Privacy Notice for:
the TEC-QQD ESA RAMS Conference 2024

[For Internal Reference - DPNR Reference Number 2156]

Kindly provide this “DPNR Reference Number” in any communication with the ESA Data Protection Officer (DPO@esa.int) for quick reference of the Processing in question.

 This Privacy Notice was last updated on: 10/08/2023

Introduction

The European Space Agency (herein the “Agency” or “ESA”) is an intergovernmental organisation established by its Convention opened for signature in Paris on 30 May 1975. The Protection of Personal Data is of great importance for ESA, which strives to ensure a high level of protection as required by the ESA Framework on Personal Data Protection (herein the “ESA PDP Framework”) which applies for processing of Personal Data at ESA, available at:

http://www.esa.int/About_Us/Law_at_ESA/Highlights_of_ESA_rules_and_regulations

The ESA PDP Framework applicable for the processing of Personal Data within ESA is composed of the following elements:

• the Principles of Personal Data Protection, as adopted by ESA Council Resolution (ESA/C/CCLXVIII/Res.2 (Final)) adopted on 13 June 2017;
• the Rules of Procedure for the Data Protection Supervisory Authority, as adopted by ESA Council Resolution (ESA/C/CCLXVIII/Res.2 (Final)) adopted on 13 June 2017; and
• the Policy on Personal Data Protection adopted by Director General of ESA on 5 February 2018 and effective on 1 March 2022

Scope of this Privacy Statement

This notice is intended to inform you about the processing of your personal data the ESA RAMS Conference 2024 and more specifically about:

• the identity of the Data Controller and contact details of the ESA Data Protection Officer (“DPO”);
• the type of personal data collected and processed;
• the modalities of collection of personal data;
• the purpose and legal basis of the collection and processing;
• the recipients to whom the personal data of the Data Subject is disclosed;
• the time-limits for storing the personal data;
• your rights and the modalities by which you can exercise them and the practical modalities of exercising your rights and those rights of other persons, when processed in this Processing Activity under the ESA PDP Framework.

Please be aware that all references to “Data” in this document if not otherwise stated relate to data by which an individual could be identified/ having an identifying character, broadly defined as Personal Data.

Description and the Purpose for this Processing of your Personal Data: What is this processing about?

The general Purpose of this processing is to enable your participation and to keep you updated about the outcome (including a satisfaction survey) of the conference.

Legal Basis: What is the legal basis for processing the personal data?

Specific Legal Basis for this processing:

• 5.2.1 i. (e) ESA PDP Framework; The performance of a contract concluded by the Agency within its purpose in relation with an activity carried out by the Agency in the framework of, and in conformity with, the ESA Convention and the applicable rules and procedures
•  5.2.1 i. (g) ESA PDP Framework; A purpose covered by the Consent of the Data Subject.

Consent is collected via the ATP B.V. registration page for the conference.

Data Controllers, Data Processors, other Recipients of Personal Data and their Contact Details: Who Processes what data in which capacity?

The following table lists all the involved companies, agencies or otherwise, where your personal data may be processed and all relevant information concerning their involvement in this activity.

