1. Who is responsible for your data?

The data controller is SBIC Noordwijk, located at Kapteynstraat 1, 2201 BB Noordwijk, The Netherlands. For questions about data handling, contact us at info@esaphilab.nl.

2. What data is collected?

Upon submission, we collect:
– Personal data (e.g. names, email addresses, phone numbers)
– Company data (e.g. name, address, registration, VAT number)
– Project and technical documents
– Budgetary or financial information (if provided)

3. Purpose of collection

Submitted data is used exclusively for:
– Evaluating your proposal’s eligibility and suitability under the ESA Phi-Lab project.
– Organising and managing the assessment and selection process
– Communicating with you during and after the evaluation
– Complying with applicable administrative, legal, and ESA contractual requirements

4. Sharing with ESA and authorised evaluators

Submitted data will be shared with:
– The European Space Agency (ESA), if the evaluation or funding involves ESA oversight
– External evaluators and subject-matter experts under strict confidentiality and non-disclosure obligations
All parties are required to use your data solely for evaluation, compliance, and related contractual purposes, in accordance with ESA’s procurement and data protection rules.

5. Legal basis for processing

Your data is processed based on:
– Your explicit consent (by submission and ticking the confirmation box)
– Legitimate interest in executing and managing the ESA-affiliated funding process
– Compliance with legal or contractual obligations under ESA or national implementation rules

6. Retention period

Data is retained for the duration of the evaluation process and for as long as necessary to meet ESA audit, reporting, and contractual archiving requirements.

7. Rights and dispute handling

You have rights under the GDPR, including:
– Access to your data
– Correction of inaccuracies
– Withdrawal of consent (note: this may invalidate your submission)
– Deletion of data where permitted
– Complaint to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

8. Updates to this notice

We may revise this privacy notice if required to align with ESA regulations or legal obligations. The latest version will always be available on this page.

9. Data Security and Protection Measures

We take appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, misuse, alteration, or disclosure. These measures include:

• Secure Hosting: Our website is hosted on secure servers located within the EU, maintained with regular security updates.
• Encrypted Connections: All data transmitted through our website is protected using HTTPS/SSL encryption.
• Access Control: Only authorised personnel have access to systems containing personal data, and access is granted only when necessary.
• Password Protection: Password policies are enforced for administrator accounts.
• Regular Updates: Systems and software are regularly updated to address potential security vulnerabilities.
• Backups: Data is backed up regularly and stored securely to enable recovery in the event of loss.

We regularly review and update these measures to ensure they remain appropriate to the nature of the data we process and the risks involved.

10. Use of Google Analytics