Privacy Notice - Earth Online

terms & conditionscookie noticeprivacy notice

Privacy Notice for Earth Online

Introduction

The European Space Agency (herein the “Agency” or “ESA” or “We”) is committed to protect Personal Data in line with the ESA Framework on Personal Data Protection (herein the “ESA PDP Framework”) available at: http://www.esa.int/About_Us/Law_at_ESA/Highlights_of_ESA_rules_and_regulations composed by

The Principles of Personal Data Protection adopted by ESA Council on 13 June 2017
The Rules of Procedure for the Data Protection Supervisory Authority adopted by ESA Council on 13 June 2017 -
The Policy on Personal Data Protection (including its Annex “Governance Scheme of the Agency’s Personal Data Protection”) adopted by Director General of ESA on 1 March 2022 (“ESA PDP Policy”).

This notice is intended to describe why and how Your personal data are collected and processed by, or on behalf of, ESA, as Data Controller, upon initiative of ESA EOP-G Department, as well as what rights You have in relation to Your personal data. It also informs You about the contact details of the Data Protection Officer. This privacy notice was last updated on 25/03/2024. It must be read in conjunction with the ESA PDP Framework and other privacy notices referred to herein.

ESA process your personal data to organise and manage sending you newsletters and for the publication of success stories via a Processor. ESA is Controller for personal data related to sending newsletters and the publication of success stories when ESA processes such data. For these purposes only as well as for the purposes mentioned in Article 5 of ESA Policy on Personal Data Protection, ESA is Data Controller. ESA does not instruct any third party to conduct any web analytics, profiling, or any other processing on ESA’s behalf, other than the purposes mentioned.

Social media, LinkedIn, X (formerly known as Twitter), external websites, etc., may be used to publish photographs, video recordings or interviews or information related to the events. These act as separate Controllers, each responsible for their personal data processing activities, please consult their privacy notices and websites for further information. You have the right to decline your participation in such processing.

1) What are the relevant contact details for this notice?

The ESA Data Protection Officer (“DPO”) may be contacted in line with the ESA PDP Framework at DPO@esa.int or: ESA Headquarters; Data Protection Officer; 8-10 RUE MARIO NIKIS; CS 45741; 75738 PARIS CEDEX 15; FRANCE.

As the collection and processing concerned by this notice is performed upon initiative of the ESA EOP-G Department, questions may also be addressed to: ESA EO Helpdesk. You will need to log in to an active EO Sign In account to submit your query.

2) What kind of personal data are collected and further processed?

ESA collects and processes a variety of Your personal data and may require You to provide personal data for the purposes mentioned further below. Depending on the purpose for which they are collected and further processed, the personal data may include:

Email (for newsletter purposes only)
Name (for article/video/image publication only)
Surname (for article/video/image publication only)
Institution/company name (for article/video/image publication only)
Appearance (for article/video/image publication only)
Voice (for article/video/image publication only)
Quote (for article/video/image publication only)

You are required not to send to the Agency any sensitive information (including information that indicate, directly or indirectly, the personnel's ethnic origin, political opinions, adhesion to unions, parties etc., health situation, sexual orientation).

3) How are Your personal data collected or further processed?

Your personal data may be collected by various means, including via:

Email collected via registration to newsletter.
Name, surname, appearance, voice, quote and institution/company name collected when preparing a video, image or article after prior consent.

ESA and its contractors will not use your Personal Data for any purpose other than the above stated and will not disclose your Personal Data to any other entity that is not listed in this Privacy Notice. They do not consider your Personal Data as an asset for sale and will not sell your Personal Data to any third parties.

4) Why are Your personal data collected and further processed

ESA processes the personal data for the following purposes:

The legitimate interest of the Data Subject
Sending you notifications in connection with the newsletter
Promoting the work of the data subject

Your personal data may be accessed by the ESA EOP-G team and service providers under ESA contract, as follows:

Recipient acting as…	Link to the Privacy Notice of the Recipient	Servers of the recipient are located in
Airbus UK	https://www.airbus.com/en/privacy-notice	United Kingdom
Eversis PL	http://eversis.com/privacy-policy/	Poland
EJR-Quartz IT	https://www.ejr-quartz.com/who-we-are/data-policy/	Italy

We collect and process Your personal data because it is necessary for the activities conducted to fulfil Our purpose, which is “to provide for and to promote, for exclusively peaceful purposes, cooperation among European States in space research and technology and their space applications, with a view to their being used for scientific purposes and for operational space applications systems” (as per ESA Convention). We serve the public interest, and we seek to foster the public interest in space activities and programmes. All the processing carried out by, or on behalf of, ESA upon initiative of the EOP-G Department falls in this general purpose and, in particular, into one of the reasons permitted under ESA PDP Framework, in particular under ESA PDP Policy.

