Skip to main content

Protecting your privacy is of the utmost importance to GSP Hub. The GSP Hub is committed to respecting and protecting your personal data and ensuring your rights as a data subject. All data of a personal nature that identifies you directly or indirectly will be handled fairly, lawfully and with due care.

This processing operation is subject to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices, and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.

1. What is the nature of the processing operation and what do we do with your data?

Personal data is processed for the purposes of communication/transparency to provide and make available information on the projects’ activities/initiatives/events, etc.
Based on the above, we use your data to:
• Compile project statistics for project reporting purposes;
• If you are using the GSP Hub to share your thoughts about the implementation of the GSP conventions in beneficiary countries; ask your feedback about the usefulness of the answers provided; and in limited instances use of pictures and/or audiovisual items on social media and on the project’s website;
• In addition, you may exceptionally be contacted by our services in very limited instances – e.g. information about an update to the privacy policy, offering collaboration opportunities, or for a survey about user needs and service improvements.

2. What personal data do we process?

The categories/types of personal data processed are the following:
The types of personally identifiable information that may be collected upon registration include information needed in order to provide the e-service, (e.g. name, e-mail, organisation)

3. Who is responsible for processing the data?

The data controller of the processing operation is Head of Unit DG TRADE D1 – Trade and Sustainable Development, Generalised System of Preferences. Personal data is processed by the consortium members of the GSP Hub. 

4. Who has access to your personal data and to whom is it disclosed?

Images and other audio-visual items are published on the websites and social media and available to the general public.
Other personal data is only accessible by the GSP Hub consortium and the controller, as well as the bodies charged with monitoring or inspection tasks in the application of EU law (e.g. internal audits, Court of Auditors, European Anti-fraud Office (OLAF)) and other EU institutions on a need-to-know basis. Personal data is not used for any other purposes or disclosed to any other recipient nor third countries or international organisations.

5. How do we protect and safeguard your information?

We take appropriate technical and organisational measures to safeguard and protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
All personal data related to the projects’ procedures is stored in secure IT applications according to the Office’s security standards, as well as in specific electronic folders accessible to authorised recipients only. Appropriate levels of access are granted individually only to the abovementioned recipients.
The database is password-protected under a single sign-on system and connected automatically to the user’s ID. E-records are held securely to safeguard the confidentiality and privacy of the data therein.

6. How can you access your personal information and, if necessary, correct it? How can you receive your data? How can you request that your personal data be erased, or restrict or object to its processing?

You have the right to access, rectify, erase, and receive your personal data, as well as restrict its processing or object to the same, as provided in Articles 17 to 24 of Regulation (EU) 2018/1725.
We want to make sure that your personal information is accurate and up to date. You may ask us to correct or remove information you think is inaccurate. You also have the right to have your data completely removed from our database. To modify or remove your personal information completely from our website and database, please send an email to:

Your request will be answered without undue delay, and in any event within 1 month of receipt of the request. However, according to Article 14(3) of Regulation (EU) 2018/1725, this period may be extended by up to 2 months where necessary, taking into account the complexity and number of requests. The GSP Hub will inform you of any such extension within 1 month of receipt of the request, together with the reasons for the delay.

Third-party platforms

Finally, it may be possible that the GSP Hub website contains links to other sites whose data processing practices are different from ours. Neither the consortium partners nor the European Union are responsible for the privacy practices implemented on any of these external sites. You should be aware of this when leaving the GSP Hub website, and we encourage you to read the privacy statements on such external websites, as we have no control over the information that is submitted to or collected by these third parties.
We also use third-party platforms to carry out some of our services for you and you can find their privacy policies separately on their website.

7. What is the legal basis for processing your data?

Personal data is processed in accordance with Article 5(1)(a) of Regulation (EU) 2018/1725, which states that ‘processing is necessary for the performance of a task carried out in the public interest’.
Personal data is collected and processed in accordance with the contract signed between the Project Contracting Authority, namely the European Commission’s DG TRADE, and the GSP Hub Team, namely SD Policies Limited and Development Solutions Europe Ltd.

