This Privacy Policy has been developed taking into account what Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y Garantía de los Derechos Digitales (LOPD-GDD), as well as Regulation 2016/679 of European Parlament and Counsil on 26th of 2016 concerning natural persons protection and their personal data treatment and circulation, in the future the RGPD.
This Privacy Policy aims to put into knowledge those personal data owners which its being obtained data from, those specific aspects relating their data treatment, among other things, the aim of the treatments, their contact data to exercise their rights, the deadline of the information conservation and security measures among other things.
Treatment responsible
In terms of data protection ASOCIACIÓN DE ARTE DE SANTANDER Y CANTABRIA (OWNER ahead) must be considered Treatment responsible, relating the identified files/treatments in this Privacy Policy, specifically in Data treatment section.
Data treatments
Requested personal data, will only consist on those strictly necessary to identify and attend the request made by the data owner, the interested one ahead. On the other side, personal data will be gathered to certain explicit and legitimate aims, not being treated with in an incompatible way with those purposes.
Each interested person gathered data will be fit for purpose, appropriate and not excessive concerning its respected aims in each case, and will always be updated when necessary.
Data owner will be informed, with previous notice to data collecting of the general digital extremes in this policy with the aim of giving expressed, precise and clear consent for the treatment of their data, according to the following matters.
Treatment aims
The explicit aims, which each treatment is carried out for, are included on informative clauses incorporated in each of the gathering data ways (web forms, paper forms, locutions or posters and information notes).
However, personal data will be treated only to give them an effective response and to attend to the user requests, specified along with an option, service, form, or data collecting system that the user uses.
Obtained data will be used for the management and organisation of the annual art fair ARTESANTANDER.
Legitimization
As a general rule, previous to personal data treatment, the OWNER obtains an expressed and unmistakable consent from their owner, through the addition of some informed consent clauses in the different collecting information systems.
However, if the interest party consent is not requested, the existence of an specific rule that the interest party allows or demands is the legitimating base of the treatment in which the OWNER exercises its right.
Recipients
As a general rule, the OWNER doesn´t proceed to give or communicate data to third entities, although those legally required. However, in case it is necessary, the cession or communication of data are informed to the interest party via consent clauses that can be found in the different ways of collecting personal data.
Origin
As a general rule, personal data are collected directly from the interested party. However, there are some exceptions, such as data collected via third persons, entities or different services of the interest party. This way, this will be informed to the interest party through informed consent clauses found in different ways of collecting information and in a reasonable period, once data is collected and at the latest in a month.
Conservation period
Information collected from the interest party will be preserved as long as it is necessary to accomplish the aim the data were collected for, in a way that, once the aim is accomplished data will be cancelled. Generally, the interest party data conservation periods, collected through expressed consent, are preserved during 5 years since they were obtained and cancelled after. This cancellation will block data, preserving them only to AAPP, Judges and Courts, to answer different responsibilities data treatment has created, during their prescription period and once this period ends information will be erased.
Browsing data
Regarding browsing data that can be treated through the website, in case that those data that submit to the rules are collected, it is recommended to consult the Cookies Policy published in our website.
Interested party rights
Regulations related to data protection give some rights to the interest parties or data OWNERS, website users or the OWNER social media profiles data. The rights these interested persons have are the following:
Access right: a right to obtain information regarding their own data are being an object of treatment, the aim of this treatment that is being done, the data categories that are being treated, the recipients or recipient categories, the conservation period the source of those data.
- Rectification right: a right to obtain the imprecise or incomplete personal data rectification.
- Suppression right: a right to obtain the suppression of data in these cases:
- When data are no longer necessary for the aims they were collected for.
- When the owner withdraws consent.
- When the interest party refuses to their treatment.
- When data must be suppressed to the compliance of legal obligation.
- When data have been obtained considering that it is an information society based on article 8, section 1, European Parliament Regulations about Data Protection.
- Opposition right: a right to oppose to certain data treatment that the interest party has knowledge of.
- Limitation right: a right to obtain data treatment limitation in the following cases:
- When the interest party refutes to certain treatment based on the consent of the interest party.
- When the interest party refutes personal data accuracy, during a period that allows the company to verify their accuracy.
- When treatment is licit and the interest party refuses to personal data suppression.
- When the company no longer needs data for the aims they were collected for, but the interest party needs them to formulate, to exercise or defend its complaints.
- When the interest party has refused to the treatment while it is being verified if the company legal aims prevail over the interest party ones.
- Portability right: a right to obtain data in a structured format of common use and mechanical reading and transmit to other treatment responsible when:
- Treatment is based on consent.
- Treatment is made by automatic means.
- Right to present a complaint to the competent control authority.
The interest parties can exercise the mentioned rights addressing the OWNER to the following email: info@artesantander.com writing in the email Subject the right they want to exercise.
The OWNER will attend their request as early as possible and taking into account the previous time periods expected in regulations concerning data protection.
Safety
Safety measures adopted by the OWNER are those required, according to what is established in article number 32 of RPGD. This way, the OWNER, taking into account the treatment technique, the outreach, application costs and nature, context and the aims of the treatment, as well as probability risks and variable seriousness for the natural persons rights and liberties, they have established the sufficient technical and organizational measures to guarantee the level of security adapted to the existing risk.
In all cases, the OWNER has implemented enough mechanisms to:
- a) Guarantee permanent confidentiality, integrity, availability of the treatment system and services.
- b) To restore availability and Access to personal data quickly, in case of a physical or technical incident.
- c) Verify, evaluate and value, regularly, the technical and organizational measures efficiency implanted to guarantee treatment safety.
- d) To give a pseudonym and encode personal data.