in the context of the use of the contact web form and the relevant contact details for further information, assistance or redress.


a) Identity and contact details of the controller

The entity that determines how and why your personal data are processed in the context of the use of the contact web form and which is legally responsible for complying with data protection obligations under Regulation (EU) 2018/1725 is the EPPO. You may contact the EPPO by email to info (at) or by mail marked for the attention of the Head of Communication Sector, EPPO, 11 Avenue John F. Kennedy, 1855 Luxembourg.


b) Contact details of the Data Protection Officer

The Data Protection Officer (“DPO”) of the EPPO can be reached by email to EPPO-DPO (at), or by mail marked for the attention of the DPO, EPPO, 11, Avenue John F. Kennedy, 1855 Luxembourg, for assistance and with regard to any issues in relation to the processing of your personal data and the exercise of your rights, as outlined below under h).


c) Purpose and legal basis for the processing of personal data

In order for the EPPO to establish an efficient communication channel with members of the public, a contact web form is available on the EPPO’s website for submission of questions of a general nature, about working for the EPPO or media related. For the purpose of being able to engage in communication with individuals who have reached out using the web form, the EPPO must process personal data.

The processing is necessary for the performance of a task carried out in the public interest, in accordance with Article 5(1)(a) Regulation (EU) 2018/1725, namely Regulation (EU) 2017/1939, requiring the management and functioning of the EPPO.


d) Categories of personal data concerned

Personal data contained in the web form completion fields, i.e. name, email address, content of the ‘message’ and ‘subject’ fields; Additional personal data only to the extent divulged by the individual in their message or subsequent contact, which may include telephone numbers, postal addresses, etc.


e) Recipients or categories of recipients of the personal data

Members of the EPPO’s staff in charge of handling the management of the web form infrastructure and answering the queries submitted; Exceptionally, personal data of users are shared with members of EPPO staff most competent to deal with the request, and the sharing only concerns what is strictly necessary in order to answer to the query or for responding directly to the user (e.g. forward the contact details); Other persons, internal or external, in the context of legal proceedings, audits, internal investigations, or responding to data protection or security related incidents may also have access to all or some of the personal data, to the extent determined by the circumstances.


f) Transfers to third countries and / or international organisations



g) Period for which the personal data will be stored

Information related to the enquiry is stored for a period of up to 2 years from the last communication occurred. This is to allow the EPPO to follow-up on initiated communication initiated, and to comply with record-keeping requirements and subsequent potential audits. In case your query relates to specific sectoral aspects, such as HR processes, financial or procurement, etc., retention periods of the related processing activities may apply. The retention period may be prolonged until the end of possible audits or legal proceedings if started before the end of it.


h) Right to request access, rectification, erasure, restriction, objection and data portability

You have the right at any time to request access to your personal data and to have them rectified in case they are inaccurate or incomplete, to object to or request restriction of processing of your personal data, to erase your personal data and to data portability. To exercise these rights, request assistance or if you have a question thereto, or to file a complaint, you may contact the DPO of the EPPO by using the contact details above.


i) Right to withdraw consent



j) Complaints to the European Data Protection Supervisor

You have the right to address yourself to the European Data Protection Supervisor (“EDPS”) to lodge a complaint. The EDPS can be contacted by email to EDPS (at), or by post to EDPS, Rue Wiertz 60, B-1047 Brussels.


k) Source from which the personal data originate

Personal data are provided through the use of the web form and related infrastructure.


l) Mandatory nature of provision of personal data

Without providing the information contained in the mandatory fields, including personal data, it would not be possible to send a query through the EPPO’s web form.


m) Automated decision-making

The processing of your personal data by the EPPO in the context of this processing activity does not result in any decision, which produces legal effects concerning you or similarly significantly affects you.


n) Record of processing activity

The related record of processing activity kept by the EPPO with record no. APD-071021-PR is available from the EPPO’s DPO.



Last updated: 07/12/2022