Privacy Policy and Data Protection rights
Asociación Obreal Global Observatory (hereafter “Obreal”) is committed to protecting your personal data and respecting your privacy. For this reason, information relating to members, project contributors, employees, experts, partners, event participants, event organisers, newsletter recipients and persons that contact it or which it contacts on an ad hoc basis, for the purposes of running the organisation and other persons associated with it, is handled in accordance with applicable law.
Obreal collects and/or processes data, as defined by the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereafter “GDPR”), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”). Other legislation may also apply to specific processing activities, including Law 34/2002 on Information Society Services and Electronic Commerce (“LSSI”) in relation to electronic communications and cookies.
This Privacy Policy explains the reason for the processing of your personal data, the way we collect, handle and protect personal data, how that information is used and what rights you have in relation to your personal data. It also specifies the contact details of the Data Controller with whom you may exercise your rights.
Asociación Obreal Global Observatory (Obreal)
Address: Calle Adolf Florensa, 8
08028 Barcelona, Spain
VAT ESG63719926
E-mail address: info@obreal.org
Visitors can normally use our website without entering personal data. In some cases, if a visitor decides to provide us with personal information, or other information through e-mail or a registration form, Obreal will store and use the visitor’s information only for the intended purpose. This data is deleted when it is no longer required for that purpose, subject to any applicable retention requirements.
Obreal may collect and process the following categories of personal data:
- Contact details, including name, surname, e-mail address, telephone number and postal address, where necessary.
- Professional information, such as organisation, institution, position, country and professional profile.
- Information you provide when registering for or participating in Obreal projects, activities or events.
- Technical information generated when you use our website, in accordance with our Cookie Policy.
- Communications between the user and Obreal.
- Photographs, video and audio recordings in connection with events and activities, where applicable.
- Information provided through surveys, evaluations or other forms connected with our activities.
- Other information required for a specific project or activity, where you are informed about the relevant processing when the information is collected.
For certain activities, Obreal may need to collect additional personal data. We will only request information that is necessary for the specific purpose and will provide appropriate information about its processing at the time it is collected.
Where special categories of personal data are required for a specific purpose, they will only be collected where necessary and where an appropriate legal basis under the GDPR applies.
Our website collects certain information by automated means when you visit us. This information does not reveal your specific identity (such as your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, approximate location, information about how and when you use our website and other technical information.
Non-essential cookies or similar technologies will only be used in accordance with the applicable consent requirements. This information is primarily needed to maintain the security and operation of our website and, where applicable and permitted by law, for analytics purposes.
Obreal processes personal data only for specific and legitimate purposes and where there is an appropriate legal basis under the GDPR and/or your consent. The legal basis depends on the purpose and circumstances of the processing.
We may process personal data to:
- respond to enquiries, requests and communications;
- send you Obreal communications and invitations. You can opt out of our communication emails at any time (see the “What are your data protection rights?” below);
- manage participation in Obreal projects, programmes, networks, events and other activities, including their organisation and logistics;
manage payments, reimbursements and other administrative or financial requirements where applicable; - inform you about themes of interest to Obreal and provide information about activities and events through our newsletter. The newsletter is sent by e-mail only when you register for it through our website or through a link in an e-mail message;
- comply with legal, contractual, audit, funding and reporting obligations; and
- maintain the security and proper operation of our website and information systems.
Depending on the activity, the legal basis for processing may be the performance of a contract or requested activity, compliance with a legal obligation, Obreal’s legitimate interests or your consent.
Where Obreal relies on legitimate interests, we take into account the interests, rights and reasonable expectations of the individuals concerned.
Where consent is required, it will be requested specifically for the relevant processing activity. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Operational communications relating to an event, project, contract or other existing relationship do not depend on consent to receive a newsletter or other optional promotional communications.
If we plan to use the personal information that you provide to us for other purposes beyond those described above, we will provide you with information about that processing at the time of collection or before carrying out the new processing, where required.
We collect your information directly from you when you fill out a form or participate in a Obreal event or activity, contact us, subscribe to communications or otherwise provide information to us.
We get technical details from the devices you use to access our website and from cookies.
Personal data are only shared where this is necessary for the relevant purpose or where required by law.
Depending on the activity, recipients may include authorised Obreal staff and collaborators, project partners, organisations involved in the relevant activity, funding bodies or public authorities, and service providers supporting Obreal’s activities.
Service providers acting on behalf of Obreal are required to process personal data in accordance with applicable data protection requirements and, where required, appropriate data processing arrangements are put in place.
More specific information about recipients may be provided in the privacy notice relating to a particular project, event or activity.
Because Obreal works internationally, some activities may involve the transfer of personal data to, or access to personal data from, countries outside the European Economic Area (EEA).
Where such a transfer takes place, Obreal will ensure that an appropriate mechanism under the GDPR is used. This may include a European Commission adequacy decision, appropriate safeguards such as Standard Contractual Clauses, or another mechanism permitted by the GDPR.
The specific privacy notice for an activity may provide additional information where an international transfer is relevant to that processing. Further information about safeguards relating to a particular transfer may be requested from Obreal.
