Exhibit 10.18

 

 

Second AMENDMENT

 

to a Long Term Employment Agreement

 

Effective Date : June 1st, 2024

 

Between:

 

NorthStar Earth & Space Europe S.à r.l., established and having its registered office at 24-28, rue Goethe, L-1637 Luxembourg, Grand-Duchy of Luxembourg, and registered in the Luxembourg Trade and Companies Register under number B266625,

 

duly represented by Mr. Stewart Bain, Manager of category A, and by Mr. Blazej Gladysz-Lehmann, Manager of category B,

 

hereinafter referred to as the “Company”;

 

And:

 

Yann Picard, born on November 17, 1976 in Montpellier (France), residing at 22, rue du Vaugueux, 14000 Caen (France),hereinafter referred to as the “Employee”;

 

the Employee and the Company are hereinafter referred to, individually, as a “Party”, and collectively as, the “Parties”.

 

WHEREAS the Parties have entered into a Long-Term Employment Agreement on June 30, 2023 (the “Agreement”);

 

WHEREAS the Parties wish to modify certain terms of the Agreement by this amendment (the “Amendment”);

 

AND WHEREAS capitalized but undefined terms used herein shall have the respective meanings attributed to such terms in the Agreement;

 

NOW THEREFORE, THE PARTIES AGREE AS FOLLOWS:

 

1)Section 1.1 is hereby deleted and replaced by the following:

 

The Employee is employed to act as Executive Director of Products. Reporting to the CEO, the Executive Director of Products is responsible to provide leadership to the shaping of the Si2 product roadmap by delivering commercial opportunities, partnerships, collaborations and R&D initiatives that will ensure NorthStar’s leadership in chosen markets. Ensure compatibility with customer requirements and NorthStar’s product, technical, and business roadmaps and that information and requirements flow to and from the Executive Director of Engineering and Chief Scientist as they are integrated into the company’s overall strategy.

 

Page 1 of 21

 

 

 

The key responsibilities of the Executive Director of Products are the following:

 

Product & Technical Strategy and Delivery

 

Own and develop product strategy and roadmap in cooperation with your team composed of: Product Managers, Scrum Masters & Agile Coaches and Product Squads to align resources, execute plans, and influence stakeholders to achieve growth and product adoption

 

Define product requirements and work closely with the Si2 Technical team to design, build, and launch features against a timely schedule

 

Drive innovative ideas, solutions and products through leadership and decisive action

 

Be the voice of our product strategy, internally and externally

 

Conduct thorough market research to identify customer needs, assess competition, and pinpoint opportunities for growth

 

Collaborate with stakeholders to define and communicate the product vision, strategy, and roadmap, ensuring alignment with strategic goals

 

Manage compelling business cases for new features or enhancements, evaluating their impact on growth and ROI

 

Prioritize features based on value, complexity, and risks to address the most valuable opportunities

 

Monitor and analyze product performance metrics, leveraging data-driven insights for decision-making and continuous improvement

 

Define clear product acceptance criteria for each backlog item to align with user needs

 

Maintain and prioritize the product backlog, ensuring alignment with strategic importance and value

 

Coordinate successful product launches and go-to-market strategies, working closely with marketing and sales teams

 

Make informed decisions on feature priorities, trade-offs, and technical constraints, balancing business needs and user expectations

 

Ensure product development & engineering goals are met and align with company needs

 

Planning, Budgeting & Resource Allocation

 

In collaboration with General Managers of NS subsidiaries:

 

Manage the Product Team operations and cost

 

Manage the current and future product development resource needs (personnel, tools, technologies) and manage the relevant budget

 

Cross-Functional Collaboration

 

Provide technical guidance to ensure a cohesive and integrated approach to product development and delivery

 

Coordinate and collaborate with other senior management, engineering, business development, finance, and marketing to ensure product development efforts align with company strategies

 

Report and make recommendations regarding current technology developments across exec, BD and engineering teams

 

Page 2 of 21

 

 

 

Facilitate collaboration between development teams and stakeholders, ensuring a unified approach to product development

 

Team Management

 

Manage KPIs and performance for team members

 

Provide mentorship and guidance to product development team members

 

2)Section 5 is hereby deleted and replaced by the following:

 

5.1 The Employee’s gross annual salary in respect of his service under this Agreement on a full-time basis shall be EUR 155,000.- gross (based on the index applicable at Commencement Date) subject to all legal and statutory deductions.

