Released by: European Space Agency, as Data Controller

Addressed to: individuals whose personal data is collected and processed

Concerning collection and processing initiated by: ESA EOP-S

European Space Agency (herein the “Agency” or “ESA” or “We”) is committed to protect Personal Data in line with the ESA Framework on Personal Data Protection (herein the “ESA PDP Framework”) available at: http://www.esa.int/About_Us/Law_at_ESA/Highlights_of_ESA_rules_and_regulations composed by

The Principles of Personal Data Protection adopted by ESA Council on 13 June 2017

The Rules of Procedure for the Data Protection Supervisory Authority adopted by ESA Council on 13 June 2017

The Policy on Personal Data Protection (including its Annex “Governance Scheme of the Agency’s Personal Data Protection”) adopted by Director General of ESA on 1 March 2022 (“ESA PDP Policy”).

This notice is intended to describe why and how Your personal data are collected and processed by, or on behalf of, ESA, as Data Controller, upon initiative of ESA EOP-S Department, as well as what rights You have in relation to Your personal data. It also informs You about the contact details of the Data Protection Officer. This privacy notice was last updated on 10/06/2024. It must be read in conjunction with the ESA PDP Framework and other privacy notices referred to herein.

ESA is Controller for the training managed by ESA via ESA online courses and for Disclosing your personal data to The Nanson Environmental and Remote Sensing Centre, (NERSC) Norway internal and external selection board panellists (selected and controlled by ESA) and if Disclosure is required, to The Statsraad Lemkuhl Foundation. 

ESA is Controller for personal data related to the selection of panellists when ESA processes such data. For these purposes only as well as for the purposes mentioned in Article 5 of ESA Policy on Personal Data Protection, ESA is Data Controller. ESA does not instruct any third party – including NERSC or The Statsraad Lemkuhl Foundation – to conduct any web analytics, profiling or any other processing on ESA’s behalf, other than the purposes mentioned above.

The Nanson Environmental and Remote Sensing Centre, (NERSC) Norway are commissioned as ESA Processors via ESA contract to support ESA to administer ESA supported One Ocean Expedition students data for the activity.

The Statsraad Lemkuhl Foundation is separate Controller for the personal data they process, where such processing is not subject to ESA contract, i.e. administration of the expedition. Please refer to their separate privacy notice for more information.

Your personal data is processed by the ship for administration of the journey, involved in this activity, as separate Controller.

(1) What are the relevant contact details for this notice?

ESA Data Protection Officer (“DPO”) may be contacted in line with the ESA PDP Framework at DPO@esa.int. As the collection and processing concerned by this notice is performed upon initiative of the ESA Communications Department, questions may also be addressed to the e-mail address:

Craig.Donlon@esa.int

Marie-helene.Rio@esa.int

eotraining@esa.int

(2) What kind of personal data are collected and further processed?

We collect and process a variety of Your personal data and may require You to provide personal data for the purposes mentioned further below. Depending on the purpose for which they are collected and further processed, the personal data may include:

Identity Data: including names, date of birth, passport number, and relevant information for international travel; aboard a ship operating in International waters, or other official identity number, gender indication, and nationality;

Contact information: including address, email address and telephone number;

Emergency contact Information: including address, email address and telephone number;

Professional information: including job title, email address, phone number and addresses;

Professional career data: including your previous positions, experience at sea/scientific campaigns at sea, and other relevant professional experience in the form of a Curriculum Vitae document;

Technical data, including online identifiers: for example, internet protocol (IP) address or domain names of the devices utilised, login data, browser type and version, uniform resource identifier (URI) address, time zone setting and location, browser plug-in types and versions, ESA or other operating system and platform and other technology on the devices you are using – collected when you access our Website, our electronic portals and platforms which we offer or which we have agreed with you to use or made available to you where you have agreed to their use;

Photo: including photographs, likeness, image;

Audio-video recording, statements, interviews, activities aboard the ship including life on board and scientific activities;

Social media data: when you are a user of social media and depending on the circumstances or the social media in question, the personal data that we may collect are derived from:

• Your user profile, e.g. Your profile picture published on social media, your nickname or avatar),

• the audiovisual content that might be published on the social media platforms; this may include information in or about the content provided by a user (e.g., metadata), such as the location / date of a photo, voice recordings, video recordings, or an image of a data subject

• other personal information You may disclose via the social media or in the use thereof.

Other personal information You may provide, in particular content of exchanges with the Agency, as for instance dietary preferences, assistance data;

(3) How are Your personal data collected or further processed?

In addition to the personal data We collect directly from You, We may, depending on Your situation, collect certain personal data about You indirectly by various means. This includes collection of personal data from availably sources or from third parties, including from analytics providers such as your home Institutional Web Pages, Google or from social media platforms.

