PRIVACY NOTICE: Little Pictures Competition 2023

Little Pictures Competition 2023

Introduction

The European Space Agency (herein the “Agency” or “ESA”) is an intergovernmental organisation established by its Convention opened for signature in Paris on 30 May 1975. The Protection of Personal Data is of great importance for ESA, which strives to ensure a high level of protection as required by the ESA Framework on Personal Data Protection (herein the “ESA PDP Framework”) which applies for processing of Personal Data at ESA, available at:

http://www.esa.int/About_Us/Law_at_ESA/Highlights_of_ESA_rules_and_regulations

The ESA PDP Framework applicable for the processing of Personal Data within ESA is composed of the following elements:

- the Principles of Personal Data Protection, as adopted by ESA Council Resolution (ESA/C/CCLXVIII/Res.2 (Final)) adopted on 13 June 2017;

- the Rules of Procedure for the Data Protection Supervisory Authority, as adopted by ESA Council Resolution (ESA/C/CCLXVIII/Res.2 (Final)) adopted on 13 June 2017; and

- the Policy on Personal Data Protection adopted by Director General of ESA on 5 February 2018 and effective on 1 March 2022

Scope of this Privacy Statement

This notice is intended to inform you about the processing of your personal data ESA Climate Office Little Pictures Competition 2023 and more specifically about:

the identity of the Data Controller and contact details of the ESA Data Protection Officer (“DPO”);
the type of personal data collected and processed;
the modalities of collection of personal data;
the purpose and legal basis of the collection and processing;
the recipients to whom the personal data of the Data Subject is disclosed;
the time-limits for storing the personal data;
your rights and the modalities by which you can exercise them and the practical modalities of exercising your rights and those rights of other persons, when processed in this Processing Activity under the ESA PDP Framework.

Please be aware that all references to “Data” in this document if not otherwise stated relate to data by which an individual could be identified/ having an identifying character, broadly defined as Personal Data.

ESA requires members of the public participating in ESA Climate Office Little Pictures Competition 2023

to be 18 years of age or older. If you are not 18 years old yet, we are sorry, but we can’t provide for you to participate in the ESA Climate Office Little Pictures Competition 2023.

This notice furthermore enables ESA to obtain your consent relating to the collection and further processing of your personal data, under the ESA PDP Framework where relevant

Description and the Purpose for this Processing of your Personal Data: What is this processing about?

The Little Pictures Competition 2023 is being held by the European Space Agency’s Climate Office to highlight climate change and the important role that satellite data play in helping to understand, monitor and address the issue. To enter the competition, entrants are required to complete and submit a ‘Little Picture’ (a satellite data-driven climate visualisation) via this form. The competition judging panel will select the winning Little Pictures. Entrants will be notified of the result and an annual newsletter will be distributed to all those registered for the competition.

The general Purpose of this processing is to enable you to enter the competition, notify you of the result and send you an annual newsletter in relation to future ESA Climate Office data visualisation competitions.

In addition to these purposes, the Agency may use your personal information for any of the purposes mentioned in Article 5 of the Policy on Personal Data Protection.

Legal Basis What is the legal basis for processing the personal data?

Specific Legal Basis for this processing:

5.2.1 i. (g) ESA PDP Framework; A purpose covered by the Consent of the Data Subject. Consent is collected via a checkbox on the website form prior to your entry is submitted to the competition.

Data Controllers, Data Processors, other Recipients of Personal Data and their Contact Details: Who Processes what data in which capacity?

The following table lists all the involved companies, agencies or otherwise, where your personal data may be processed and all relevant information concerning their involvement in this activity.

Processing Entity	Personal Data Categories	Type of Personal Data in detail	Description of Processing Responsibilities and specific Purpose of the Processing
European Space Agency (ESA) as Controller	Contact details	Name Surname Email Address Organisation Nationality	Your personal data are collected and further processed as described in this Privacy Notice upon the decision taken by: ESA through and limited to staff directly involved in the ESA Climate Office.
ESA DPO	All Personal Information required to accomplish the DPO’s duties as defined in the ESA PDP	All Personal Information required to accomplish the DPO’s duties as defined in the ESA PDP	According to ESA PDP Framework, your first and unique point of contact concerning personal data matters is the ESA Data Protection Officer (“DPO”). In this regard your personal information may be processed by ESA’s DPO to reply to your requests and to exercise your rights under the ESA PDP.
Limesurveys https://esa-survey.limequery.org as Processor	Contact details	Name Surname Email Address Organisation Nationality	To permit individuals to submit a competition entry and for ESA to contact entrants

Entity	Contact details
European Space Agency (ESA)	Headquarters: 8-10 Rue Mario Nikis, CS 45741, 75738 Paris Cedex 15, France.
European Space Agency (ESA)
European Space Agency (ESA)
ESA DPO	Data Protection Officer: DPO@esa.int

Personal Data Disclosure, Transfer and Safeguards:

ESA does not instruct any third party – including Limesurveys – to conduct any web analytics, profiling or any other processing on ESA’s behalf, other than the purposes mentioned above.