 

The Employee’s annual salary shall be payable monthly in 12 (twelve) equal instalments at the end of each calendar month, after deduction of all duties, taxes and social security contributions as required by law.

 

5.3 The Employee shall be eligible to receive a discretionary bonus of up to 30% of his Base Salary in accordance with the Company’s compensation plan, as amended from time to time. Potential bonus payments, even if made repeatedly or regularly and whatever their amounts are, can never lead to a vested right for the Employee. Bonus payments are made at the Company’s sole discretion and according to the financial achievements of the Company and/or the Employee’s own achievement of goals. The Employee’s goals will be annually defined by the Employee and his line manager.

 

Bonus payments, if any, will be made subject to the deduction of social and tax contributions as required by applicable law.

 

5.4 The Company shall reimburse (or procure the reimbursement of) all reasonable expenses wholly, properly and necessarily incurred by the Employee in the proper performance of his duties during the course of his Appointment and in accordance with the Company’s and any Group Company’s policies on expenses as communicated to the Employee from time to time, subject to the production of receipts or other appropriate evidence of payment.

 

5.6 In addition to the Employee’s monthly salary, at the Company’s sole discretion, the Employee will receive a monthly mobile phone allowance of up to EUR 40.- (forty) including tax and VAT. Any monthly charge (excluding VAT) exceeding this monthly allowance will be reimbursed to the Employee if this amount is justified as a business usage.

 

5.7 At the signature of this Agreement and at the entire discretion of the Board, the Employee shall receive an additional 800 options under the terms of the ESOP. The options granted to the Employee shall vest over a period of 4 years or such other period of time determined by the Board and shall be subject to the terms and conditions contained in the Employee Stock Option Plan of the Group Companies.

 

Page 3 of 21

 

 

 

5.8 The Employee shall not be entitled to additional payments under this Agreement. The Employee shall most notably not be entitled to extra compensation for overtime work, for work performed or on Sundays.

 

5.9 All payments to be made to the Employee arising out of or in connection with his Appointment shall be paid subject to the deduction of tax and social security contributions as required by applicable law.

 

3)Section 10 is hereby deleted and replaced by the following:

 

10.1 The Employee shall not (except as authorized or required by his employment hereunder) during the continuance of the signature date of the Long Term employment contract or after the termination, during a period of 10 (ten) years, use (other than in the proper performance of his duties and for the purposes of the Company or any Group Company) or disclose to any person, firm, company or other organization whatsoever any information relating to the organization, business or finances of the Company or any Group Company or any of its investors, customers, agents or suppliers or any of its or their trade secrets or confidential details of any dealings, transactions or affairs of which the Employee is or may become in possession as from the signature date of the Long Term employment contract and during his Appointment and shall keep with inviolable secrecy all matters entrusted to his, and the Employee shall use his best endeavors to prevent the disclosure or use of any such information in any manner which may injure or cause loss whether directly or indirectly to the Company or any Group Company or any of its or their officers, directors or employees.

 

10.2 Any notes, memoranda or copies made by the Employee as from the signature date of the Long Term employment contract and during his Appointment or at any time thereafter relating to any matter within the scope of the business of the Company or any Group Company or concerning any of its or their dealings, transactions or affairs shall be and remain the property of the Company or any Group Company, and the Employee will not either as from the signature date of the Long Term employment contract and during his Appointment or at any time thereafter use or permit to be used any such notes, memoranda or copies otherwise than for the benefit of the Company or any Group Company.

 

10.3 The Employee will not make any public statement or any statement to a person employed or associated with the media concerning the Company, any Group Company or any of its or their officers, directors or employees, investors customers or suppliers or their activities without first obtaining the written permission of the Company.

 

4)Section 12 is hereby deleted and replaced by the following:

 

12.1 For a period of 12 (twelve) months following the termination of this Agreement (the “Restricted Period”), the Employee shall be subject to a post-contractual non-compete obligation pursuant to the following provisions (the “Non-Compete”).

 

12.2 During the Restricted Period, the Employee shall not, directly or indirectly, for his own account or for the account of a third party, as an employee, contractor, consultant or in a similar function, for or without compensation, permanently or occasionally, work for or have an interest in a business that is a competitor of the Company or of the Group (“Competitor”).

 

Page 4 of 21

 

 

 

12.3 A Competitor shall be any business which renders services which are competitive with any of the services rendered by the Company or any of the Group Companies (e.g. space-based services, in particular Space Situational Awareness) located in Luxembourg or abroad on the territory of the European Union.

