Privacy Information

1. About EvaDesk and this privacy information

EvaDesk is a digital platform used to support the organisation and delivery of project-proposal evaluation processes.

EvaDesk is provided and technically operated by Micro Digital d.o.o.

For evaluation services currently provided through EvaDesk, the Ministry of Science, Education and Youth of the Republic of Croatia (the “Client”) is the contracting authority. Micro Digital processes personal data on behalf of the Client and according to its documented instructions and the applicable contractual and data-protection arrangements.

The current EvaDesk implementation for the Client was established in the context of the Digital, Innovation and Green Technology Project (DIGIT), supported through IBRD Loan No. 9558-HR.

This page provides general information about personal data processed through the EvaDesk platform in connection with evaluation services provided to the Client. Additional privacy information may apply to a specific evaluation call or engagement and may be provided by the Client.

2. Personal data processed through EvaDesk

Depending on your role and participation in an evaluation process, EvaDesk may process information such as:

• name and contact details;
• organisation or institution;
• professional and evaluator-profile information;
• Microsoft Entra user and authentication information;
• user roles and access permissions;
• evaluator assignments and conflict-of-interest related records;
• evaluation workflow and activity information;
• technical, security and audit information generated through use of the platform.

The exact personal data processed depends on the relevant evaluation process, your role and the applicable instructions and requirements of the Client.

3. Why personal data is processed

Personal data may be processed through EvaDesk for purposes connected with the organisation and delivery of project-proposal evaluation processes, including:

• creating and administering user access;
• authenticating users and managing permissions;
• maintaining evaluator profiles and roles;
• managing evaluator pools and assignments;
• supporting project-proposal evaluation workflows;
• monitoring evaluation progress and supporting quality control;
• maintaining security, traceability and audit information;
• providing technical support and troubleshooting;
• preparing evaluation outputs, reports and data exports required by the Client.

The EvaDesk platform does not use personal data for advertising or marketing purposes.

EvaDesk is designed to support role-based user access, evaluator independence, traceability and secure authenticated access to evaluation information. The Client's requirements include secure authentication, confidentiality, auditability and restrictions ensuring that evaluators access only the information assigned to them.

4. Data protection roles and processing on behalf of the Client

For evaluation services provided to the Ministry of Science, Education and Youth of the Republic of Croatia, Micro Digital processes personal data on behalf of the Client and according to its documented instructions.

Under the applicable contractual model, Micro Digital acts as a processor of personal data on behalf of the Client.

The purposes and legal basis applicable to the underlying evaluation process are determined within the relevant legal, contractual and evaluation framework of the Client.

Micro Digital does not independently determine new purposes for the use of Client personal data processed through EvaDesk.

The contractual framework requires personal-data processing to comply with Regulation (EU) 2016/679 (GDPR) and provides for a separate personal data processing agreement between the Client and Micro Digital.

5. Microsoft cloud services and data location

EvaDesk uses Microsoft cloud services, including:

• Microsoft Entra ID;
• Microsoft 365;
• Microsoft SharePoint Online;
• other Microsoft 365 services required for operation of the evaluation platform.

These services are used for functions such as identity management, authentication, access control, data storage, workflow support and platform operation.

The EvaDesk Microsoft 365 environment is designed and configured to meet the applicable contractual requirement that personal data be stored within the European Union / European Economic Area. The contractual documentation requires EU/EEA storage of personal data.

The current EvaDesk technical architecture uses a dedicated Microsoft 365 environment and Microsoft SharePoint Online as the principal operational platform.

6. Access, confidentiality and security

Access to EvaDesk is authenticated and restricted according to the user's role and business need.

Technical and organisational measures include, as applicable:

• role-based and least-privilege access;
• secure Microsoft authentication;
• encrypted HTTPS communication;
• controlled guest-user access;
• separation of access between evaluation processes;
• evaluator-specific access restrictions;
• audit information and version history;
• administrative and security controls intended to prevent unauthorised access, modification, loss or disclosure.

Evaluators are provided access only to the project proposals and evaluation materials assigned to them. Evaluations performed by other evaluators are not made available to them as part of the independent evaluation process.

Project proposals, evaluations and related information are treated as confidential.

The Client's contractual requirements also require appropriate technical and organisational measures for protection against unauthorised access, loss, destruction, modification, disclosure or other compromise of information and systems.

7. Retention, handover and deletion

Personal data is retained for as long as necessary to provide the relevant evaluation services and to meet applicable contractual, legal, security and audit requirements.

Client data will be retained, handed over and, where applicable, deleted in accordance with the Client's documented instructions and the applicable contractual requirements.

Specific retention, handover and deletion requirements may therefore depend on the applicable contractual arrangements and the continued need for platform and data availability.

The current contractual framework provides for final data handover and, when the applicable contract-closure conditions are met, written confirmation of deletion of Client data from the systems used for the assignment. The timing of this process may also depend on written notification from the Client that continued platform and data availability is no longer required.

8. Your data-protection rights

Depending on the applicable circumstances and legal framework, individuals may have rights concerning their personal data, including rights relating to:

• access;
• rectification;
• erasure;
• restriction of processing;
• objection;
• data portability;
• other rights provided by applicable data-protection law.

Questions or requests concerning the purposes, legal basis or substantive processing of personal data within an evaluation process should generally be addressed to the Ministry of Science, Education and Youth of the Republic of Croatia as the Client through the contact channels provided by the Ministry.

For privacy questions concerning EvaDesk platform access, administration or technical operation, you may contact:

Where appropriate, Micro Digital will coordinate such questions or requests with the Client.

9. Platform operator

EvaDesk is provided and technically operated by Micro Digital d.o.o. as a digital platform supporting project-proposal evaluation processes.