Cisco Webex Videoconferencing Service may be used to enable participation during the event. For this purpose, some personal data (including Audio and Video Data) may be processed by Cisco Systems, strictly limited to the European Union as per contractual obligations implemented between ESA and Cisco Systems Inc. Personal Data collected is limited to the necessary and Audio/Video data is retained only for the duration of the meeting. Some further Data (chat, signup information) may be retained for 6 months after the event and then automatically deleted. Processing in the European Union.

Microsoft Teams Videoconferencing Services and Microsoft 365 tools may be used to enable participation during the event.

ConfTool GmbH tools is used to provide the online registration system. ConfTool is contractually limited to processing personal data within the EU.

(4) Why are Your personal data collected and further processed?

We collect and process Your personal data because it is necessary for the activities conducted to fulfil Our purpose, which is “to provide for and to promote, for exclusively peaceful purposes, cooperation among European States in space research and technology and their space applications, with a view to their being used for scientific purposes and for operational space applications systems” (as per ESA Convention). We serve the public interest, and we wish to foster the public interest in space activities and programmes.

ESA is convening a training course in support of earth observation ocean domain as part of the UN Ocean Decade. Part of the course is held online for 3 hours each week over a period of 3 months to be followed by a voyage onboard a ship sailing from Tromso to Rekyavik concluding at the UN Ocean Decade Conference in June 2025, Nice France. Personal data is processed to select students and to administer the online training course. Personal data is also required to join the ship to be managed by the ships’ administration (as separate Controller).

Personal images, videos and interviews will be taken and processed throughout the training course to promote the UN Ocean Decade, the role of ESA and Earth Observation in supporting the Ocean Decade and related UN Conventions (e.g. UN Convention of the Law Of the Sea – UNCLOS, and related amendments/annexes that is a UN treaty signed internationally which ESA supports) and to promote the One Ocean Expedition for a sustainable ocean. You have the right to opt out of having your appearance processed, please inform the photographer/ video recorder (switch off your camera/microphone during recordings).

For the One Ocean 2025 Expedition, ESA collects data to select students with the best profile for the Expedition, to communicate with students during online training courses, to send materials to You, and to participate in Webex or Teams meetings (using ESA IT tools).

All ESA sponsored participants to the At Sea element of the ESA sponsored One Ocean Expedition (i.e. Students and Lecturer/support team) will join the ship which will operate under international maritime laws interpreted by the Norwegian Government at which point they will then become subject to captain’s instructions. Each student and the ship have a contract with the STATSRAAD LEHMKUHL Foundation, as separate Controller, that is independent of ESA.

The STATSRAAD LEHMKUHL Foundation, Norway will be working under ESA purchase order but will manage data protection for their legal activities with respect to passengers aboard a commercial vessel at sea (e.g. Immigration/customs clearance) as separate Controller for the ship voyage travel. However, it may be necessary to share personal information collected by ESA and /or administered together with the Nanson Environmental and Remote Sensing Centre in order to effectively manage Your participation in the ESA sponsored One Ocean Expedition 2025.

All the processing carried out by, or on behalf of, the Agency upon initiative of the EOP-S Department falls in this general purpose and, in particular, into one of the reasons permitted under ESA PDP Framework, in particular under ESA PDP Policy.

In any case, we do not use your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or legally permitted.

You will find more information on this matter in the summary table below.

• (5) On what legal grounds do We collect and process Your data?

We process Your personal data pursuant to the ESA PDP Framework, in particular pursuant to Article 5 of the ESA PDP Policy, for fair, specified and legitimate purposes or for purposes compatible therewith.

Generally, the processing referred to in this notice falls under Article 5.2.1 of the ESA PDP Policy, i.e.:

1. for the performance of an activity carried out by the Agency within its purpose and in the framework of, and in conformity with, the ESA Convention, the Policy on Personal Data Protection adopted by Director General of ESA on 1 March 2022 “Agreement between the States Parties to the Convention for the establishment  of a European Space Agency and the European Space Agency for the protection and the exchange of classified information” done in Paris on 19 August 2002, and the applicable rules and procedures, including ESA Security Regulations and Directives; this includes Processing necessary for the Agency’s management and functioning, Dispute Resolution Procedure, and or Investigation Procedures; or
2. for the performance of a contract concluded by the Agency within its purpose in relation with an activity carried out by the Agency in the framework of, and in conformity with, the ESA Convention and the applicable rules and procedures;
3. for purposes covered by Your Consent, as it may be obtained from You under a separate document (e.g. Consent form).

