Euro-Funding Advisory Group, S.L. (hencefort Euro-Funding), with registered office at Plaza de la Independencia 8, floor 2 28001 Madrid-Spain, company registered in the Mercantile Register of Madrid-Spain, Volume 26,920 Section 8, Sheet 160, Page M-485,130, telephone +34 917 010 490 and e-mail address email@example.com, hereby informs you of its personal data protection policy, so that you may be informed of the processing of personal data by Euro-Funding in accordance with the provisions of the regulations on data protection and online privacy:
- RGPD: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
- LOPD: Organic Law 3/2018, of December 5, on the protection of personal data and guarantee of digital rights
- LSSI: Law 34/2002, of July 11, of services of the society of the information and electronic commerce.
AREA OF APPLICATION
- Euro-Funding Innovation, S.L.U. with TIN B62189345
- Euro-Funding Environmental S.L.U. with TIN B97228639
- Euro-FundingLocal Taxes S.L.U. with TIN B85997625
- Euro-Funding EU Projects S.L.U. with TIN B84460252
- Euro-Funding Cost Solutions, S.L.U. with TIN B87514063
- Euro-Funding International S.L.U. with TIN B84460252
- Euro-Funding Multilateral Projects, SL con NIF 87994596
- Euro-Funding, Portugal UNIPESSOAL, LDA. NIPC 509149677
- Euro-Funding Polonia, Spólka Z.O.O. con NIP 1080012306
- Euro-Funding Mexico S.A.P.I. de C.V. con R.F.C. EAG130520BB9
- Euro-Funding Chile S.p.A. con R.U.T. nº 762767619
TREATMENT OF PERSONAL DATA
Euro-Funding carries out various treatments of personal data which are detailed below:
Browser user (IP address)
- Purpose of the treatment: To manage access to the web server.
- Recipients: Competent authorities in the event of a security incident.
- Processing time: The time technically necessary to manage your access. Subsequently they will be blocked and kept at the disposal of the competent authorities.
- Legitimacy: The legal basis that legitimates this processing is the need to provide the service of access to the web server.
Browsing user (cookies)
- Recipients: Companies of the Euro-Funding Group.
- Processing period: Maximum of 2 years.
- Legitimacy: The legal basis that legitimates this processing is the consent given through the cookie warning
Contact form or mailboxes
- Purpose of treatment: To manage your request for contact and answer the questions you raise.
- Recipients: The corresponding companies of the Euro-Funding Group, according to the nature and content of your request.
- Processing time: The time needed to answer your request. Subsequently, they will be kept for 5 years to deal with possible claims.
- Legitimacy: The legal basis that legitimates this treatment is your consent, given when requesting the contact.
Subscription to newsletter and commercial communications
- Purpose of the treatment: To manage your request for registration in the newsletter and to send you commercial communications by e-mail about the services, initiatives, events, conferences, publications, news, activities and calls of the sector of purchasing consultancy, tax, international cooperation, energy efficiency, real estate taxation, international taxation, sustainability, European funds, research, development and innovation. The commercial communications will be sent through a specific tool that will include links and tiny and transparent images that will be associated to your e-mail address. In this way, when you download one of these images or access the links contained in the e-mail, Euro-Funding can know for statistical purposes if the e-mail has been opened or if any link has been accessed from the e-mail. You can prevent these uses by configuring your manager or e-mail program to prevent automated downloading of images, as well as by not accessing the links included in the e-mails you receive.
- Recipients: Companies of the Euro-Funding Group.
- Processing period: Indefinite as long as you do not withdraw your consent, oppose future communications or request your right to delete data.
- Legitimacy: The legal basis that legitimizes this treatment is your consent, given when you subscribe to these communications.
- Purpose of the treatment: To manage your registration, attendance and participation in the various events in which you register, as well as, unless you object, to provide you with commercial information about the Euro-Funding Group.
- Target group: Companies of the Euro-Funding Group involved in the celebration of the event. Likewise, your data will be communicated to third parties for the management of your attendance at the event, such as physical or virtual space management entities for access control, which may be located in the United States or other countries which do not guarantee an adequate level of data protection, which will be informed during the registration process. Eventually, other third parties such as sponsors or collaborating entities may request the transfer of their data, in which case it will be expressly indicated in the registration process.
- Processing time: The time needed to manage the event and send the invitation to receive commercial information from the Euro-Funding Group. Subsequently, the data will be kept, duly blocked, for a period of 5 years after the end of the event in order to deal with possible claims.
