Privacy policy

At FUNDACIÓN BILBAO ARTE FUNDAZIOA, we are committed to the protection of privacy and the correct use of the personal data that we process and that you provide to us, both online on this website and, where appropriate, any of its subdomains, microsites, as well as off-line.

Please read this policy carefully and make sure you understand and agree with it before providing us with your personal data. If you do not agree with it, please do not use this web site or its services or provide us with your personal information.

By accessing this site, using any of its services or providing us with your data, whether online or offline, we will take this as a clear affirmative action by which you give us your consent (where required) to process your data for the purposes set out below.

who is responsible for the processing of your data?

BILBAO ARTE FUNDAZIOA FOUNDATION

Postal Address: Calle Urazurrutia, 32 – 48003 Bilbao

E-mail: bilbaoarte@bilbao.eus

Telephone: 944 155 097

If you have any doubt, complaint or claim about the treatment of your data, you can raise it directly to the FUNDACIÓN BILBAO ARTE FUNDAZIOA before, if necessary, raising it before the Data Protection Agency. We will respond as soon as possible and in any case within a maximum of two months from receipt of the complaint.

 how did we obtain your data?

• Obtaining from the interested person himself/herself.

If you are a user, intern, participant or user of our website, you have provided them, either offline or online, when requesting our products or services, or contacting us for information.  Also, you have been able to provide us in person, if you have come to our facilities.

By providing us with your information, you warrant that you are authorized to do so, and that the information is accurate, up to date, and does not violate any contractual restrictions or third party rights. You are responsible for keeping your data updated, and FUNDACIÓN BILBAO ARTE FUNDAZIOA declines all responsibility in case of not doing so. You agree not to impersonate other users by using their registration data for the different services and/or contents of the website.

• Obtained automatically when visiting our website:

When you visit our website or any other of our platforms (social networks…), we collect information through cookies and other tracking and web analytics technologies.  This means that data is sent from your browser to our servers to optimize our services and improve your user experience. This data may be automatically collected and stored by us or by third parties on our behalf.  You can consult our cookie policy.

what types of data we process?

The categories of data we process may be:

o Obtained from the person concerned: identification data (name and surname, NIF), contact data (telephone, postal address, email address), economic data (those necessary for the payment of the aid: bank).

o Obtained automatically when visiting our website: the user’s IP address, the date and time of the visit, the URL of the site from which the user came, the pages visited on our website, information about the browser used (browser type and version, operating system, etc.).

Regarding data with special protection: We do not process special categories of data.

what do we process your data for?

The data you provide us, as well as all the data generated during the development of the relationship we have with you, may be used for different purposes:

• If you are a current or potential user: to maintain contact and communication with you and manage the existing relationship between the parties as well as inform you of the ordinary activity of the organization.
• If you are a user of our website, or sender or recipient of an email: to manage the requests you make to us online, and to contact you.
• If you are an intern: to maintain contact and communication with you and to manage the existing relationship between the parties as well as to inform you of the ordinary activities of the organization.
• If you are a visitor to our facilities: to manage access and visitor control.
• If you are a user of our complaints channel: to process and investigate the complaint filed.
• If you provide us with your curriculum: to contact you and manage the selection processes that we carry out. In this case, it is mandatory that you accept the privacy policy, marking the field provided for this purpose. If you do not give your consent, we will not be able to take your resume into account.
• If you are a participant in activities or events that we may promote or organize: to manage the registration and/or participation in such activities, as well as to maintain contact and communication with you,
• If you are a speaker at our activities, events or trainings: to maintain contact and relationship with you, as well as to report your professional curriculum and your image, in the activities we organize. We may publish such data both on our website and other platforms, as well as in the paper documentation related to such activities.
• Taking images: we also inform you that, in the activities or events, photographs or videos may be taken to inform and publicize the activity, as well as to document it and be part of the audiovisual memory of the organization.

