Privacy Policy - Fundación Tomillo

1. PERSON RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

FUNDACIÓN TOMILLO, as Data Controller, in accordance with the provisions of Regulation (EU) 2016/679 of 27 April (RGPD) and O.L. 3/2018 of 5 December on data protection and guarantee of digital rights (LOPDGDD), informs you about the processing carried out through the website and that affect your personal data as we reflect in this Privacy Policy.

In this Privacy Policy we describe how we collect your personal data and why we collect it, what we do with it, who we share it with, how we protect it and your choices regarding the treatment of your personal data.

This Policy applies to the processing of your personal data collected by Tomillo Foundation for the provision of its services. If you agree to the measures in this Policy, you consent to our treatment of your personal data as defined in this Policy.

2. CONTACT

Company name: FUNDACIÓN TOMILLO
NIF: G28979136
Address: Calle Albuñuelas 15, 28041, Madrid
e-mail: protecciondatos@tomillo.org
Data Protection Delegate: The Data Protection Delegate has been appointed before the Spanish Data Protection Agency, whose contact is protecciondatos@tomillo.org.

3. KEY PRINCIPLES

We have always been committed to providing our services with the highest degree of quality, which includes treating your data with security and transparency. Our principles are:

Legality: We will only collect your Personal Data for specified, explicit and legitimate purposes.
Data minimization: We limit the collection of personal data to what is strictly relevant and necessary for the purposes for which it was collected.
Purpose Limitation: We will only collect your personal data for the stated purposes and only according to your wishes.
Accuracy: We will keep your personal information accurate and up to date.
Data Security: We implement appropriate technical and organizational measures commensurate with the risks to ensure that your data is not harmed, such as unauthorized disclosure or access, accidental or unlawful destruction or accidental loss or alteration and any other form of unlawful processing.
Exercise of rights: We have means for you to access or rectify your data when you consider it appropriate.
Retention: We retain your personal data in a lawful and appropriate manner and only for as long as necessary for the purposes for which it was collected.
Third parties: Access and transfer of personal data to third parties are carried out in accordance with applicable laws and regulations and with appropriate contractual safeguards.
Direct Marketing and cookies: We comply with the applicable legislation on advertising and cookies.

4. PURPOSES OF THE PROCESSING OF YOUR PERSONAL DATA

Users of the responsible party’s website

We will process the personal data provided for the following purposes:

Respond to requests, queries, complaints or incidents made through our contact forms included on the website.
Protect and exercise our rights or respond to claims of any nature.
Comply with the legal obligations that are applicable and regulate the activity carried out by Fundación Tomillo.
In case of obtaining consent, send commercial communications relating to projects and services undertaken by Fundación Tomillo, as well as other communications related to the activity developed.

Volunteers

We will process the personal data provided for the following purposes:

Manage the volunteer status and relationship with Tomillo Foundation.
Send communications related to the activities of Fundación Tomillo and manage the participation of volunteers in them.
Respond to requests, queries, complaints or incidents made through our contact forms included on the website.
Protect and exercise our rights or respond to claims of any nature.
Comply with the legal obligations that are applicable and regulate the activity carried out by Fundación Tomillo.

Donors

We will process the personal data provided to:

Manage donations made through the website.
Respond to requests, queries, complaints or incidents made through our contact forms included on the website.
In case of obtaining consent, send commercial communications relating to projects and services undertaken by Fundación Tomillo, as well as other communications related to the activity developed.
Protect and exercise our rights or respond to claims of any nature.
Comply with the legal obligations that are applicable and regulate the activity carried out by Fundación Tomillo.

Partners and collaborators

We will process the personal data provided to:

Manage the relationship established with partners and collaborators committed to Fundación Tomillo.
Respond to requests, queries, complaints or incidents made through our contact forms included on the website.
In case of obtaining consent, send commercial communications relating to projects and services undertaken by Fundación Tomillo, as well as other communications related to the activity developed.
Protect and exercise our rights or respond to claims of any nature.
Comply with the legal obligations that are applicable and regulate the activity carried out by Fundación Tomillo.

Candidates for job offers

We will process the personal data provided to:

Manage applications for Tomillo Foundation job offers.
Send communications regarding the status of the selection process.
If consent is obtained, to send communications regarding new job offers that we may make.
Protect and exercise our rights or respond to claims of any nature.

5. LEGAL BASIS FOR PROCESSING

Users on the responsible party’s website

In the consent given by the person concerned to process their personal data for the purposes indicated.
To comply with the legal obligations that apply to Tomillo Foundation.
Because there is a legitimate interest, in accordance with the provisions of Article 6.1.f) of the RGPD.

