Catalonia Space Skills Mapping Privacy Policy

Summary

This policy in 5 points:

1. We collect a variety of personal data as part of the surveys. We do this as part of research about the space sector and how it can be improved.
2. We share some data publicly, but never in a way that makes any individual identifiable.
3. We take data security very seriously and do everything in our power to keep your personal information secure. We limit access to the people in our team who need it, we keep the amount we hold to a minimum, we try not to hold on to it for longer than is necessary, and we protect it with passwords and other security measures.
4. You have the right to access and correct the personal data we store about you, to restrict what we do with it, and to ask us to remove it entirely.
5. This privacy policy only covers data collection in the context of surveys and interviews for the Catalonia Space Skills Mapping project. It does not cover the use of our main website or interactions with us on social media.

Introduction

This document covers data collection in the context of surveys and interviews for the Catalonia Space Skills Mapping project. It does not cover using our main website, or interacting with us on social media. That is covered by our separate Web Privacy Policy.

This document may be updated from time to time by agreement between the responsible partners. We will notify you by email if we store your personal information and the changes affect you.

Who manages the information

The surveys for the Catalonia Space Skills Mapping project are developed by the company Space Skills Alliance (the data processor), on behalf of the Institute of Space Studies of Catalonia (IEEC) and the Department of Business and Labour of the Government of Catalonia (DEMT) (joint data controllers). In this document, these three organizations are collectively referred to as the “responsible delivery partners”.

The joint data controllers are:

protecciodedades@ieec.cat

You can contact the IEEC Data Protection Delegate: dpd.recercaiuniversitats@gencat.cat

You can contact the Department Data Protection Delegate: dpd.empresa@gencat.cat

Access to the essential parts in accordance with article 26.2 of the RGPD, you can access the essential parts of the joint agreement by contacting the contact point mentioned in the previous point dpd.recercaiuniversitats@gencat.cat or dpd.empresa@gencat.cat

Space Skills Alliance

Space Skills Alliance is the data processor for this project.

‘Space Skills Alliance’ refers to Space Skills Ltd, a registered company in England and Wales (UK), number 12209851. It is registered with the UK Information Commissioner’s Office (ICO), with registration reference ZA828423. Its Data Protection Officer is Joseph Dudley (joseph@spaceskills.org).

What we collect

Requesting a reminder

When you request a reminder, we ask for your email address so that we can send you that reminder. We collect and use it under the legal basis of legitimate interest, and only in order to send you that reminder. Reminder emails aren’t linked in any way to census responses.

Completing the surveys

Completing the survey of individuals

The surveys collect a variety of personal data about you and your job.

We ask for your explicit consent to store and process your personal data.

This survey is anonymous, but your combination of responses might accidentally make you identifiable to our researchers. For example if you are the only woman in your company, then if you tell us your gender and your company’s name then we might be able to identify you.

We will make no attempt to identify you unless you provide your email address for follow-up research.

Optionally, you may also be offered the opportunity to provide your email address to enter a raffle for tickets to Mobile World Congress 2027. This email address will be collected separately from your survey responses and will not be used to link your identity with your answers. The data provided for the raffle will only be used to manage the draw and contact the winners.

Completing the survey of organisations

The survey collects information primarily about your organisation, as well as small amount of personal information about you:

• Name
• Position
• Employer
• Email address

We ask for your explicit consent to store and process your data and your organisation’s data.

This survey is not anonymous as it is important to know who is answering the survey so that we can properly interpret the results. However, no identifying information will be shared beyond the survey delivery partners. Aggregate data will be made publicly available.

Follow-up research and interviews

You have the option of providing your email address in order to take part in follow-up research. As with all the questions in the survey, this is optional.

If you provide your email address for follow up research, then your survey responses will no longer be anonymous, and we will look at your responses to understand what follow-up questions we might ask you.

We will use your email address only for contacting you about this survey. We won’t share your email address with anyone, or add you to any mailing list.

If you change your mind at any time about participating in the follow-up research, you can email us at info@spaceskills.org and we will delete your email address.