Processing Entity	Personal Data Categories	Type of Personal Data in detail	Description of Processing Responsibilities and specific Purpose of the Processing
European Space Agency (ESA) as Controller	Contact Information/ Registration Data       Personal Information in the Abstract       Image Data               Health and or Philosophical beliefs	Name, Surname, E-Mail Address, Telephone Number, Company/ Institution Address All personal information provided in the Abstract (for example: Name, Surname, E-Mail Address, Institution etc.) Images taken at the event               Dietary preferences	Your personal data are collected and further processed as described in this Privacy Notice upon the decision taken by: ESA through and limited to staff directly involved The ESA RAMS Conference 2024. ESA will collect and process relevant Registration Data to enable your participation for the event and -if necessary- enable your participation via ESA Webex. Registration Data will furthermore be used to inform you about the outcome of the conference and to request your participation in a satisfaction survey. ESA will collect and process relevant Registration Data to enable your participation in the Abstract Submission Process. Images of the Conference participants will be taken at the event and to be published via the ESA LinkedIn account. You may opt-out by either approaching the photographer directly with your wish not to be photographed or via wearing coloured Lanyards and/or bands provided at the conference, expressing your wish not to be photographed. You may revoke your consent related to your image in accordance with the ESA Protection of Personal Data Policy, article 5.4. Requests shall be addressed to the ESA DPO (dpo@esa.int). ESA does not require you to provide special categories of personal data, e.g., sensitive personal data about health, religion, philosophical beliefs, or disabilities. If you do provide such data, it is only processed for providing disability support or essential dietary requirements upon your explicit request.
ESA DPO	All Personal Information required to accomplish the DPO’s duties as defined in the ESA PDP	All Personal Information required to accomplish the DPO’s duties as defined in the ESA PDP	According to ESA PDP Framework, your first and unique point of contact concerning personal data matters is the ESA Data Protection Officer (“DPO”). In this regard your personal information may be processed by ESA’s DPO to reply to your requests and to exercise your rights under the ESA PDP.
ATPI/ATP Specials B.V. as Processor	Contact Information/Registration Data       Food related requirements	Name, Surname, E-Mail Address, Telephone Number, Company/ Institution Address Dietary preferences	The Registration and event organisation is provided via a ATP Specials B.V. in the Netherlands. Your personal data is processed by this company to enable your event participation. Furthermore, the satisfaction survey will be managed through this ESA Processor and the outcome provided to ESA.
Cisco Systems, Inc   as   Processor	Audio/Video/Other Data	Audio/ Video/ Chat and Log Data	In cases where online participation occurs, ESA Webex is used to enable your participation. ESA contractually limited the processing the European Union. Data will be retained only for as long as necessary.
LinkedIn   As   Controller	Image Data	Images taken at the event	Your images may be uploaded and used on the ESA LinkedIn Account to promote the event, if you consented to this. You may, revoke your consent related to your image in accordance with the ESA Protection of Personal Data Policy, article 5.4. Please be aware that LinkedIn Terms and Conditions, including its Privacy Policy apply and these should be read carefully prior to providing consent:  https://www.linkedin.com/legal/privacy-policy

Contact Details per involved entity:

Entity	Contact Details
European Space Agency (ESA)	Headquarters: 8-10 Rue Mario Nikis, CS 45741, 75738 Paris Cedex 15, France. Your first point of contact is ESA’s DPO at DPO@esa.int at all times. You may also contact the ESA colleagues in charge for this Activity via ESAConferenceBureau@atpi.com
ESA DPO	Data Protection Officer: DPO@esa.int
ATPI/ATP Services B.V.	Please contact ESA directly via the information above as this is a processor for ESA
LinkedIn	Privacy Policy: https://www.linkedin.com/legal/privacy-policy Address: LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA

Personal Data Disclosure, Transfer and Safeguards:

The table below informs you about any transfer outside the EU or other particular transfers where your data may be put at higher risk and the measures ESA applies in such cases to protect your personal data.

Recipient	Location of Recipient	Safeguards
LinkedIn / Worldwide Publication   Publication of Abstract to Conference Participants (via E-Mail)	United States of America/Worldwide Worldwide	Based on your consent (Clause 5.2.2.1 i. PDP) as provided when registering. Please make sure to opt out from your images being taken at the event if you choose to not provide consent when registering for the event. You may revoke your consent in accordance with the ESA Protection of Personal Data Policy, article 5.4. where ESA acts as Data Controller. For websites and social media platforms where ESA is not the Data Controller, please refer to the separate privacy notices of these providers and read these carefully. LinkedIn applies wide scale web analytics, etc. - please inform yourself via their Privacy Policy: https://www.linkedin.com/legal/privacy-policy prior to providing consent. Based on your consent. You may revoke your consent in accordance with the ESA Protection of Personal Data Policy, article 5.4. where ESA acts as Data Controller. ESA may not be able to request deletion if Presentation/s are provided to the Conference Participants. As such, please assure to have obtained the prior consent of all (Co-)Authors for publication of the relevant Presentations after the event.

Personal Data Retention and Deletion: For which time period are your personal data retained by ESA?

