INTRODUCTION
The European Space Agency (herein the “Agency” or “ESA”) is an intergovernmental organisation established by its Convention opened for signature in Paris on 30 May 1975. The Protection of Personal Data is of great importance for ESA, which strives to ensure a high level of protection as required by the ESA Framework on Personal Data Protection (herein the “ESA PDP Framework”) which applies for processing of Personal Data at ESA, available at: Highlights of ESA rules_and regulations.
The ESA PDP Framework applicable for the processing of Personal Data within ESA is composed of the following elements:
- the Principles of Personal Data Protection, as adopted by ESA Council Resolution (ESA/C/CCLXVIII/Res.2 (Final)) adopted on 13 June 2017;
- the Rules of Procedure for the Data Protection Supervisory Authority, as adopted by ESA Council Resolution (ESA/C/CCLXVIII/Res.2 (Final)) adopted on 13 June 2017; and
- the Policy on Personal Data Protection adopted by Director General of ESA on 5 February 2018 and effective on 1 March 2022
The Agency does not consider your personal data as an asset for sale and, thus, does not sell your personal data to any third parties.
SCOPE OF THE PRIVACY NOTICE
This notice is intended to inform you about the processing of your personal data collected from the ESA Images and Videos registration form and more specifically about:
- the identity of the Data Controller and contact details of the ESA Data Protection Officer (“DPO”);
- the type of personal data collected and processed;
- the modalities of collection of personal data;
- the purpose of the collection and processing;
- the recipients to whom the personal data of the Data Subject is disclosed;
- the time-limits for storing the personal data;
- your rights and the modalities by which you can exercise them and the practical modalities of exercising your rights and those rights of other persons, when processed in this Processing Activity under the ESA PDP Framework.
Please be aware that all references to “Data” in this document if not otherwise stated relate to data by which an individual could be identified/ having an identifying character, broadly defined as Personal Data.
This notice furthermore enables ESA to obtain your consent relating to the collection and further processing of your personal data, under the ESA PDP Framework where relevant.
Context, Activity Description and the Purpose for this Processing of your Personal Data/Information: What is this processing about?
The ESA Images and Videos database provides access to a large collection of audio-visual material produced by the European Space Agency and its partners. Registering to access this database allows you to download and use the materials under the applicable license.
The general Purpose of this Processing is to allow your registration for the access and use of the ESA Images and Videos database, for example, requesting the use of an ESA Image for your own purposes.
Also, if you select the checkbox “Sign Up for the Photolibrary for professionals Newsletter”, you will authorise ESA to send you the Photolibrary for professionals Newsletter.
DATA CONTROLLERS, DATA PROCESSORS and other RECIPIENTS of Personal Data and their contact details:
The following table provides you with an overview of all involved in processing your personal data at ESA.
| Responsibility | Name and contact details of the responsible | Description |
| Controller | European Space Agency (ESA) Headquarters: 8-10 rue Mario Nikis, CS 45741, 75738 Paris Cedex 15, France. As a first point of contact you may contact ESA’s DPO at DPO@esa.int at all times. | Your personal data are collected and further processed as described in this Privacy Notice upon the decision taken by: ESA through and limited to staff directly involved in the design and maintenance of the ESA Web Portal. |
| ESA DPO | Data Protection Officer: DPO@esa.int | According to ESA PDP Framework, your first and unique point of contact concerning personal data matters is the ESA Data Protection Officer (“DPO”). In this regard your personal information may be processed by the ESA’s DPO to reply to your requests and to make the exercise of your rights under the ESA PDP possible. |
| ESA Data Processor | Atanar Technologies https://www.atanar.com/en/ | Atanar provides the hosting and management of the ESA website and as such might have access to the information you provide when submitting the Contest participation form. |
LEGAL BASIS: What is the legal basis for processing the personal data?
Individual Legal Basis for this processing:
- 5.2.1 i. (g) PDP; A purpose covered by the Consent of the Data Subject. ii. in a not excessive manner, as necessary for the purposes for which the Personal Data were collected or for which they are further Processed
DATA CATEGORIES:
The categories of personal data which may be collected and further processed for legitimate purposes per company or other party involved, are:
| ROLE | PERSONAL DATA CATEGORIES | TYPE OF PERSONAL DATA | DATA PROCESSING PURPOSE (S) |
| As CONTROLLER ESA | Basic Information | First name, last name | To allow the creation of your account |
| As PROCESSOR Atanar Technologies | Contact details | Country, Phone, Email. | To allow the creation of your account |
| Employment details | Company, Sector of activity, service | To allow the creation of your account and evaluate your access to the restricted areas of the database. | |
| Other | Terms and Conditions acceptance, Privacy Notice acceptance, Newsletter request. | To allow the creation of your account To provide you with the Photo Library for professionals Newsletter |
PERSONAL DATA RETENTION AND DELETION: How long are your personal data retained?
Your Personal Data is stored and processed based on the following timeframes:
| PERSONAL DATA CATEGORIES | RETENTION |
| Basic Information, Contact details, Contact details | Accounts and their personal information will be erased after 6 months of inactivity |
| Basic Information, Contact details, Contact details | Accounts and their personal information will be deleted within one month after data subjects have exercise their erasure right |
DATA SUBJECT RIGHTS: How can you access, erase, rectify, complete or amend your personal data?
You have the right to be informed in a transparent manner about: the processing of your personal data (the Controller, purpose, recipients, etc.); your rights and the modalities of exercising these, (e.g. erasure, rectification, completion, or amendment as per the conditions under PDP 5.1. i.; right for every interested Data Subject to lodge a complaint before the Supervisory Authority in case the former demonstrates or has serious reasons to believe that a Data Protection Incident occurred in relation with his/her Personal Data, following a decision of the Agency (e.g. Data Protection Officer). The right of information under PDP 5.4.1 i. and the right of access under Section 5.4.1 ii. shall not apply: (a) where and insofar as the Data Subject is already in possession of the information; (b) for the right of information, when processing of Personal Data is necessary for any Investigation or Dispute Resolution Procedure; (c) for the right of access, where and insofar such access would conflict with an Investigation Procedure concerning the Data Subject.
If you would like to exercise any of those rights, please send a request explicitly specifying your query to the ESA DPO via e-mail at dpo@esa.int or addressed to the:
ESA Data Protection Officer
8-10 rue Mario Nikis
CS 45741, 75738 Paris Cedex 15
France
via postal service.
Please keep in mind that the more specific information you can provide to us about the Activities, Events, Systems, ESA Departments and/or Processes where your personal data is to your knowledge stored, the sooner we can respond to your enquiry, request or complaint.
We seek to respond without undue delay, and in any event within one month of receipt of the request. However, that period may be extended by two further months where necessary, taking into account the complexity and number of the requests. You will be informed of any such extension, together with the reasons for the delay.
If you wish to submit a complaint to the ESA Data Protection Supervisory Authority, you are required to comply with the Rules of Procedure of the Supervisory Authority set forth in the ESA PDP Framework:
Highlights of ESA rules and regulations.
You will be required to demonstrate that a Data Protection Incident occurred in relation to your personal data, following a decision of the Agency or at least be able to provide serious reasons and indicators to establish that such an incident occurred.
UNSUBSCRIBE
If you wish to unsubscribe from the Photolibrary for professionals Newsletter you can do so by clicking on the link at the end of every email.
PERSONAL DATA BREACH: What should you do in case of a data protection incident?
If you have any concerns about your personal data or became the victim of a data breach of ESA processed personal data, you should contact ESA’s DPO, as first point of contact, by sending an email to: dpo@esa.int and provide all information available to you regarding the potential breach.