Privacy Policy

This Privacy Policy governs the processing of the personal data that Robert & Ethel Kennedy Human Rights Center Spain (hereinafter, the "Foundation") carries out in relation to the persons who interact with it through the website https://kennedyhumanrightsspain.org (hereinafter, the "Website"), by email, in person, or by any other means. The Foundation processes personal data in accordance with Regulation (EU) 2016/679, of 27 April, General Data Protection Regulation (GDPR), and with Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

1. Data controller

The controller responsible for the processing of the personal data is:

• Owner: Robert & Ethel Kennedy Human Rights Center Spain (the "Foundation"), a foundation registered in the Register of Foundations under number 2194, subject to Law 50/2002, of 26 December, on Foundations, and to the corresponding Protectorate.
• Tax ID (N.I.F.): G88262068
• Registered office: C/ Velázquez 140, Bajo Izquierda, 28006 Madrid.
• Telephone: +34 915 636 740
• Contact email for data protection matters: [email protected]

2. Purposes and legal basis for processing

The Foundation processes the personal data it collects through the Website, forms, email, or other channels for the following purposes, indicating in each case the legal basis that legitimizes the processing in accordance with article 6 of the GDPR:

• To respond to enquiries, requests for information, and communications submitted through the contact form or by email. Legal basis: the consent of the data subject and, where applicable, the implementation of pre-contractual measures taken at the data subject's request (article 6.1.a and 6.1.b of the GDPR).
• To manage the registration and participation of interested persons in the programs, awards, activities, and events organized by the Foundation, such as the "Bilbao Balioen Hiria" award. Legal basis: the performance of the relationship established with the data subject and/or their consent (article 6.1.b and 6.1.a of the GDPR).
• To manage the donations made to the Foundation, as well as compliance with the associated tax, accounting, and reporting obligations. Legal basis: the performance of the relationship with the donor and compliance with the legal obligations applicable to the Foundation (article 6.1.b and 6.1.c of the GDPR).
• To send communications and information about the activities, campaigns, news, and projects of the Foundation. Legal basis: the consent of the data subject or the legitimate interest of the Foundation in providing information about its activity, the data subject being able to object to this processing at any time (article 6.1.a and 6.1.f of the GDPR).
• To analyze and improve the operation, usability, and security of the Website. Legal basis: the legitimate interest of the Foundation and, in the case of non-essential cookies, the consent of the user in accordance with the Cookie Policy (article 6.1.f and 6.1.a of the GDPR).
• To comply with the legal obligations applicable to the Foundation. Legal basis: compliance with a legal obligation (article 6.1.c of the GDPR).

3. Processing of minors' data

Certain activities, programs, or awards of the Foundation may be aimed at minors. In such cases, the personal data of minors will only be processed when the consent and/or authorization of those who hold parental authority or guardianship is available, in accordance with article 7 of the LOPDGDD. The Foundation will take reasonable measures to verify that such consent or authorization has in fact been granted.

4. Categories of data processed

Depending on the purposes described, the Foundation may process the following categories of personal data:

• Identification and contact data: first name and surname, postal address, postal code, email address, telephone number, and identity document.
• Personal characteristics data: date and place of birth, age, sex, or nationality.
• Social, academic, or professional circumstances data: level of education, position or profession, where necessary for participation in the activities.
• Browsing data: information on the use of the Website, sections visited, and IP address, obtained, where applicable, by means of cookies.
• Financial and banking data: those strictly necessary to manage the donations made to the Foundation.

5. Retention period

Personal data will be kept for as long as the relationship with the interested person is maintained and they do not exercise their right to erasure or, where applicable, withdraw the consent given.

Once that relationship has ended, the data will be kept duly blocked for the limitation periods legally provided for, in order to address any liabilities arising from the processing and to make them available to the competent Public Administrations, Judges and Tribunals, or the Public Prosecutor. Once those periods have elapsed, the Foundation will proceed to erase the data. In the case of processing based on consent for the sending of communications, the data will be kept for as long as the data subject does not revoke that consent or object to its processing.

6. Recipients and disclosures of data

As a general rule, the Foundation does not disclose personal data to third parties, except in the following cases:

• Providers that render services to the Foundation and that, in their capacity as data processors, access personal data for the correct provision of such services (for example, technology, IT, hosting, payment management, or advisory services). Such access is regulated by the corresponding data processing agreements with the appropriate safeguards, in accordance with article 28 of the GDPR.
• Public administrations, authorities, and competent bodies, where there is a legal obligation to disclose the data.

As a general rule, the Foundation does not carry out international transfers of data outside the European Economic Area. Should it be necessary to make an international transfer for the provision of any service, this would be carried out with the appropriate safeguards provided for in Chapter V of the GDPR.

7. Security measures

The Foundation has implemented the appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in order to protect personal data against its alteration, loss, or unauthorized processing or access, taking into account the state of the art, the nature of the data, and the risks to which they are exposed.

8. Rights of data subjects

Data subjects may exercise, under the terms provided for by applicable regulations, the following rights in relation to their personal data:

• Right of access: to know whether the Foundation processes their personal data and, if so, to obtain information about such processing.
• Right to rectification: to request the correction of inaccurate or incomplete data.
• Right to erasure: to request the deletion of the data when, among other reasons, they are no longer necessary for the purposes for which they were collected.
• Right to object: to object to the processing of their data for reasons relating to their particular situation, as well as to processing for the purpose of sending communications.
• Right to restriction of processing: to request that the processing of their data be restricted in the cases legally provided for.
• Right to portability: to receive their data in a structured, commonly used, and machine-readable format, or to request its transmission to another controller.
• Right to withdraw consent given, at any time, without this affecting the lawfulness of the processing prior to its withdrawal.

Data subjects may exercise these rights through any of the following means:

• By written communication addressed to Robert & Ethel Kennedy Human Rights Center Spain, C/ Velázquez 140, Bajo Izquierda, 28006 Madrid.
• By email to the address [email protected].

In both cases, in order to guarantee the security of your data, the Foundation may request that the identity of the person exercising the right be verified by means of a copy of a valid identity document (D.N.I., N.I.E., passport, or equivalent).

Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), with address at C/ Jorge Juan 6, 28001 Madrid, and website www.aepd.es, particularly when they consider that they have not obtained satisfaction in the exercise of their rights.

9. Changes to the Privacy Policy

The Foundation reserves the right to modify this Privacy Policy to adapt it to legislative or case-law developments, as well as to the Foundation's practices. Should substantial modifications be introduced, these will be communicated through the Website or other appropriate means. Data subjects are advised to periodically review the current version of this Policy.