This Privacy Notice details how Luxembourg Space Agency Foundation (“LSA” or “we”) collects, uses, stores and discloses personal data collected from the users of our Website (“users” or “you”) in compliance with the rules set forth by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of persons regarding the processing of personal data and on the free movement of such data (“GDPR”).
Any person visiting our Website and using our services offered by our Website shall be deemed to be aware this Privacy Notice.
1. WHO IS THE CONTROLLER ?
LSA, incorporated under the laws of the Grand-Duchy of Luxembourg and registered with the Luxembourg Trade Register under number G254, whose registered office is at 19-21 Boulevard Royal L-2449 LUXEMBOURG, acts as data controller[1].
This Website is provided by the Ministry of Economy of Luxembourg and located in Luxembourg. LSA and has appointed a Data Protection Officer (DPO). In case of need, you can contact our DPO using this e-mail address: personaldata@space-agency.lu
2. WHAT ARE THE PERSONAL DATA THAT ARE COLLECTED?
« “Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject »[2]. LSA may collect personal data from its users in a variety of ways: when they visit the Website, when they register to participate to our events or subscribe to our newsletter, or when they send a spontaneous application.
In our Website, collected personal data may include :
- Identification data such as first and last name, Contact data such as email address,,
- Technical data collected by automated means such as your IP address, your browser type and language, access logs, connection methods, geographical data, behavioral as well as other analytical data.
3. FOR WHAT PURPOSES DOES LSA PROCESS YOUR DATA AND WHAT IS THE LAWFUL BASIS OF THOSE PROCESSING OPERATION?
The GDPR requires that any processing be based on one of the six lawful basis it lists:
- the consent of the data subject,
- the need for the performance of a contract concluded with the data subject or pre-contractual measures at the latter’s request,
- a legal obligation,
- the protection of the vital interests of a natural person,
- the fact that the processing is required for LSA to fulfil its public interest missions[1] or,
- the legitimate interest of the controller.
Depending on your situation and the reasons for which you are in contact with LSA, you will find below the purposes of the processing of your data and the applicable lawful bases. Be aware that several headings may apply to you.
3.1. If you visit our Website, your data are processed as described in our Cookies Policy.
3.1. If you use one of the forms available on our Website, your data can be processed for the following purposes (depending of the form in question):
- To communicate with you;
- To provide our services :
- Sending newsletters and other LSA information,
- Invitation to events organised or co-organised by LSA,
- Statistical analysis of requests for support and participation in projects
3.1. The lawful basis of those purposes is consent. Consent to process your data is required for each registration (contact form, newsletter, spontaneous application, etc.), for a duration of twelve (12) months. LSA allows itself to re-ask the consent after this deadline. Furthermore, the data subject has the right to withdraw its consent at any time, this withdrawal not affecting the lawfulness of the processing based on the consent given before this withdrawal.
4. HOW LONG WILL YOUR DATA BE KEPT ?
The duration of the storage of your data will be determined by:
- the purposes detailed above;
- any legal or regulatory obligations to keep data;
- the applicable legal limitation period.
Your personal data is collected via the LSA Fondation website either in the contact form or in the newsletter subscription form. This information is processed by LSA Foundation in order to complete your request.
By completing these forms, you agree your personal data being processed by LSA Foundation. In the specific case of a newsletter subscription request, you can unsubscribe at any time (a link is provided at the bottom of each newsletter). If you choose to unsubscribe, your email address is immediately deleted from the mailing list and your personal data is deleted from LSA Foundation systems within 3 months.
In the case of sending a contact form, depending on the request expressed, LSA Foundation transfers it either to its internal collaborators and able to respond to you, or to its external partners, because their missions make them legitimate to answer you. If your request is processed internally, your personal data will be kept for 24 months from the last date of contact. If your request is entrusted to an external institution, LSA deletes your personal data within 3 months from your last sending date.
5. WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM?
As a data subject, you have various rights. Below is a brief description of these rights and how you can exercise them.
