Privacy statement

1. Introduction

The European Commission (hereafter "the Commission") is committed to protecting your personal data and respecting your privacy. The Commission collects and further processes personal data pursuant to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.

This privacy statement explains the reason for the processing of your personal data within the EC Where2Go mobile application, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you have in relation to your personal data.

2. Why and how do we process your personal data?

EC Where2Go processes personal data for the following purposes:

• Authentication and access management: verifying your identity via EU Login (OpenID Connect) to give you access to the application.
• Buildings and services: showing the Commission buildings, their facilities, the daily menus and the IT services, and your profile as known to the Where2Go service.
• BeWell activities: listing the activities and events, and registering you for a session or cancelling your registration when you ask for it.
• Assistant (optional): when you use the assistant, your messages and the information it looks up to answer them — buildings, BeWell activities, your profile and, only if you allow each tool in Settings, device information such as your location or network status — are sent to GPT@EC, the Commission's generative AI service, which produces the answers. A photo you take, a picture or a file you pick, or a screenshot — through the assistant's tools, each only when you allow it, or the attach button — is sent to the assistant's service with your message, so that it can answer about it; a copy stays on this device with the conversation.
• Map and location (optional): showing your position on the map, only if you grant the location permission. Your position is used on your device; the map tiles are loaded from the Commission's GISCO service.
• Application quality: crash reports and pseudonymous usage statistics through Firebase Crashlytics and Firebase Analytics, to find and fix errors and to see which parts of the application are used. Usage statistics are counted per installation of the application, not per person: the screens opened and a few actions, such as signing in or opening the assistant. Your name and e-mail address are not sent to them.
• Application updates: checking for and downloading updates of the application through the Capawesome Cloud live-update service.
• Your settings: keeping your language, theme and optional biometric unlock on your device.

3. On what legal ground(s) do we process your personal data?

We process your personal data on the following legal grounds:

• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body (Article 5(1)(a) of Regulation (EU) 2018/1725).
• Where specific features require it — your location, the assistant's device tools and the biometric unlock — processing is based on your explicit consent (Article 5(1)(d) of Regulation (EU) 2018/1725). You may withdraw your consent at any time, in the device settings or in the application's Settings, without affecting the lawfulness of processing based on consent before its withdrawal.

4. What personal data do we collect and further process?

• Identification data: EU Login user identifier, name, e-mail address, organisation, building and country, and your BeWell group and roles.
• BeWell registrations: the activities and sessions you registered for, with their dates and status.
• Assistant data: the text of your messages, the answers, and the information looked up to produce them; your location only if you allowed it.
• Location data: your position, only while you use the map or an assistant tool you allowed.
• Technical data: device model, operating system and application versions, a pseudonymous installation identifier, crash details, and the IP address seen by the services the application contacts.

5. How long do we keep your personal data?

• Session data on your device: until you sign out or the session expires.
• Other data on your device (cached content, assistant conversations, your biometric unlock choice): deleted when you sign out; your language and theme choices and a technical diagnostic log remain until you uninstall the application.
• BeWell registrations: kept by the Where2Go service for as long as needed to manage the activities and their attendance.
• Assistant messages: processed by GPT@EC under its own record of processing and retention rules.
• Crash reports and usage statistics: for the retention periods set in the application's Firebase project.

6. How do we protect and safeguard your personal data?

All personal data is stored on servers of the European Commission and its contractors. All processing operations are carried out pursuant to Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission.

In order to protect your personal data, the Commission has put in place a number of technical and organisational measures, including:

• Encrypted communication channels (HTTPS/TLS) for all data transmission.
• Session credentials kept in the device's secure storage, optionally protected by biometric unlock.
• OpenID Connect authentication through EU Login, with multi-factor authentication support.
• Access restricted to authorised staff on a need-to-know basis.

7. Who has access to your personal data and to whom is it disclosed?

Access to your personal data is provided to authorised Commission staff and contractors responsible for carrying out the processing operations on a need-to-know basis. Such staff abide by statutory, and when required, additional confidentiality agreements.

The following services may process your data:

• EU Login (European Commission Authentication Service) — for identity verification.
• The Where2Go service (European Commission) — for buildings, services, your profile and BeWell registrations.
• GPT@EC (European Commission) — for the assistant's answers, when you use it.
• GISCO (European Commission, Eurostat) — for the map tiles.
• Firebase Crashlytics and Firebase Analytics (Google) — for crash reports and usage statistics.
• Capawesome Cloud — for application updates.

8. What are your rights and how can you exercise them?

You have specific rights as a "data subject" under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular:

• The right to access your personal data (Article 17).
• The right to rectify your personal data if it is inaccurate or incomplete (Article 18).
• The right to erase your personal data (Article 19).
• Where applicable, the right to restrict the processing of your personal data (Article 20).
• The right to data portability (Article 22).
• The right to object to the processing of your personal data (Article 23).

You can exercise your rights by contacting the Data Controller or, in case of conflict, the Data Protection Officer. If necessary, you can also address the European Data Protection Supervisor.

9. Contact information

Data Controller

If you would like to exercise your rights under Regulation (EU) 2018/1725, or if you have comments, questions or concerns regarding the processing of your personal data, please contact:

Directorate-General for Digital Services (DIGIT), Unit B.3
European Commission
Email: DIGIT-ON-THE-GO-DEV@ec.europa.eu

Data Protection Officer (DPO)

You may contact the Data Protection Officer with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725:

Email: DATA-PROTECTION-OFFICER@ec.europa.eu

European Data Protection Supervisor (EDPS)

You have the right to have recourse (i.e. you can lodge a complaint) to the European Data Protection Supervisor if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data:

European Data Protection Supervisor
Email: edps@edps.europa.eu
Website: https://edps.europa.eu

This privacy statement was last updated on 1 October 2026.