- Legitimacy: The legal basis that legitimizes this treatment derived from the event is your consent, given when you register for the event. With respect to the offer of commercial information from the Euro-Funding Group, the legal basis that legitimizes the treatment is the legitimate interest, as well as the previous existing relationship.
Social network users
- Purpose of the treatment: To manage relationships and contacts through social networks.
- Recipients: Your data will be the joint responsibility of the company managing the social network in question and the Euro-Funding Group Companies involved in the management of the social network. The social network management companies may be located in the United States or other countries that do not guarantee an adequate level of data protection, which is accepted by the users of the social network.
- Processing period: Indefinite, until it is decided to cancel the relationship with Euro-Funding through the social network in question. Euro-Funding will not extract data from the social network unless it is necessary for other of the planned treatments and informed to the interested parties (e.g. selection processes).
- Legitimacy: The legal basis that legitimizes this treatment derived from the event is your consent, given when you register for the event. With respect to the offer of commercial information by the Euro-Funding Group, the legal basis that legitimizes the treatment is the legitimate interest, as well as the previous existing relationship.
- Purpose of the treatment: Carrying out satisfaction surveys.
- Recipients: Euro-Funding Group companies involved in providing the services being surveyed.
- Processing time: The time required to manage the survey. Subsequently, the data will be kept, duly blocked, for 5 years in order to attend to possible claims.
- Legitimacy: When you participate proactively in satisfaction surveys, the legal basis that legitimizes this treatment is your consent. When you receive satisfaction surveys from the Euro-Funding Group for having received a service from the Group, the legal basis that legitimizes this processing is your legitimate interest in knowing your satisfaction.
Representatives of clients, suppliers, potential collaborators and other commercial contacts
- Purpose of the treatment: Management of the commercial and professional relationship Your identification and professional contact data may come from third parties, such as the company where you work, online platforms for professional contacts or directories of commercial information on companies.
- Recipients: Companies of the Euro-Funding Group involved in the commercial relationship.
- Processing time: The time required for commercial management. Subsequently, the data will be kept, duly blocked, for 15 years in order to meet possible liabilities, including criminal liabilities, arising from the processing.
- Legitimacy: When you proactively participate in satisfaction surveys, the legal basis that legitimizes this treatment is your consent. When you receive satisfaction surveys from the Euro-Funding Group for having received a service from the Group, the legal basis that legitimizes this processing is your legitimate interest in knowing your satisfaction.
Selection processes of labor personnel
- Purpose of the treatment: To manage your participation in the present and future selection processes of labor personnel for Euro-Funding and the companies which make up the Euro-Funding Group. Your identification data and curriculum vitae may come from third parties, such as online employment platforms, personnel selection agencies or temporary employment agencies.
- Recipients: Euro-Funding Group companies. Occasionally, depending on the position, it will be necessary to communicate your data to clients or potential clients for the acceptance of a project.
- Processing period: 2 years, during which you may be contacted to update your data and renew your consent.
- Legitimacy: The legal basis that legitimizes this treatment is your consent given when signing up for a selection process.
Selection processes of external, expert and freelance collaborators
- Purpose of the treatment: To manage your participation in the present and future selection processes of external collaborators, experts and freelancers for Euro-Funding projects and the companies which make up the Euro-Funding Group in any country in the world. Your identification data and curriculum vitae may come from third parties, such as online platforms for professional contacts.
- Recipients: Companies of the Euro-Funding Group. Occasionally, depending on the position, it will be necessary to communicate your data to European entities and organizations, as well as clients or potential clients in any country in the world for the acceptance of a project.
- Processing time: 7 years due to the requirements of European bodies.
- Legitimacy: The legal basis that legitimizes this treatment is your consent given when signing up for a selection process.
Users must keep their data permanently updated, and if it is not possible to update them on-line, they must inform Euro-Funding, as the person responsible for the processing, of any changes that may occur at any time.
Euro-Funding will cancel, erase and/or block the data when it is inaccurate, incomplete or no longer necessary or pertinent for its purpose, in accordance with the provisions of data protection legislation and once the appropriate legal deadlines for processing have expired.
TRANSPARENCY AND LEGALITY OF TREATMENT
Euro-Funding does not collect personal data in an illicit or opaque way for the interested parties.
Euro-Funding has adopted all technical and organizational security measures in accordance with the nature of the data, to guarantee the security of personal data, and to avoid its alteration, loss, treatment or unauthorized access.
RIGHTS OF THE INTERESTED PARTIES
The data protection regulations guarantee users the following rights:
- Access: Allows the User to know what information is held, where it has been obtained from, to whom it has been provided and what uses it has been put to.
- Rectification: Allows the User to rectify any erroneous or outdated data.
