PRIVACY POLICY
In accordance with the provisions of Regulation (EU) 2016/679 of 27 April 2016 (hereinafter, “GDPR”) and the Spanish Organic Law on Data Protection and Guarantee of Digital Rights (hereinafter, “LOPDGDD”), Fundació COAC (hereinafter, “THE FOUNDATION”) wishes the User to be aware of the Privacy Policy applied with regard to their personal data.
1. Details of the Data Controller
|
Identity |
Fundació COAC |
|
N.I.F. |
G19827120 |
|
Postal address |
Plaça Nova, nº 5, 08002 Barcelona (Espanya) |
|
Phone number |
+ 34 93 306 78 09 |
|
Mail address |
fundaciocoac@fundaciocoac.org |
|
DPO or contact |
fundaciocoac@fundaciocoac.org |
2. Purpose
The User is informed that the personal data and information they provide to THE FOUNDATION will be processed in accordance with the following purposes, depending on how they were provided:
- Cultural programmes
- Social programmes
- Research programmes
3. Legal Basis
The legal basis for the processing of the User’s data is their consent and the contractual relationship with THE FOUNDATION, in compliance with legal and statutory obligations.
The legal basis for the processing of their data as suppliers and clients is the contractual relationship in force with THE FOUNDATION.
The legal basis for the processing of the User’s data for the purpose of sending them information on activities, services and events of THE FOUNDATION that may be of interest to them is their consent, without the withdrawal of this consent, under any circumstances, affecting the processing of data in accordance with legal and statutory obligations as a member of the professional association.
The legal basis for the processing of the User’s data as a possible recipient of THE FOUNDATION’s programmes is their consent.
The legal basis for the processing of data of candidates or participants in THE FOUNDATION’s programmes is their consent.
The legal basis for the processing of their data received through the suggestions, requests, complaints and claims form is their request and consent in order to carry out the management of their request.
The legal basis for the processing of images captured by the video surveillance cameras at THE FOUNDATION’s facilities is legitimate interest.
4. Data Retention Period
Data linked to the contractual relationship with THE FOUNDATION (patrons, suppliers, clients…) will be kept for a maximum of ten (10) years from the end of the service. Notwithstanding the aforementioned period, this data will be kept for the statutory limitation periods in order to comply with our legal obligations, for the management of our rights (to make or respond to, where applicable, a claim), also applying the provisions of the internal regulations relating to the periods of filing and retention of documentation.
Personal data provided for the sending of information will be kept for as long as consent is not withdrawn. The User may withdraw their consent at: fundaciocoac@fundaciocoac.org.
Data linked to the contractual relationship with THE FOUNDATION will be kept for a maximum of 12 months from the end of the service. Notwithstanding the aforementioned period, the User’s data will be kept for the statutory limitation periods in order to comply with our legal obligations, for the management of our rights (to bring or defend, where applicable, a claim), also applying the provisions of the internal regulations relating to the periods of filing and retention of documentation.
Data of candidates for a position at THE FOUNDATION will be kept for one (1) year from receipt of their CV. Where the CV has been submitted for a specific selection process, the personal data will be deleted once that process has ended, unless the data subject authorises its retention for future recruitment processes.
With regard to requests for suggestions, requests, complaints and claims, the period legally applicable in accordance with the regulations applicable in each case shall apply.
Images taken by THE FOUNDATION in connection with its programmes will be kept for thirty (30) days, except in those cases where they must be kept to prove the commission of acts that violate the integrity of persons or property, or where they have been provided to law enforcement agencies.
5. Data Recipients: Assignees and Data Processors
We inform you that the User’s data will not be disclosed to third parties, except where legally required. In addition, we inform you that, in certain cases, we may disclose your data to other entities that provide us with advertising, digital media and social media services, which help us to provide our services efficiently and always under the protection of current regulations, and with which, in their capacity as processors of data owned by THE FOUNDATION, and in accordance with the provisions of Article 28 of the GDPR, a contract has been formalised legitimising these entities’ access to personal data and including the obligations to be observed in the processing thereof.
These exceptions are, according to purposes and processing:
- Management of members/donors and collaborators: data disclosed to banking institutions for the management of fees, donations and direct debits.
- Accounting and tax management: data disclosed to the Tax Agency and other competent public administrations.
- Personnel management: data disclosed to the General Treasury of the Social Security, work accident mutual insurance companies and labour consultancies.
- Provision of THE FOUNDATION’s own services: data disclosed to collaborating entities, suppliers or partners necessary for the execution of specific projects or activities.
