Quality Reports Advanced Search Portal

Terms & Conditions Cookie Notice Privacy Notice

Privacy Notice for QRAS

The European Space Agency (hereafter the "Agency" or "ESA" or "We") is committed to protecting personal data in line with the ESA Framework on Personal Data Protection (the "ESA PDP Framework"), available at esa.int/About_Us/Law_at_ESA/Highlights_of_ESA_rules_and_regulations, comprising:

the Principles of Personal Data Protection adopted by the ESA Council on 13 June 2017;
the Rules of Procedure for the Data Protection Supervisory Authority adopted by the ESA Council on 13 June 2017; and
the Policy on Personal Data Protection (including its Annex, "Governance Scheme of ESA's Personal Data Protection") adopted by the Director General of ESA on 1 March 2022 (the "ESA PDP Policy").

This notice explains why and how your personal data are collected and processed by, or on behalf of, ESA as Data Controller in connection with the Quality Reports Advanced Search Portal ("QRAS" or "the Portal"), and what rights you have in relation to your personal data. It also provides the contact details of the Data Protection Officer. This notice must be read together with the ESA PDP Framework and the other notices referred to herein, including the QRAS Cookie Notice and the QRAS Terms and Conditions.

In short

QRAS is a single-page web application that lets you search, filter, visualise and download publicly available Earth Observation quality reports. It does not include any registration, sign-in, account, contact form or upload functionality, and it does not ask you to submit any personal information. The only personal data associated with your use of QRAS are limited technical data generated automatically by your browser, and — solely if you consent — anonymised visit statistics collected through analytics cookies. We do not build user profiles, and we do not retain any data that identifies you individually.

1. How can you contact ESA regarding this notice?

The ESA Data Protection Officer ("DPO") may be contacted, in line with the ESA PDP Framework, at dpo@esa.int. Further information is available from the DPO on request.

Separate controllers

To identify the point of contact for personal data protection matters concerning separate controllers (organisations independently responsible for the personal data they decide to collect and process), please refer to the privacy notice of that separate controller. Queries relating to such matters will not be dealt with by ESA or its DPO.

2. What kinds of personal data are collected?

QRAS does not include any form, registration, sign-in or upload feature, so we do not ask you to submit any personal data through the Portal itself. We do not collect your name, email address or any other identifying information you might otherwise provide, because there is no functionality that requests it. The only personal data that may be processed in connection with your use of QRAS are:

Technical data, including online identifiers: your internet protocol (IP) address, browser type and version, device and operating-system information, and equivalent server-log data, generated automatically by your browser each time you load the page. This data is used only transiently, to serve the page to you and to protect the Portal against misuse; it is not stored in a form linked to you;
Usage and analytics data: statistics about how QRAS is visited and used, such as the number of visits, pages viewed and general browsing patterns, collected through analytics cookies only where you have given your consent via the cookie banner (see the Cookie Notice). This data is pseudonymised at collection and used solely in aggregate, statistical form; it is not used to identify individual visitors.

3. How are your personal data collected and processed?

Because QRAS is a single-page portal with no forms or accounts, all data collection happens automatically, in the background, as a by-product of loading and viewing the page. ESA processes your personal data by:

receiving technical information (such as your IP address and browser details) that your browser sends automatically whenever it requests the QRAS page or the underlying report data, for the sole purpose of delivering the service and protecting it against misuse;
collecting anonymised or pseudonymised usage and analytics information through cookies placed on your device via the Matomo analytics tool, but only where you have given your consent through the cookie banner (see the Cookie Notice for full details).

We do not collect personal data from any other source, and we do not combine the technical data above with any other information to build a profile of you.

4. Why are your personal data collected and processed?

We collect and process your personal data as necessary for the activities carried out to fulfil ESA's purpose, which is "to provide for and to promote, for exclusively peaceful purposes, cooperation among European States in space research and technology and their space applications, with a view to their being used for scientific purposes and for operational space applications systems" (as per the ESA Convention). We serve the public interest, including the public interest in Earth observation activities and open access to Earth observation quality information.

All processing carried out by, or on behalf of, ESA in connection with QRAS falls within this general purpose and, in particular, within one of the grounds permitted under the ESA PDP Framework. We do not process your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or permitted by law to do so.

If you…	Your data are processed to…
visit QRAS and use its search, filtering, visualisation and download tools	serve you the page and the Earth Observation quality report data you search for, filter, view or download; ensure the security of the Portal and identify or prevent unauthorised access to, or misuse of, our servers; where you have consented to analytics cookies, compile anonymised, aggregate statistics on how QRAS is visited (for example, overall visit numbers and general usage trends), so that we can understand demand and improve the service.

