Privacy Policy
Effective Date: July 29, 2026
The International Space Education and Research Guild (ISERG) processes personal information to support collaborative research, project matchmaking, and academic publication across international teams. We treat all personal data with appropriate standards of security and confidentiality. This privacy policy details our data processing practices in full compliance with the General Data Protection Regulation (GDPR).
1. Data Controller and Contact Information
The data controller responsible for processing personal data under this privacy policy is: International Space Education and Research Guild (ISERG).
For any inquiries, requests to exercise data subject rights, or privacy concerns, you can contact our designated data protection officer directly at: dpo@iserg.org
2. Categories of Personal Data Collected
We process various categories of personal data collected directly from participants during platform onboarding, application submission, and research activities:
- We collect identity and contact data, including names, email addresses, telephone numbers, postal addresses, and countries of residence.
- We collect professional and academic data, including academic credentials, qualifications, technical experience, institutional affiliations, project preferences, and resumes/CVs.
- We process research and project data, including written documentation, research notes, technical logs, physical laboratory records, experimental hardware logs, and output files associated with research performance or research deliverables.
- We collect communication data, including correspondence, feedback, and records of inquiry submitted to ISERG.
3. Purposes of Processing and Legal Bases
Under article 6 of the GDPR, we process personal data based on specific legal grounds:
| Processing Purpose | Categories of Data | Legal Basis (GDPR Article 6) |
|---|---|---|
| platform onboarding, participant application processing, and credential verification | identity, contact, academic, and professional data | performance of a contract (article 6(1)(b)) |
| matching research collaborators, coordinating project workflows, and managing research teams | identity, contact, academic, project preferences, and research data | performance of a contract (article 6(1)(b)) and legitimate interests (article 6(1)(f)) |
| academic publication, peer review, and dissemination of research deliverables | names, academic credentials, and research output deliverables | legitimate interests (article 6(1)(f)) in advancing collaborative space research |
| organizational communications, newsletters, and mission updates | names and email addresses | consent (article 6(1)(a)) |
| compliance with statutory, legal, tax, and accounting obligations | identity, contact, and administrative records | legal obligation (article 6(1)(c)) |
4. Recipients and Data Disclosures
We do not sell personal data. We disclose personal data only to specific recipients under defined conditions:
- We share data with internal team members, including authorized ISERG staff and project leads who require access for research administration.
- We share data with collaborating institutions, including partner academic bodies and scientific reviewers participating in joint research workflows.
- We share data with third-party service providers who offer operational support, such as server hosting, communication tools, and physical storage facilities, bound by data processing agreements pursuant to article 28 of the GDPR.
- We disclose data to legal authorities, including public agencies or courts when required by applicable law or statutory demand.
5. International Data Transfers
Because ISERG operates across international teams, personal data may be transferred to and processed in countries outside the European Economic Area (EEA).
When transferring personal data outside the EEA, we ensure appropriate legal safeguards under chapter V of the GDPR:
- We execute transfers to countries recognized by the European Commission as offering an adequate level of data protection pursuant to article 45 of the GDPR.
- We execute transfers under standard contractual clauses approved by the European Commission pursuant to article 46(2)(c) of the GDPR.
You may request a copy of the standard contractual clauses or details regarding transfer mechanisms by contacting dpo@iserg.org.
6. Data Protection and Retention Criteria
We protect personal data through technical, physical, and organizational security safeguards against loss, theft, unauthorized access, copying, or modification. Physical safeguards include secured physical file storage and lockable physical premises. Technical and organizational safeguards include encrypted transmission protocols, restricted digital access levels, periodic security audits, and confidentiality obligations.
We retain personal data only for as long as necessary to fulfill specified organizational and project objectives according to defined criteria:
- For applicant data, personal records of unsuccessful applicants are retained for 12 months following application evaluation, after which they are deleted or anonymized.
- For active researcher data, records for active participants are retained for the duration of platform participation plus 5 years to support academic verification and citation.
- For published research deliverables, author attributions and academic publications are retained permanently as part of the public scientific record.
- For legal and financial records, statutory accounting and legal documentation is retained for 7 years to meet legal obligations.
7. Data Subject Rights Under GDPR
Under articles 15 through 22 of the GDPR, participants possess specific rights regarding their personal data:
- Under the right of access (article 15), you have the right to request confirmation of data processing and obtain copies of personal data held about you.
- Under the right to rectification (article 16), you maintain the right to request corrections to inaccurate or incomplete personal records.
- Under the right to erasure (article 17), you may request the deletion of personal data when processing is no longer necessary or consent is withdrawn.
- Under the right to restriction of processing (article 18), you have the right to request restriction of processing under specified conditions, such as contesting accuracy.
- Under the right to data portability (article 20), you have the right to receive personal data provided to us in a structured, commonly used, machine-readable format or request direct transfer to another controller.
- Under the right to object (article 21), you maintain the right to object at any time to processing based on legitimate interests or direct communication.
- Under the right to withdraw consent (article 7(3)), you may withdraw consent for data processing at any time without affecting the lawfulness of processing conducted prior to withdrawal.
To exercise any of these rights, please submit a request to dpo@iserg.org. We respond to all valid requests within one calendar month.
8. Right to Lodge a Complaint
Under article 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that our processing of personal data violates data protection laws. You may lodge a complaint in the EU member state of your habitual residence, place of work, or place of alleged infringement.
9. Statutory and Contractual Requirements
Providing personal data for platform onboarding and application submission is necessary to enter into a participant agreement with ISERG. Failing to provide required identity and academic data prevents us from evaluating applications, matching research collaborators, or coordinating project workflows.
10. Automated Decision-Making and Profiling
We do not engage in automated decision-making or profiling that produces legal effects or similarly significant effects concerning participants under article 22 of the GDPR. All research matchmaking and application reviews involve direct human review.
11. Updates to This Privacy Policy
We may update this privacy policy periodically to reflect operational changes or statutory requirements. Any revisions will be published on this page with an updated effective date.