Privacy policy

Data Controller

  • Data Controller: INTERNATIONAL ASSOCIATION PEOPLE-ENVIRONMENT STUDIES
  • Tax Number: G70420765
  • Address: Lugar Campus de Elviña, s/n, 15071, A Coruña
  • e-mail to exercise your rights: admin@iaps-association.org

Purposes and lawful bases

In addition to the basic information on data protection provided through each of the data collection channels, additional information is provided below regarding the purposes, legal bases, and other information relating to the following files or processing operations:

Membership management

Personal data will be processed for the purposes of managing membership of the organization, collecting membership fees, and for accounting, tax, and administrative purposes.

The lawfulness of the processing is based on Article 6.1.b. of the GDPR: “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.”

Compilation of historical statistics on members

Personal data will be processed to keep historical information on membership for statistical and analytical purposes, as well as to create aggregate reports on membership trends by university, country of residence, and other academic or sociodemographic variables, and to improve the planning of future association activities.

The lawfulness of the processing is based on Article 6.1.f. GDPR – “processing is necessary for the purposes of the legitimate interests pursued by the controller.”

Providers

The data will be processed for the proper management and monitoring of suppliers for the purposes of controlling the products or services contracted, receipts, shipments, and inquiries. Management of commercial reports, delivery notes, and payment of supplier invoices. Accounting, tax, and administrative management. Maintenance of the business relationship.

The lawfulness of the processing is based on Article 6.1.b. GDPR “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.”

Professional contacts

The data will be processed for the maintenance of relations of any kind with the legal entity in which the data subject provides their services and for professional location.

The lawfulness of the processing is based on Art. 6.1.f. GDPR “processing is necessary for the purposes of the legitimate interests pursued by the controller”

Event management and organization

Personal data will be processed to manage the participation of attendees at events organized by the association, maintain a historical record of participation, and send information about future related events, provided that the interested party has given their consent.

The lawfulness of the processing will be based on Article 6.1.a. of the GDPR, “the data subject has given consent to the processing of his or her personal data for one or more specific purposes,” and Article 6.1.b., “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.”

Web users

Personal data is collected through the website for various purposes, including:

  • Contact section for queries, complaints, suggestions, or claims: Analysis of browsing habits through analytical cookies (see Cookie Policy published on the website). The lawfulness of the processing is based on 6.1.a. GDPR “the data subject has given consent to the processing of his or her personal data for one or more specific purposes.”
  • Social media: Personal data will be processed for the purpose of publicizing the entity’s activities and showcasing the services or events carried out by the entity. The lawfulness of the processing is based on Article 6.1.a. GDPR: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes.”

Data communications

In order to manage certain services offered by the entity, it is necessary to allow third-party service providers contracted for this purpose to access certain data. In this regard, the entity proceeds to sign the respective data processor agreements necessary and has given precise instructions to the different service providers or data processors to ensure the security and integrity of the data to which they have access for the purpose of providing the contracted service.

Except in the above cases, your personal data will not be transferred to third parties, except in cases required by law.

Data retention

By completing the basic information on data protection that is provided through each of the data collection channels, additional information is provided below regarding the purposes and legitimate bases of the following data processing activities:

  • Members: The data will be kept until the end of the contractual relationship and will be kept, duly restricted, during the limitation periods for any liabilities that may arise.
  • Providers: The data will be kept for as long as necessary to fulfill the purpose for which it was collected.
  • Professional contacts: the data will be kept until the end of the professional relationship with the data subject.
  • Event management: The data will be kept for as long as necessary to fulfill the purpose for which it was collected.
  • Web users: will be retained while your request is being processed (contact).
  • Social media: data will be retained for as long as the consent given by the data subject remains valid, without prejudice to their right to withdraw it at any time.

 

Data profiling and international data transfers

No profiling will be carried out, nor are any international data transfers planned.

Consent withdrawal

In cases where the processing of personal data is based on consent, interested parties are informed of their right to withdraw their consent at any time, easily and free of charge, by writing to the data controller’s address or via admin@iaps-association.org. The withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal.

Data subject rights

Data protection regulations grant a series of rights to data subjects or owners. These rights are as follows:

  • Right of access: the right to obtain information about whether your own data is being processed, the purpose of the processing, the categories of data being processed, the recipients or categories of recipients, the retention period, and the origin of the data.
  • Right of rectification: the right to obtain the rectification of inaccurate or incomplete personal data.
  • Right to object: the right to object to certain processing based on the consent given.
  • Right to erasure: the right to obtain the erasure of data in the following cases:
    • When the data is no longer necessary for the purpose for which it was collected.
    • When the owner of the data withdraws consent
    • When the data subject objects to the processing
    • When it must be deleted in compliance with a legal obligation
    • When the data has been obtained by virtue of an information society service based on the provisions of Article 8(1) of the GDPR.
  • Right to restriction: the right to obtain restriction of data processing in any of the following cases:
    • When the data subject contests the accuracy of the personal data, for a period enabling the entity to verify the accuracy of the data.
    • When the processing is unlawful and the data subject opposes the erasure of the data.
    • When the entity no longer needs the data for the purposes for which it was collected, but the data subject needs it for the establishment, exercise, or defense of legal claims.
    • When the data subject has objected to the processing while it is being verified whether the legitimate grounds of the entity override those of the data subject.
  • Right to portability: the right, when the processing is carried out by automated means, for the data subject to receive their personal data in a structured, commonly used, machine-readable and interoperable format, and to transmit it to another controller, provided that the processing is based on consent or in the context of the performance of a contract.
    This right, by its very nature, cannot be applied when the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  • Right not to be subject to automated individual decisions: the right not to be subject to a decision based solely on the processing of personal data, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them.
    This right shall not apply when:
    • It is necessary for the conclusion or performance of a contract between you and the controller
    • The processing of your data is based on your prior consent
    * In these first two cases, the controller must guarantee the right of data subjects to obtain human intervention, express their point of view, and contest the decision.
    • It is authorized by Union or Member State law and appropriate measures are in place to safeguard the rights and freedoms and legitimate interests of the data subject.

* In turn, these exceptions shall not apply to special categories of data (Art. 9.1), unless Article 9.2(a) or (g) applies and the appropriate measures referred to in the previous paragraph have been taken.

Data subjects may exercise the above rights by writing to the entity at admin@iaps-association.org, indicating in the subject line the right they wish to exercise, or, if they prefer, by sending their request to the entity’s postal address at Lugar Campus de Elviña, s/n, 15071, A Coruña.

In this regard, the entity will respond to your request as soon as possible, taking into account the deadlines set out in the data protection regulations. Furthermore, it should be noted that the interested party or data subject may at any time file a complaint with the Spanish Data Protection Agency www.aepd.es.

Security

The security measures adopted by the entity are those required in accordance with the provisions of Article 32 of the GDPR. In this regard, the entity, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, has established appropriate technical and organizational measures to ensure a level of security appropriate to the existing risk.

In any case, the entity has implemented sufficient mechanisms to:

  • Ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
  • Restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.
  • Regularly test, evaluate, and assess the effectiveness of the technical and organizational measures implemented to ensure the security of the processing.
  • Pseudonymize and encrypt personal data, where appropriate.

Cookies

A cookie is a file or device that is downloaded to users’ terminal equipment for the purpose of storing data that can be updated and retrieved by the entity responsible for its installation. In other words, it is a file that is downloaded to your computer when you access certain websites. For more information, please see our Cookies Policy.