5) On what legal grounds do We collect and process Your data?

We process Your personal data pursuant to the ESA PDP Framework, in particular pursuant to Article 5 of the ESA PDP Policy, for fair, specified and legitimate purposes or for purposes compatible therewith. The processing of your personal data by ESA for this event is lawful as it is necessary for the performance of a task carried out in the public interest.

Generally, the processing referred to in this notice falls under Article 5.2.1.i. of the ESA PDP Policy, i.e.:

for the performance of a contract concluded by the Agency within its purpose in relation with an activity carried out by the Agency in the framework of, and in conformity with, the ESA Convention and the applicable rules and procedures;
for Your legitimate interest; or

Depending on the situation, we may consider that your consent is given by various modalities and may result from affirmative motions (e.g., swiping on a screen), browser settings, written statements, filling an electronic online form, sending an email, uploading a scanned document with their signature, using an electronic signature and other modalities that may appear in the future.

6) In which circumstances may We transfer or provide access to Your personal data?

Where relevant, We may disclose Your personal data to recipients (e.g. ESA staff members, advisors, contractors), under a “need to know” principle, for carrying out the processing operations referred to in this notice. They are generally located in the European Union, the European Economic Area or in countries that offer an adequate level of protection equivalent to that offered within the European Union and the European Economic Area (e.g. Argentina, Canada, Japan, Switzerland, United Kingdom).

When the third-party data recipients are located in a country or international organisation not offering an adequate level of protection (e.g. Australia, United States, etc.), We will not proceed to the transfer of Your data unless You consented to it or unless the conditions set forth in ESA PDP framework (see Article 5.3 of ESA PDP Policy) are fulfilled. As appropriate, We take adequate safeguards (e.g. via appropriate contractual clauses) in order to obtain from third-party recipients a level of protection equivalent to that offered within the European Union and the European Economic Area.

In case of transfer of personal data to the United States or other countries not offering an adequate level of protection, transfer may expose You to certain risks, in particular the risk of profiling, the risk that the applicable legal framework may allow further processing of the personal data and that any given consent may not always be withdrawn.

You may be provided with information regarding the privacy notices of separate controllers of personal data either herein or elsewhere in Our communications to you.

In exceptional cases, for instance in case of a criminal offence evidenced by the collection or processing of data, we may share the said data with the appropriate authorities or bodies, including the ones having an investigative role or the ones involved in the concerned legal proceedings.

7) How long do We retain Your personal data for?

Your data are stored for the shortest time possible, taking into account the reasons why we need to process Your data, as well as all legal obligations applicable to the Agency. The Agency established time limits to erase or review the data stored. Retention periods applied by the Agency are proportionate to the purposes for which they were collected. Thus, the Agency will keep Your personal data for as long as necessary for the fulfilment of those purposes, which will be at least for the duration mentioned in the Table below. Your Personal Data is deleted upon expiry of the applicable retention period. By way of exception, We may keep Your personal data for a longer period, for archiving purposes in the public interest or for reasons of scientific or historical research, being reminded that appropriate technical and organisational measures are put in place (e.g. anonymisation, encryption, etc.).

Personal Data	Retention
ESA systems	For the full duration of the service contract and 1 year after deletion request
ESA contracted service providers and Third-Party data providers	For the full duration of the service contract
ESA Records of consent	For the full duration of the service contract and 1 year after deletion request
ESA held scientific/technical papers	Permanent retention for historic/ research purposes, ESA Archives

To the extent your personal data are collected via a web account. You have the possibility to delete the personal data as well as the account by making a request to the ESA EO Helpdesk. You will need to log in to an active EO Sign In account to submit your query.

Please note that your data deletion request will be completed after 1 year as the data must be retained for a 12 month period from your initial request for legitimate security purposes.

8) How do We protect and safeguard Your personal data?

All processing operations are carried out pursuant to ESA Rules and Regulations, including ESA PDP Framework and ESA Security Regulations. In particular, the Agency collects and processes personal data in conditions protecting confidentiality, integrity, and security of personal data.

In order to protect Your personal data, ESA has implemented a number of technical and organisational measures against the risks of loss as well as against unauthorised access, destruction, use, modification or disclosure of personal data, in particular when such risks concern sensitive personal data. These measures take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. They may include, as appropriate, the pseudonymisation and encryption of personal data.

9) What are Your rights as data subject and how can you exercise them?