 

12.4 The Non-Compete shall apply in all markets in which the Company or the Group operate or demonstrably concretely plan to operate.

 

12.5 At all times during this Agreement and during the Restricted Period, the Employee will, neither for himself nor as a self-employed person or engaged person or otherwise for third parties, directly or indirectly, induce or influence any managing director, employee, independent contractor or customer of the Company or the Group to terminate his or her employment, engagement or customer relationship respectively with the Company or Group Company.

 

12.6 Customers of the Company include all companies and individuals who, as of the termination of this Agreement, have a business relationship with the Company or the Group or where the establishment of such a business relationship is initiated both demonstrably and concretely.

 

12.7 During the Restricted Period, the Employee shall be entitled to a financial compensation for each month equal to 30% of his most-recently received gross remuneration, without prejudice to any specific agreement to be entered into between the Parties. Such compensation shall be paid monthly at the end of each month after deduction of any amounts to be withheld under the applicable statutory provisions, if any.

 

12.8 The Company may at any time after the notification of the termination notice, waive the Non-Compete in writing with the effect that the obligation to pay the compensation pursuant to clause 0 of this Agreement ceases after two (2) months and the Employee upon receipt of the waiver and termination of the Agreement is free to enter into competition.

 

12.9 In the event of termination by the Company with immediate effect for serious misconduct of the Employee, following the termination letter sent or remitted by hand to the Employee against acknowledgement of receipt, the Company may release itself with immediate effect from its compensation obligations under this Non-Compete by written notification whereby the Company informs the Employee that the Company shall be released from the obligation to pay the compensation pursuant to clause 0 of this Agreement.

 

12.10 The Employee is required to reimburse the totality of the amount paid by the Employer under this clause 12 for any breach of any of his obligations under this Non-Compete, within two (2) weeks starting on the date the breach occurred, without relinquishing any of the Company’s rights to damages or any other actions it deems fit.

 

12.11 If individual provisions of this Non-Compete are invalid, in particular with regard to the duration of the prohibition of competition, the extent of the prohibited activities or the territorial range, the invalid provisions shall be replaced by a provision which contains the admissible maximum period of the prohibition of competition, the admissible field of activities and the admissible territorial scope.

 

Page 5 of 21

 

 

 

12.12 The Employee undertakes not to solicit or induce or endeavour to solicit or induce any person who, on the date of termination of this Agreement, is employed by the Company or any Group Company to cease working for or providing services to the Company or any Group Company.

 

12.13 The Employee undertakes not to solicit or induce or endeavour to solicit or induce any investor, consultant, supplier, or service provider to cease to deal with the Company or any Group Company and shall not interfere in any way with any relationship between an investor, a consultant, a supplier, or a service provider and the Company or any Group Company.

 

12.4 The undertakings set out in sub-paragraphs 0 and 0 are applicable during the term of this Agreement and shall survive during a period of 5 (five) years from the term of this Agreement.

 

5)Section 13 is hereby deleted and replaced by the following:

 

13.1 “Intellectual Property Rights” means, without limitation and where applicable, all present and future patents, utility models, ideas and rights to inventions (whether or not patentable or reduced to practice), improvements, all copyright, author’s rights and neighbouring rights (including without limitation moral rights, as well as the rights of reproduction, distribution, communication to the public, renting and lending), trademarks, service marks, rights in designs or models, brand names, product names, logos, slogans, trade names, company names and reputation, domain names, database right, rights in confidential and/or proprietary information (including without limitation know-how and trade secrets), rights in software (including without limitation analyses, designs, preparatory materials algorithms, APIs, source, executable and object code, apparatus, circuit designs and assemblies), network configurations and architectures, concepts, marketing and development plans, methods and any other intellectual property rights, in each case whether registered or unregistered and including all applications for and renewals or extensions of such rights, and all similar or equivalent rights or forms of protection in any part of the world. For the avoidance of doubt, Intellectual Property Rights also includes any updates, version upgrade, improvements, enhancements, configurations, extensions, and derivative works of the foregoing and related documentation or manuals, as well as any source code.

 

13.2 The Employee acknowledges and agrees that, to the fullest extent authorised by law, all Intellectual Property Rights which are directly or indirectly related to the Company’s activities and which concern works created by the Employee in the course of his employment by the Company, upon instruction of the Company or simply by using techniques, means and/or data belonging to the Company, shall be exclusively assigned to the Company from their creation and for the duration of their legal protection, without the Employee having the right to claim any additional remuneration other than that provided for under clause 5 (Pay) of this Agreement.