- Deletion: Allows the user to stop processing their data.
- Opposition: Allows the user to stop using their data for a specific purpose.
- Limitation: Allows the user to restrict the processing of their data, but so that they are retained for some subsequent purpose.
- Portability: Allows the User to obtain a copy of their data in electronic format and, in certain circumstances, request that they be communicated to another service provider. It is only applicable for computerized treatment carried out with the consent of the User or for the fulfillment of a contract.
Users are informed that they may exercise the aforementioned rights before Euro-Funding, as well as revoke the consents they have given, by mail to Plaza de la Independencia 8, floor 2 28001 Madrid-Spain or by e-mail (firstname.lastname@example.org).
If your request is not attended to in time and form, we inform you that you may exercise your right to file a complaint with the Spanish Data Protection Agency as the competent control authority (www.aepd.es).
ORDER OF PERSONAL DATA PROCESSING
In the event that your relationship with the Euro-Funding Group involves an order for processing from the Euro-Funding Group companies to you or vice versa, the party in charge of the processing will assume the following obligations in accordance with the provisions of Article 28 of the RGPD:
- To access personal data only when it is essential for the proper performance of the services for which it has been contracted.
- To treat the data according to the instructions received from the person in charge.
- Follow the procedures and instructions received from the person responsible, especially with regard to the duty of information and, where appropriate, obtaining the consent of those affected.
- Immediately inform the person responsible if he detects that any of the instructions from the person responsible violates current regulations on data protection.
- Not to destine, apply or use the personal data with a purpose different from the provision of the contracted services or in any other way that implies a breach of the instructions of the responsible.
- Not to disclose, transfer, assign or otherwise communicate the personal data, either verbally or in writing, by electronic means, paper or by computer access, not even for its conservation, to any third party, unless there is prior authorization or instruction from the person responsible.
- Except for the auxiliary services inherent to the activity of the person in charge, in the event that it is necessary to subcontract all or part of the contracted services in which the processing of personal data is involved, this must be communicated in advance and in writing to the person in charge with a minimum of 1 month’s notice, indicating the processing to be subcontracted and clearly and unequivocally identifying the subcontracting company and its contact details. Subcontracting may be carried out if the person responsible does not express his or her opposition within the established period. The subcontractor, who will also have the status of data processor, is also obliged to comply with the obligations established in this document for the data processor and the instructions given by the data controller. The processor shall remain fully responsible to the data controller for compliance with the obligations.
- Give notice to the person in charge, as soon as possible, and within a maximum period of two (2) working days, of any request to exercise the right of access, rectification, suppression, opposition, limitation of the treatment, portability of the data and not to be subject to automated individualized decisions, made by a person whose data have been treated by the person in charge for the purpose of providing the contracted services, so that it can be resolved within the periods established by the regulations in force.
- To make available to the person in charge all the necessary information to prove the fulfillment of his/her obligations, as well as to carry out the audits or inspections carried out by the person in charge or another auditor authorized by him/her.
- In the event that the person in charge is required to transfer or allow access to personal data for which the person in charge is responsible to a third party under the applicable law of the Union or the Member States, he shall inform the person in charge of that legal requirement in advance, unless it is forbidden for reasons of public interest.
- Once the contractual relationship agreed upon between the data controller and the data processor has been fulfilled or terminated, the data controller shall provide the data processor with precise instructions as to the destination of the data, and may choose between its return, referral to another service provider or complete destruction, provided that there is no legal provision requiring the data to be retained, in which case it may not be destroyed.
- To adopt and apply the appropriate technical and organizational measures to guarantee a level of security that avoids its alteration, loss, treatment or unauthorized access, taking into account the state of technology, the nature of the stored data and the risks to which they are exposed, in accordance with the provisions of article 32 of the RGPD. Such measures may include, among others:
- the pseudonymization and encryption of personal data;
- the ability to guarantee the confidentiality, integrity, permanent availability and resilience of the processing systems and services, as well as the availability and access to personal data in a prompt manner in the event of a physical or technical incident.
- A process of regular verification, evaluation and assessment of the effectiveness of technical and organizational measures to ensure the security of processing.
- In the event of a breach of the security of personal data in the information systems used by the person in charge of providing the contracted services, the person in charge must notify the person in charge, without undue delay, and in any case before the maximum period of 72 hours, of the breaches of the security of the personal data in his charge of which he is aware, together with all the relevant information for the documentation and communication of the incident in accordance with the provisions of article 33.3 of the RGPD.
- To comply with any other obligation that corresponds to him as a person in charge of the treatment by virtue of the regulations in force at every moment in the matter of data protection and privacy online.