EUROPEAN COMMISSIONPROTECTION OF YOUR PERSONAL DATAThis privacy statement provides information about the processing and the protection of yourpersonal data
Processing operation: Copernicus.eu website
Data Controller: European Commission, Directorate-General for Defence, Industry and Space
Unit R.3 - COMMUNICATION, HUMAN RESOURCES AND SECURITY OF INFORMATION [“DG DEFIS
Unit R.3” or the “Data Controller”]
Data Processor(s):ICF Next
Avenue Marnix 171000 Brussels, Belgium
FDC SARL
10 Cours Louis Lumière
94300 Vincennes, France
ALSO Space
Rue Emmanuel Van Driessche 61
1050 Brussels, Belgium
Contact information:
Phone: +33 153 66 11 11
Email: eusso.dpo@euspace-programme.eu

Record reference: DPR-EC-04346.1
Table of Contents
1. Introduction
2. Why and how do we process your personal data?
3. On what legal ground(s) do we process your personal data?
4. Which personal data do we collect and further process?
5. How long do we keep your personal data?
6. How do we protect and safeguard your personal data?
7. Who has access to your personal data and to whom is it disclosed?
8. What are your rights and how can you exercise them?
9. Contact information
10. Where to find more detailed information?

Commission européenne/Europese Commissie, 1049 Bruxelles/Brussel, BELGIQUE/BELGIË - Tel. +32 22991111

1. Introduction
The European Commission (hereafter ‘the Commission’) is committed to protect your personal
data and to respect your privacy. The Commission collects and further processes personal data
pursuant to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23
October 2018 on the protection of natural persons with regard to the processing of personal databy the Union institutions, bodies, offices and agencies and on the free movement of such data(repealing Regulation (EC) No 45/2001).
This privacy statement explains the reason for the processing of your personal data, the way wecollect, handle and ensure protection of all personal data provided, how that information is used
and what rights you have in relation to your personal data. It also specifies the contact details of
the responsible Data Controller with whom you may exercise your rights, the Data Protection
Officer and the European Data Protection Supervisor.
The information in relation to processing operation of the Copernicus.eu website undertaken by
the Data Controller is presented below.
2. Why and how do we process your personal data?
The Data Controller processes your personal data to allow you to receive information via email(personal and automated), postal mail and phone, necessary to perform your role as member ofthe EU Space Networks, and to follow relevant developments, activities, events, workshops,
initiatives, thematic articles, reports, interviews, surveys, newsletters, phone calls, videoconferences, webinars, visual content.
The Data Processors are a consortium contracted to manage the EU Space Support Office, i.e.,
FDC SARL, ALSO Space SRL, and ICF NEXT. Activities undertaken by this consortium include
website management, newsletter, podcast, and other media dissemination, as well as user
support and uptake activities including webinars and videoconferences. ICF Next administers
Copernicus.eu, managing the sign-in to the member area and any site cookies related toCopernicus.eu, as explained in the cookie policy. Contractors from both FDC SARL and ALSO SpaceSRL help manage the website content but have no visibility over any personal data on the website,which is managed solely by ICF Next.
The EU Space Support Office is responsible for the animation of the EU Space Networks. Your data
may also be shared with additional data processors contracted by the European Commission to
perform the same or other services necessary for the successful animation of the Networks, suchas the website Copernicus.eu. The public Copernicus website, http://www.copernicus.eu/en, may
contain personal data in the form of contact details and may collect personal data via cookies
based on consent.
The restricted Copernicus website hub for EU Space Network members contains invitations tomeetings, related minutes and follow-up, common actions, updates and background information
about the Copernicus component of the EU Space Programme and contact information of EU
Space Network members. Users access the restricted member area of the Copernicus EU website
via personal credentials.
All of the data gathered on users by Copernicus.eu in the context of using Copernicus.eu ismanaged by ICF Next. The website contact form and Copernicus Network application forms,
though hosted on or linked to from Copernicus.eu, are connected to a ticketing system on ODOO.
This system is managed conjointly by FDC SARL and ALSO Space SRL, who work together to track
application and support requests received. ICF Next does not have access to the ODOO database.