Volunteers

In the execution of a contract to which it is a party or application of pre-contractual measures.
In the consent given by the person concerned to process their personal data for the purposes indicated.
To comply with the legal obligations that apply to Tomillo Foundation.
Because there is a legitimate interest, in accordance with the provisions of Article 6.1.f) of the RGPD.

Donors

In the consent given by the person concerned to process their personal data for the purposes indicated.
To comply with the legal obligations that apply to Tomillo Foundation.
Because there is a legitimate interest, in accordance with the provisions of Article 6.1.f) of the RGPD.

Partners and collaborators

Execution of a contract to which it is a party or application of pre-contractual measures.
In the consent given by the person concerned to process their personal data for the purposes indicated.
To comply with the legal obligations that apply to Tomillo Foundation.
Because there is a legitimate interest, in accordance with the provisions of Article 6.1.f) of the RGPD.

Candidates for job offers

In the consent given by the person concerned to process their personal data for the purposes indicated.
To comply with the legal obligations that apply to Tomillo Foundation.
Because there is a legitimate interest, in accordance with the provisions of Article 6.1.f) of the RGPD.

6. COLLECTION AND PROCESSING OF YOUR PERSONAL DATA

The types of data that may be requested and processed are:

Identifying information.
We also automatically collect information about your visit to the Tomillo Foundation website as described in the cookie policy.
Whenever we request your personal data, we will inform you clearly what personal data we collect and for what purpose. In general, we collect and process your personal data for the purpose of:
- To provide information, services, products, relevant information and news in the sector.
- Sending communications.
This site is protected by reCAPTCHA and Google’s privacy policy and terms of service apply.

7. AUTOMATED DECISIONS AND PROFILING

The website does not make automated decisions or create profiles.

8. COMMUNICATION OF PERSONAL DATA

The data may be communicated to other entities related to Tomillo Foundation for the provision of various services as Data Processors, in accordance with the provisions of Article 28 of the RGPD.

Tomillo Foundation will not make any transfer, except by legal obligation.

9. INTERNATIONAL DATA TRANSFERS

No international data transfers will be made.

In the event that international data transfers are necessary, the degree of protection of the destination country will be verified and the guarantees required by the regulations in force will be adopted.

10. YOUR RIGHTS

In connection with the collection and processing of your personal data, you can contact us at any time to:

Access your personal data and any other information indicated in Article 15.1 of the GDPR.
Rectify your personal data that is inaccurate or incomplete in accordance with Article 16 of the GDPR.
Delete your personal data in accordance with Article 17 of the GDPR.
Limit the processing of your personal data in accordance with Article 18 of the GDPR.
Request the portability of your data in accordance with Article 20 of the GDPR.
Oppose the processing of your personal data in accordance with Article 21 of the GDPR.

If you have given your consent for a specific purpose, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on the consent prior to its withdrawal.

You can exercise these rights by sending a reasoned and accredited communication to protecciondatos@tomillo.org.

You also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that the processing does not comply with the regulations in force.

11. DATA RETENTION PERIODS

The personal data provided will be kept for the time necessary to fulfill the purposes for which they were initially collected.

Once the data are no longer necessary for the processing in question, they will be kept in order to, if requested, make them available to the competent Public Administrations and Bodies, Judges and Courts or the Public Prosecutor’s Office, during the statute of limitations period for any actions that may arise from the relationship maintained with the data subject and/or the conservation periods provided for by law.

Below we indicate the periods of conservation of personal data:

Commercial Code: Commercial documents shall be kept for 6 years (Article 30).
General Tax Law: For 4 years to meet tax obligations (articles 66 to 79).
Civil Code: Between 1 and 5 years, in accordance with the provisions of articles 1964.2 and 1968.2.
Law 10/2010, of April 28, 2010, on the prevention of money laundering and the financing of terrorism. The identification of all persons who contribute or receive funds or resources from the foundation free of charge shall be kept for 10 years, in accordance with the provisions of articles 25 and 39 of the aforementioned law.

12. SECURITY

Tomillo Foundation has implemented organizational and technical measures in order to ensure the security of personal data and avoid its alteration, loss, treatment or unauthorized access, not being responsible for any loss, misplacement or manipulation of unauthorized data and beyond the control of the entities associated with the processing of your personal data.

13. LEGAL INFORMATION

The requirements of this Policy supplement, and do not replace, any other requirements existing under applicable data protection regulations, which shall prevail in any event.

This Policy is subject to periodic review and may be modified by Tomillo Foundation at any time. When this occurs, we will notify you of any changes and ask you to re-read the most recent version of our Policy and confirm your acceptance of it.