This Privacy Policy (hereinafter, the "PRIVACY POLICY") regulates, in general, the collection and processing by BASQUE CYBERSECURITY CENTRE (hereinafter, "BCSC") of (i) the personal data that you provide to us as a user of the website accessible through the domain name www.basquecybersecurity.eus/en/ (hereinafter, the "WEBSITE"), including the services available at all times through the WEBSITE; and (ii) other data collected through other collection systems duly identified below. All this without prejudice to the specific provisions established in sections, forms or services available on the WEBSITE in order to provide you with the relevant information and, where appropriate, to obtain your consent.
BCSC reserves the right to modify the PRIVACY POLICY in order to adapt it to new legislative, jurisprudential and/or administrative developments, as well as to the practices developed at any time through the WEBSITE, taking into account your rights and interests at all times.
In any case, BCSC will provide you with the appropriate technical resources so that you may access the PRIVACY POLICY in order to duly comply with the information obligations that we must observe in accordance with the applicable data protection regulations.
1. Who is the person/entity responsible for processing your data?
BCSC (with address for notification purposes in Vitoria-Gasteiz (Álava), P.T. de Álava, C/ Albert Einstein, nº 46, E-7), is a specific unit or area of action within SPRI BASQUE BUSINESS DEVELOPMENT AGENCY, a Public Entity under Private Law, with address in Bilbao (Bizkaia), C/ Alameda Urquijo, nº 36, 4º and with Tax ID number Q-4800789-B which, through BCSC, promotes and develops cybersecurity culture among the Basque society, boosts economic activity related to the application of cybersecurity and seeks to strengthen the professional sector.
Through the following link you will find the Register of Processing Activities (RAT - Registro de Actividades de los Tratamientos) that BCSC carries out in its capacity as Responsible person/entity.
In this document you will be able to identify the detailed description of all data processing, as well as the category of data processed, the applicable legal basis, the intended communications, the applicable storage period and other information relevant to all processing activity.
In compliance with the provisions of the applicable regulations on data protection, we have appointed a Data Protection Officer (DPO), responsible for the management and control of privacy in BCSC and whom you can contact through the email address dpd@spri.eus.
For any matter related to the PRIVACY POLICY and/or the processing of your personal data, you can contact our DPO or us directly by writing to the postal address indicated above and/or via the following e-mail address: lopd@spri.eus.
2. How did we obtain your data?
The data we process at BCSC have been obtained from you, through (i) the different forms you fill in while browsing the WEBSITE and/or other channels (e.g. registration as a WEBSITE user -when applicable-, contact forms, forms referring to job offers and/or selection processes, registration forms for activities, events or projects organised or led by BCSC, etc.); (ii) by sending an email inquiry.
In the event that the personal data provided belong to a third party, you guarantee that you have informed such third party of the PRIVACY POLICY and have obtained their authorisation to provide their data to BCSC for the purposes set forth below.
Additionally, we inform you of the possible processing of your social network data through the corporate profiles that BCSC maintains available on each social network on which it is present, all under the terms and conditions established on each social network.
3. What type of data do we process?
In general, the data that we process at BCSC are those that you have provided us with while browsing the WEBSITE, through the appropriate forms that we use to formalise our contact with you and/or via email, as well as those others that, if applicable, we obtain through BCSC's corporate profiles on the social networks on which we are present.
In particular, BCSC processes the following categories of data:
- Identification and contact data (name, surname, ID number, postal and email address, telephone number, etc.).
- Professional data (company in which you perform your functions, position and functions, professional postal and email address, and professional telephone number) when (i) you provide them through the forms related to activities, events and projects organised or led by BCSC, etc.; and (ii) they are necessary for your business location and/or for the maintenance of our business relationship with you or your entity.
- Codes and identification keys as a registered user of the WEBSITE and/or of the applications accessible through it.
- Internet browsing data (e.g. IP address, web page visits, Wi-Fi network connections, etc.).
4. For what purpose do we process your data and under what legal basis?
Without prejudice to what is specifically indicated in the Register of Processing Activities available through the PRIVACY POLICY, in general, the processing of your personal data pursues the following purposes:
- To manage and process your registration as a user of the WEBSITE, when possible, and on the basis of your request for pre-contractual measures or the contractual relationship established with you in this regard.