8. How long can data be kept?

Personal data will be kept only for the time needed to achieve the purpose for which it is processed.
All data related to the project will be stored for the duration of the project. This is normally 2 years. Information will be shared on the website and in the media and is stored for as long as the European Commission considers it appropriate.
In the event of a formal appeal, all data held at the time of the appeal will be retained until the completion of the appeal process.

9. Contact information

Should you have any queries on the processing of your personal data, please address them to the data controller, Head of Unit DG TRADE D1


You shall have right of recourse at any time to the DG TRADE Data Protection Officer at and to the European Data Protection Supervisor at

10. Links to other websites

It may be possible that the GSP Hub web pages contain links to other sites whose privacy practices may differ. Neither the GSP Hub nor the European Commission, nor DG TRADE are responsible for the Privacy Policy of these websites. We encourage you to read the privacy statements on other websites you visit, as we have no control over information that is submitted to, or collected by, these third parties. 


11. Cookies

What is a cookie?
A cookie is a simple text file that is stored on your computer or mobile device while you browse a website by such website’s and allows a website storing you browse preferences such as visits frequency, preferred options, etc.

How do we use cookies?
Enabling these cookies is not strictly necessary for the website to work but it will provide you with a better browsing experience. You can delete or block these cookies, but if you do that some features of this site may not work as intended.

The cookie-related information is not used to identify you personally and the pattern data is fully under our control. These cookies are not used for any purpose other than those described here.

How to control cookies?
You can control and/or delete cookies as you wish - for details, see You can delete all cookies that are already on your computer and you can set most browsers to prevent them from being placed. If you do this, however, you may have to manually adjust some preferences every time you visit a site and some services and functionalities may not work.

Website cookies

A list of the different cookies that are used on this website are set out below. We have categorised these to help you understand the type of function the cookies are performing.

Strictly Necessary Cookies:

These cookies are essential in order to enable you to move around the website and use its features, such as accessing secure areas of the website. Without these cookies, some of the services you have asked for could not be provided. 

Cookie Name


Purpose of the cookie

Further Information



Uniquely identifies a user who has logged in. The cookie is associated with a user account in the database backend along with any information the user provides in their profile

This cookie lasts for 22-23 days or until you logout.



Used only for administration user accounts to administer the website module list and to personalise the website module lists for administrator. The cookie is used to store the previous filter criteria on modules list page.

Expires in 7 days



It is set when the user clicks on the “OK, I accept” button on the “Cookies Pop-up banner” or when the user, after viewing the “Cookies Pop-up banner”, proceeds to use the website by clicking any link on the website.

Expires in 3 months



Let visitors choose which cookie categories they want to opt-in for (GDPR compliant)

Expires in 3 months


Analytics and Performance Cookies:

These cookies collect information about how visitors use a website, for instance which pages visitors go to most often, and if they get error messages from web pages. These cookies do not collect information that identifies a visitor and all information collected is aggregated and therefore anonymous. These cookies improve how a website works. 

Cookie Name


Purpose of the cookie

Further Information



This keeps visitor ID value used by Piwik to recognize returning visitors.

This cookie is deleted after 13 months



Session cookies are responsible for keeping the session active for 30 minutes after last tracked action, when they expire the visit is considered as ended, the time can be altered.

This cookie is deleted after 30 minutes

We use analytic information to help us make our website more focussed and better for our website visitors. You may, however, opt out of Piwik Analytics tracking if you prefer. 

Functionality Cookies:

These cookies allow the website to remember choices you make (e.g. language setting, text size) and provide enhanced, more personal features. They can help provide services such as local weather reports by storing in a cookie the region in which you are currently located. These cookies may also be used to provide services you have asked for such as watching a video or commenting on a blog. The information collected may be anonymous and they cannot track your browsing activity on other websites.

Cookie Name



Further Information



Informs our website whether the user has Javascript enabled. This is anonymous and doesn't uniquely identify the user.

This cookie is deleted when you close your browser