VET-PASS Data Processing Statement

We process personal data about four kinds of people:

• Applicants — people who have applied in e-COST to join a Working Group.
• Participants — Working Group members, Management Committee members, Core Group members and other role-holders.
• Volunteers — people who expressed interest through this site's “Get involved” form (currently closed).
• Country contacts — regulators and bodies named in the public Directory, which holds organisational and publicly available contact details.

Where you already hold an account with EBVS (as a diplomate or resident of a European veterinary College), your VET-PASS access is attached to that account rather than duplicated, and your name and email come from the EBVS register.

• Screening applications against the Working Groups' published criteria and recommending decisions to the Management Committee — our legitimate interest in composing the Action's Working Groups fairly, and the task COST entrusts to the Action.
• Running the Action — access to the members' area, meeting invitations and logistics, task reminders, shared documents, the forums — performance of your participation in the Action, which you confirm on the consent page.
• Reporting to COST on geographical spread, inclusiveness and gender balance — legitimate interest and COST's rules; reporting is aggregate and does not identify you.
• Gender is a special category. It arrives in the e-COST export, is used only for aggregate reporting during screening, and is deleted at the decision; it is not stored on participant records.
• Security and accountability — audit entries and sign-in records are kept to protect the members' area and to show who did what; legitimate interest.

1. The Core Group imports the e-COST export and scores each application against its Working Group's criteria. Only Core Group members and administrators see the application text; Working Group leads see their own group's.
2. The cycle goes to the Management Committee, which sees names, countries, scores and recommendations, and the Chair records the decision.
3. Rejected: the application, all scores and comments, and the applicant's record are deleted immediately. We keep only a one-way hash of the email address with the Working Group and outcome, so that the same application is recognised if it is submitted again. The hash cannot be turned back into the address.
4. Approved: the narrative fields (motivation, expertise, COST history, gender) and all scores are deleted at once. You are emailed a personal link to a page showing the data we still hold, this statement in summary, and a choice of how visible you wish to be. Accept → your access is created and we record the date, the statement version and your choice. Decline, or no answer within 30 days (a reminder is sent after 14) → your remaining details and the emails we sent you are deleted, leaving the hashed record as for a rejection.

e-COST keeps its own copy of your application under the COST Association's rules; this section describes only ours.

• The public sees nothing about applicants. For participants, it sees only what you chose on the consent page (listed with affiliation and country, name only, or not listed) once Working Group member lists are published, and the names of office-holders such as the Chair, Working Group leads and Management Committee members as COST requires.
• Your Working Group sees your name, email, affiliation and country, and your work in it.
• The Core Group and administrators see all participant records and open applications.
• Our processors, bound by contract and acting only on our instructions: the hosting provider for our servers (EU), Cloudflare for encrypted off-site backups (EU jurisdiction) and web protection, and Brevo for sending email (EU). Documents are edited in a Collabora Online instance we run ourselves; forums run on a Discourse instance we run ourselves. No processor outside the EEA receives your data.
• COST Association receives aggregate reports, and the formal membership of the Action is recorded in e-COST under its own notice.

We do not sell data, use it for marketing, or make automated decisions about you.

• Rejected and declined applications: deleted at once, as in section 4; the hashed record is kept for the life of the Action.
• Participant records, roles, consent records, meetings, tasks, documents and forum posts: for the duration of the Action (to 2030) and up to two years afterwards for reporting and the Action's final deliverables, then deleted or anonymised. Public deliverables and minutes that name office-holders remain part of the Action's record.
• Mail log: 12 months, except entries to people who declined, which are deleted with their application.
• Audit entries and sign-in records: for the duration of the Action.
• Backups: nightly encrypted copies of our databases are kept for 14 days on our servers and 30 days off-site. Data deleted from the live system can therefore remain in a backup for up to 30 days. Backups are used only to recover from failure, are never browsed, and if one is ever restored the deletions recorded since are re-applied before the system is returned to use.

On the consent page, and afterwards in your profile, you choose how visible you are publicly. You can withdraw from the Action at any time by writing to privacy@vet-pass.eu; your participant record is then deleted, and your name remains only where it is part of the Action's formal record (minutes, published deliverables, e-COST).

Under the GDPR you may ask for access to your data, correction, deletion, restriction, portability, and object to processing based on legitimate interest. Write to the address above; we answer within a month. You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), as EBVS is established in the Netherlands, or to the authority in your own country.

The version at the top changes when the statement's meaning changes; the version you accepted is kept with your consent record. Material changes are notified to participants by email.