The European Space Agency (herein the “Agency” or “ESA”) is an intergovernmental organisation established by its Convention opened for signature in Paris on 30 May 1975. The Protection of Personal Data is of great importance for ESA, which strives to ensure a high level of protection as required by the ESA Framework on Personal Data Protection (herein the “ESA PDP Framework”) which applies for processing of Personal Data at ESA, available at:

http://www.esa.int/About_Us/Law_at_ESA/Highlights_of_ESA_rules_and_regulations

The ESA PDP Framework applicable for the processing of Personal Data within ESA is composed of the following elements:

• the Principles of Personal Data Protection, as adopted by ESA Council Resolution (ESA/C/CCLXVIII/Res.2 (Final)) adopted on 13 June 2017;
• the Rules of Procedure for the Data Protection Supervisory Authority, as adopted by ESA Council Resolution (ESA/C/CCLXVIII/Res.2 (Final)) adopted on 13 June 2017; and
• the Policy on Personal Data Protection adopted by Director General of ESA on 5 February 2018 and effective on 1 March 2022

This notice is intended to inform you about the processing of your personal data the ESA 4S Symposium and more specifically about:

• the identity of the Data Controller and contact details of the ESA Data Protection Officer (“DPO”);
• the type of personal data collected and processed;
• the modalities of collection of personal data;
• the purpose and legal basis of the collection and processing;
• the recipients to whom the personal data of the Data Subject is disclosed;
• the time-limits for storing the personal data;
• your rights and the modalities by which you can exercise them and the practical modalities of exercising your rights and those rights of other persons, when processed in this Processing Activity under the ESA PDP Framework.

Please be aware that all references to “Data” in this document if not otherwise stated relate to data by which an individual could be identified/ having an identifying character, broadly defined as Personal Data.

Your personal data will be processed to facilitate and manage your participation in the 4S Symposium.

Furthermore, your personal data may be processed via Images (your appearance) taken at the event and published on ESA websites. You may choose to opt out from this via either approaching the ESA photographer directly regarding your wish not to be photographed or by choosing to wear a dedicated band/lanyard available at the registration desk at the event, to indicate your preference not to be photographed.

Your contact details (Name, E-Mail Address) may be shared with other participants at the event if you have indicated your interest in sharing these when registering for the conference.

Special categories of personal data may be collected where you have informed ESA of food related preferences based on your consent. This data will only be used for catering to any dietary or otherwise relevant food requirements/condition(s).

Furthermore, your Abstract/the presentation of it at the event and included personal data will be provided to all Conference participants via E-Mail.

Applicants, as separate Controllers, are responsible for ensuring that consent for the inclusion in the application procedure and the potential publication of the Abstract/Presentation of all the (Co-)Authors is included in the Paper (if applicable) and that consent has been obtained prior to submitting an application to ESA.

For Presenters at the event only: Your Presentation may be recorded by ESA and may be retained in the ESA Archive.

Specific Legal Basis for this processing:

• 5.2.1 i. (g) ESA PDP Framework; A purpose covered by the Consent of the Data Subject.

The following table lists all the involved companies, agencies or otherwise, where your personal data may be processed and all relevant information concerning their involvement in this activity.

The table below informs you about any transfer outside the EU or other particular transfers where your data may be put at higher risk and the measures ESA applies in such cases to protect your personal data.

Personal data is retained by ESA for the time period necessary to fulfil the legitimate purpose of the processing.

Your Personal Data is stored and processed based on the following timeframes:

• The Agency does not consider your personal data as an asset for sale and, thus, does not sell your personal data to any third parties.
• ESA does not plan to implement any automated decision-making within this activity.
• ESA does not instruct any ESA affiliated processor – including ATPI/ATP Services B.V. – to conduct any web analytics, profiling or any other processing on ESA’s behalf, other than the purposes mentioned above.

Third party IT tools or social media may be used to promote and inform you about an activity (meeting, event). ESA websites may provide links to social media and videos may be available on ESA social media pages. If you view an embedded video hosted on an external provider (such as YouTube) or interact with links to social media, third-party cookies are likely to be installed on your device, covered by third party Terms and Conditions and cookie policies. ESA has no influence over these.

Carefully assess the privacy policies and Terms and Conditions regarding your data subject rights, the further processing and the protection of your personal data prior to playing the relevant video or clicking on a link to external providers. ESA seeks to protect your personal data when embedding videos and to make you aware when a link refers you to an external social media or other websites where ESA cannot control the processing of your personal data.

You have the right to be informed in a transparent manner about: the processing of your personal data (the Controller, purpose, recipients, etc.); your rights and the modalities of exercising these, (e.g. erasure, rectification, completion, or amendment as per the conditions under PDP 5.1. i.; right for every interested Data Subject to lodge a complaint before the Supervisory Authority in case the former demonstrates or has serious reasons to believe that a Data Protection Incident occurred in relation with his/her Personal Data, following a decision of the Agency (e.g. Data Protection Officer). The right of information under PDP 5.4.1 i. and the right of access under Section 5.4.1 ii. shall not apply: (a) where and insofar as the Data Subject is already in possession of the information; (b) for the right of information, when processing of Personal Data is necessary for any Investigation or Dispute Resolution Procedure; (c) for the right of access, where and insofar such access would conflict with an Investigation Procedure concerning the Data Subject.

If you would like to exercise any of those rights, please send a request explicitly specifying your query to the ESA DPO via e-mail at dpo@esa.int

Please keep in mind that the more specific information you can provide to us about the Activities, Events, Systems, ESA Departments and/or Processes where your personal data is to your knowledge stored, the sooner we can respond to your enquiry, request or complaint.

• We seek to respond without undue delay, and in any event within one month of receipt of the request. However, that period may be extended by two further months where necessary, taking into account the complexity and number of the requests. You will be informed of any such extension, together with the reasons for the delay.

If you wish to submit a complaint to the ESA Data Protection Supervisory Authority, you are required to comply with the Rules of Procedure of the Supervisory Authority set forth in the ESA PDP Framework:

(https://www.esa.int/About_Us/Law_at_ESA/Highlights_of_ESA_rules_and_regulations).

You will be required to demonstrate that a Data Protection Incident occurred in relation to your personal data, following a decision of the Agency or at least be able to provide serious reasons and indicators to establish that such an incident occurred.