Privacy Statement

All personal data are dealt with in compliance with the applicable rules on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (currently Regulation (EU) 2018/1725). The following data protection information notice outlines the criteria by which the Polish Space Agency, as the GEXTRECS Consortium member under the Grant Agreement No. 101129626, collects, manages and uses personal data on behalf of GMV Aerospace and Defence S.A. in relation to the online contact form on the GEXTRECS website. Identity of controller and data protection officer: Data Controller: GMV Innovating Solutions S.L, 11 Calle Isaac Newton, Parque Tecnologico de Madrid, Tres Cantos 28760, Madrid, Spain e-mail address: privacy@gmv.com Data Protection Officer: Audens e-mail address: privacy@gmv.com Purposes of data processing:

1. To respond to queries submitted by web users.
2. To process data for statistical and management purposes.

Data/Categories of data concerned: GEXTRECS website users (referred to as data subjects) are requested to provide the following personal data in order to submit a message or enquiry to the GEXTRECS Consortium via a dedicated contact form:

• Mandatory data: first name, last name, e-mail address, subject of enquiry and the message (free-text field);
• Non-mandatory fields: country of residence and occupational category.

Recipients/Categories of recipients of the data processed: Access to personal data is granted on a ‘need to know’ basis to:

1. A limited number of staff of the GMV Aerospace and Defence S.A. managing enquiries.
2. Data processors: GEXTRECS Consortium members and external contractors, which are bound by personal data protection rules equal to those applying to GMV Aerospace and Defence S.A.:
   • A limited number of staff of the Polish Space Agency managing enquiries;
   • Staff of the Polish Space Agency’s contractor in charge of the communication services;
   • Staff of the Polish Space Agency’s contractor, including its subcontractors (i.e. sub-processors), in charge of providing cloud hosting servers;
   • A limited number of staff of RESOLVO Srl (RESOLVO) providing technical support for the project website.
3. Staff of the European Union Agency for the Space Programme (EUSPA), as Contracting Authority in the frame of the Grant Agreement No. 101129626, may also access personal data, in their quality of managing and monitoring the aforementioned Grant Agreement.

Any recipient of personal data will be reminded of its obligation not to use the data received for other purposes than the one for which they were transmitted. Legal basis/Lawfulness of the processing: Processing of personal data is based on the consent of the data subject, in compliance with Art. 5(1)(d) of Regulation 2018/1725, whereby data subject has unambiguously given his or her consent to provide  personal data by filling-in and submitting the online contact form with the requested personal data. Information on the storage locations and retention period of personal data:

1. Personal data will be stored electronically on the servers of the Polish Space Agency’s contractors, including cloud hosting servers, which are located in the EU.
2. Personal data will be retained for 4 years after the expiry of the Grant Agreement No. 101129626 for audit and discharge purposes. Once the retention period is over, personal data will be destroyed.

Automated decision-making Your personal data will not be used for automated decision-making, including profiling. GEXTRECS website users contacting the Consortium via a dedicated contact form (i.e., data subjects) have the right:

1. To obtain confirmation as to whether or not his or her personal data are being processed, access the data and obtain detailed information on the processing;
2. Of rectification of inaccurate personal data;
3. Of erasure of personal data if the statutory provisions are met;
4. Of restriction of processing if the statutory provisions are met;
5. To data portability, allowing to obtain and reuse personal data for their own purposes across different services;
6. To withdraw the consent to personal data processing at any time, without affecting the lawfulness of the processing before the consent’s withdrawal;
7. To lodge a complaint to the European Data Protection Supervisor at EDPS@edps.europa.eu should they consider that the processing operations do not comply with Regulation (EU) 2018/1725.

Any request for the exercise of any of the above-mentioned rights shall be addressed to GMV Innovating Solutions, S.L. at privacy@gmv.com. In your email, please describe exactly your request. Contact information:

• Regarding the processing of your personal data: privacy@gmv.com;
• Regarding the interpretation, application or breach of Regulation (EU) 2018/1725, please contact GMV Innovating Solutions, S.L. at privacy@gmv.com.