2

Newsletter subscriptions are handled via a separate platform called Mailerlite, which is managed
by consultants at ALSO Space. Users of Copernicus.eu can subscribe directly to the newsletter via
a form hosted on Copernicus.eu. Management of this subscriber list is done uniquely through the
Mailerlite platform. Neither ICF Next nor FDC SARL have any access to or visibility of this list.
Your data will not be used for any automated decision-making, including profiling.
3. On what legal ground(s) do we process your personal data?
We lawfully process your personal data on the following legal ground(s):Processing is necessary for the management and functioning of the Commission, as mandated
by the Treaties. Those provisions are in particular Article 11 of the Treaty on European Union and
Article 15 of the Treaty on the Functioning of the European Union. Consequently, those
processing operations are lawful under Article 5(1)(a) of Regulation (EU) 2018/1725 (processing
is necessary for the performance of a task carried out in the public interest or in the exercise of
official authority vested in the Union institution or body).
Furthermore, the promotion of information sharing is based on Article 108 (2) of Regulation (EU)2021/696 of the European Parliament and of the Council of 28 April 2021 establishing the Space
Programme of the Union and the European Union Agency for the Space Programme. Thisestablishes the EU space programme for the period 2021-2027 and aims to maintain the EU's
leadership in space, ensure competitiveness in the new space industry and address challenges
such as climate change and technological innovation. The Regulation supports the disseminationand exploitation of space-related data and information, including promoting the societal benefitsof Copernicus and other components of the EU Space Programme. The Commission is authorised
to take measures (here: information through podcasts) to inform the public.
Furthermore, you have given consent to the processing of your personal data for the
publication of contact details and photos, subscription to a newsletter managed by the Data
Controller, via a clear affirmative act of ticking a box in the online registration form(s) (Article
5(1)(d) of Regulation (EU) 2018/1725). Your consent for this/these purpose(s) can bewithdrawn at any time by writing to eusso.dpo@euspace-programme.eu to unsubscribe or
by clicking on the unsubscribe link in any email newsletter that you receive.
Users of the sign-in section can delete their accounts from the restricted section at any time. An
email must be sent to eusso.dpo@euspace-programme.eu, asking for the removal of the account.
Once the removal is effective, users will no longer be able to access the restricted section, andtheir data will be permanently deleted from the server.
4. Which personal data do we collect and further process?
In order to carry out this processing operation, the Data Controller collects the following
categories of personal data:
For the subscription to the EU Space Observer newsletter- Email address
For the contact form: https://www.copernicus.eu/en/network/get-touch- Name- Username- Email address
For the license agreement form - https://www.copernicus.eu/en/form/license-agreement-form- Name3-Street name and number
Postal code
City
Country
Email address

On the Copernicus website, we feature a sign-in to restricted section for specific users of our
website. The purpose of the restricted section is to coordinate and animate the Copernicus
component of the EU Space Networks.
For the sign-in section,
we only collect data that is necessary for the proper animation of the Copernicus component of
the EU Space Networks. We do not share the data with third parties nor use them for advertising
purposes.
1. In the sign-in section of the Copernicus website, we collect personal data as follows:- Name- Surname- Email
2. In the cases of the EU Space Network Members (Copernicus Relays and Academies members),
we also collect:- Contact person's first name, family name, phone number and email- Names of other representatives of the organisation
We have obtained your personal data from you. Your personal data will not be used forautomated decision-making including profiling.
5. How long do we keep your personal data?
The Data Controller only keeps your personal data for the time necessary to fulfil theabovementioned purpose(s).
For each of the categories of personal data that is processed, please find below the retention
details:-

Data for the subscription to the weekly newsletter: 2 years
Data used to request information when using the contact form: 2 years
Data used for the registration to the sign-in section: 2 years
Data following your request and authorisation to use Copernicus Data and information
through the “licensing” page: 2 years
Data used by cookies: 2 years

from the moment personal data are collected.
6. How do we protect and safeguard your personal data?
All personal data in electronic format (e-mails, documents, databases, uploaded batches of data,etc.) are stored on the servers of the European Commission or of its contractors. All processing
operations are carried out pursuant to the Commission Decision (EU, Euratom) 2017/46 of 10
January 2017 on the security of communication and information systems in the European
Commission.
The Commission’s contractors are bound by a specific contractual clause for any processing
operations of your data on behalf of the Commission, and by the confidentiality obligations
4

