ESRI Website Privacy Notice - what personal data do we process through our website?

The following categories of data are processed either through our website or via platforms linked to our site. 

Job Applications: Applications for ESRI job opportunities are submitted through the careers portal on our website. More information is available in the Privacy Notice for Applicants.

Newsletter, Event and Publication Notifications: Individuals may sign-up to receive our newsletter and/or publications and events notifications via email. Subscribers are asked to submit their email address and if they wish they can also submit their name. We process this data on the basis of consent and you may withdraw your consent at any time.

Event Registration: Individuals may register to attend conferences, events, and seminars at the ESRI via our website. They are asked to provide details such as name, email address and organisation. They submit these details on the basis of consent and can choose whether or not their details can be retained for the purposes of similar communications on future ESRI events.

The ESRI issues direct invitations to events to specific policy, research and academic stakeholders via email. The ESRI maintains databases of professional/business contacts on the basis of legitimate business interests. Contacts may opt out of receiving direct email invitations by replying to the email invitation or contacting the ESRI directly at

Requests to Receive ESRI Media Releases: Members of the media who wish to receive embargoed ESRI Media Releases are asked to send email requests to We will request their name, email address, media outlet and contact number. We process this data on the basis of legitimate interests.

Under data protection law, there are six available lawful bases under which an organisation may process personal data. They are consent, contractual purposes, legal obligations, vital interests, public task, and legitimate interests.

The legal basis for which we process each category of personal data are as follows:

  • Newsletter, Event and Publication Notifications: Consent via subscription
  • Direct Event Invitations: Legitimate Interest
  • Event Registration:Consent via online registration
  • Media Notifications: Legitimate Interest


Consent means that an individual has given us clear, explicit consent to process their personal data for a specific purpose. Consent may be withdrawn at any time.

Legitimate interest means we have a legitimate business interest. When we process your Personal Data based on our legitimate interests, we make sure to consider and balance any potential impact on you and your data protection rights. We will not use your Personal Data for activities where privacy impact may override legitimate business interests (unless we have your consent or are otherwise required or permitted by law). 

The Institute does not disclose your personal data to any third parties.

We use third party cloud software to host and manage communications and event registration. The Institute ensures that specific data protection guarantees have been provided by the service including where data are hosted and security credentials. The privacy notices of these providers are available here:

Communications Distribution via Poppulo:

Event Registration via Microsoft Forms:

Event Registration via Survey Monkey

For data processed on a consent basis, it is retained as long as the individual wishes us to retain it for. Consent may be withdrawn at any time. For data processed on a legitimate interest basis, it will be retained for as long as there is a purpose associated with the legitimate interest. An individual may object to their data being processed on this basis.

Please see our main Privacy Page here.

Update: October 2019