 

13.3 To the extent that the Company Intellectual Property Rights do not automatically vest in the Company under this clause 13, and unless prohibited or ineffective by law, the Employee holds such property in trust for the Company and hereby grants the Company an exclusive, transferable, sub- licensable, worldwide, royalty-free licence to use such Intellectual Property Rights at its discretion until such time as it is assigned in full to the Company.

 

Page 6 of 21

 

 

 

13.4 The Employee undertakes to cooperate fully with the Company in taking all necessary steps to ensure the effective transfer of the Intellectual Property Rights in accordance with this section 13. The Employee will provide the Company with all assistance required to carry out the legal or other administrative procedures necessary for this purpose. Moreover, the Employee accepts that this obligation is binding on his assignees, executors, administrators, and other legal representatives. In addition, the Employee hereby waives against the Company, its successors, assigns and licensees, to the fullest extent permitted by applicable law, all present and future moral rights and similar rights in other jurisdictions in respect of the Intellectual Property Rights transferred in compliance with the present section.

 

13.5 The transfer of Intellectual Property Rights to the Company will in particular, but not only, include the right to sell, licence, reproduce, communicate, translate, adapt, modify and in a general way put on the market either for free or against remuneration.

 

6)Section 15 is hereby deleted and replaced by the following:

 

15.1 The Employer undertakes and warrants to collect, store and process, electronically or by any other means, any personal data in accordance with (i) the Data Protection Laws (as defined in the Privacy Notice) and (ii) the Privacy Notice attached to this Agreement as 0.

 

15.2 The Employee represents and warrants that he has carefully read and understood the Privacy Notice.

 

7)The other terms and conditions of the Agreement remain unchanged.

 

8)This Amendment and any non-contractual obligations arising out of or in relation to this Amendment shall be governed by, and shall be construed in accordance with, the laws of Luxembourg, especially the Labour Code, and the parties give exclusive jurisdiction to the Luxembourg Courts.

 

This Amendment may be executed in counterparts, each of which will be considered an original, but all of which together will constitute one agreement. If a party signs the signature page and faxes (or scans and emails) the signature page to the other party or signs this Amendment by electronic signature, then such signature page shall be deemed an original signature page to this Amendment and shall constitute the execution and delivery of this Amendment by the sending party.

 

[Remainder of the page left blank – signature page follows]

 

Page 7 of 21

 

 

 

Done in two originals in Luxembourg on May 22, 2024, each Party declaring having received one original.

 

The Company

 

/s/ Stewart Bain   /s/ Blazej Gladysz-Lehmann
By: Mr. Stewart Bain   By: Mr. Blazej Gladysz-Lehmann
Title: Manager of category A   Title: Manager of category B

Signature date: 5/22/2024   Signature date: 23/05/2024

 

The Employee

 

/s/ Yann Picard  
Name: Mr. Yann Picard  
5/23/2024  

 

Page 8 of 21

 

 

 

SCHEDULE 2 – PRIVACY NOTICE

 

The below key terms used in this privacy = notice (the “Privacy Notice”) have the following meaning:

 

controller: a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
   
processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
   
personal data: any information relating to an identified or identifiable natural person;
   
data subject: the identified or identifiable natural person to whom personal data relates;
   
recipient: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed.

 

The Company (also referred to as the “Employer”), acting as controller (the “Controller”), has prepared this Privacy Notice to comply with (i) the EU Regulation n°2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”) and (ii) any applicable national data protection laws (including but not limited to the Luxembourg law of 1st August 2018 on the organisation of the National Data Protection Commission and the general data protection framework, as amended from time to time) (collectively hereinafter the “Data Protection Laws”).

 

Page 9 of 21

 

 

 

Table of contents

 

1. WHAT ARE THE CATEGORIES OF DATA SUBJECTS? 11
2. WHAT PERSONAL DATA DOES THE CONTROLLER COLLECT? 11
3. FROM WHICH SOURCES WILL PERSONAL DATA BE COLLECTED? 12
4. FOR WHAT PURPOSES ARE PERSONAL DATA PROCESSED AND UPON WHICH LEGAL BASES? 12
5. WITH WHOM WILL PERSONAL DATA BE SHARED? 13
6. WHERE WILL PERSONAL DATA BE TRANSFERRED? 14
7. HOW LONG WILL PERSONAL DATA BE RETAINED? 14
8. THE DATA SUBJECTS’ RIGHTS 15
9. COMMITMENTS 16
10. CHANGES TO THIS PRIVACY NOTICE 16
11. CONTACT INFORMATION 16

 

Page 10 of 21

 

 

 

1.WHAT ARE THE CATEGORIES OF DATA SUBJECTS?