deriving from the transposition of the General Data Protection Regulation in the EU Member
States (‘GDPR’ Regulation (EU) 2016/679).
In order to protect your personal data, the Commission has put in place a number of technicaland organisational measures. Technical measures include appropriate actions to address online
security, risk of data loss, alteration of data or unauthorised access, taking into consideration therisk presented by the processing and the nature of the personal data being processed.
Organisational measures include restricting access to the personal data solely to authorised
persons with a legitimate need to know for the purposes of this processing operation.
7. Who has access to your personal data and to whom is it disclosed?
Access to your personal data is provided to the Commission staff responsible for carrying out thisprocessing operation and to authorised staff according to the “need to know” principle. Such staff
abide by statutory, and when required, additional confidentiality agreements.
The controller will transmit your personal data to the contractors (processors based on a current
or future contract pursuant to Article 29 of Regulation (EU) 2018/1725) responsible formaintaining and managing the Copernicus.eu website, including the animation of the EU Space
Networks.
Cookies
Cookies are short text files stored on a user’s device (such as a computer, tablet or phone) by a
website. Cookies are used for the technical functioning of a website (functional cookies) or forgathering statistics (analytical cookies).
The cookies employed on your device for that purpose will be covered by the cookie policy of theCopernicus website, which is available here: https://www.copernicus.eu/en/cookies
When you visit the website https://www.copernicus.eu/en, we will keep the browser history of
your visit for a maximum of 2 years. This information will then be deleted.
The collection, aggregation and anonymising operations are performed in the data centre of
Amazon Web Services in Frankfurt under adequate security measures.
Cookies are stored by Matomo Analytics which is a web analytics service self-hosted by theCopernicus website contractor. Its purpose is to analyse the traffic on our website. We use thecollected data and information, inter alia, to evaluate the use of our website and to provide online
reports, which show the activities on our websites.
The IP addresses of visitors are anonymised by the Copernicus website prior to their storage in
the Matomo self-hosted database; this protects the anonymity of the visitors that have opted forthe full website functionalities. Consequently, such data is stored on the website’s contractor
servers located in the European Union. The self-hosted version of Matomo Analytics has aretention control feature. This feature provides website owners with the flexibility to define a
retention period for the data stored within the database with a retention period of 26 months;
any data beyond this period is deleted from Google servers.
Your data will not be used for an automated decision-making, including profiling.
Enabling these cookies is not strictly necessary for the website to work but it will provide you witha better browsing experience. You can delete or block these cookies, but if you do that, somefeatures of the website may not work as intended.
5

Should you wish to opt your personal data out of our anonymised, aggregated statistics, you cando so on our cookies page. In particular, you can control and/or delete those cookies as you wish.
Third-party IT tools, including Social MediaWe use third party IT tools to inform about and promote the Copernicus.eu website throughwidely used communication channels, including newsletters and social media. For detailed
information about the use of social media by the European Commission, see the Record ofProcessing DPR-EC-00073 (Social Media Use by the European Commission).
You can watch our videos, which we also upload to our YouTube page and follow links from our
website to Twitter, Instagram and Facebook.
In order to protect your privacy, our use of third-party IT tools to connect to those services does
not set cookies when our website pages are loaded on your computer (or other devices), nor are
you immediately redirected to those social media or other websites. Only in the event that you
click on a button or “play” on a video to watch it, a cookie of the social media company concerned
will be installed on your device. If you do not click on any social media buttons or videos, no
cookies will be installed on your device by third parties.
In order to view such third-party content on our websites, a message will alert you that you needto accept those third parties’ specific Terms and Conditions, including their cookie policies, overwhich the Commission has no control.
We recommend that users read the relevant privacy policies of Twitter, Instagram, Facebook,YouTube, carefully before using them. These explain each company’s policy of personal datacollection and further processing, their use of data, users' rights and the ways in which users canprotect their privacy when using those services.
The use of a third-party IT tool does not in any way imply that the European Commission endorses
them or their privacy policies. In the event that one or more third party IT tools are occasionallyunavailable, we accept no responsibility for lack of service due to their downtime.
Please note that pursuant to Article 3(13) of Regulation (EU) 2018/1725 public authorities(e.g. Court of Auditors, EU Court of Justice) which may receive personal data in the framework ofa particular inquiry in accordance with Union or Member State law shall not be regarded asrecipients. The further processing of those data by those public authorities shall be in compliancewith the applicable data protection rules according to the purposes of the processing.
The information we collect will not be given to any third party, except to the extent and for the
purpose we may be required to do so by law.
Specific third-party tools and services utilised
In the context of tracking and handling queries from both our member networks and from thegeneral public, we use Monday.com and Odoo. These tools assist us in managing, organising, andresponding to various operational and communication needs efficiently.
Data Processing and Storage with Monday.com
Monday.com, a cloud-based platform, is utilised for project management. As a data processor
under, Monday.com securely stores that data that we enter for purposes such as project
management, issue tracking, and client communication. The lawful basis for this processing
includes implied consent and legitimate interests.
6

