1. Introduction

The European Investment Bank (hereinafter “the EIB”) is committed to the protection personal data.
The EIB collects and further processes personal data in accordance with Regulation (EC) 2018/1725 of
23 October 2018 on the protection of natural persons with regard to the processing of personal data by
the Union institutions, bodies and agencies and on the free movement of such data, and repealing
Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (hereinafter the “EU DPR”).

This data protection statement explains the reason for the processing, the way of collection, handling
and ensuring protection of all personal data. Additionally, this statement further explains the ways in
which the information is used, and the rights of the individuals concerned, that are available in relation
to their personal data.

The information in relation to the processing operation the Modernisation Fund website undertaken by
the EIB is presented below.

2. Controller

The data controller is the General Secretariat of the European Investment Bank (the “EIB”).

3. Purpose of the processing

This data protection statement provides information regarding the processing of personal data carried
out by the EIB in order to communicate the purposes & scopes of the Modernisation Fund. The EIB
performs these tasks in the exercise of the authority vested to it in accordance with the Provisions of
the Treaties and its Statute.

The EIB processes personal data with a view to manage the Modernisation Fund website, in a
reasonable and proper manner, in accordance with applicable laws and regulations. Personal data are
processed in accordance with Regulation (EU) 2018/1725 of 23 October 2018 on the protection of
natural persons with regard to the processing of personal data by the Union institutions, bodies, offices
and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and
Decision No 1247/2002/EC (hereafter, the EU DPR).

In the context of the Modernisation Fund website, the EIB processes the personal data for the below
purpose(s) as described in the record, to understand website user behaviour, provide relevant content
and communications, respond to a user enquiry, store user preferences, provide specific website
functions or allow attribution permissions for content.

The Modernisation Fund site has been created in order to communicate the purposes & scopes of the
Modernisation Fund. This is a programme from the European Union to support 10 Member States to
meet 2030 energy targets by helping to modernise energy systems and improve energy efficiency. It
offers various types of content and functionalities to engage with the general public and specific
audiences, ranging from general information, news, background information, official documents, policy
information, to specialised tools and applications. Furthermore, personal data related to authentication
is processed to allow attribution permissions.

The processing of personal data in the context of the Modernisation Fund website does not involve the
existence of automated decision-making, including profiling.

4. Legal Basis of the processing

The legal basis for the processing of personal data in the context of the Modernisation Fund website is:
Public interest assigned by Union legislation: Directives, Regulations, Consent.

5. Categories of data subjects

The following categories of data subjects are/may be concerned by the processing under 2:

Designated EIB/EIF Staff members and consultants featured in articles and project content., content
authors (for stories and press), promoters / financial Intermediaries related to projects, photo subjects
used in website photos with specific data protection approval (at time of photo / video capture), website
visitors.

6. What personal data does the EIB process?

The EIB processes the following categories of personal data: Name, Contact information (Email
address, telephone number, Internet address), Photo, Video, Voice recordings. . The following data are
also processed:

• Website user function/behaviors
  o Internal metrics – not applicable
  o Embedded services – User ID / Behaviour on embedded content
• As part of website analytics monitoring, the data processor collects Internet Protocol address
  (IP address) or device ID (e.g. IMEI numbers or WiFi MAC addresses) of the device used to
  access the website. These data are anonymised and stored.
• Cookies: these data files are in the vast majority set by the visited website, also known as “Firstparty cookies”, and their purpose is to enable the site to store visitor preferences, make the
  websites operational and gather anonymous analytics data for a certain period of time. More
  info about cookies can be found here Cookies on the Jaspers website (eib.org).
• Web analytics: When opening a page where EIB’s web analytics is enabled, the browsing
  experience is registered by the service. If cookies are refused, the EIB’s web analytics will also
  stop registering the browsing experience
• Audiovisual data: In these cases, specific data protection records and relevant privacy
  statements are established. For any other data that can be used, specific data protection
  records & relevant privacy statements are established

7. Where does the EIB obtain the personal data?

Personal data is obtained directly from the data subject.

8. To whom is the personal data disclosed?

The EIB may disclose personal data to the following recipients:

• Internally, to the EIB relevant services: authorised EIB personnel in charge of business
  processing, EIB webmasters and online editors in charge of website updates
• service providers who hold and process your personal data on our behalf, under strict conditions
  of confidentiality and security.

9. International Transfers

Personal data may be transferred to entities established outside the EU or the European Economic
Area.

10. How long does the EIB keep personal data?

Personal data will be kept for the time necessary to fulfil the purpose of collection or further processing,
or until a potential request from the concerned data subject “to be forgotten” (Art. 19 of Regulation (EU)
N° 2018/1 725). More specifically:

• Website user function/behaviours – 1 year
• Website users requesting information – 5 years then archived

11. What are the rights of data subjects and how can they exercise them?

Data subjects’ rights are set out in sections 3 to 5 of the EU DPR.

• Data subjects have the right to obtain from the controller confirmation as to whether or not their
  personal data are being processed, and, if so, to access their personal data by contacting the
  controller or through the EIB DPO (right of access);
• Data subjects have the right to request the controller to rectify any inaccurate data and/or have
  incomplete personal data completed (right to rectification);
• Data subjects have the right to request the controller to erase their personal data as per Article
  19 of the EU DPR (right to be forgotten);
• Data subjects have the right to request the controller to restrict the processing of their
  personal data in the following cases (right to restriction of processing):
  (i) if they contest the accuracy of their data;
  (ii) if the processing of the data is unlawful and they oppose to their erasure;
  (iii) if the controller no longer needs the personal data referred to for the purposes of the
  processing but the data subject concerned needs them for the establishment, exercise
  or defence of legal claims; or
  (iv) if data subjects have objected to the processing of their data and the EIB seeks to
  establish whether the controller has legitimate grounds overriding data subjects’ right to
  restriction.
• Data subjects have the right to object to the processing of personal data, on grounds relating
  to their particular situation, unless the EIB demonstrates compelling legitimate grounds for the
  processing or for the establishment, exercise or defence of legal claims;
• Data subjects have the right to receive their personal data from the EIB in a structured,
  commonly used and machine-readable format to allow you to transmit your data to another
  controller without hindrance from the EIB (right to data portability);
• When the legal basis of the processing is consent, data subjects have the right to withdraw their
  consent at any time. The withdrawal of consent shall not affect the lawfulness of processing
  based on consent before its withdrawal;
• Data subjects have the right to lodge a complaint with the European Data Protection Supervisor
  (www.edps.europa.eu) at any time (right to lodge a complaint).

12. Contact

Should data subjects have any questions about the processing of their personal data, or wish to exercise
any of the aforementioned rights, please contact General Secretariate: webmaster@eib.org or the EIB’s
Data Protection Officer, Mr. Pelopidas Donos, by email at p.donos@eib.org or at the following address:

Mr. Pelopidas Donos
European Investment Bank
98-100 Boulevard Konrad Adenauer
L-2950 Luxembourg (Grand Duchy of Luxembourg)