Personal Data Retention and Deletion: For which time period are your personal data retained by ESA?

Personal data is retained by ESA for the time period necessary to fulfil the legitimate purpose of the processing.

Your Personal Data is stored and processed based on the following timeframes:

Personal Data Categories and Place of Processing	Retention
Basic Information, Contact details, Contact details	General Personal Data: Deletion 5 years after creation
Basic Information, Contact details, Contact details	Accounts and their personal information will be deleted within one month after data subjects have exercised their erasure right

Other Considerations

The Agency does not consider your personal data as an asset for sale and, thus, does not sell your personal data to any third parties.
ESA does not plan to implement any automated decision-making within this activity.
ESA does not instruct any third party – including [one or all Processors] – to conduct any web analytics, profiling or any other processing on ESA’s behalf, other than the purposes mentioned above.

Third party IT tools or social media may be used to promote and inform you about an activity (meeting, event). ESA websites may provide links to social media and videos may be available on ESA social media pages. If you view an embedded video hosted on an external provider (such as YouTube) or interact with links to social media, third-party cookies are likely to be installed on your device, covered by third party Terms and Conditions and cookie policies. ESA has no influence over these.

Carefully assess the privacy policies and Terms and Conditions regarding your data subject rights, the further processing and the protection of your personal data prior to playing the relevant video or clicking on a link to external providers. ESA seeks to protect your personal data when embedding videos and to make you aware when a link refers you to an external social media or other websites where ESA cannot control the processing of your personal data.

Your rights (Data Subject Rights) How can you access, erase, rectify, complete or amend your personal data?

You have the right to be informed in a transparent manner about: the processing of your personal data (the Controller, purpose, recipients, etc.); your rights and the modalities of exercising these, (e.g. erasure, rectification, completion, or amendment as per the conditions under PDP 5.1. i.; right for every interested Data Subject to lodge a complaint before the Supervisory Authority in case the former demonstrates or has serious reasons to believe that a Data Protection Incident occurred in relation with his/her Personal Data, following a decision of the Agency (e.g. Data Protection Officer). The right of information under PDP 5.4.1 i. and the right of access under Section 5.4.1 ii. shall not apply: (a) where and insofar as the Data Subject is already in possession of the information; (b) for the right of information, when processing of Personal Data is necessary for any Investigation or Dispute Resolution Procedure; (c) for the right of access, where and insofar such access would conflict with an Investigation Procedure concerning the Data Subject.

If you would like to exercise any of those rights, please send a request explicitly specifying your query to the ESA DPO via e-mail at dpo@esa.int or addressed to the:

ESA Headquarters

Data Protection Officer

8-10 RUE MARIO NIKIS

CS 45741

75738 PARIS CEDEX 15

FRANCE

via postal service.

Please keep in mind that the more specific information you can provide to us about the Activities, Events, Systems, ESA Departments and/or Processes where your personal data is to your knowledge stored, the sooner we can respond to your enquiry, request or complaint.

We seek to respond without undue delay, and in any event within one month of receipt of the request. However, that period may be extended by two further months where necessary, taking into account the complexity and number of the requests. You will be informed of any such extension, together with the reasons for the delay.

If you wish to submit a complaint to the ESA Data Protection Supervisory Authority, you are required to comply with the Rules of Procedure of the Supervisory Authority set forth in the ESA PDP Framework:

(https://www.esa.int/About_Us/Law_at_ESA/Highlights_of_ESA_rules_and_regulations).

You will be required to demonstrate that a Data Protection Incident occurred in relation to your personal data, following a decision of the Agency or at least be able to provide serious reasons and indicators to establish that such an incident occurred.

Unsubscribe: If you wish to unsubscribe you can do so by contacting us via climate.office@.esa.int and ask to be removed from the Little Pictures competition newsletter.

If you want to consent to receiving our newsletter, please subscribe below. If at any point you want to withdraw your consent, please email us at: climate.office@esa.int

Personal Data Breach: What should you do in case of a data protection incident?

If you have any concerns about your personal data or became the victim of a data breach of ESA processed personal data, you should contact ESA’s DPO, as first point of contact, by sending an email to: dpo@esa.int and provide all information available to you regarding the potential breach.

Your Consent for ESA Climate Office Little Pictures Competition 2023

(DPNR 2138)

The processing of your personal data as described in this privacy notice is based on consent indicated by either ticking the consent box in this form or sending ESA the signed form by email.

I [please provide your Name, Surname,] __________________________

born, ________________________, have read and understood all the information provided to me with regard to the processing of my personal data for ESA Climate Office Little Pictures Competition 2023 and I hereby explicitly consent to the use of my personal data for the purpose of

enabling entry to the competition, notification of the result and sending an annual newsletter in relation to future ESA Climate Office data visualisation competitions.

ð I am aware of my right to revoke my consent at any time by contacting either climate.office@esa.int or the ESA DPO directly under DPO@esa.int and my other rights as stated in the Privacy Notice provided to me in connection with this Consent Declaration.

Signature and Date _________________________