Privacy policy
This policy explains what 303 Overwatch A.S.B.L does with personal data collected through
303overwatch.org, and in particular through the Center of Excellence inquiry
form. It is written to be read rather than survived. If anything in it is unclear, write to
[email protected] and we will explain it.
1. Who is responsible
The controller of your personal data is:
- 303 Overwatch A.S.B.L., a Luxembourg non profit association
- 10, rue Willy Goergen, L-1636 Luxembourg
- R.C.S. Luxembourg F13274
- Telephone +352 661 539 307
- General inquiries: William O. Ferguson, Managing Director, [email protected]
- Privacy questions and rights requests: [email protected]
No data protection officer has been appointed. We have assessed that the criteria in Article 37 GDPR are not met by our processing: we are a small organization, the processing is not large scale, there is no systematic monitoring of people, and we do not collect special category data. Privacy questions reach the Managing Director directly at the address above.
2. What we collect
The inquiry form asks different questions depending on whether you say you are an individual or that you are here for an organization. You are only ever asked the questions on your own path. Everything below is what the form can collect.
Everyone
- Full name and email address
- Country or region
- Whether you are a Space ISAC member, and which chapter
- What you are getting in touch about
- Your consent choices, the exact wording you agreed to, and when
If you are here for an organization
- Organization name, and your role or title
- Organization type
- Operating environments and capability focus
- Depending on what you are interested in: number of people to train, delivery preference, target timeframe, intended use of METEORSTORM, platform or system in scope, partnership objective, funding or vehicle status, your role in the decision, the standards body or working group, what you are offering, and for a speaking or media request the event or outlet, date, and location or format
- Anything you write in the free text box
If you are here as an individual
- Whether you are a student, a professional, a government employee, or a jobseeker registered with ADEM
- Your institution, or your agency or department, or your current role, depending on which of those you are
- If you are registered with ADEM: your registration status and a broad description of your background so far
Collected automatically when you submit
-
Campaign parameters in the link you arrived by (
utm_source,utm_medium,utm_campaign,utm_term,utm_content) - The page that referred you and the page you submitted from
- Your browser language
- The time you submitted, and how long the form was open before you submitted it, which is used only to tell people apart from automated scripts
- Your IP address, processed by our hosting provider to enforce a submission rate limit
What we do not collect
The form is not designed to collect special category data as defined in Article 9 GDPR, meaning data about health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetics, biometrics, sex life, or sexual orientation. Please do not include such details in the free text box. If you send them anyway, we remove them.
3. Why we process it, and on what legal basis
We do not rely on your consent for everything, and that is deliberate. Answering an inquiry you deliberately sent us does not need your consent. If it did, withdrawing consent would oblige us to delete a record we had a legitimate reason to keep. Consent is reserved for the things that genuinely depend on it: the briefing subscription and advertising cookies.
| Purpose | Legal basis | Note |
|---|---|---|
| Replying to your inquiry and scoping what you asked for | Article 6(1)(b), steps at your request prior to a contract. Where no contract is in view, Article 6(1)(f), legitimate interests. | You asked us to get in touch. |
| Routing your inquiry to the right person, including by country and organization type | Article 6(1)(f), legitimate interests | Our interest: answering accurately and meeting export control obligations. |
| Recording that you agreed to be contacted, and when | Article 6(1)(c), legal obligation, read with Article 7(1) | We have to be able to demonstrate consent where consent is the basis. |
| Sending you the briefing | Article 6(1)(a), consent | Separate tick box. Withdraw at any time. |
| Assessing training funding eligibility for a jobseeker registered with ADEM | Article 6(1)(b), steps at your request prior to a contract | We cannot tell you what you may be eligible for without knowing your status. |
| Grouping interest into cohorts so that a course can actually be scheduled | Article 6(1)(f), legitimate interests | Our interest: running courses that would not otherwise reach a viable size. |
| Noticing that several people from one institution have been in touch | Article 6(1)(f), legitimate interests | See 3.1 below. |
| Measuring which campaigns bring people to the form | Article 6(1)(f), legitimate interests | Our interest: not wasting a non profit's outreach budget. |
| Blocking automated and abusive submissions | Article 6(1)(f), legitimate interests | Our interest: keeping the form usable and our records clean. |
| Automatic enrichment of contact records by our CRM provider | Article 6(1)(f), legitimate interests | See 5.1 below. This cannot currently be switched off. |
| Advertising measurement through Google Ads | Article 6(1)(a), consent, read with the rules on access to your device | Nothing loads unless you accept. See section 8. |
3.1 When several people name the same institution
If three or more people independently tell us they are at the same university, agency, or employer, we note that the institution appears to be interested and may approach it about working together. We do not tell the institution who mentioned it, we never turn your own inquiry into a pitch, and the count is kept against the institution rather than as a list of names.
3.2 Automated decisions
Your inquiry is sorted and prioritised automatically, so that an urgent, funded request is flagged for a faster reply. This affects the order in which a person contacts you and nothing else. It produces no legal or similarly significant effect and is not automated decision making within the meaning of Article 22 GDPR. A person reads and answers every inquiry.
4. Whether you have to provide it
The required fields are what we need in order to answer you. Optional fields simply mean a less specific answer. Declining the briefing subscription has no effect on your inquiry.
If you would rather not fill in a form at all, write to [email protected] and a person will reply. Writing to us is not consent to anything: we will not add you to the briefing list, we will reply and ask.
