Privacy Policy

PRIVACY NOTICE AND CONSENT FORM FOR: DISCOVER ESA LIVE

For Internal Reference: DPNR Reference Number: 1957

If possible, provide this “DPNR Reference Number” in any communication with the ESA Data Protection Officer (DPO@esa.int) for quick reference of the Processing in question.

This Privacy Notice was last updated on: 03/03/2023

———————————————————————————————————————–

INTRODUCTION

The European Space Agency (herein the “Agency” or “ESA”) is an intergovernmental organisation established by its Convention opened for signature in Paris on 30 May 1975. The Protection of Personal Data is of great importance for ESA, which strives to ensure a high level of protection as required by the ESA Framework on Personal Data Protection (herein the “ESA PDP Framework”) which applies for processing of Personal Data at ESA, available at:

http://www.esa.int/About_Us/Law_at_ESA/Highlights_of_ESA_rules_and_regulations

The ESA PDP Framework applicable for the processing of Personal Data within ESA is composed of the following elements:

the Principles of Personal Data Protection, as adopted by ESA Council Resolution (ESA/C/CCLXVIII/Res.2 (Final)) adopted on 13 June 2017;
the Rules of Procedure for the Data Protection Supervisory Authority, as adopted by ESA Council Resolution (ESA/C/CCLXVIII/Res.2 (Final)) adopted on 13 June 2017; and
the Policy on Personal Data Protection adopted by Director General of ESA on 5 February 2018 and effective on 1 March 2022

The Agency does not consider your personal data as an asset for sale and, thus, does not sell your personal data to any third parties.

SCOPE OF THE PRIVACY NOTICE

This notice is intended to inform you about the processing of your personal data when you browse and interact with the Discover ESA Live website and more specifically about:

the identity of the Data Controller and contact details of the ESA Data Protection Officer (“DPO”);
the type of personal data collected and processed;
the modalities of collection of personal data;
the purpose of the collection and processing;
the recipients to whom the personal data of the Data Subject is disclosed;
the time-limits for storing the personal data;
your rights and the modalities by which you can exercise them and the practical modalities of exercising your rights and those rights of other persons, when processed in this Processing Activity under the ESA PDP Framework.

Please be aware that all references to “Data” in this document if not otherwise stated relate to data by which an individual could be identified/ having an identifying character, broadly defined as Personal Data.

This notice furthermore enables ESA to obtain your consent relating to the collection and further processing of your personal data, under the ESA PDP Framework where relevant.

Context, Activity Description and the Purpose for this Processing of your Personal Data/Information: What is this processing about?

The registration form allows you to obtain access to the events displayed on the Discover ESA Live website.

The general Purpose of this Processing is to provide you with the link to your assigned digital event.

DATA CONTROLLERS, DATA PROCESSORS and other RECIPIENTS of Personal Data and their contact details:

The following table provides you with an overview of all involved in processing your personal data at ESA.

Responsibility	Name and contact details of the responsible	Description
Controller	European Space Agency (ESA) Headquarters: 24 Rue du Général Bertrand, CS 30798, 75345 Paris Cedex 07, France. As a first point of contact you may contact ESA’s DPO at DPO@esa.int at all times.	Your personal data are collected and further processed as described in this Privacy Notice upon the decision taken by: ESA through and limited to staff directly involved in the management and functioning of the Discover ESA Live website.
ESA DPO	Data Protection Officer: DPO@esa.int	According to ESA PDP Framework, your first and unique point of contact concerning personal data matters is the ESA Data Protection Officer (“DPO”). In this regard your personal information may be processed by the ESA’s DPO to reply to your requests and to make the exercise of your rights under the ESA PDP possible.
ESA Data Processor	Space42 https://www.space42.eu/	Website development service supplier
ESA Data Processor	Atanar Technologies https://www.atanar.com/en/	Atanar provides the hosting and management of the ESA website and as such might have access to the information you provide when submitting the online form.

LEGAL BASIS: What is the legal basis for processing the personal data?

Individual Legal Basis for this processing:

5.2.1 i. (g) PDP; A purpose covered by the Consent of the Data Subject. ii. in a not excessive manner, as necessary for the purposes for which the Personal Data were collected or for which they are further Processed

DATA CATEGORIES:

The categories of personal data which may be collected and further processed for legitimate purposes per company or other party involved, are:

ROLE	PERSONAL DATA CATEGORIES	TYPE OF PERSONAL DATA	DATA PROCESSING PURPOSE (S)
As CONTROLLER ESA	Contact Information	Email address	Email address is only used to provide the event URL address upon user request.
As PROCESSOR Space42	Contact Information	Email address	To process your request
As PROCESSOR Atanar	Contact Information	Email address	To process your request

PERSONAL DATA RETENTION AND DELETION: How long are your personal data retained?

Your Personal Data is stored and processed based on the following timeframes:

PERSONAL DATA CATEGORIES

RETENTION

Contact Information (email)

Deleted within the next 24 hours after the URL of the event has been provided.

DATA SUBJECT RIGHTS: How can you access, erase, rectify, complete or amend your personal data?

You have the right to be informed in a transparent manner about: the processing of your personal data (the Controller, purpose, recipients, etc.); your rights and the modalities of exercising these, (e.g. erasure, rectification, completion, or amendment as per the conditions under PDP 5.1. i.; right for every interested Data Subject to lodge a complaint before the Supervisory Authority in case the former demonstrates or has serious reasons to believe that a Data Protection Incident occurred in relation with his/her Personal Data, following a decision of the Agency (e.g. Data Protection Officer). The right of information under PDP 5.4.1 i. and the right of access under Section 5.4.1 ii. shall not apply: (a) where and insofar as the Data Subject is already in possession of the information; (b) for the right of information, when processing of Personal Data is necessary for any Investigation or Dispute Resolution Procedure; (c) for the right of access, where and insofar such access would conflict with an Investigation Procedure concerning the Data Subject.

If you would like to exercise any of those rights, please send a request explicitly specifying your query to the ESA DPO via e-mail at dpo@esa.int or addressed to the:

ESA Data Protection Officer

24 Rue du Général Bertrand

CS 30798, 75345 Paris Cedex 07

France

via postal service.

Please keep in mind that the more specific information you can provide to us about the Activities, Events, Systems, ESA Departments and/or Processes where your personal data is to your knowledge stored, the sooner we can respond to your enquiry, request or complaint.

We seek to respond without undue delay, and in any event within one month of receipt of the request. However, that period may be extended by two further months where necessary, taking into account the complexity and number of the requests. You will be informed of any such extension, together with the reasons for the delay.

If you wish to submit a complaint to the ESA Data Protection Supervisory Authority, you are required to comply with the Rules of Procedure of the Supervisory Authority set forth in the ESA PDP Framework:

(https://www.esa.int/About_Us/Law_at_ESA/Highlights_of_ESA_rules_and_regulations).

You will be required to demonstrate that a Data Protection Incident occurred in relation to your personal data, following a decision of the Agency or at least be able to provide serious reasons and indicators to establish that such an incident occurred.

If at any point you want to withdraw your consent, please email us at: remove.booking@space42.eu

PERSONAL DATA BREACH: What should you do in case of a data protection incident?

If you have any concerns about your personal data or became the victim of a data breach of ESA processed personal data, you should contact ESA’s DPO, as first point of contact, by sending an email to: dpo@esa.int and provide all information available to you regarding the potential breach.