Privacy Policy

Last updated: October 2026

This Privacy Policy explains how the EU Funds Corruption Controller website (the “Website”) collects, uses, stores and protects personal data, and what rights you have in relation to it. We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and applicable national data protection law. We collect as little data as possible, and we do not use it for anything other than the purposes described here.

1. Who is responsible for your data

The Website is operated by the EU Funds Corruption Controller (the “controller”, “we”, “us”). If you have any questions about this policy or about how your data is handled, contact us at iec@liberalforum.eu.

2. What data we collect

We collect only the data needed to run the Website and improve it. Depending on how you use the Website, this may include:

• Contact data. Your name, email address and the content of your message when you contact us through the contact form or by email, and any other information you choose to include.
• Usage data. Anonymised information about how the Website is used, such as pages visited, referring page, time and duration of the visit, approximate location (country or region), device type, screen size, operating system and browser.
• Technical data. Your IP address, which our servers process to deliver pages and to protect the Website against abuse, as well as server logs and the data stored in cookies and similar technologies, described below.
• Preference data. Your cookie choices and interface settings, such as the selected language.

We do not ask you to create an account, and we do not knowingly collect special categories of personal data (such as data revealing political opinions or health). Please do not send us such data through the contact form. The Website is not directed at children under 16, and we do not knowingly collect their data.

3. Why we use your data and on what legal basis

• To respond to your enquiries (legal basis: our legitimate interest in communicating with the people who contact us, or steps taken at your request, Article 6(1)(f) and (b) GDPR).
• To measure and improve the Website through privacy-friendly analytics that does not use cookies (legal basis: our legitimate interest in understanding how the Website is used, Article 6(1)(f) GDPR).
• To display embedded social media content (legal basis: your consent, Article 6(1)(a) GDPR).
• To keep the Website secure and working properly, including preventing abuse and fixing errors (legal basis: our legitimate interest, Article 6(1)(f) GDPR).
• To comply with legal obligations where the law requires us to keep or disclose data (legal basis: Article 6(1)(c) GDPR).

Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interest, we have weighed it against your rights and interests, and you may object to the processing as described in the section on your rights.

4. Cookies and similar technologies

Cookies are small text files stored on your device when you visit a website. When you first visit the Website you can choose which categories of cookies to allow, and you can change or withdraw your choice at any time through the cookie settings. Apart from essential cookies, nothing is stored or loaded before you give consent.

• Essential cookies store your preferences, including your cookie choices, and are required for the Website to work. They do not contain personally identifiable information and cannot be switched off.
• Social media cookies allow the display of interactive social media elements, such as embedded posts or videos. The providers of these services may set their own cookies and receive data such as your IP address.

You can also delete cookies or block them in your browser settings. Doing so may affect how parts of the Website work. If you refuse non-essential cookies, you can still use the entire Website.

Website analytics. To measure traffic we use Matomo, an open-source analytics tool hosted on the same server as the Website. It does not set cookies or store anything on your device. When a page loads, it reads basic technical information from your browser, such as the browser and operating system type, screen resolution and language, together with the page you visit and the page you came from. The last two bytes of your IP address are removed before a visit is recorded (for example, 192.168.x.x), so your location is known only approximately, at country or region level. The data is not shared with Matomo or any other third party and is not used for advertising, profiling or to identify you. Analytics runs for all visitors without asking for consent, on the basis of our legitimate interest in knowing how the Website is used (Article 6(1)(f) GDPR). You can object to this processing at any time by contacting us, or block it with a content-blocking extension in your browser.

5. Sharing your data

We do not sell your personal data. We share data only with:

• Service providers who process it on our behalf under a written agreement, such as hosting and email providers. They may use the data only to provide their service to us.
• Public authorities and professional advisers, where required by law or necessary to establish, exercise or defend legal claims.

The Website may contain links to external websites, including the websites of EU institutions, courts and media referenced in our case archive. We are not responsible for their privacy practices, and we encourage you to read their policies.

6. Transfers outside the European Economic Area

Analytics data stays on our own server and is not transferred to third parties. If any of our service providers processes data outside the European Economic Area, we make sure the transfer is covered by appropriate safeguards, such as an adequacy decision of the European Commission or standard contractual clauses, in line with Chapter V GDPR. You can ask us for more information about these safeguards using the contact details above.

7. How long we keep your data

We keep personal data only for as long as necessary for the purposes described above, and then delete or anonymise it.

• Messages and related correspondence are kept for as long as needed to handle your enquiry and for a reasonable period afterwards, unless the law requires longer retention.
• Analytics data is recorded with shortened IP addresses. Detailed visit records are deleted automatically after 12 months; after that, only aggregated statistics (for example, the number of visits per page) are kept.
• Cookie data is kept for the lifetime of the relevant cookie. Your cookie choices are stored for up to 12 months, after which we will ask you again.
• Server logs are kept for a short period for security and troubleshooting.

8. How we protect your data

We apply appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including encrypted connections (HTTPS), access controls, regular software updates and the careful selection of providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach is likely to put your rights at risk, we will notify the competent authority and, where required, the people affected.

9. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy of it;
• rectification, that is, to have inaccurate or incomplete data corrected;
• erasure, that is, to have your data deleted where there is no longer a reason to keep it;
• restriction of processing in certain situations;
• object to processing based on legitimate interest, and at any time to processing for direct marketing;
• data portability, that is, to receive the data you provided in a structured, commonly used format;
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, contact us using the email address above. We will reply within one month. We may ask you to confirm your identity before acting on a request, and we will not charge a fee unless a request is clearly unfounded or excessive.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State where you live, work or where the alleged infringement took place. We would appreciate the chance to address your concern first, so please contact us.

10. Automated decision-making

We do not use automated decision-making or profiling that produces legal effects for you or similarly significantly affects you.

11. Information about people in our case archive

The Website publishes information about corruption cases that is already public, such as announcements of the European Public Prosecutor’s Office (EPPO), the European Anti-Fraud Office (OLAF), national prosecutors, courts and reputable media. This is done in the public interest and in the exercise of freedom of expression and information. We distinguish allegations from findings, and findings from final judgments, and we respect the presumption of innocence. If you believe that an entry contains an error or is out of date, contact us with a link to the relevant source and we will review and, where appropriate, correct it promptly.

12. Changes to this policy

We may update this policy from time to time, for example when we change how the Website works or when the law changes. The latest version is always published on this page, together with the date it was last updated. If a change is significant, we will draw attention to it on the Website.

13. Contact

For any question about this policy or your personal data, write to iec@liberalforum.eu.