 

The Controller collects personal data related to the following identified or identifiable natural person (the “Data Subject(s)”):

 

Employees:   the employee himself/herself.
     
Employee’s related persons:   any natural person related to the employee, whose personal data is supplied by the employee (such as emergency contacts or relatives, as the case may be) during their employment relationship.

 

2.WHAT PERSONAL DATA DOES THE CONTROLLER COLLECT?

 

The Controller collects the following categories of personal data (the “Personal Data”):

 

Identification data:   name, age, gender, date and place of birth, nationality, passport/ID number, identity card with photo, images and photos, address, proof of address, signature, employee ID number, tax ID.
     
Contact data:   e-mail, address, proof of address, phone number, fax number.
     
Professional data:   marital status, immigration status, job title, salary, bonuses and other benefits, professional experience, education, qualification, hobbies and interests, career plans, performance history, information concerning performance and/or disciplinary and grievance matters.
     
Bank account data:   IBAN and BIC codes and other bank account information.
     
Health related data:   medical leave information, emergency and health or handicap data to the extent permitted by employment laws and regulations.
     
Special categories of personal data:   Criminal convictions and offences, political opinions.
     
Communication data:   communications prior and during the employment relationship with the Controller via electronic or other means, telephone conversations recordings.

 

The Data Subjects may, at their discretion, refuse to communicate the Personal Data to the Controller. In this event however, the Controller may be prevented from entering into and executing the employment contract if the relevant Personal Data is necessary for such purposes.

 

In addition, the Data Subjects should refrain from supplying additional Personal Data which are not requested by the Controller or any other entity acting on its behalf. Unless provided otherwise by applicable law, the Controller shall not be liable for any damage caused by the processing of such Personal Data provided by the Data Subjects without being requested by the Controller.

 

Page 11 of 21

 

 

 

3.FROM WHICH SOURCES WILL PERSONAL DATA BE COLLECTED?

 

The Personal Data are collected from various sources, namely:

 

directly from the Data Subject;
   
from third parties representing the Controller;
   
from the employee’s former employer;
   
from the Controller’s service providers;
   
from public registers/platforms;
   
from public social media platforms;
   
from public agencies/authorities.

 

4.FOR WHAT PURPOSES ARE PERSONAL DATA PROCESSED AND UPON WHICH LEGAL BASES?

 

In order for a data processing activity to take place lawfully, the latter first needs to be legitimate and thus to be based on at least one of the grounds set out in article 6 of the GDPR, including among others:

 

the Data Subject has given his consent to the processing of his or her Personal Data for one or more specific purposes;
   
processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract;
   
processing is necessary for compliance with a legal obligation to which the Controller is subject;
   
processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of personal data, in particular where the Data Subject is a child.

 

For the avoidance of doubt, where consent is given by the Data Subjects, such consent shall be construed distinctly from any consent given in the context of confidentiality and/or professional secrecy compliance obligations.

 

In the case at hand, the purposes for which the Personal Data are collected and the legal bases upon which the Controller relies are further specified in Annex 1. Where the Controller’s purposes change over time or where the latter wants to use Personal Data for new purposes, the Controller will inform the employee of such new processing in accordance with the Data Protection Laws.

 

Page 12 of 21

 

 

 

Nevertheless, where the Controller has collected the Personal Data based on consent or following a legal obligation, no further processing is allowed beyond what is covered by the original consent or the provisions of the law.

 

The Controller will not process the Data Subject’s Personal Data for commercial prospecting purposes.

 

The Controller may also, in exceptional cases and in order to safeguard its legitimate interests, access the professional e-mail box/files and, where applicable, the instant messaging system made available to the Data Subject for his work, where, for instance, the Data Subject is on an extended leave. Any such review will always be carried out in strict compliance with the applicable data protection and privacy legislation and the Controller’s internal IT policy.

 

5.WITH WHOM WILL PERSONAL DATA BE SHARED?