Requesting a copy of your responses

You have the option of providing your email address in order to receive a copy of your responses. As with all the questions in the survey, this is optional.

If you provide your email address for a copy of your responses, then your email address will only be used for this purpose, and will not be stored.

Accessing the website

We store up to two distinct kinds of records, explained below, when you access the survey website. The data is processed to compile statistical reports on website activity. It is not linked in any way to your survey response.

Server logs

Our web server automatically logs all requests for webpages. This is standard procedure for most websites.

This means that whenever anyone loads one of our webpages or submits data, the action will be logged. Each log entry contains the requester’s IP address (a kind of name computers use to identify each other), some details about the browser they are using, and the name of the page that has been requested (more information can be found here). No information about the page content or any survey response is stored. All such logs are anonymous.

Server logs are stored by our web host on their servers. We rarely use full server logs, but from time to time they are analysed by our team to troubleshoot problems, particularly spam attacks.

Cookies

We store 1 cookie on your computer when you complete the survey. This cookie does not identify you, and only serves to prevent you from resubmitting the survey form.

Tracking and analytics

We do not use any other tracking software on the survey website.

How we store and protect the data

As you answer each question, a copy of your responses so far is stored on your computer. This is so that if you close the page, or your internet connection drops, you can continue where you left off.

When you submit the survey, the responses are removed from your computer and securely in our password-protected database. Only we have access to this database.

We take data security very seriously and do everything in our power to keep your personal information secure.

• We audit our data to ensure we are keeping only information we need
• We carefully limit what can be accessed publicly, and protect the rest with passwords
• We use protocols such as HTTPS, Single Sign On, and Multi Factor Authentication to minimise the chances of someone intercepting data or one of our passwords
• We monitor our servers and databases for suspicious activity

Service providers

The webpages and databases are hosted on web servers owned and operated on our behalf by our hosting provider Heroku, a subsidiary of Salesforce, in Ireland. These servers store the files and database for our websites and provide them to website visitors and our team.

We may also transfer some or all of the data to Google Drive, a cloud storage service provided by Google. The data is stored in Europe.

Data breaches

We have a comprehensive action plan and checklist for data breach incidents. If we identify that personal data has been exposed, we will make this news public and notify any affected individuals The IEEC will communicate this to the Catalan Data Protection Authority (APDCAT), if applicable. We will also act to identify the cause of the breach and take steps to prevent it from happening again.

How we use and share the data

Reminders

When you provide your email address for a reminder, we keep it for the duration you specify and then send you a reminder email. Once that email is sent, we delete your email address.

Reminder emails aren’t linked in any way to survey responses.

Survey responses

Once the survey is completed, we will analyse the data to look for trends and test some hypotheses. The results of this analysis will be published in one or more reports, alongside recommendations for actions for the sector. The results will be available online on the Catalonia Space Strategy 2030 website and on the IEEC website.

Some reports will be public, others may only be shared with our partners.

Your rights

Your rights relating to your data are written into law under the Data Protection Act, and the General Data Protection Regulation. These are:

1. The right to be informed – You have a right to be informed about how we collect, process, and store your personal data. This information is provided in this document.
2. The right of access – You have a right to access the personal data we store about you.
3. The right to rectification – You have a right to have inaccurate details corrected.
4. The right to erasure – You have a right to have personal data erased.
5. The right to restrict processing – You have a right to restrict the way in which we process your personal data.
6. The right to data portability – You have the right to obtain the personal data we store about you in a structured machine readable format.
7. The right to object – You have the right to object to the way in which we process your personal data.
8. Rights in relation to automated decision making and profiling – This right does not apply as we do not engage in automated decision making or profiling.

To exercise any of the rights listed above, please email us at info@spaceskills.org including your name and outlining the ways in which you have interacted with us. You must also provide proof of identity, which can include sending the email from an address we have on record.

If you consider that your rights have not been adequately addressed, you have the right to file a prior complaint with the data protection delegate: dpd.empresa@gencat.cat. This complaint must be resolved within a maximum period of 2 months from its receipt.

On the other hand, you can also file a complaint with the Catalan Data Protection Authority through its electronic office.