The European Space Agency ("the Agency" or "ESA" or "We") is committed to protecting personal data in line with the ESA Framework on Personal Data Protection (the "ESA PDP Framework"), available on the ESA website. This framework is composed of the Principles of Personal Data Protection adopted by ESA Council on 13 June 2017, the Rules of Procedure for the Data Protection Supervisory Authority adopted by ESA Council on 13 June 2017, and the Policy on Personal Data Protection adopted by the Director General of ESA on 1 March 2022.
This notice describes why and how your personal data are collected and processed by, or on behalf of, the Agency, as data controller, upon initiative of the ESA Communication Department, and what rights you have in relation to your personal data. It also provides the contact details of the Data Protection Officer. It must be read in conjunction with the ESA PDP Framework and any other privacy notices referred to herein.
Last updated: 18 October 2023
The ESA Data Protection Officer ("DPO") may be contacted in line with the ESA PDP Framework at DPO@esa.int. As the collection and processing concerned by this notice is performed upon initiative of the ESA Communications Department, questions may also be addressed to commppdp@esa.int.
We collect and process a variety of your personal data and may require you to provide personal data for the purposes mentioned below. Depending on the purpose for which they are collected and further processed, the personal data may include:
In addition to personal data we collect directly from you (e.g. when you fill in a form submitted by, or for, ESA), we may, depending on your situation, collect certain personal data about you indirectly by various means. This includes collecting personal data from publicly available sources or from third parties, including analytics providers or social media platforms (e.g. from content you post, or cookies deposited on your device if you have accepted their use).
We collect and process your personal data because it is necessary for the activities conducted to fulfil our purpose, which is to provide for and promote, for exclusively peaceful purposes, cooperation among European States in space research and technology and their space applications, for scientific purposes and operational space applications systems (as per the ESA Convention). We do not use your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or legally permitted.
Your data is processed to manage your registration; to correspond with you about the event; to secure your access to event premises; to accommodate special needs you communicate to us; to take and potentially publish photos or recordings for documentation or outreach; to provide feedback or invitations to future events; to arrange reimbursement of expenses where applicable; to produce statistics; and to defend the Agency from possible liability claims.
In addition to the purposes above, your data may be used to facilitate your registration and venue arrangements; to enable your speech to be recorded and made public; to transcribe your participation; and to publish related content on ESA websites, newsletters, or social media channels.
Your data is processed to provide you with information about ESA activities, programmes and events; to collect feedback to improve future newsletters; to defend the Agency from possible liability claims; and to respond to your requests related to ESA activities and space-related matters.
Informing the public and monitoring website use are public service tasks related to the ESA mission. Your data is processed to raise awareness or conduct surveys; to analyse and monitor your interactions with the website; to respond to queries; to ensure audience measurement; to grant access to functionalities requiring authentication; to gather statistics to improve user experience; to identify unauthorised access attempts; and to moderate irrelevant or abusive comments.
Your data is processed to raise awareness on space-related topics; to engage with your queries; to ensure audience measurement and gather statistics; to analyse your interactions and reactions in relation to ESA content; to evaluate potential involvement in promotional activities; to identify and collaborate with relevant influencers; and to moderate irrelevant or abusive comments.
Your data is processed to respond to requests; to maintain a dialogue with the press and media; to disseminate and monitor press releases and related material; to raise awareness on space topics; and to analyse media publications related to ESA activities.
Your data is processed to allow your participation, evaluate your submission, contact you if selected as a winner, and deliver any prize or opportunity awarded.
Your data is processed to allow you to submit a request to ESA on behalf of an external entity; to evaluate your request and contact you for further information or next steps; and to protect and defend the Agency's rights and interests in connection with the request.
Your data is processed to handle questions or complaints you submit, to respond to requests relating to your rights, and to defend the Agency from possible liability claims arising in connection with your request.
Your data may be processed to provide and, where applicable, discontinue your access to ESA IT infrastructure and services; to enable optimised data flow and service performance; to provide support, maintenance, and identity and access management; to ensure data subject rights management; and to protect the Agency's rights, interests, and data quality.
We process your personal data pursuant to the ESA PDP Framework, in particular Article 5 of the ESA PDP Policy, for fair, specified and legitimate purposes or purposes compatible therewith.
Processing generally falls under Article 5.2.1 of the ESA PDP Policy: for the performance of an activity carried out by the Agency within its purpose and consistent with the ESA Convention; for compliance with a legal obligation; for cooperation with competent authorities of Member States; for security; for the performance of a contract; for your legitimate interest; or for purposes covered by your consent.
We may also process sensitive personal data under Article 5.2.2 of the ESA PDP Policy where the processing is covered by your consent, relates to data you have manifestly made public, or is necessary for the protection of vital interests, dispute resolution and investigation procedures, obligations under applicable staff regulations or health and social care systems, or protection against serious threats to security or public health.
When consent is the appropriate legal basis, it will be requested from you, and you may refuse to give it. Consent may be given in various ways, including written or verbal statements, electronic means (such as a click or keystroke), filling in forms, or positive behaviour undertaken with knowledge that it constitutes agreement. You may withdraw your consent at any time by contacting DPO@esa.int, copying commppdp@esa.int. If your data is processed for several purposes, we will stop using it only for the part of the processing for which consent has been withdrawn.
We may disclose your personal data to authorised recipients under a "need to know" principle, including service providers (e.g. for communications, social media management, advertising, cloud hosting, website services, contracting, or premises security), partners of ESA in relation to its activities and programmes, and ESA governing bodies and authorities as required by the applicable legal framework.
Third-party recipients are generally situated within the European Union, the European Economic Area, or countries offering an adequate level of protection. Where recipients are located in countries without an adequate level of protection, we take necessary measures to safeguard your data in line with the ESA PDP Framework. Such transfers may carry risks, including profiling or further processing under a different legal framework. In exceptional cases, such as evidence of a criminal offence, we may share data with the appropriate authorities.
Your data is stored for the shortest time necessary, taking into account the purposes of processing and applicable legal obligations. The Agency has established time limits to erase or review stored data, proportionate to the purposes for which it was collected. By way of exception, we may retain data for longer periods for archiving in the public interest or for scientific or historical research, with appropriate safeguards such as anonymisation or encryption.
All processing is carried out pursuant to ESA Rules and Regulations, including the ESA PDP Framework and ESA Security Regulations, in conditions protecting the confidentiality, integrity and security of personal data. ESA has implemented technical and organisational measures against risks of loss, unauthorised access, destruction, use, modification or disclosure of personal data, which may include pseudonymisation and encryption where appropriate.
Under the ESA PDP Framework, you have the right to be informed about the processing of your data; the right to access the personal data we process about you; the right to have your data erased, rectified or completed; and the right to lodge a complaint before the Supervisory Authority where you believe a data protection incident has occurred. You may exercise any of these rights, or withdraw consent where applicable, by contacting dpo@esa.int. You may be asked for additional information to confirm your identity or help us locate the data you are seeking.
We do not generally intend to directly collect personal information from a child (under the age of majority), but may collect such information from a child's legal guardian where necessary for the processing activities described in this notice. If you are under the age of majority, you should not interact or engage with ESA without the consent of your legal guardian, and should act under their supervision when doing so. Where initiatives are specifically addressed to children, additional terms and privacy conditions applicable to those initiatives will apply. We reserve the right to request contact details for your legal guardian whenever necessary, including to verify your identity and confirm guardian approval.