Other ESA Rules and Regulations may serve as legal basis, as they may be indicated to You in additional notices, as appropriate.

Depending on the situation, we may consider that your consent is given by various modalities and may result from affirmative motions (e.g., swiping on a screen), browser settings, written statements, filling an electronic online form, sending an email, uploading a scanned document with their signature, using an electronic signature and other modalities that may appear in the future.

(6) In which circumstances may We transfer or provide access to Your personal data?

Where relevant, We may disclose Your personal data to recipients (e.g. ESA staff members, advisors, contractors), under a “need to know” principle, for carrying out the processing operations referred to in this notice. They are generally located in the European Union, the European Economic Area or in countries that offer an adequate level of protection equivalent to that offered within the European Union and the European Economic Area (e.g., Argentina, Canada, Japan, Switzerland, United-Kingdom).

When the third-party data recipients are located in a country or international organisation not offering an adequate level of protection (e.g., Australia, United States, etc.), We will not proceed to the transfer of Your data unless You consented to it or unless the conditions set forth in ESA PDP framework (see Article 5.3 of ESA PDP Policy) are fulfilled. As appropriate, We take adequate safeguards (e.g. via appropriate contractual clauses) in order to obtain from third-party recipients a level of protection equivalent to that offered within the European Union and the European Economic Area.

In case of transfer of personal data to the United States or other countries not offering an adequate level of protection, transfer may expose You to certain risks, in particular the risk of profiling, the risk that the applicable legal framework may allow further processing of the personal data and that any given consent may not be withdrawn.

You may be provided with information regarding the privacy notices of separate controllers of personal data either herein or elsewhere in Our communications to you.

In exceptional cases, for instance in case of a criminal offence evidenced by the collection or processing of data, we may share the said data with the appropriate authorities or bodies, including the ones having an investigative role or the ones involved in the concerned legal proceedings.

ESA may Disclose your personal data to The STATSRAAD LEHMKUHL Foundation, NERSC and the ship, to facilitate your participation in this activity. We may disclose all of the information you provide to NERSC to enable You to participate in the One Ocean Expedition 2025 shore-based and at sea course.   We may disclose your name, address, email, age, contact details and passport details to the Statsraad Lehmkuhl foundation in order to register You for the at sea course.

(7) How long do We retain Your personal data for?

Your data are stored for the shortest time possible, taking into account the reasons why we need to process Your data, as well as all legal obligations applicable to the Agency. The Agency established time limits to erase or review the data stored. Retention periods applied by the Agency are proportionate to the purposes for which they were collected. Thus, the Agency will keep Your personal data for as long as necessary for the fulfilment of those purposes, which will be at least for the duration mentioned in the Table below. Your Personal Data is deleted upon expiry of the applicable retention period. By way of exception, We may keep Your personal data for a longer period, for archiving purposes in the public interest or for reasons of scientific or historical research, being reminded that appropriate technical and organisational measures are put in place (e.g. anonymisation, encryption, etc.).

Personal Data	Retention
ESA: your CV document, your application to participate in the ESA sponsored One Ocean Expedition 2025, emails, information relating to international travel aboard a ship operating in International waters. Information is used to select students for the Expedition and to administer the on-line course and ESA elements of the At Sea course.	2 years after the end of the activity, then deletion
Records of consent of the ESA consent form for Disclosure to BVCA	5 years after the end of the event
ESA Cisco Webex/Microsoft Teams	For the duration of the meeting, deletion immediately after the meeting ends.
Nanson Environmental and Remote Sensing Centre, (NERSC) Norway via ESA contract: help ESA to administer the students as ESA processor	2 years after the end of the activity, then deletion
The STATSRAAD LEHMKUHL Foundation, Norway to manage Your participation in the ESA sponsored One Ocean Expedition 2025.	1 year after the end of the activity, then deletion
ESA photos:	5 years Recording of training sessions: 7 years Copy of passport, name, address: ESA IT tools – delete at end of contract.

To the extent your personal data are collected via a web account, You have the possibility to delete the personal data as well as the account in your account’s settings.

(8) How do We protect and safeguard Your personal data?

All processing operations are carried out pursuant to ESA Rules and Regulations, including ESA PDP Framework and ESA Security Regulations. In particular, the Agency collects and processes personal data in conditions protecting confidentiality, integrity, and security of personal data.

In order to protect Your personal data, ESA has implemented a number of technical and organisational measures against the risks of loss as well as against unauthorised access, destruction, use, modification or disclosure of personal data, in particular when such risks concern sensitive personal data.

These measures take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. They may include, as appropriate, the pseudonymisation and encryption of personal data.

ESA applies contractual and technical measures for the protection of your personal data disclosed to the STATSRAAD LEHMKUHL Foundation, NERSC and the ship, with processing located in Norway.

