Introduction

The European Space Agency (hereafter “the Agency” or “ESA” or “We”) is committed to protecting Personal Data in line with the ESA Framework on Personal Data Protection (herein the “ESA PDP Framework”) available at: http://www.esa.int/About_Us/Law_at_ESA/Highlights_of_ESA_rules_and_regulations

composed of:

• the Principles of Personal Data Protection adopted by ESA Council on 13 June 2017
• the Rules of Procedure for the Data Protection Supervisory Authority adopted by ESA Council on 13 June 2017
• the Policy on Personal Data Protection (including its Annex entitled “Governance Scheme of the ESA’s Personal Data Protection”) adopted by the Director General of ESA on 1 March 2022 (“ESA PDP Policy”).

The Destination Earth (DestinE) Platform is a platform leading to the collection and processing of personal data for various purposes, as described in the corresponding privacy notices, as follows:

1. This notice is released by ESA and is intended to describe why and how Your personal data are collected and processed by or on behalf of ESA as separate Data Controller, in relation to the Destination Earth initiative, the DestinE Core Service Platform implementation and the Contribution Agreement (hereinafter Agreement), as well as what rights You have in relation to Your personal data. It also informs You about the contact details of the Data Protection Officer. This privacy notice was last updated on 09/10/2024. It must be read in conjunction with the ESA PDP Framework.
2. Other privacy notices may apply, as indicated on the DestinE Platform.

1. How can you contact the Data Protection Officer regarding this notice?

The ESA Data Protection Officer (“DPO”) may be contacted in line with the ESA PDP Framework at DPO@esa.int. Specific information is available upon request from the DPO.

1. What kinds of personal data are collected and further processed?

We collect and process various kinds of personal data and may require You to provide personal data for the purposes mentioned later in this notice. Depending on the purpose for which they are collected and further processed, the personal data may include the following:

• Identity Data: including Your names;
• Copies of identity documents: including copies of Your diplomatic cards, copy of passport (including visa if necessary), the identity card or other identity documents, certificates, Your photograph;
• Contact information: email address;
• Technical data, including online identifiers: for example, internet protocol (IP) address or domain names of the devices utilised, login data, browser data, in particular the type plug-in version, user preferences and history; MAC data, device information, uniform resource identifier (URI) address, time zone setting, operating system and platform and other technology of the devices you are using; geolocation server logs data, log data;
• Other personal information You may provide: in particular the content of exchanges with ESA, for instance assistance data;
• Other data, such as:
  • Your messages, date, and time the message was sent;
  • the content of the questions you have asked;
  • other data mentioned in Your messages;
  • feedback and interaction on the tools provided, support requests, etc.

1. How are Your personal data collected or further processed?

When ESA acts as a Data Controller, ESA collects and processes Your personal data via the DestinE Core Service Platform and via ESA systems, networks and devices that interconnect with DestinE Core Service.

In addition to the personal data We collect directly from You, we may, depending on Your situation, collect certain personal data about You indirectly including from third-parties.

1. Why are Your personal data collected and further processed?

ESA collects and processes Your personal data to enable ESA to fulfil its role, tasks and obligations for the legitimate purposes as set out in this privacy notice under point 5.1., e.g., for security and for fulfilment of a contractual legal agreement, e.g., for the Contribution Agreement and to enable the services for Your legitimate interest in Your use of the DestinE Core Service Platform and for the implementation of the Destination Earth initiative.

The collection and processing of personal data carried out by, or on behalf of, ESA in connection with the DestinE Core Service Platform will ensure adequate protection of personal data in accordance with the ESA's positively assessed Personal Data Protection (PDP) Policy. The collection and processing of personal data will be limited to what is strictly necessary for the implementation of the DestinE Core Service Platform as specified in the Contribution Agreement.

In any case, we do not process Your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or legally permitted.

Further information on the purpose of processing is provided by clicking on links associated with each section below, which correspond to various situations that may be relevant to You.

NOTA BENE:  If Your personal data processing is subject to one of the situations above, other sections may be relevant to You. You are thus invited to take knowledge of information provided under all the sections that are relevant to your case. In the description of the purpose, we made the choice to avoid duplication.

1. On what legal grounds do We collect and process Your data?

We collect and process Your personal data in relation to the Destination Earth initiative, the DestinE Core Service Platform implementation and the Contribution Agreement in accordance with the ESA PDP Framework, in particular pursuant to Article 5 of the ESA PDP Policy, for fair, specified and legitimate purposes or for purposes compatible therewith. Other ESA Rules and Regulations may serve as legal basis, as they may be indicated to You in additional notices, as appropriate.

1. In which circumstances may We transfer or provide access to Your personal data?

The validation of Your Account to DestinE Core Service Platform may require the transfer of the necessary personal data to the European Commission, which may separately decide to process Your data. Provided this is necessary, a separate privacy notice will be released by the European Commission accordingly.

