Privacy Policy

This privacy policy applies to the Earth & Space Sustainability Initiative ("ESSI", "we", "us") website at www.essi.org. ESSI is registered in England and Wales under company number 14100205, with its registered office at 126 New Kings Road, London, SW6 4LZ. ESSI is the controller of the personal data processed on this website and we take your privacy seriously.

This policy covers the collection, processing and other use of personal data under the Data Protection Act 2018 ("DPA") and the UK General Data Protection Regulation ("UK GDPR").

If you need to contact us about your personal data you can email contact@essi.org at any time.

Information we collect

We collect the following personal data:

• When you contact us or subscribe: your name, email address, organisation and the content of your message when you use our contact form; your email address when you subscribe to our Orbitwise newsletter.
• When you create a members account: your name and email address, and the authentication identifiers needed to sign you in. If you choose to sign in with Google or Microsoft, we receive the basic profile information those providers share with us — your name, email address and, where available, your profile picture — solely to create and manage your ESSI account.
• When you subscribe to paid membership: your billing name, email address and subscription status. Your payment card details are entered directly with our payment processor (Stripe); we do not receive or store full card numbers.
• When you use the members area: the standards you save, the member content you access, and related timestamps, so we can provide those features.
• When you use the standards database: your search queries and filters.
• Automatically: aggregate, privacy-friendly usage and performance analytics that help us understand and improve the site. This analytics data does not identify you personally.
• Cookies: see the "Use of cookies" section below.

Our lawful bases for processing

• Contract: to create and administer your account and provide the membership and services you sign up for.
• Consent: to send you our newsletter (you may withdraw consent at any time).
• Legitimate interests: to operate, secure and improve the website and to understand which organisations and regions our users represent (we anonymise or aggregate this data wherever possible).
• Legal obligation: to keep financial and transaction records as required by UK tax and accounting law.

Service providers we share data with

We use a small number of trusted providers to run the website and our services. They process personal data only on our instructions and under contract:

• Clerk — account authentication and management, including Google and Microsoft sign-in (hosted in the European Union).
• Stripe — payment processing for paid memberships (European Union and United States).
• Resend — delivery of transactional and newsletter emails (European Union).

Google and Microsoft sign-in data

If you sign in with Google or Microsoft, we use the name, email address and profile picture that they share with us only to create and manage your ESSI account and to sign you in. We do not use this information for advertising, we do not sell it, and we do not share it with third parties except the service providers listed above who help us run the site. ESSI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Use of your information

We use your personal data to provide our services to you, to meet our contractual commitments, to administer paid memberships and payments, to send you our newsletter where you have consented, and to notify you about material changes to the website or our services. If information we need to provide a service is not supplied, we may be unable to provide that service.

Disclosure of your information

We may disclose your information to regulatory or law-enforcement bodies where required to comply with the law, to prevent fraud, or to protect our rights, property or safety. We do not sell your personal data, and we do not reveal information about identifiable individuals to advertisers.

International data transfers

Some of our service providers are located in the European Union and the United States, so your personal data may be transferred and processed outside the UK. Where we transfer personal data outside the UK, we rely on an appropriate safeguard — a UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU–US Data Privacy Framework — so that your data receives an equivalent level of protection.

How long we keep your data

We keep your personal data only for as long as reasonably necessary for the purposes we collected it for:

• Account data: for as long as your account is active. If your account is inactive we may contact you to confirm whether you wish to keep it; if we do not hear from you, we will close it and delete the associated personal data.
• Payment and transaction records: retained for six years to comply with UK tax and accounting requirements.
• Newsletter: we refresh our mailing list every two years and will unsubscribe you if you do not confirm you wish to remain subscribed.

Security

The transmission of information via the internet or email is not completely secure. Although we do our best to protect your personal data, we cannot guarantee the security of data while you are transmitting it to our site; any such transmission is at your own risk. Once we receive your personal data we use strict procedures and security features to prevent unauthorised access.

You may find links to third party websites on our site. Those websites have their own privacy policies, which you should check. We do not accept responsibility or liability for their policies as we have no control over them.

Use of cookies

A cookie is a small file of letters and numbers stored on your browser or device. Our website uses only essential cookies that are required for the site to work — in particular, the secure session cookies our authentication provider sets to keep you signed in to the members area. These essential cookies do not require your consent. Our usage and performance analytics are privacy-friendly and do not use tracking cookies or identify you. You can set your browser to decline cookies, but parts of the members area may not work if you decline the essential ones.

Your rights

The UK GDPR gives you rights in relation to your personal data, including the right to:

• request access to your personal data;
• request correction of your personal data;
• request erasure of your personal data;
• object to processing of your personal data;
• request restriction of processing your personal data;
• request transfer of your personal data;
• withdraw consent at any time.

To exercise any of these rights, or to ask what personal data we hold about you, email contact@essi.org. There is no charge, and we will respond within one month.

Children

Our website and services are intended for professionals in the space sector and are not directed at children. We do not knowingly collect personal data from anyone under 18.

Changes to this policy

We may update this policy to reflect changes to the website, our services or the law. Please review it regularly to stay informed about how we protect your personal data.

Queries and complaints

We welcome any queries, comments or requests regarding this policy at contact@essi.org.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection (www.ico.org.uk). We would appreciate the chance to address your concern first, so please contact us before approaching the ICO.