(9) What are Your rights as data subject and how can you exercise them?

Under conditions detailed in the ESA PDP Framework, You have:

• the right to be informed about the identity of the data controller, the contact details of the data protection officer, the purpose of the data processing, the data recipients to whom the personal data shall be disclosed, the rights of rectification or erasure of his/her data, the storage time-limits (if any), the practical modalities of exercising the rights, etc. ; this is the purpose of this privacy notice and any other notice referred to herein ;
• the right to access the personal data We process about You,
• the right to have Your personal data erased, rectified, completed;  
• the right to lodge a complaint before the Supervisory authority, in accordance with the latter’s rules of procedure, in case You demonstrate or have serious reasons to believe that a data protection incident occurred in relation with Your personal data, following a decision of the Agency.

Note however that We may not erase Your personal data in case the processing is based on the performance of a legal obligation of ESA or where such data is necessary for the establishment, exercise, or defence of legal claims.

When the processing of Your personal data is based on Your consent and unless a specific case applies (e.g. see Article 6 above), You have also the right to withdraw Your consent.

You may wish to exercise any of the above-mentioned rights, by sending a request explicitly specifying Your query to the ESA DPO via e-mail at dpo@esa.int copy eotraining@esa.int

You may be asked additional information to confirm your identity and/or to assist ESA to locate the data You are seeking.

(10) ESA Contractors

ESA may enter into contracts with various contractors who, with regard to Your Personal Data and depending on the contract concluded with ESA, may act either as a separate Data Controller or as a Data Processor.

• To the extent such contractor act as a separate Data Controller, the separate privacy notice of the contractor will apply for the purposes of collection and processing decided by the contractor.
• To the extent such contractor act as a Data Processor, this privacy notice applies for the purposes of collection and processing decided by ESA.

(11) Third Party Providers and Social Media

Personal images, videos and interviews will be used throughout the training course to promote the UN Ocean Decade, the role of ESA and Earth Observation in supporting the Ocean Decade and related UN Conventions (e.g. UN Convention of the Law Of the Sea – UNCLOS, and related amendments/annexes that is a UN treaty signed internationally which ESA supports) and to promote the One Ocean Expedition for a sustainable ocean. You have the right to opt out of photographs and video recordings and of their publication.

ESA may use third party IT Providers or social media for information purposes or to promote an activity (meeting, event, recruitment campaign, etc.). ESA websites may provide links to social media and videos may be made available on ESA social media pages.  

It is up to You to decide whether You wish, or not, to have access and use those IT tools and social media, in consideration of the fact that they are governed by terms and conditions, including privacy notices, that are not under ESA control and that they may send data in territories that do not provide an equivalent protection. If You do not want Your data to be processed by such IT tools or social media, You may decide not to register as user or otherwise accept the applicable third party terms and conditions.

Processing from third party sources: Where necessary for the execution of the business relationship with you, we may also obtain personal data from third party sources. This may also include the collection of further personal data from publicly accessible sources (e.g. commercial press, media, internet,).

You can object to the processing of personal data for marketing, commercialization, advertising purposes including the analysis of your data or the transfer to third parties for advertising purposes at any time without giving reasons.

YouTube and Vimeo use non-essential cookies to process your Personal Data.You may decline such cookies.

(12) Age limitation

Participation in the ESA sponsored One Ocean Expedition 2025 activity is open to you if you are 18 years of age or older.

(13) Your consent

By participating in the ESA Sponsored One Ocean Expedition 2025 activity and by submitting your personal data you agree to ESA Framework on Personal Data Protection and to the processing of your personal data by, or on behalf of, the Agency, as mentioned in this ESA Privacy Notice and Consent form as follows:

• I agree to the processing of my personal data for potential selection as a participant in the event.
• Should I be selected, I agree to the processing of my personal data for the participation in the event.
• I agree to the processing and publishing of my personal data on publicly available social media, websites, or for ESA promotional materials (esa.int, ESA Earth Observation Twitter, LinkedIn Channel, and related newsletters).
• I agree to be photographed / video recorded / intervierwed during the activity but may choose to decline without predijice.
• I agree to the public publication in any/specific media of the photographs / video recordings in which I am included as part of the promotional activities surrounding the One Ocean Expedition in support of a sustainable ocean.
• I agree to share my contact details with slected Expedition participants, the Nansen Environmental and Remote Sensing Centre and the Statsraad Lehmkuhl Foundation in order to manage my participation in the event.

You will be able to withdraw your consent depending on the modality used to collect your personal data, in particular: by contacting the DPO@ESA.int and copy eotraining@esa.int.