Data stored on Monday.com is secured in their EU data centre in Germany, and this data is notshared with third parties. We ensure robust data security in alignment with GDPR standards.
Use of Odoo for Business Operations
Odoo is utilised for various organisational purposes, including CRM and ticket tracking. Personal
data processed through Odoo may include name, email address, phone number, and mailingaddress and is used for in the context of providing the support specifically requested by network
members and the general public. The processing is based on consent and legitimate interests.
Like with Monday.com, data security and GDPR-compliant transfer mechanisms are a priority in
our use of Odoo.
Your Rights Under GDPR
You have the right to access, rectify, erase, restrict, or port your data processed via Monday.com
or Odoo. To exercise these rights, please contact us at eusso.dpo@euspace-programme.eu.
Data Retention
We retain personal data processed through both platforms for a necessary period, adhering tolegal requirements and the purposes outlined in this policy.
Changes and Updates
We reserve the right to modify how we use Monday.com and Odoo. Any changes will be
communicated and updated in this policy. No data or information that is entered into theseplatforms is processed outside of the European Union.
8. What are your rights and how can you exercise them?
You have specific rights as a ‘data subject’ under Chapter III (Articles 14-25) of Regulation (EU)2018/1725, in particular the right to access, rectify or erase your personal data and the right torestrict the processing of your personal data. Where applicable, you also have the right to object
to the processing or the right to data portability.
You have the right to object to the processing of your personal data, which is lawfully carried out
pursuant to Article 5(1)(a), on grounds relating to your particular situation.
You have consented to provide your personal data to the data controller for the present
processing operation. You can withdraw your consent at any time by notifying the data controller
by writing to eusso.dpo@euspace-programme.eu. The withdrawal of your consent will not affectthe lawfulness of the processing carried out before you have withdrawn the consent.
You can exercise your rights by contacting the Data Controller, or in case of conflict the Data
Protection Officer. If necessary, you can also address the European Data Protection Supervisor.
Their contact information is given under Heading 9 below.
Where you wish to exercise your rights in the context of one or several specific processing
operations, please provide their description (i.e. their Record reference(s) as specified under
Heading 10 below) in your request.
Any request for access to personal data will be handled within one month. Any other request
mentioned above will be addressed within 15 working days.

79. Contact information- The Data Controller
If you would like to exercise your rights under Regulation (EU) 2018/1725, or if you havecomments, questions or concerns, or if you would like to submit a complaint regarding thecollection and use of your personal data, please feel free to contact the Data Controller:
European Commission - Unit DEFIS R.3 – COMMUNICATION, HUMAN RESOURCES AND SECURITY
OF INFORMATION - E-mail: defis-R3@ec.europa.eu.
- The Data Protection Officer (DPO) of the Commission
In case of disagreement with the Data Controller, you may contact the Data Protection Officer(DATA-PROTECTION-OFFICER@ec.europa.eu) with regard to issues related to the processing ofyour personal data under Regulation (EU) 2018/1725.
- The European Data Protection Supervisor (EDPS)
You have the right to have recourse (i.e. you can lodge a complaint) to the European Data
Protection Supervisor (edps@edps.europa.eu or https://edps.europa.eu/data-protection/ourrole-supervisor/complaints_en) if you consider that your rights under Regulation (EU) 2018/1725
have been infringed as a result of the processing of your personal data by the Data Controller.
10. Where to find more detailed information?
The Commission DPO publishes the register of all processing operations on personal data by theCommission, which have been documented and notified to him. You may access the register via
the following link: http://ec.europa.eu/dpo-register.
This specific processing operation has been included in the DPO’s public register with thefollowing record reference: DPR-EC-04346.1.

8