Under conditions detailed in the ESA PDP Framework, You have:

the right to be informed about the identity of the data controller, the contact details of the data protection officer, the purpose of the data processing, the data recipients to whom the personal data shall be disclosed, the rights of rectification or erasure of his/her data, the storage time-limits (if any), the practical modalities of exercising the rights, etc.; this is the purpose of this privacy notice and any other notice referred to herein;
the right to access the personal data We process about You,
the right to have Your personal data erased, rectified, completed;
the right to lodge a complaint before the Supervisory authority, in accordance with the latter’s rules of procedure, in case You demonstrate or have serious reasons to believe that a data protection incident occurred in relation with Your personal data, following a decision of the Agency.

Note however that We may not erase Your personal data in case the processing is based on the performance of a legal obligation of ESA or where such data is necessary for the establishment, exercise, or defence of legal claims.

When the processing of Your personal data is based on Your consent and unless a specific case applies (e.g. see Article 6 above), You have also the right to withdraw Your consent.

You may wish to withdraw Your consent or to exercise any of the above-mentioned rights, by sending a request explicitly specifying Your query to the ESA DPO via e-mail at dpo@esa.int or addressed to the: ESA Headquarters, Data Protection Officer, 8-10 RUE MARIO NIKIS, CS 45741 75738 PARIS CEDEX 15, FRANCE via postal service. You may be requested to provide additional information to confirm your identity and/or to assist ESA to locate the data You are seeking.

Please note that withdrawing consent does not affect the lawfulness of any processing based on the consent given before this consent is withdrawn.

In cases where a participants’ request to the ESA relates to the processing of personal data by a separate Controller, it will be forwarded to the separate Controller and vice versa.

10) ESA Contractors

ESA may enter into contracts with various contractors who, with regard to Your Personal Data and depending on the contract concluded with ESA, may act either as a separate Data Controller or as a Data Processor.

To the extent such contractor act as a separate Data Controller, the separate privacy notice of the contractor will apply for the purposes of collection and processing decided by the contractor.
To the extent such contractor act as a Data Processor, this privacy notice applies for the purposes of collection and processing decided by ESA.

ESA may use third party IT Providers or social media for information purposes or to promote an activity (meeting, event, recruitment campaign, etc.). ESA websites may provide links to social media and videos may be made available on ESA social media pages. It is up to You to decide whether You wish, or not, to have access and use those IT tools and social media, in consideration of the fact that they are governed by terms and conditions, including privacy notices, that are not under ESA control and that they may disclose data to territories that do not provide an equivalent protection. If You do not want Your data to be processed by such IT tools or social media, You may decide not to register as user or otherwise accept the applicable third party terms and conditions. Non-essential cookies may be used to process your Personal Data. You may decline such cookies and/or configure your browser privacy and security settings to manage cookies.

Where you have consented to the processing of images/ video recordings taken during the event, upon registering to the event, ESA may process these for archiving purposes and to share them on their social media accounts (e.g., ESA X (formerly known as Twitter), ESA LinkedIn, ESA public websites, YouTube, etc.). Please note nevertheless that, if personal data or information is disclosed online, it may be used by third parties for their own purposes, within their platforms and or shared, and at times without informing ESA and it may not be possible for us, apart from any implemented safeguards, to ensure removal of your data from the Internet.

Disclaimer regarding exterior Links, cookies, third parties and Endorsement: websites in the ESA.int domain and ESA associated websites may hold links to external websites in domains not having an Adequate Level of Protection, which may not be maintained by ESA or be under ESA control and for which ESA, is not responsible. If you decide to click on a link to an external website, you leave the ESA domain and become subject to privacy, cookies and legal policies of the external website as separate Controllers, outside the control and responsibility of ESA.

Endorsement disclaimer: ESA websites may offer linked references to external resources or websites or online services, to provide further information, however, linked references, services, information and their providers/organisations are not endorsed by ESA. ESA websites may provide links to third-party sites. To use third party content on ESA websites, may require acceptance of their specific terms and conditions, involving their cookie policies for which ESA has no control.

ESA webpages may provide content from external providers, e.g., YouTube, Facebook, X (formerly known as Twitter), etc. Viewing such third-party content means that you must agree to their terms and conditions and their cookies. ESA has no control over these. If you do not want third-party cookies to be installed on your device, you do not have to view this content.

Please note that if information also comprising personal data, is uploaded online (for example, published on social media), it can be used by third parties for their own purposes, on their platforms, and every so often without ESA having been informed. In such cases, ESA, despite any implemented safeguards may not be able to ensure removal from the internet.

The processing of personal data is described in this privacy notice. Where consent is required, You may provide your consent by submitting the registration form and accepting the T&C and Privacy Policy.

By registering, I accept and consent to:

the processing of my Personal Data for receving newsletters and having a success story prepared
being contacted in order to receive newsletters