At times, it is necessary for us to disclose Your personal data to authorised recipients within the scope of the implementation and management of the DestinE Core Service Platform, to the extent this is necessary for carrying out the processing operations referred to in this notice. Typically, the third-party recipients include:

1/ third party providers: We may engage various service providers such as:

1. providers of cloud/data hosting services,
2. providers of platform-maintenance related services,
3. providers enabling Us to manage our contracting process,
4. providers ensuring the security of our premises,
5. providers enabling Us to provide you with working tools, etc.
6. providers in charge with the organisation and management of communication activities,
7. providers involved in the management of social media accounts,
8. providers involved in marketing, advertising activities, managing newsletters, managing statistics and media services,
9. providers of website related services.

2/ other third parties interacting with ESA for the purpose of the DestinE Core Service Platform and within the scope of the implementation and management of the DestinE Core Service Platform. In particular, ECMWF and EUMETSAT as Entrusted Entities of DestinE.

These third-party recipients are generally situated in the European Union, the European Economic Area or in countries that offer an adequate level of protection equivalent to that offered within the European Union and the European Economic Area (e.g. Argentina, Canada, Japan, Switzerland, United-Kingdom).

When the third-party data recipients are located in a country or international organisation not offering an adequate level of protection (e.g., Australia, United States, etc.), we take necessary measures to safeguard your data, in line with the conditions set forth in the ESA PDP framework.

Additionally, we may utilise services provided by IT providers or integrate social media features into our platforms. In such instances, these IT providers or social media platforms may provide links to their respective websites, where they conduct their own data processing activities. It is entirely at your discretion whether you choose to access and utilise these social media features, depending on the terms and conditions applicable to each platform. If you prefer not to engage with social media or not to accept their terms and conditions, you have the option to refrain from accessing or using these platforms. Your decision regarding social media usage is within your control.

In exceptional cases, for instance in case of a criminal offence evidenced by the collection or processing of data, we may share the said data with the appropriate authorities or bodies, including those having an investigative role or those involved in the concerned legal proceedings.

1. How long do We retain Your personal data for?

Your data are stored for the shortest time possible, considering the reasons why we need to process Your data, as well as all legal obligations applicable to ESA. The ESA established time limits to erase or review the data stored. Retention periods applied by the ESA are proportionate to the purposes for which they were collected. Thus, the ESA will keep Your personal data for as long as necessary for the fulfilment of those purposes and shall be deleted afterwards. By way of exception, We may keep Your personal data for a longer period, for archiving purposes in the public interest or for reasons of scientific or historical research, being reminded that appropriate technical and organisational measures are put in place (e.g. anonymisation, encryption, etc.).

1. How do We protect and safeguard Your personal data?

All processing operations are carried out pursuant to ESA Rules and Regulations, including ESA PDP Framework and ESA Security Regulations. In particular, the ESA collects and processes personal data in conditions protecting confidentiality, integrity and security of personal data.

In order to protect Your personal data, ESA has implemented a number of technical and organisational measures against the risks of loss as well as against unauthorised access, destruction, use, modification or disclosure of personal data, in particular when such risks concern sensitive personal data.

These measures consider the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. They may include, as appropriate, the pseudonymisation and encryption of personal data.

1. What are Your rights as data subject and how can you exercise them?

Under conditions detailed in the ESA PDP Framework, You have:

• the right to be informed about the identity of the data controller, the contact details of the data protection officer, the purpose of the data processing, the data recipients to whom the personal data shall be disclosed, the rights of rectification or erasure of his/her data, the storage time-limits (if any), the practical modalities of exercising the rights, etc. ; this is the purpose of this privacy notice and any other notice referred to herein ;
• the right to access the personal data We process about You; unless you have access to such data via an account, you may send us your request by email to dpo@esa.int ;
• the right to have Your personal data erased, rectified, completed; if you want to review and correct the personal information, you can either do it yourself, in case you have access to such data via an account, or you may send us your request by email to dpo@esa.int ;
• the right to lodge a complaint before the Supervisory authority, in accordance with the latter’s rules of procedure. In case You demonstrate, or have serious reasons to believe, that a data protection incident occurred in relation with Your personal data, following a decision of ESA, you may send notify us thereof by email to dpo@esa.int.

Once a request to erase data is received, we will ensure that the data are deleted unless it can be processed on another legal ground, as mentioned in Article 5.1 above. If Your data was processed for several purposes, We do not process personal data for the part of the processing for which consent has been withdrawn.

For instance:

• Your personal data may continue to be processed for the performance of a legal obligation of ESA or where such data is necessary for the establishment, exercise, or defence of legal claims;
• If there are multiple processing concerning You, based on consent, You have to expressly indicate which consent you wish to withdraw.

When the processing of Your personal data are based on Your consent and unless a specific case applies (e.g. see Article 6 above), You have also the right to withdraw Your consent.

You may wish to exercise any of the above-mentioned rights, by sending a request explicitly specifying Your query to the ESA DPO via e-mail at dpo@esa.int

You may be asked additional information to confirm your identity and/or to assist ESA to locate the data You are seeking.