5. Who else sees it
| Recipient | Role | What for |
|---|---|---|
| Attio | Processor | The CRM where inquiries are stored |
| Attio's sub-processors | Sub-processors | Fourteen named in Annex A of Attio's Data Processing Addendum. Listed in section 6. |
| Cloudflare | Processor | Website hosting, and the endpoint that receives the form |
| Microsoft | Processor | Internal notification of a new inquiry, scheduling, and document sharing through Microsoft 365 |
| Advertising measurement | Only for visitors who accept advertising cookies. See section 8. |
We do not sell personal data, and we do not share it with anyone else for their own marketing.
5.1 Automatic enrichment
Attio automatically adds publicly available context to contact records, using identifiers such as an email address or a company domain. This is part of the product and cannot be turned off. It is carried out through Attio's sub-processors Full Contact and Clearbit (APIHub).
Because of that, the answers you give about your employment situation, your ADEM registration, your institution, and your agency are deliberately stored in custom fields that enrichment does not read or write, and are never placed in the standard fields that it does.
6. Where it goes
Attio is established outside the European Economic Area and personal data is transferred there. Attio's Data Processing Addendum forms part of its Customer Agreement and is entered into by accepting that agreement, so there is no separate signed document. Transfers rely on the European Commission's Standard Contractual Clauses, Modules Two and Four, with the UK Addendum appended, governed by Irish law with the Irish Data Protection Commission as competent supervisory authority.
Annex A of that addendum names fourteen sub-processors: Cloudflare (infrastructure and security), Google Cloud EMEA (hosting and language model features), Ably Realtime (notifications), Full Contact and Clearbit via APIHub (data enrichment), Postmark (email delivery), Recall.ai (call recording), Eleven Labs (call transcription), OpenAI and Anthropic Ireland (language model features), Parallel Web Systems (research), Mapbox (maps), and Intercom (customer support). Several of these relate to Attio features we do not use, such as call recording and transcription.
7. How long we keep it
| Category | Kept for | Counted from |
|---|---|---|
| Name, email, and the content of your inquiry | 24 months | Last contact with you |
| Employment or education status, ADEM registration status, background, institution or agency | 24 months | Last contact with you |
| Organization details, qualification answers, Space ISAC status | 24 months | Last contact with you |
| Country and region | 24 months | Last contact with you |
| Campaign and referrer data | 14 months | Submission |
| Consent records, including wording, version, and timestamps | 6 years | Withdrawal, or the end of the relationship |
| Briefing subscription | Until you unsubscribe | |
| A submission that could not be saved and is waiting to be retried | 30 days maximum | The failed submission |
Consent records outlive the rest on purpose. If you withdraw consent, we still have to be able to show what you originally agreed to and when. Deleting that evidence alongside the record would leave us unable to demonstrate we ever had a basis at all.
Every record carries a review date. When it passes and there has been no contact, the record is reviewed for deletion or anonymisation rather than kept indefinitely.
8. Cookies and analytics
Nothing non essential loads unless you say yes. The site uses one such technology, Google Ads conversion measurement. No request is made to Google, and no identifier is set or read, unless you press Accept on the consent banner. Declining is a single press, is exactly as easy as accepting, and changes nothing about how the site works.
Closing the banner without choosing is not treated as consent. If you decline, or never answer, the Google tag is never loaded at all.
| What | Purpose | Set when | Lasts |
|---|---|---|---|
303-ads-consent (local storage) |
Remembers your choice so you are not asked on every visit | When you press Accept or Decline | Until you clear it |
| Google Ads cookies and identifiers | Measuring which campaigns lead to an inquiry | Only after you press Accept | Per Google's own retention |
A conversion is recorded once, when an inquiry is actually submitted. It is not recorded on page views.
To change your mind at any time, use the Cookie choices link in the footer of every page. It forgets your answer, stops any advertising storage immediately, and asks again.
The inquiry form sets no cookies of its own. We measure how the form is used, for example which path was chosen and which explanation was opened. Those measurements carry no personal data of any kind, only the segment, and nothing is measured before you give contact consent.
This page itself loads no fonts, no scripts, and no analytics of any kind.
9. Your rights
You have the right to:
- ask what personal data we hold about you, and get a copy
- have inaccurate data corrected
- have data erased
- have processing restricted
- receive data you gave us in a portable format
- object to processing based on legitimate interests
- withdraw consent at any time, without affecting the lawfulness of processing already carried out on the basis of that consent before it was withdrawn
Write to [email protected]. We answer within one month. Every briefing email also carries an unsubscribe link, which reaches the same records.
If you are unhappy with how we have handled your data, you can complain to the Luxembourg supervisory authority:
- Commission nationale pour la protection des données
- 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg
- Telephone (+352) 26 10 60 1, Monday to Friday between 9:00 and 11:30
- cnpd.public.lu, which also has an online complaint form
You may also complain to the supervisory authority where you live or work.
10. Accreditation
303 Overwatch a.s.b.l. is accredited by the Luxembourg Ministry of National Education, Children and Youth as an organizer of continuing vocational training courses, under the ministerial act of 12 June 2026 (Memorial B2710), issued pursuant to Article L.542-2 of the Luxembourg Labour Code. The accreditation took effect on 12 June 2026 and is not time limited. Read the act.
Accreditation means we are recognised as an organizer of continuing vocational training in Luxembourg. It does not mean that any particular funding scheme will pay for a given course. Funding is decided under the relevant scheme, case by case.
11. Changes to this policy
This policy carries a version number and a date. When it changes materially we update both, and where the change affects processing you have consented to, we ask again rather than assuming.