Sociedad Mercantil Estatal de Acción Cultural, S.A. (hereinafter referred to as “AC/E”) complies in processing the personal data of its stakeholders with the legislation currently in effect in Spain and in the European Union, in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as “GDPR”) and Organic Law 3/2018 of 5 December on Personal Data Protection and guaranteeing digital rights (hereinafter referred to as “LOPDGDD”). To that end, it adopts the technical and organizational measures necessary to guarantee the security of personal data and to prevent the loss, misuse, alteration, unauthorised access and theft of the personal data provided, given the state of the technology, nature of the data and risks they may be exposed to, all in compliance with the applicable legislation.

Who is responsible for processing the personal data?

Sociedad Mercantil Estatal de Acción Cultural, S.A. – Tax ID: A-81553521

Address: Calle José Abascal 4, 4º B, 28003 Madrid

Email: info@accioncultural.es

Tel.: +34 917 004 000

Data Protection Officer:  Castañeda Abogados, S.L.

dpo@castaneda-abogados.com

+34 915 233 230

What data do we collect and why?

AC/E will process only the personal data deemed adequate, pertinent and limited to what is necessary with regard to the reasons for which they are processed. In this sense, stakeholders may provide AC/E with personal data, through the different procedures established for that purpose, to be processed for the following purposes, as long as the stakeholder has provided their specific, informed and unequivocal consent:

1. Contact

AC/E will process the personal data of the stakeholders to manage, process and respond to requests for information, suggestions, claims and any other communication conducted through visits, forms, social media, email or by phone. For this purpose, AC/E may access identifying data, contact details and the voice of the stakeholders.

1. Communications

AC/E will process the personal data of the stakeholders for the purpose of managing communications in general within the scope of the company and, in particular, to send information, catalogues, books and more. For this purpose, AC/E may access identifying data, contact details, commercial information and economic and financial data the stakeholders.

1. Event organisation

AC/E will process the personal data of the stakeholders for the purpose of processing invitations to workshops, events, exhibitions, as well as to send information related to the same. For this purpose, AC/E may access identifying data, contact details, employment details and commercial information of the stakeholders.

1. Artists and presentation of cultural works

AC/E will process the personal data of the stakeholders in order to manage relationships with artists and providers of works within the framework of AC/E’s activity. To this end, AC/EE may access stakeholders’ identifying data, personal data, academic and professional data, employment details, commercial information, economic financial and insurance data and data on transactions of goods and services.

1. Newsletter

AC/E will process the personal data of the stakeholders in order to manage this subscription to AC/E’s newsletter. For this purpose, AC/E may access identifying data and contact details of the stakeholders.

1. Photo and video gallery

AC/E will process the personal data of the stakeholders in order to inform site users about events, interviews and other current events. For this purpose, AC/E may access identifying data and image of the stakeholders.

What is the legitimacy for processing the personal data?

The legal basis for processing or accessing the stakeholders’ personal data is as follows:

• Consent: contact, communication, newsletter, photo and video gallery.
• Undertaking a contract: organization of events, artists and presentations of cultural works.

Furthermore, as it is a state mercantile company, AC/E may process personal data in exercising any governmental authority granted to it.

How long do we keep the personal data?

The personal data shall be kept as long as necessary to fulfil the purpose for which they were collected; in particular:

• When the legitimacy basis is the existence of a contractual relationship, AC/E shall keep the personal data for the duration of said relationship and, once it is over, for the amount of time establish legally for the defence or claim of liabilities deriving from the contracts
• When the legitimacy basis is the consent of the stakeholder, AC/E shall keep the personal data as long as consent is not withdrawn.
• When the legitimacy basis is the legitimate interest of AC/E, AC/E shall keep the personal data as long as said interest remains or prevails over the rights and fundamental freedoms of the stakeholder.
• When the legitimacy basis is fulfilment of omission of public interest or in the exercise of governmental authority, as long as said interest remains in place.

Who are the recipients of the personal data?

Insofar as one of the primary aims of the activity carried out by AC/E is the promotion of cultural activities conducted by Spanish creators around the world, collaborating in doing so with foreign institutions, artists’ and collaborators’ details may be transferred internationally to countries outside of the European Economic Area, such as, for example, to the United Arab Emirates within the context of EXPO DUBAI 2020. Said transfer will be necessary to enter into or undertake a contract, in the interest of the stakeholder.

AC/E may only transfer personal data in cases not set forth in the paragraph above if specific, informed and unequivocal consent has been obtained from the stakeholders, except as imposed by a legal obligation or when in defence of its rights and interests, as long as they prevail over the rights of the stakeholders.

You are likewise informed that third parties may process stakeholders’ personal data on behalf of AC/E to provide requested services. These third parties are considered responsible for processing and offer sufficient guarantees in the application of appropriate technical and organizational measures to comply with the GDPR and the LOPDGDD.

What are your rights when you provide us with your data?

• Right of access: stakeholders have the right to obtain confirmation regarding whether AC/E processes data related to them and, if they do, to access those data. They will likewise have the right to obtain a copy of the data.
• Right of rectification: stakeholders have the right to request the rectification of inaccurate personal data related to them.
• Right of elimination (including the right to be forgotten): stakeholders have the right to request the elimination of their data, online or permanently, when, among other reasons, the data are no longer appropriate, necessary or pertinent to the purposes for which they were collected.
• Right of opposition: stakeholders have the right to oppose the processing of their personal data, for reasons related to their specific situation. In that case, AC/E will cease to process the data, unless there are urgent legitimate reasons, or to formulate, exercise or defend against claims.
• Right to the limitation of processing: stakeholders, under certain conditions, may request the limitation of processing their data, in which case AC/E may only process them, with the exception of their preservation, to exercise or defend against claims, to protect the rights of third parties or for reasons of public interest.
• Right of data portability: stakeholders have the right to receive or, when appropriate, have AC/E provide to third parties their personal data in a structured, commonly used and machine-readable format, as long as the processing is based on the consent of the stakeholders and is done by automated means.

Stakeholders may exercise their rights of access, rectification, elimination, opposition, limitation and portability by sending a letter to Calle José Abascal 4, 4º B, 28003 Madrid or an email to info@accioncultural.es, including a photocopy of their “DNI” or other identification document.

AC/E is committed to responding to all requests within the period established by applicable legislation.

Likewise, stakeholders may request the protection of the Spanish Data Protection Agency (AEPD), the contact details of which are available on the website www.aepd.es 

IP addresses, links and cookies

Due to the communication protocols that exist on the Internet, when stakeholders visit our website, AC/E automatically receives the IP (Internet Protocol) addressed assigned to their computer by the Access Provider. The IP address is recorded for internal use only, such as for statistical information on web access. In general, the IP address for one user is different from an Internet connection to another, so it is not possible to track browsing habits through the site by a particular user.

This website contains links to other websites. The user should be aware that AC/E is not responsible for the privacy practices or content of those other websites. We ask that stakeholders understand that by using any of these links, they are leaving our website and should carefully read the privacy policies of those other sites that collect personal data.

AC/E may use cookies when a user browses its website and pages in order to optimise the browsing experience. For more information on cookies, see our cookie policy.