Space Resources Week Privacy Notice
Last revised: December 2023
On 18 November 2020, an implementation agreement concerning cooperation activities atESRIC was signed between the Ministry of the Economy, as the supervisory body of theLuxembourg Space Agency (LSA), the Luxembourg Institute of Science and Technology(LIST), a leading mission-driven research and technology organisation, and ESA. The Centre
is embedded in Luxembourg’s space ecosystem, which is promoted and supported by LSA.
ESRIC is operated and hosted by LIST.
Please kindly note that the Space Resources Week is jointly organised by LIST, LSA and ESA(hereafter “the Organisers”, “We””).
1. An overview of data protection
LIST, LSA and ESA are committed to ensure the highest standards of data protection incompliance with the national applicable legislation and with the Regulation (EU) 2016/679 of
the European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of suchdata (hereafter “GDPR”).
The present notice aims at illustrating what personal data LIST collects about you, the reason
why we use your data and, as the case may be, share your data and the applicable retention
periods. Additionally, the notice also provides you with information regarding your rights, how
to exercise them and whom you can contact in case of any query.
2. Scope of the notice
The present notice is directed to:••••users or visitors of the Space Resources Week’s website (hereafter the “website”),
users registering for any of the events organized in the course of the Space
Resources Week (including public lectures and conferences and online events suchas webinars - hereafter “Event”),
individuals who contact us by any means in relation to the Space Resources Week,individuals who submit papers in the context of the call for papers for the Space
Resources Week 2024.

Hereafter together “you” or “Participant”.
3. Identity of the data controller
In the framework of this Event, LIST qualifies as independent controller.
Our contact details are set out in Section 11 (“Your rights and how to exercise them”) below.
4. Why and how your personal data is processed
LIST collects and uses personal data of Participants for the following purposes:
PurposeDetails1

To perform and execute In the case of sponsors, speakers, authors and remaining
Participants purchasing registrations for the Event, LIST
agreements
processes personal data needed to perform and execute therequired agreements. This includes:

Event management•

to prepare and execute agreements;•

to deliver the Event;•to process payments and refunds; and•to manage invoices•

to issue certificates.

To properly organize and deploy Event, which includes:•managing Participants’ registration and participation to
an Event (e.g. creation and management of user
accounts in our event management platform,distribution of badges, provide updates and details
regarding an event, distribution of satisfaction forms,
managing complaints, feedback and queries regarding
an Event, issue of certificates of atendance uponrequest);•ensuring the broadcast of the Event•

receiving and evaluating papers submitted in thecontext of a call for papers related to an Event;•ensuring the security of our premises and facilities, aswell as to provide Participants access to the premissesof an Event;•taking photographs and/or videos of an Event for
dissemination in different media (LIST Intranet, LIST'ssocial media accounts, conferences..) and promotion
to the general public;•publishing and sharing attendance lists as well as
biographies and list of speakers, sponsor and authors;•performing statistics and evaluation of Events.

Management of scientific The aim of this activity is to ensure that applicants can present
papers submission
their scientific research and publication to the public of theEvent. To do so, the applicant has to submit his/her scientificpaper via the Event website. These data will handled by theinternal Communication team of the Organizations as well asthe Evaluation Committee, who is in charge of the review andselection of the papers.
Processing of contact To process contact details to contact and invite Participants todetails for inviting to ESRIC’s future events.
future events

5. How we obtain the personal data of Participants2Generally, we obtain the personal data directly from Participants, typically at the registration
to an Event, when attending an Event, when communicate with us in relation to an Event,when completing our feedback forms or surveys or when submitting a scientific paper.
In some cases, we may obtain the personal data from third parties:•••

a third party who may register the Participant for a LIST’s Event on his/herbehalf,a third party who may submit the paper within the context of the call for papers
and indicate the Participant as author,
LIST’s IT providers as better explained below.

6. Categories of personal data we process
The categories of personal data that we collect about you may vary depending on the type ofEvent. Those include:•Contact details: name, surname, address, email, phone number,•

Professional information: company/organisation, job title,•

Economic and financial information: Payment method, Credit card (last 4 digits andfirst 6 digits), information about the transaction (authorised, expired, declined, failed,date and time of the transaction), full transaction ID,•

Technical data: device identification data and traffic data (e.g. MAC addresses, weblogs, IP address),•Your image, audio and likeliness (as captured on a webinar, in photographs orrecordings taken at the Event),•Records of communications sent to You or received from You,•Any other requirement (such as accessibility requirements and emergency contacts).

7. Legal basis for processing
Below you can find the list of legal basis on whose grounds LIST collects and processes
Participants’ personal data:
PurposeLegal basis

To perform and executeagreements

The processing of personal data is necessary for a contract
with the Participant, in the case of sponsors, speakers,
authors and remaining Participants purchasing registrations
for Events.
After the Event, in the case of financial transactions, LIST willneed to process personal data to comply with legal
obligations.

Event management

LIST processes personal data for such purpose under LIST’slegitimate interest in properly organizing and deploying
Events. The use made of the personal data benefits theindividuals since it allows LIST to deliver the Event theParticipant has registered for.

3

Management ofscientific papers
submission

Consent provided during the Event registration. To withdraw
consent, contact LIST at contact@esric.lu.