- To manage your access and use of the contents and services that BCSC makes available to you through the WEBSITE, including blog services, social networks or any other functionalities that may be accessible from the WEBSITE at all times, and on the basis of your request for pre-contractual measures or the contractual relationship established with you in this regard.
- To process and manage the contracting of products or services that you may formalise with BCSC through the WEBSITE and/or by other means and, in general, to maintain, manage and control the contractual relationship that you establish with us as purchaser of our products or services, all on the basis of your request for pre-contractual measures or the contractual relationship established with you in this regard.
- To process and manage your request for participation in the activities, events and/or projects organised or led by BCSC, as well as your subsequent participation in these, all on the basis of your request for pre-contractual measures or the contractual relationship established with you in this regard.
- In cases where you have consented, and on the basis of such consent, to manage and disseminate activities and events organised by BCSC in which you have voluntarily participated.
- To process and manage the request for information, suggestions, complaints or claims that you make through the WEBSITE or email, and on the basis of your request for pre-contractual measures or the contractual relationship established with you.
- To send you by various means, including electronic means, communications and documentation relating to BCSC and its activities, provided that you have consented and on the basis of such consent.
- To manage your subscription to our service "Boletín de Alertas de Seguridad" and the sending of the corresponding electronic communications, provided that you have consented and on the basis of such consent.
Additionally, you will find detailed information on each kind of data processing on each of the online forms for collecting personal data available on the WEBSITE.
We remind you that, at any time, in cases where the processing is based on your consent, you may revoke it freely and free of charge, under the terms indicated in Section 7 below.
5. To whom do we communicate your data?
Apart from those cases in which BCSC is obliged to do so by law (e.g. Tax Administrations, Justice Administration or other Public Administrations or authorities), your data will not be communicated to third parties.
There are also no plans for international transfers of your personal data.
6. How long will we keep your data?
Without prejudice to what is specifically indicated in the Register of Processing Activities available through the PRIVACY POLICY, in general, personal data will be kept (i) as long as they are necessary for the purpose for which they were collected; and (ii) as long as you do not revoke your consent to the processing, upon legal basis, or request their deletion at an earlier time; as well as (iii) the additional time necessary to comply with the legal obligations that BCSC must observe.
In any case, we inform you that BCSC has established internal data purification policies aimed at controlling the retention periods of the personal data in its possession, so that they may be deleted when they are no longer necessary and/or appropriate for the purpose for which they were collected.
7. What are your rights?
The applicable data protection regulations grant you a number of rights relating to your personal data that you may exercise during the processing of your personal data. These rights are as follows:
- Access to your data: you have the right to access your data to find out what personal data concerning you we are processing.
- Request the rectification or deletion of your data: under certain circumstances, you have the right to rectify any inaccurate personal data concerning you that are subject to processing by us, or even request their deletion when, among other reasons, the data are no longer necessary for the purposes for which they were collected.
- Request the limitation of the processing of your data: under certain circumstances, you have the right to request the limitation of the processing of your data, in which case we inform you that we will only keep them for exercising or defending claims as set forth in the applicable regulations on data protection.
- The portability of your data: under certain circumstances, you have the right to receive the personal data concerning you, and which you have provided to us, in a structured, common use and mechanical reading format, and transfer them to another data controller.
- Objection to the processing of your data: under certain circumstances and for reasons related to your individual situation, you have the right to object to the processing of your data, in which case, we would stop processing them unless there are compelling legitimate reasons or they are needed to exercise or defend possible claims for which they must be conserved.
You also have the right to withdraw consent at any time, without affecting the legality of the processing based on the consent given prior to its withdrawal.
You may exercise these rights by sending a written request to BCSC at the postal address indicated in Section 1 or by sending an email to lopd@spri.eus.
Finally, we inform that you can file a claim with the competent Controlling Authority (in the case of BCSC, the Basque Data Protection Agency), especially when you have not obtained satisfaction in the exercise of your rights. You can contact this Authority through the following website: www.avpd.euskadi.eus.
8. Security measures
BCSC shall treat your data at all times in an absolutely confidential manner and shall keep the mandatory duty of secrecy with respect to them, in accordance with the provisions of the applicable regulations on data protection, adopting for this purpose the necessary technical and organisational measures to guarantee the security of your data and prevent its alteration, loss, processing or unauthorised access, taking into account the state of the technology, the nature of the data stored and the risks to which they are exposed.
9. Cookie policy
Additionally, please note that BCSC has established a Cookie Policy, which is accessible through the following link