Privacy statement

1. Introduction

The European Commission (hereafter "the Commission") is committed to protecting your personal data and respecting your privacy. The Commission collects and further processes personal data pursuant to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.

This privacy statement explains the reason for the processing of your personal data within the PMOTG (PMO On The Go) mobile application, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you have in relation to your personal data.

2. Why and how do we process your personal data?

The PMOTG application processes personal data for the following purposes:

• Authentication and access management: verifying your identity via EU Login (OpenID Connect) to provide secure access to the application services.
• Push notifications: delivering real-time notifications relevant to your activities and preferences through Firebase Cloud Messaging.
• User preferences: storing your language settings, notification preferences, and application configuration to provide a personalised experience.
• Device registration: registering your mobile device for push notification delivery through the Central Push Notification Service (CPNS).
• Usage statistics: counting which screens and features of the application are used, in order to improve it, through Firebase Analytics (Google). These statistics are pseudonymous and counted per installation of the application: they carry no name, e-mail address or other identifier of yours.
• Crash reports: diagnosing failures of the application through Firebase Crashlytics (Google). A crash report is linked to the installation of the application, not to you: it carries no name or e-mail address.
• Your latest payslip: showing it inside the application, in its own viewer, without saving it on your device. If you choose «Open in another app», the application hands a single-use link to your device's browser, which opens the payslip and may save a copy of it on your device (on Android, in the Downloads folder); the application tells you so the first time. That copy is then under your control.

3. On what legal ground(s) do we process your personal data?

We process your personal data on the following legal grounds:

• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body (Article 5(1)(a) of Regulation (EU) 2018/1725).
• Where specific features require it, processing is based on your explicit consent (Article 5(1)(d) of Regulation (EU) 2018/1725). You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

4. What personal data do we collect and further process?

In order to provide the application services, we collect the following categories of personal data:

• Identification data: name, email address, department number, and EU Login credentials (via ECAS authentication tokens).
• Device data: device identifier, platform type (iOS/Android), and push notification token for notification delivery.
• Usage data: notification interaction history (read, archived, starred), language preferences, and application settings.
• Usage statistics and diagnostics: the screens you open and the features you use (for example, a tile tapped on the home page), the device model, operating system and application version and, after a crash, the technical details of the failure. They are linked to a random identifier of the installation, never to your name or e-mail address.

5. How long do we keep your personal data?

We only keep your personal data for the time necessary to fulfil the purposes of collection:

• Authentication tokens: for the duration of the active session. Tokens are refreshed or revoked upon logout.
• Notification data: retained for a maximum of 2 years from the date of receipt, after which they are automatically purged.
• Device registration data: retained as long as the application is installed on your device. The registration is removed upon uninstallation or manual deregistration.
• User preferences: retained as long as your account is active. Deleted upon account deactivation or upon your request.
• Usage statistics: kept by Firebase Analytics for the period set in the application's Firebase project, at most 14 months, then deleted.
• Crash reports: kept by Firebase Crashlytics for 90 days, then deleted.
• Payslip: not stored by the application. A copy saved by the browser through «Open in another app» stays on your device until you delete it.

6. How do we protect and safeguard your personal data?

All personal data is stored on servers of the European Commission and its contractors. All processing operations are carried out pursuant to Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission.

In order to protect your personal data, the Commission has put in place a number of technical and organisational measures, including:

• Encrypted communication channels (HTTPS/TLS) for all data transmission.
• CSRF prevention, CORS security, and cache prevention interceptors.
• OpenID Connect authentication with multi-factor authentication support.
• Access restricted to authorised staff on a need-to-know basis.

7. Who has access to your personal data and to whom is it disclosed?

Access to your personal data is provided to authorised Commission staff and contractors responsible for carrying out the processing operations on a need-to-know basis. Such staff abide by statutory, and when required, additional confidentiality agreements.

The following services may process your data:

• EU Login / ECAS (European Commission Authentication Service) — for identity verification.
• Central Notification Service (CNS) — for notification management and delivery.
• Central Push Notification Service (CPNS) — for mobile push notification delivery.
• Compass Corporate User Profile — for user profile and preference management.
• Firebase Cloud Messaging (Google) — for push notification transport to mobile devices.
• Firebase Analytics (Google) — for pseudonymous usage statistics, counted per installation.
• Firebase Crashlytics (Google) — for crash reports, linked to the installation.

8. What are your rights and how can you exercise them?

You have specific rights as a "data subject" under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular:

• The right to access your personal data (Article 17).
• The right to rectify your personal data if it is inaccurate or incomplete (Article 18).
• The right to erase your personal data (Article 19).
• Where applicable, the right to restrict the processing of your personal data (Article 20).
• The right to data portability (Article 22).
• The right to object to the processing of your personal data (Article 23).

You can exercise your rights by contacting the Data Controller or, in case of conflict, the Data Protection Officer. If necessary, you can also address the European Data Protection Supervisor.

9. Contact information

Data Controller

If you would like to exercise your rights under Regulation (EU) 2018/1725, or if you have comments, questions or concerns regarding the processing of your personal data, please contact:

PMO — Office for the Administration and Payment of Individual Entitlements
European Commission
Email: PMO-IT-COORDINATION@ec.europa.eu

Data Protection Officer (DPO)

You may contact the Data Protection Officer with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725:

Email: DATA-PROTECTION-OFFICER@ec.europa.eu

European Data Protection Supervisor (EDPS)

You have the right to have recourse (i.e. you can lodge a complaint) to the European Data Protection Supervisor if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data:

European Data Protection Supervisor
Email: edps@edps.europa.eu
Website: https://edps.europa.eu

This privacy statement was last updated on October 2026.