 

The Controller may disclose Personal Data to other persons or entities (the “Recipients”) which, in the context of the above-mentioned purposes, refer to:

 

all relevant units of the Employer to perform the Employer’s contractual and statutory obligations;
   
the Controller’s affiliates;
   
the Controller’s service providers and auxiliary persons that observe all relevant secrecy obligations: IT service providers, logistics service providers, human recourses administration providers, printing services and telecommunications service providers, legal advisors, accounting firms, benefit administrators, payroll administrators, tax preparation firms;
   
Any third party that acquires, or is interested in acquiring or securitizing, all or part of the Controller’s assets or shares, or that succeeds to it in carrying on all or a part of its businesses, or services provided to it, whether by merger, acquisition, financing, reorganization or otherwise
   
Any other third party supporting the activities of the Controller;
   
Public authorities: governmental, judicial, prosecution or regulatory agencies and/or authorities;
   
Official national and international registers.

 

In particular, in compliance with the Foreign Tax Compliance Act (FATCA) and Common Reporting Standard (CRS), Personal Data may be disclosed to the Luxembourg tax authorities, which in turn may, acting as controller, disclose the same to foreign tax authorities.

 

Page 13 of 21

 

 

 

The Recipients may, under their own responsibility, disclose the Personal Data to their agents and/or delegates (the “Sub-Recipients”), which shall process the Personal Data for the sole purposes of assisting the Recipients in providing their services to the Controller and/or assisting the Recipients in fulfilling their own legal obligations.

 

The Recipients and Sub-Recipients may, as the case may be, process the Personal Data as processors (when processing the Personal Data on behalf and upon instructions of the Controller and/or the Recipients), or as distinct controllers (when processing the Personal Data for their own purposes, namely fulfilling their own legal obligations).

 

6.WHERE WILL PERSONAL DATA BE TRANSFERRED?

 

The Recipients and Sub-Recipients may be located either inside or outside the European Economic Area (the “EEA”).

 

In any case, where the Recipients are located in a country outside the EEA which benefits from an adequacy decision of the European Commission, the Personal Data will be transferred to the Recipients upon such adequacy decision.

 

Where the Recipients are located outside the EEA in a country which does not ensure an adequate level of protection for Personal Data, the Controller will enter, prior to such transfer, into legally binding transfer agreements with the relevant Recipients in the form of the European Commission approved standard contractual clauses or any other appropriate safeguards pursuant to the GDPR, as well as, if necessary, supplementary measures.

 

In this respect, the Data Subjects have a right to request copies of the relevant document for enabling the Personal Data transfer(s) towards such countries by writing to the Controller at the address referred to in the Section 11 (“Contact Information”).

 

The countries to which Personal Data may be transferred are further specified in Annex 2.

 

7.HOW LONG WILL PERSONAL DATA BE RETAINED?

 

The Controller will retain the Personal Data for the duration of the contract between the Controller and the employee and thereafter for a period of ten (10) years, unless longer or shorter statutory limitation periods apply. Once the Controller no longer requires the Personal Data for the purposes for which it was collected, it will securely destroy the Personal Data in accordance with applicable laws and regulations. The principal retention periods applied by the Controller are further specified in Annex 3.

 

In some circumstances the Personal Data may be anonymised so that it can no longer be associated with the Data Subjects, in which case documents having been anonymised can be kept for an unlimited period of time.

 

Page 14 of 21

 

 

 

8.THE DATA SUBJECTS’ RIGHTS

 

In accordance with the conditions and limitations laid down by the Data Protection Laws, the Data Subjects acknowledge their right to:

 

Access their Personal Data:   To obtain from the Controller confirmation as to whether or not Personal Data concerning them are being processed, and, where that is the case, access to the Personal Data.
     
Rectify their Personal Data:   To obtain from the Controller without undue delay the rectification of inaccurate Personal Data concerning them. Taking into account the purposes of the processing, the Data Subject shall have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.
     
Object to the processing of their Personal Data (including for commercial prospecting purposes):  

To object, on grounds relating to his or her particular situation, at any time to processing of Personal Data concerning them which is based on the performance of a task carried out in the public interest or the legitimate interests pursued by the Controller or by a third party. The Controller shall no longer process the Personal Data unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defence of legal claims.

 

Where Personal Data are processed for commercial prospection purposes, the Data Subject shall have the right to object at any time to processing of Personal Data concerning them for such commercial prospection, which includes profiling to the extent that it is related to such direct commercial prospection.

     
Restrict the use of their Personal Data:  

To obtain from the Controller restriction of processing, in some circumstances.

 

Where processing has been restricted under the above paragraph, such Personal Data shall, with the exception of storage, only be processed with the Data Subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

     
Have their Personal Data erased:   To obtain from the Controller the erasure of Personal Data concerning them without undue delay and the Controller shall have the obligation to erase Personal Data without undue delay, except in certain limited scenarios set out in the GDPR.