Processing of contact
detailsforinviting
Participants to future
eventsConsent provided during the Event registration. To withdraw
consent, the Participant can click the unsubscribe link in thefooter of any email received or contact LIST atcontact@esric.lu.

8. Share of your personal data with third parties
LIST may share your personal data with:•

LIST’s internal departments on a need-to-know basis, in order to ensure the properorganization and management of the Event,•The public in general in relation to dissemination of photographs and videos,•External service providers that perform services on LIST behalf, such as catering
companies, event organisation or communication agencies service providers and IT
service providers,•The Organizers of the Event,•The scientific committee that is in charge of evaluating and selecting the scientificpapers and that is composed of experts from LIST, ESA, LSA.

•Some of the mentioned recipients of your personal data may be in countries outside
the European Union or the European Economic Area (EU/EEA):•Swoogo LLC: We use Swoogo, a company based in the United States, as oursubmission platform for scientific papers and mailing lsit. Swoogo as our processor
must ensure the compliance of its subcontractors providing contractual services
outside the EU/EEA with EU data protection regulations. Transfers out of the EuropeanUnion and European Economic Area, are governed by Standard Contractual Clauses.
Furtherdetails
aremadeavailable
bytheprocessor:
https://swoogo.events/legal/privacy/•Microsoft Ireland Operations Limited: This processor is based in Ireland and is theprovider of MS Teams, a videoconferencing application. Microsoft may transfer, store
and process personal data in the United States or any other country in which Microsoftor its contractors maintain facilities. Transfers out of the European Union and European
Economic Area, are governed by Standard Contractual Clauses. For further details,
please have a look at the following page: https://privacy.microsoft.com/engb/privacystatement•PayPal (Europe) S.à r.l. et Cie, S.C.A: We use PayPal to process online payments,
which is a payment service provided by PayPal (Europe), a company based in
Luxembourg. PayPal may transfer, store and process your personal data in countries
outside the European Union and European Economic Area country in which PayPal orits contractors maintain facilities. These transfers will be done based on Binding
Corporate Rules. PayPal acts in its capacity as data controller when processing yourtransactional data. For further details, please have a look at the following page:https://www.paypal.com/myaccount/privacy/privacyhub
9. Ensuring personal data security and integrity4In compliance with the applicable data protection legislation, LIST has put in place appropriatetechnical and organisational measures in order to prevent or act upon any unauthorised andunlawful processing or disclosure, accidental loss, modification or destruction of personaldata. These measures are implemented based on the current state of art, an evaluation of therisks derived by the processing activity and the need to protect personal data. Such technicaland organisation measures are regularly updated and/or adjusted to new technicaldevelopments or any organisational change that may affect LIST.
In particular, access on a need-to-know basis has been implemented to ensure only staff withappropriate need for the purpose has access to the personal data of Participants in LIST
Events. Additionally, we have data processing agreements in place with our processors.
10. Data retention periods
LIST will only retain your personal for a period of time that is strictly necessary for the purposes
for which we collect your data, without prejudice to LIST to keep them for a longer duration forlegal and/or regulatory obligations applying to LIST or due to exceptional situations that would
justify them being kept longer (judicial procedure, etc.). Below are the details regarding thetime we keep your personal data:

PurposeLegal basis

To perform and executeagreements

The personal data will be retained for 30 years (maximum)from the termination of the agreement in accordance with Art.
2262 Code Civil.

Event management

In this case, we will keep the personal data in accordance with
our retention schedule.

Management ofscientific papers
submission

The data is kept until the final book of abstracts is published.

Processing of contact Until you unsubscribe to the newsletter.
details
forinviting
Participants to future
events

11. Your rights and how to exercise themWith regards to your personal data collected and processed by LIST, you may exercise at any
time the following rights:•Right to access: You have the right to receive confirmation about whether or not yourpersonal data is being processed by LIST. If that is the case, you have the right toknow what data is being collected and processed and to obtain of copy of it;•Right to rectification: If the personal data we hold about you is inaccurate orincomplete, you have the right to request to have it rectified;•Right to erasure: Subject to certain conditions specified in art. 17 of the GDPR, youhave the right to have your personal data deleted by LIST;

5•

Right to restriction of processing: Subject to certain conditions specified in art. 18of the GDPR, you have the right to obtain restriction of the processing of your personaldata performed by LIST;•Right to data portability: Subject to certain conditions specified in art. 20 of theGDPR, you have the right to obtain a copy of the personal data you provided to LIST
in in a structured, commonly used and machine-readable format and to request thetransfer of these data to another data controller;•Right to object: You have the right to object the processing of your personal datawhen the conditions set out in art. 21 of the GDPR apply;•Right to withdraw consent: If LIST is processing your personal data based on yourconsent, you have the right to withdraw that consent at any time. The withdrawal ofsuch consent shall not affect the lawfulness of processing based on consent before its
withdrawal.

•Right to lodge a complaint with a supervisory authority: You have the right to lodge
a complaint with the Commission Nationale pour la Protection des Données (CNPD).
More information on how to lodge a complaint are available on CNPD’s website:
https://cnpd.public.lu.

You may exercise any of these rights by contacting our Data Protection Officer (DPO) by fillingthe online form.
12. Changes to this notice
LIST may make changes to this privacy notice from time to time, to reflect our current privacy
practices or to comply with changes in the applicable data protection legislation. LIST
encourages you to regularly visit this page in order to remain informed on our data protection
policies.

6