If you…

Your data are processed to…

visit QRAS and use its search, filtering, visualisation and download tools

serve you the page and the Earth Observation quality report data you search for, filter, view or download;
ensure the security of the Portal and identify or prevent unauthorised access to, or misuse of, our servers;
where you have consented to analytics cookies, compile anonymised, aggregate statistics on how QRAS is visited (for example, overall visit numbers and general usage trends), so that we can understand demand and improve the service.

As QRAS has no accounts, forms or upload features, there is no scenario in which we process your personal data for any other purpose, such as communicating with you directly, managing a profile, or fulfilling a request you have submitted through the Portal. If you wish to contact ESA about QRAS, this is done outside the Portal (see Section 1), and is not covered by this notice.

5. On what legal grounds do we process your data?

General basis under the ESA PDP Policy

The processing described in this notice generally falls under Article 5.2.1 of the ESA PDP Policy, namely processing that is:

necessary for security purposes;
necessary for the performance of an activity carried out by ESA within the framework of, and in conformity with, the ESA Convention and applicable rules and procedures;
necessary for our legitimate interest; or
based on your consent, where consent is the appropriate legal basis (for example, for the use of analytics cookies).

Consent

Where consent is the most appropriate legal basis, it will be requested from you and you may refuse it. In the context of QRAS, consent is typically obtained through your choices in the cookie banner or cookie preference settings. You may withdraw your consent at any time, with future effect, by changing your cookie preferences as described in the Cookie Notice, or by contacting dpo@esa.int. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

6. How long do we retain your personal data?

We do not retain any personal data that identifies individual visitors to QRAS. The technical data generated when your browser requests the QRAS page (such as your IP address) is used only to deliver that request and to protect the service, and is not stored beyond what is strictly necessary for that transient, real-time purpose.

The only data retained over time is the anonymised or pseudonymised visit-tracking data described in Section 2, and only where you have consented to analytics cookies. As set out in the Cookie Notice, analytics data collected via Matomo cookies are automatically deleted after 12 months, while the resulting aggregated, non-identifying statistical reports may be retained indefinitely by ESA for service-improvement purposes.

7. How do we protect and safeguard your personal data?

All processing operations are carried out in accordance with ESA's Rules and Regulations, including the ESA PDP Framework and ESA Security Regulations. ESA collects and processes personal data under conditions designed to protect its confidentiality, integrity and security.

To protect your personal data, ESA has implemented a range of technical and organisational measures against the risk of loss, and against unauthorised access, destruction, use, modification or disclosure of personal data. These measures take account of the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing, as well as the risks to your rights and freedoms, and may include pseudonymisation and encryption where appropriate.

8. What are your rights and how can you exercise them?

Under the conditions set out in the ESA PDP Framework, you have the right to:

be informed about the identity of the controller, the DPO's contact details, the purposes of processing, the recipients of your data, your rights, and applicable retention periods — this is the purpose of this notice and the other notices referred to herein;
access the personal data we hold about you, by writing to dpo@esa.int;
have your personal data rectified, completed or erased, by writing to dpo@esa.int;
withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out beforehand;
lodge a complaint with the ESA Data Protection Supervisory Authority, in accordance with its rules of procedure, if you believe, or have serious reason to believe, that a data protection incident has occurred in relation to your personal data.

In practice, because QRAS does not retain any data that identifies you individually, requests for access, rectification or erasure will typically confirm that no personal data associated with you is held. The rights above are most relevant to your analytics cookie consent, which you can withdraw at any time by changing your cookie preferences as described in the Cookie Notice, without needing to contact the DPO.

You may be asked for additional information to confirm your identity and/or to help us locate any data you are seeking.

Exercising your rights

To exercise any of the rights above, please send a request explicitly specifying your query to the ESA DPO by email at dpo@esa.int.

9. ESA contractors

ESA works with a number of contractors who, in respect of your personal data and depending on their contract with ESA, may act either as a separate Data Controller or as a Data Processor.

Where a contractor acts as a separate Data Controller, that contractor's own privacy notice applies to the collection and processing decided by the contractor.
Where a contractor acts as a Data Processor, this notice applies to the collection and processing decided by ESA.

As set out in the Cookie Notice, anonymised analytics information generated through QRAS is processed on ESA's behalf by Airbus Defence and Space Limited (Airbus UK), Eversis Sp. z o. o. (Eversis) and Serco Limited, who transmit it to ESA in the form of statistical reports. None of these parties uses this information for promotional or marketing purposes, or shares it with any other third party.

10. Specific rules for children

QRAS is intended for use by professional, academic and general public audiences with an interest in Earth observation quality information, and is not directed at children. As the Portal has no registration, account or contact functionality, it does not knowingly or otherwise collect personal data from children beyond the same limited, non-identifying technical and analytics data described in Section 2, which apply equally to all visitors regardless of age.