Personal data is retained by ESA for the time period necessary to fulfil the legitimate purpose of the processing. Your Personal Data is stored and processed based on the following timeframes:

Personal Data Categories and      Place of Processing	Retention
ESA   Processing in European Union   Data Categories: Registration Data Personal Data in the Abstract/Presentation Image Data	Contact Details and Sensitive Personal Data: 2 years after the end of the activity, then deletion Personal Data in the Abstract/ Presentation Indefinitely (Abstracts may be included in the ESA Archive for historic purposes) Image Data: 2 years after the event, then deletion and removal from LinkedIn
ATPI/ATP Services B.V. Processing in the Netherlands/EU Data Categories: Registration Data and Dietary Requirements	Registration Data and Dietary Requirements 2 years after the event, then deletion
LinkedIn Processing outside the European Union/United States of America Data Categories: Image Data	Image Data on external websites (social media, non-ESA websites): 2 years after the event, then deletion from the ESA affiliated account. Further Retention may apply based on LinkedIn Policies Please refer to the Privacy Policy of the Controller: https://www.linkedin.com/legal/privacy-policy.  ESA has no influence over this aspect of the processing.

Other Considerations

• The Agency does not consider your personal data as an asset for sale and, thus, does not sell your personal data to any third parties.
• ESA does not plan to implement any automated decision-making within this activity.
• ESA does not instruct any ESA affiliated processor – including ATPI/ATP Services B.V. – to conduct any web analytics, profiling or any other processing on ESA’s behalf, other than the purposes mentioned above.

Third party tools, including Social Media

Third party IT tools or social media may be used to promote and inform you about an activity (meeting, event). ESA websites may provide links to social media and videos may be available on ESA social media pages. If you view an embedded video hosted on an external provider (such as YouTube) or interact with links to social media, third-party cookies are likely to be installed on your device, covered by third party Terms and Conditions and cookie policies. ESA has no influence over these.

Carefully assess the privacy policies and Terms and Conditions regarding your data subject rights, the further processing and the protection of your personal data prior to playing the relevant video or clicking on a link to external providers. ESA seeks to protect your personal data when embedding videos and to make you aware when a link refers you to an external social media or other websites where ESA cannot control the processing of your personal data. 

Your rights (Data Subject Rights) How can you access, erase, rectify, complete or amend your personal data?

You have the right to be informed in a transparent manner about: the processing of your personal data (the Controller, purpose, recipients, etc.); your rights and the modalities of exercising these, (e.g. erasure, rectification, completion, or amendment as per the conditions under PDP 5.1. i.; right for every interested Data Subject to lodge a complaint before the Supervisory Authority in case the former demonstrates or has serious reasons to believe that a Data Protection Incident occurred in relation with his/her Personal Data, following a decision of the Agency (e.g. Data Protection Officer). The right of information under PDP 5.4.1 i. and the right of access under Section 5.4.1 ii. shall not apply: (a) where and insofar as the Data Subject is already in possession of the information; (b) for the right of information, when processing of Personal Data is necessary for any Investigation or Dispute Resolution Procedure; (c) for the right of access, where and insofar such access would conflict with an Investigation Procedure concerning the Data Subject.

If you would like to exercise any of those rights, please send a request explicitly specifying your query to the ESA DPO via e-mail at dpo@esa.int.

Please keep in mind that the more specific information you can provide to us about the Activities, Events, Systems, ESA Departments and/or Processes where your personal data is to your knowledge stored, the sooner we can respond to your enquiry, request or complaint.

If you wish to submit a complaint to the ESA Data Protection Supervisory Authority, you are required to comply with the Rules of Procedure of the Supervisory Authority set forth in the ESA PDP Framework:

(https://www.esa.int/About_Us/Law_at_ESA/Highlights_of_ESA_rules_and_regulations).

You will be required to demonstrate that a Data Protection Incident occurred in relation to your personal data, following a decision of the Agency or at least be able to provide serious reasons and indicators to establish that such an incident occurred.

Personal Data Breach: What should you do in case of a data protection incident?

If you have any concerns about your personal data or became the victim of a data breach of ESA processed personal data, you should contact ESA’s DPO, as first point of contact, by sending an email to: dpo@esa.int and provide all information available to you regarding the potential breach.