 

Page 15 of 21

 

 

 

Withdraw their consent:   To withdraw their consent easily and at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
     
Ask for Personal Data portability:   To receive the Personal Data concerning them, which they have provided to the Controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Controller to which the Personal Data have been provided, where (i) the processing is based on consent or on a contract and (ii) the processing is carried out by automated means.

 

The Data Subjects may exercise their above rights by writing to the Controller at the address referred to in Section 11 (“Contact Information”).

 

The Data Subjects also acknowledge the existence of their right to lodge a complaint with the Commission Nationale pour la Protection des Données (the “CNPD”) at the following address: 15, Boulevard du Jazz, L-4370 Belvaux, Grand Duchy of Luxembourg; or with any competent data protection supervisory authority of their EU Member State of residence.

 

9.COMMITMENTS

 

Employees supplying Personal Data relating to any other natural persons other than themselves (such as emergency contacts or relatives, as the case may be) undertake and guarantee to process Personal Data and to supply such Personal Data to the Controller in compliance with the Data Protection Laws, including, where appropriate, informing the relevant Data Subjects of the content of this Privacy Notice and any updated version thereof in accordance with articles 12, 13 and/or 14 of the GDPR.

 

In addition, the employees undertake to ensure the accuracy of the Personal Data provided and promptly inform the Controller where such Personal Data is not up to date.

 

10.CHANGES TO THIS PRIVACY NOTICE

 

The Controller reserves the right to update this Privacy Notice at any time.

 

An up-to-date version will be made available to the employee on the Controller’s portal. In case of substantial updates to the present Privacy Notice, employees will be notified via e-mail and/or through the Controller’s portal or other means of communication.

 

11.CONTACT INFORMATION

 

The Data Subjects may exercise their above rights by writing to the Controller at the following address: hr@northstar-data.com.

 

 

Page 16 of 21

 

 

 

ANNEX 1 TO THE PRIVACY NOTICE

Purposes and legal bases

 

The Personal Data are processed by the Controller for the following purposes and legal bases:

 

(i)Compliance with applicable legal obligations

 

Categories of Personal Data   Purposes
     
Identification data, contact data, professional data, health related data, sensitive data.  

Enabling the Controller to comply with its legal obligations and employment-related requirements, including income tax, social security, health and safety, data protection, regulatory and immigration obligations, the amended Criminal Records Act of 29 March 2013, to carry out any other duties relating to employment and social security legislation (e.g. in relation to sick pay) or to comply with reporting or disclosure obligations under applicable laws and regulations (e.g. in relation to health and safety at work duties);

 

Health related data of Data Subjects will be processed by the Controller on the basis of article 9 (2) (a) (b), (c), (f) or (h) of the GDPR. Special categories of personal data, specifically political opinions of Data Subjects having a public political exposure will be processed by the Controller on the basis of article 9, (2), e) and/or g) of the GDPR (i.e. respectively the personal data have manifestly been made public by the data subject and/or the personal data is necessary for reasons of substantial public interest).

 

Page 17 of 21

 

 

 

(ii)Necessity to execute the contract between the employee and the Controller or in order to take steps at the request of the data subjects prior to entering into the contract

 

Categories of Personal Data   Purposes
     
Identification data, contact data, professional data, bank account data, health related data, sensitive data and communication data   The performance of the Agreement, manage human resources, including recruitment, performance appraisal, promotions, training, payroll administration, insurance and social security.
     
Identification data, contact data, professional data, health related data and communication data   Responding to the Data Subject’s requests and enquiries and otherwise communicate with the Data Subject or the Data Subject’s emergency contact or third parties.

 

(iii)The legitimate interests of the Controller or of relevant third parties

 

Categories of Personal Data   Purposes
     
Identification data, contact data, professional data, health related data, performance data and communication data   Responding to the Data Subject’s requests and enquiries and otherwise communicate with the Data Subject or the Data Subject’s emergency contact or third parties.
     
Identification data, contact data, professional data and communication data,   Allowing the Controller to exercise and defend their rights before any relevant court, government, supervisory or regulatory authority.
     
Identification data, contact data, professional data, sensitive data, communication data   Investigating and resolving the Data Subject’s disciplinary issues or grievances.
     