We keep your personal information only for as long as necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law or by applicable legal or contractual retention requirements. Personal data will not be kept for longer than necessary for the purpose for which they were collected, subject to any applicable legal or contractual retention requirements.
Where appropriate, a specific privacy notice will provide more detailed information about the retention period applicable to a particular processing activity.
Once personal data are no longer required, they will be deleted, anonymised or otherwise securely disposed of, as appropriate.
Like many companies, our websites may use cookies. Cookies are small text files that the visitor’s internet browser downloads and stores on the visitor’s computer/device. Cookies are used to improve the website and services. Some cookies are necessary for the website to operate, while others may be used for purposes such as preferences or analytics.
Cookies that require consent will only be used after the appropriate consent has been obtained. Users will be able to accept or reject non-essential cookies and to change or withdraw their preferences.
In most cases, session cookies are deleted once the visitor leaves the website. Cookies may contain information that allows the visitor or device to be recognised during use of the website and ensures that certain information is retained while the website is being used.
More detailed information about the cookies used by Obreal, their purposes and how users can manage their preferences is provided in our Cookie Policy.
Obreal’s website and activities are generally directed at professional and higher education audiences.
Where consent is relied upon for the processing of children’s personal data, the applicable rules regarding the capacity of minors to provide consent will be respected.
We do not knowingly collect data from or market to children under 18 years of age. If you become aware of any data we have collected from children under the age of 18, please contact us at info@obreal.org
As a data subject, you have rights concerning your personal data, including access, rectification, erasure, restriction of processing, objection, data portability, withdrawal of consent where applicable, and the right to lodge a complaint with a supervisory authority.
Your principal rights under data protection law are:
- (a) the right to access – you can ask for copies of your personal data;
- (b) the right to rectification – you can ask us to rectify inaccurate personal data and to complete incomplete personal data;
- (c) the right to erasure – you can ask us to erase your personal data where the legal requirements are met;
- (d) the right to restrict processing – you can ask us to restrict the processing of your personal data;
- (e) the right to object to processing – you can object to the processing of your personal data;
- (f) the right to data portability – you can ask that we transfer your personal data to another organisation or to you;
- (g) the right to complain to a supervisory authority – you can complain about our processing of your personal data; and
- (h) the right to withdraw consent – to the extent that the legal basis of our processing of your personal data is consent, you can withdraw that consent.
Where applicable, you also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
You may exercise your right to withdraw your consent by contacting the Data Controller by sending an email to info@obreal.org
You also have the right to lodge a complaint with the Spanish Data Protection Agency via its website www.aepd.es.
Obreal has taken appropriate organisational and technical measures to ensure a level of security adapted to the risk, to the extent possible, to prevent:
– unauthorised access to or modification of personal data;
– improper use or disclosure of such data;
– unlawful destruction or accidental loss of such data.
In this respect, all employees of Obreal who have access to personal data are subject to a strict confidentiality obligation.
Obreal follows the organic Spanish law of Data Protection and Guarantee of Digital Rights 3/2018 on the protection of personal data and guarantee of digital rights, which develops those aspects that the European Data Protection Regulation (GDPR) allows to be adapted and regulated by national legislation.
This policy applies to both data collected and held electronically (including photographs, video and audio recordings) and data collected and held as hard copy or paper files. Obreal regularly reviews the organisational and technical measures used to protect personal data and adapts them where appropriate to the nature of the processing and the risks involved.
The devices and computers used by Obreal for the storage and processing of personal data are regularly updated. In computers and devices where automated processing of personal data is performed a business antivirus system and cloud service encrypted using the Advanced Encryption Standard (AES) and with Secure Sockets Layer (SSL)/Transport Layer Security (TLS) technology to protect data that ensures as far as possible the theft and destruction of information and personal data. The anti-virus system and cloud services are periodically updated.
In order to avoid undue remote access to personal data, the existence of an activated and correctly configured firewall in Obreal computers and devices where the storage and/or processing of personal data takes place are installed. Obreal guarantees the existence of passwords for access to personal data stored in electronic systems. The access to personal data is strictly restricted to Obreal staff.
When it is necessary to transfer personal data outside the premises where it is processed, whether by physical or electronic means, an encryption method will be used to guarantee the confidentiality of the personal data in the event of improper access to the information.
The security measures are reviewed periodically; the review is carried out by automatic mechanisms (software or computer programs) or manually by Obreal staff.
This Privacy Policy provides general information about the way Obreal processes personal data.
Where a particular activity requires additional or more specific processing — for example, an event registration, travel arrangements, a reimbursement, recruitment, a survey or a project-specific activity — Obreal may provide a separate privacy notice explaining the relevant purpose, legal basis, data involved, recipients, international transfers and retention period.
These notices should be read together with this Privacy Policy.
Obreal is committed to reviewing its data policies regularly.
This Privacy Policy may be updated to reflect changes in legislation, regulatory guidance, Obreal’s activities or the way personal data are processed. The date of the most recent revision will be indicated at the beginning of the policy.
Where a change materially affects an existing processing activity, additional information will be provided where required by law.
Obreal is grateful to be notified of any potential ways of improving its data protection practices.
Questions relating to privacy or the processing of personal data may be sent to dpo@obreal.org.