Processing of personal data in AGORA
Article 11
1. The transmission, storage and other processing of personal data in AGORA may take place only as necessary and proportionate and only for the following purposes: (a) supporting communications between AGORA actors in connection with the supervision, investigation, enforcement and monitoring under Regulation (EU) 2022/2065; (b) case-handling by AGORA actors when carrying out their own activities in connection with the supervision, investigation, enforcement and monitoring under Regulation (EU) 2022/2065; (c) performing the business and technical transformations of data listed in this Regulation, where this is necessary to enable the exchange of information referred to in points (a) and (b). 2. The processing of personal data may take place in AGORA only in respect of the following categories of data subjects: (a) natural persons whose personal information is contained in documents obtained in connection with the supervision, investigation, enforcement and monitoring under Regulation (EU) 2022/2065; (b) AGORA administrators and AGORA users that have been granted access to AGORA. 3. The processing of personal data may take place in AGORA only in respect of the following categories of personal data: a) identification data, contact details, case involvement data, case related data, and any other information deemed necessary for the supervision, investigation, enforcement and monitoring under Regulation (EU) 2022/2065; b) name, address, contact information, contact number and user ID of the AGORA administrators and AGORA users referred to in paragraph 2, point (b). 4. AGORA shall store the categories of personal data listed under Article 11(3) of this Regulation and the logs indicating information about the flow and movements of the exchanged data carried out for the supervision, investigation, enforcement and monitoring under Regulation (EU) 2022/2065. 5. The storage of data referred to in paragraph 2 shall be performed using information technology infrastructure located in the European Economic Area. 6. Each AGORA actor shall ensure that data subjects can exercise their rights in accordance with Regulation (EU) 2016/679 and Regulation (EU) 2018/1725, and shall be responsible for compliance with these regulations for the personal data processing activities carried out on its behalf. 7. The national Supervisory Authorities and the European Data Protection Supervisor, each acting within the scope of their respective competence, shall ensure coordinated supervision of AGORA and its use by AGORA administrators and AGORA users.