Identification data, contact data, bank account data, professional data and communication data   Conducting the Controller’s business, manage client relationships and secure the Controller’s IT networks and systems, operations, assets, premises and clients.
     
Identification data, contact data, bank account data, professional data and communication data   The provision of evidence in the event of a dispute, transaction or business communication and in connection with any proposed purchase, merger or acquisition of all or part of the Controller’s business.
     
Identification data, contact data, professional data, bank account data, health related data, sensitive data and communication data   Compliance with foreign laws and regulations and/or any order of a foreign court, government, supervisory, regulatory or tax authority.
     
Identification data and contact data   Protection of the Controller’s property, assets and investments (including camera recording).
     
Identification data, contact data, professional data and communication data   Control, monitoring and ensuring compliance with the Controller’s policies and procedures.
     
Identification data, contact data, professional data and communication data   The prevention, investigation, monitoring and resolution of any misuse of the system or computer resources, or security incidents that may occur in relation to the network and/or computer systems.
     
Identification data, contact data, professional data and health related data   The effective administration of business and labour relations at the level of the group to which the Controller belongs.t

 

 

Page 18 of 21

 

 

 

ANNEX 2 TO THE PRIVACY NOTICE

Recipients and countries of establishment

 

The Controller transfers Personal Data to the below categories of recipients and their countries of establishment:

 

Categories of recipients   Name and country of establishment
     
The Controller’s affiliates   NorthStar Earth & Space Inc, Montréal, Canada
     
The Controller’s service providers   Mintz Global Screening, Montréal, Canada
     
The Controller’s service providers   WTS GmbH, Germany Securex, Luxembourg
     
Legal advisor(s)   Arendt & Medernach S.A., Luxembourg

 

 

Page 19 of 21

 

 

 

ANNEX 3 TO THE PRIVACY NOTICE

Retention Periods

 

The Controller undertakes to ensure that necessary records and documents are adequately protected and maintained and that records that are no longer needed or are of no value are deleted or destroyed in compliance with the provisions of the GDPR.

 

In this respect, unless longer or shorter statutory limitation periods apply, the principal retention periods implemented by the Controller are specified below:

 

General
Type of records   Retention periods
Contracts   10 years from the end of the contractual relationship to which the documents relate.
     
Business correspondence (letters, emails, faxes, etc.)   10 years from the end of the accounting year in which the document was sent or received.
     
Employee earning records   10 years from the end of the accounting year in which the document was sent or received.
     
Employee expense records   10 years from the end of the accounting year in which the document was sent or received.

 

Human resources
Type of records   Retention periods
Applicant records (not hired)   Data will be deleted after the decision not to hire the applicant. However, data will be kept during a period of 6 months if the employer considers that an offer could be made during this period of six months, unless otherwise agreed by the applicant (consent).
     
Criminal records (for applicants not hired)   Data will be deleted after the decision not to hire the applicant.
     
Criminal records (for employees)  

1 month as of the conclusion of the employment contract for newly hired employee and 2 months for employee changing function.

     
Compensation records   10 years from the end of the accounting year to which the documents relate.

 

Page 20 of 21

 

 

 

Complementary pension scheme   As long as the last employee benefits from such complementary pension scheme.
     
Employment contracts   10 years from the end of the employment relationship
     
Annual leave register   5 years as from the date of the closing of the liquidation of the company.
     
Pay slips and records related to payroll administration and records supporting the wages and taxes paid, withheld and reported.   10 years from the end of the accounting year to which the documents relate.
     
Employees’ files including medical certificates sent by the employee in case of sickness  

If the documents cannot be relevant for the evaluation or payment of the employee’s remuneration (including bonuses):

 

  Dismissal: 15 months after the employee receives the notification of the grounds for termination.
     
  Resignation with immediate effect: 17 months after the employee’s resignation.
     
  Resignation with prior notice: Immediate deletion as from the expiry of the notice period.

 

    If the documents can be relevant for the evaluation or payment of the employee’s remuneration (including bonuses):

 

  Dismissal, resignation with immediate effect and resignation with prior notice: 3 years

 

    In any case, such documents should not be kept for more than 10 years after the end of the employment relationship.
     
Registers for hours worked (including overtime / hours worked on Sunday / hours worked at night)   5 years as from the date of the closing of the liquidation of the company.
     
Register for hours worked on public holidays   5 years as from the date of the closing of the liquidation of the company.
     
List of industrial accidents having caused a disablement of an employee for more than 3 days   5 years as from the date of the closing of the liquidation of the company.

 

 

Page 21 of 21