- Right to information : You can send us any questions regarding the recording and processing of your data.
- Right of access : You may, at any time, and by written request to us, obtain confirmation that personal data concerning you is processed or not and, where applicable, obtain access to such data and a free copy thereof.
- Right to rectification : You may, at any time, and via a written request addressed to us, obtain the rectification of any inaccurate personal data concerning you. You can also request that incomplete data be completed in the same way.
- Right to erasure : You may, at any time, and by written request to us, obtain the deletion of your data, provided that one of the following reasons applies:
- the data is no longer necessary for the purposes for which it was collected and processed;
- you have withdrawn your consent on which the processing was based and there is no other legal basis for it;
- you object to the processing and there is no compelling legitimate reason for it;
- the data has been unlawfully processed;
- the data must be deleted in order to comply with a legal obligation.
- Right to limitation of processing: You may request, by sending a written request to us, that the processing be limited for one of the following reasons:
- you dispute the accuracy of the personal data (processing will be limited for the period necessary to verify the accuracy of the data);
- in the event of unlawful processing, you object to the deletion of your data and request that its use be limited;
- we no longer need your data for processing purposes, but it is still necessary for you to establish, exercise or defend legal claims;
- you have objected to the processing (the processing will be limited for the period necessary to verify the existence of legitimate grounds pursued by LSA that would prevail over yours).
- Where processing restrictions are granted, personal data may, with the exception of storage, be processed only with the consent of the data subject, or for the establishment, exercise or defence of legal rights, or for the protection of the rights of another natural or legal person, or for important reasons relating to the public interest.
- Right of opposition : You have the right to object, at any time and by sending a written request to us, for reasons relating to your particular situation, to the processing of your data based on the performance of a public mandate or necessary for the legitimate interests pursued by us.
- We will no longer process such personal data unless it is demonstrated that there are legitimate and compelling reasons for processing that prevail over your interests and rights and freedoms, or for the establishment, exercise or defence of legal rights.
- When your personal data is processed for the purpose of prospection, you have the right to object at any time to this processing.
- Right to portability : You have the right, by sending a written request to us, to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and to transmit such data to another controller without LSA hindering it, when:
- the processing is based on your consent or a contract; and
- the processing is carried out using automated processes.
- Right to withdraw consent : Where the processing is based on your consent, you have the right to withdraw it at any time by sending a written request to us. The withdrawal of your consent will not affect the lawfulness of the processing operation based on the consent given before it was withdrawn.
- Right to lodge a complaint: We make every effort to ensure that our legal obligations regarding data protection are respected and to respond as quickly as possible to any complaint addressed to us in this regard.
For any questions regarding the processing of your personal data carried out by LSA, and for any queries regarding the exercise of your rights, please contact the LSA DPO : personaldata@space-agency.lu
In the event that you are not satisfied with the response received, you have the option of filing a complaint with the Luxembourg supervisory authority:
Commission Nationale pour la Protection des Données (the “CNPD”)
15, Boulevard du Jazz
L-4370 Belvaux
Grand-Duchy of Luxembourg
You also have the option of contacting the supervisory authority in your country. You will find the contact details of all the supervisory authorities here: https://edpb.europa.eu/about-edpb/board/members_en.
In application since : September 2023
[1] As described in the coordinated bylaws of LSA, published in the Commercial Register of Luxembourg Companies, under the reference C16: https://gd.lu/rcsl/2DXWJm.
[1] « "controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing; where the purposes and means of such processing are determined by Union law or the law of a Member State, the controller may be designated or the specific criteria applicable to his designation may be provided for by the law of the Union or by the law of a Member State »: https://cnpd.public.lu/fr/legislation/droit-europ/union-europeenne/rgpd/chapitre-1.html#article4.
[2] https://cnpd.public.lu/fr/legislation/droit-europ/union-europeenne/rgpd/chapitre-1.html#article4.
