Privacy Notice

Last revised: March 2023

LIST general privacy policy

AN OVERVIEW OF DATA PROTECTION

Based in Luxembourg, the European Space Resources Innovation Centre (ESRIC) is the world’s first innovation centre entirely dedicated to space resources.

ESRIC has been launched in 2020 by a common initiative of the Luxembourg Space Agency (LSA) and the Luxembourg Institute of Science and Technology (LIST) in strategic partnership with the European Space Agency (ESA). ESRIC is part of the LIST.

The LIST(hereafter “We”) is committed to ensure the highest standards of data protection in compliance with the applicable legislation, notably with reference to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereafter “GDPR”).

The present document aims at illustrating what personal data we collect about you, the reason why LIST uses your data and, as the case may be, share your data and the applicable retention periods. Additionally, the notice also provides you with information regarding your rights, how to exercise them and whom you can contact in case of any query.

SCOPE OF THE NOTICE

The present notice is directed to:

• users or visitors of ESRIC’s website (hereafter the “website”),
• individuals who contact ESRIC via the contact form in the website,

Hereafter together “you”.

IDENTITY OF THE DATA CONTROLLER

The data controller is LIST, having its registered office at 5, Avenue des Hauts-Fourneaux L-4362 Esch-sur-Alzette, Luxembourg. LIST is responsible for collecting and processing your personal data in relation with LIST’s activities. 

WHY AND HOW YOUR PERSONAL DATA IS PROCESSED

LIST collects and uses your personal data for the following purposes:

HOW WE OBTAIN YOUR PERSONAL DATA

We obtain the personal data directly from you when you submit your message in the ESRIC website or subscribe to the newsletter.

CATEGORIES OF PERSONAL DATA WE PROCESS

Please find here below a list of personal data we process:

LEGAL BASIS FOR PROCESSING

Please find here below a list of the legal basis on whose grounds LIST collects and processes your personal data:

SHARE OF YOUR PERSONAL DATA WITH THIRD PARTIES

LIST may share your personal data with:

• LIST’s internal departments on a need-to-know basis, in order to ensure the administration of your contact message;
• Institutional or non-institutional partners, with whom LIST collaborates in the context of ESRIC management and organization, particularly the Luxembourg Space Agency (LSA) and the European Space Agency (ESA).

Some of the mentioned recipients of your personal data may be in countries outside the European Union or the European Economic Area (EU/EEA):

• Ungerboeck Systems International GmbH: We use Ungerboeck, a company based in Germany, as our event management platform. Ungerboeck as our processor must ensure the compliance of its subcontractors providing contractual services outside the EU/EEA with EU data protection regulations. Particularly, this processor is authorized to involve Ungerboeck Systems International, Inc (United States) under the European Commission's Standard Contractual Clauses. Further information can be found at: ungerboeck.com/privacy-policy.
• The Rocket Science Group LLC d/b/a Mailchimp: Mailchimp is the online platform that we use to manage and send LIST newsletters. Mailchimp may transfer and process personal data to and in the United States and anywhere else in the world where Mailchimp, its affiliates or its sub-processors maintain data processing operations. As between LIST and Mailchimp, such processing is done in compliance with the standard contractual clauses. For more details, you can have a look at the following webpage: https://mailchimp.com/en-gb/legal/data-processing-addendum/?_gl=1*13ddyte*_up*MQ..*_ga*ODA1NzU0OTExLjE2Nzc2ODQ1MDk.*_ga_N5HD1RTH6E*MTY3NzY4NDUwOC4xLjAuMTY3NzY4NDUwOC4wLjAuMA..&gclid=EAIaIQobChMI5OPC-P-6_QIVD97tCh2uUAGiEAAYASAAEgJoDPD_BwE&gclsrc=aw.ds.
• Microsoft Ireland Operations Limited: This processor is based in Ireland and is the provider of MS Teams, a videoconferencing application. Microsoft may transfer, store and process personal data in the United States or any other country in which Microsoft or its contractors maintain facilities. Transfers out of the European Union and European Economic Area, are governed by Standard Contractual Clauses. For further details, please have a look at the following page: https://learn.microsoft.com/en-us/microsoftteams/teams-privacy.

ENSURING PERSONAL DATA SECURITY AND INTEGRITY

In compliance with the applicable data protection legislation, LIST has put in place appropriate technical and organisational measures in order to prevent or act upon any unauthorised and unlawful processing or disclosure, accidental loss, modification or destruction of personal data. These measures are implemented based on the current state of art, an evaluation of the risks derived by the processing activity and the need to protect personal data. Such technical and organisation measures are regularly updated and/or adjusted to new technical developments or any organisational change that may affect LIST.

DATA RETENTION PERIODS

LIST will only retain your personal for a period of time that is strictly necessary for the purposes for which we collect your data, to comply with a legal or regulatory obligation to which LIST is subject or to manage our relationship with you. In particular, we will retain your personal data for the following periods of time:

YOUR RIGHTS AND HOW TO EXERCISE THEM

With regards to your personal data collected and processed by LIST, you may exercise at any time the following rights:

• Right to access: You have the right to receive confirmation about whether or not your personal data is being processed by LIST. If that is the case, you have the right to know what data is being collected and processed and to obtain of copy of it;
• Right to rectification: If the personal data we hold about you is inaccurate or incomplete, you have the right to request to have it rectified;
• Right to erasure: Subject to certain conditions specified in art. 17 of the GDPR, you have the right to have your personal data deleted by LIST;
• Right to restriction of processing: Subject to certain conditions specified in art. 18 of the GDPR, you have the right to obtain restriction of the processing of your personal data performed by LIST;
• Right to data portability: Subject to certain conditions specified in art. 20 of the GDPR, you have the right to obtain a copy of the personal data you provided to LIST in in a structured, commonly used and machine-readable format and to request the transfer of these data to another data controller;
• Right to object: You have the right to object the processing of your personal data when the conditions set out in art. 21 of the GDPR apply;
• Right to withdraw consent: If LIST is processing your personal data based on your consent, you have the right to withdraw that consent at any time. The withdrawal of such consent shall not affect the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD). More information on how to lodge a complaint are available on CNPD’s website: https://cnpd.public.lu.

You may exercise any of these rights by contacting our Data Protection Officer (DPO):

• by e-mail at the following address: dpo@list.lu,
• or by post at:

Luxembourg Institute of Science and Technology

Attn. Data Protection Officer

5, Avenue des Hauts-Fourneaux

L-4362 Esch-sur-Alzette, Luxembourg.

Please kindly note that your rights are not absolute and they may be withheld in accordance with applicable data protection laws. In such event, LIST will provide you with the reasons for not complying with your request. In such case, you may lodge a complaint with the CNPD and seek a judicial remedy against such decision.

LINK TO OTHER WEBSITES

Please be aware that LIST website may contain links to other website that are not governed by this privacy notice. We encourage users to review the privacy notice of each website before disclosing any personal data.

CHANGES TO THIS NOTICE

LIST may make changes to this privacy notice from time to time, to reflect our current privacy practices or to comply with changes in the applicable data protection legislation. LIST encourages you to regularly visit this page in order to remain informed on how LIST collects and processes personal data.