- Advertising and communication: data disclosed to digital advertising and social media platforms for the dissemination of THE FOUNDATION’s campaigns and activities.
Where a legal provision exempts from the need for consent, as is the case of compliance with the duty of cooperation with judicial bodies and competent public administrations in the exercise of their functions.
Where disclosure is necessary to provide the service through a third party (data processor), according to the following purposes:
- Hosting and maintenance of the website and IT systems (hosting and cloud service providers).
- Sending of communications and newsletters (email marketing platforms).
- Management of payments and online donations (payment gateways).
- Web analysis and audience measurement (analytics tools).
- Administrative and accounting management (external accounting and consultancy firms).
As a general rule, THE FOUNDATION does not transfer data outside the European Union and the European Economic Area, but it is sometimes required to use service providers based outside that area, thereby giving rise to international data transfers.
5. Data Recipients: Assignees and Data Processors
We inform you that the User’s data will not be disclosed to third parties, except where legally required. In addition, we inform you that, in certain cases, we may disclose your data to other entities that provide us with advertising, digital media and social media services, which help us to provide our services efficiently and always under the protection of current regulations, and with which, in their capacity as processors of data owned by THE FOUNDATION, and in accordance with the provisions of Article 28 of the GDPR, a contract has been formalised legitimising these entities’ access to personal data and including the obligations to be observed in the processing thereof.
These exceptions are, according to purposes and processing:
- Management of members/donors and collaborators: data disclosed to banking institutions for the management of fees, donations and direct debits.
- Accounting and tax management: data disclosed to the Tax Agency and other competent public administrations.
- Personnel management: data disclosed to the General Treasury of the Social Security, work accident mutual insurance companies and labour consultancies.
- Provision of THE FOUNDATION’s own services: data disclosed to collaborating entities, suppliers or partners necessary for the execution of specific projects or activities.
- Advertising and communication: data disclosed to digital advertising and social media platforms for the dissemination of THE FOUNDATION’s campaigns and activities.
Where a legal provision exempts from the need for consent, as is the case of compliance with the duty of cooperation with judicial bodies and competent public administrations in the exercise of their functions.
Where disclosure is necessary to provide the service through a third party (data processor), according to the following purposes:
- Hosting and maintenance of the website and IT systems (hosting and cloud service providers).
- Sending of communications and newsletters (email marketing platforms).
- Management of payments and online donations (payment gateways).
- Web analysis and audience measurement (analytics tools).
- Administrative and accounting management (external accounting and consultancy firms).
As a general rule, THE FOUNDATION does not transfer data outside the European Union and the European Economic Area, but it is sometimes required to use service providers based outside that area, thereby giving rise to international data transfers.
6. Rights of the Data Subject
We inform the User that they have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
In certain circumstances, the User:
- May request the restriction of the processing of their data, in which case we will only retain it for the exercise or defence of claims.
- May, for reasons related to their particular situation, object to the processing of their data, in which case the data controllers will stop processing it except for compelling legitimate reasons, or the exercise or defence of possible claims; and, in the event that they have given their consent for a specific purpose.
- May withdraw their consent at any time, where applicable, which will not affect the lawfulness of the processing based on the consent prior to its withdrawal.
Likewise, the User shall have the right to receive the personal data they have provided to the data controllers, in a structured, commonly used and machine-readable format, and to transmit it to another data controller without the data controllers being able to prevent this. In this regard, the User may request that the data controllers transmit the personal data directly, where technically possible, to the data controller indicated by the User in their communication.
Finally, we inform the User that they may exercise their rights by sending a request to:
THE FOUNDATION, in writing, enclosing a copy of their ID card, passport or equivalent document, to Plaça Nova, nº 5, 08002 Barcelona (Spain), or by sending an email to fundaciocoac@fundaciocoac.org indicating on the envelope or in the subject line of the message: “Fundació COAC Privacy Policy”.
If the User considers that the processing of their personal data infringes applicable regulations or, simply, is not satisfied with the exercise of their rights, they have the right to lodge a complaint with:
- The Spanish Data Protection Agency, through one of the following channels:
– By telephone on +34 900 293 183
– Electronically, via the website https://www.aepd.es/es/la-agencia/donde-encontrarnos - The Catalan Data Protection Authority, through one of the following channels:
– By telephone on +34 93.552.78.00;
– Electronically, via the website https://apdcat.gencat.cat/ca/seu_electronica/serveis/atencio/
– In person, by requesting an appointment via email at atenciopublic.apdcat@gencat.cat
7. Accuracy of Data
The User is responsible for the accuracy of their data, and undertakes not to enter false data and to modify it if necessary.