How we protect your data

Data controller

• Organisation: Fundación Acción, Desarrollo y Sostenibilidad
• Tax ID (NIF): G09702531
• Address: Calle Marqués de Monteagudo, 20, local 25, 28028 Madrid, Spain
• Phone: +34 91 411 65 65
• Email for data protection matters: info@adsong.org

Purposes

In accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights, we inform you that, depending on your relationship with us, the Foundation processes the data you give us for some or all of the following purposes:

• To manage your donations and, if you are a member, your regular fees, including collection by direct debit or card.
• To issue donation certificates and file the donations information return (Form 182) with the Spanish Tax Agency.
• To send you our newsletter and news about the Foundation, if you have signed up.
• To answer the questions and requests you send us through the website forms, by email or by phone.
• To communicate with you by WhatsApp when you contact us through that channel. WhatsApp is a third-party service, and the Foundation cannot guarantee the security measures that platform applies.
• To manage the information collected through cookies, as set out in our cookie policy.

How long we keep your data

• Donors and members: for as long as you support us and, after that, for the periods required by law: six years for accounting and tax records, and ten years for the identification data required by anti-money laundering rules.
• Newsletter: until you unsubscribe, which you can do at any time using the link in each email.
• Questions and messages: for as long as needed to deal with them and, at most, one year from the last contact, unless a new relationship with the Foundation begins.

Once these periods end, or if you ask us to delete your data, it will be blocked and kept available only to judges, courts and public authorities for the period in which any liabilities could arise. It will then be deleted.

Legal basis

The legal basis for processing your data is:

• Your consent, for the newsletter, questions, WhatsApp messages and non-essential cookies. You can withdraw it at any time.
• Managing the support you ask to give us as a donor or member.
• Compliance with legal obligations, such as issuing donation certificates, filing Form 182, and meeting accounting and anti-money laundering obligations.

Recipients

We will not share your data with third parties unless required by law. The following may have access to it:

• The Spanish Tax Agency and other public authorities, when required by law.
• The banks and payment providers that process your donations and fees.
• The providers that deliver services to the Foundation and process data on its behalf, under the contract required by law: supporter database management, web hosting, newsletter delivery, administrative, advisory and audit services.

Some of these services, such as WhatsApp or the Google services used on the website (reCAPTCHA and Maps), may involve transfers of data outside the European Economic Area, with the safeguards set out in the General Data Protection Regulation.

Your rights

You have the right to know whether the Foundation is processing personal data about you.

You also have the right to access your personal data, to ask us to correct inaccurate data or, where applicable, to ask us to delete it when, among other reasons, it is no longer needed for the purposes for which it was collected.

In certain circumstances, you may ask us to restrict the processing of your data. In that case, we will only keep it to make or defend legal claims.

In certain circumstances, and for reasons relating to your particular situation, you may object to the processing of your data. The Foundation will then stop processing it, except for compelling legitimate grounds or to make or defend possible legal claims.

You may also exercise your right to data portability and withdraw any consent you have given at any time. This does not affect the lawfulness of processing based on consent before it was withdrawn.

To exercise any of these rights, write to us at info@adsong.org or by post to Calle Marqués de Monteagudo, 20, local 25, 28028 Madrid, Spain, stating which right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for the additional information needed to confirm it.

If you feel we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).