Such content may be published both on the internet (on this website, on the website of the event promoter, on our social media profiles and online platforms…), and on paper (reports, brochures, programs, magazines, advertising or informative posters and other stationery…), as well as on the organization’s own premises.

In the corresponding form, we have requested your express consent for this processing. In case you do not want your image to be disseminated, please let us know in a personalized way to our email (bilbaoarte@bilbao.eus), in order to attend your request preferably. Likewise, we recommend that you pay attention to the activities or events, and try not to stand in the front rows or in front of the cameras, if you do not want to be recognized in the images.

Notwithstanding the foregoing, you may in any case oppose the elaboration of the aforementioned profile by exercising the right of opposition as indicated below in the section on the exercise of rights or by indicating it to us at bilbaoarte@bilbao.eus.

• To send you, by means of electronic communications, information about our activities and/or services similar to those requested, including advertising and/or commercial communications for the purposes of art.21 LSSICE 34/2002. If we already have a previous contractual relationship, such communications will be sent on the basis of our legitimate interest. In the case of not having a previous contractual relationship, we will only send you these types of communications if you authorize us to do so by marking the option expressly included for this purpose in the corresponding forms. The electronic communications that we send you will include, in the communication itself, the option to stop receiving them. If you opt out, we will stop sending you these types of communications in the future.
• To transfer your data to other companies or entities, directly related to FUNDACIÓN BILBAO ARTE FUNDAZIOA, in order to provide you with the service or product you have requested, and the administrative-accounting management required for such provision. Specifically, we may communicate your data to the recipients listed in the specific section that you will find below in this policy

• table summarizing the purposes and their legal basis

The data you provide us, as well as all the data generated during the development of the relationship we have with you, can be processed for different purposes and with different legitimate bases

how long will we keep your data?

General conservation period

We will keep the personal data you provide for as long as the contractual, pre-contractual or commercial relationship is maintained and, once these are terminated, as long as the person concerned does not request their deletion. Even if the deletion is requested, we may keep them for the necessary time and limiting its treatment, only for:

• Comply with legal/contractual obligations to which we are subject,
• and/or during the legal periods foreseen for the prescription of any liability on our part
• and/or the exercise or defense of claims arising from the relationship with the person concerned.

In coordination with the above criteria, the deletion of personal data either in computer records or on paper, may be carried out, at the discretion of the organization, depending on logistical needs and / or storage space that make it advisable to delete information or documentation.

• Specific conservation periods

• If you have applied for a job by submitting your resume: we will keep it until you request its deletion/ during the term of its validity, in order to contact you for selection processes.
• In the case of complaints made through the complaints channel: the data of the person making the communication and of the employees or third parties appearing in the complaint will be kept in the complaints system only for the time necessary to decide whether to initiate an investigation into the facts reported.

 In any case, after three months have elapsed since the data were entered, they will be deleted from the reporting system, unless the purpose of the storage is to leave evidence of the functioning of the model for the prevention of the commission of crimes by the legal person. Complaints that have not been followed up may only be recorded in anonymized form. Once this period of 3 months has elapsed, the data may continue to be processed by the body responsible, in accordance with section 2 of article 24 LOPDGDD, for the investigation of the reported facts, but will not be kept in the internal complaints information system itself.

to which recipients may we disclose your data?

We inform you that the data you provide may be communicated to third parties for the fulfillment of purposes directly related to legitimate functions of transferor and transferee as:

1. To banking entities: for the management of collections and payments.
2. To entities or organizations to which there is a legal obligation to communicate data: for example, the Tax Administration or Courts and Tribunals in the case of complaints filed through the internal information system.
3. To the Executive Service of the Commission for the Prevention of Money Laundering and Monetary Infractions to report suspicious transactions, as obligated parties
4. To insurance companies: for management and civil liability insurance.
5. If you are a participant in any of our contests, the data of the winners will be communicated to the companies in charge of providing the prize.
6. For publication of your image in RRSS in which the entity has a profile.

international data transfers

At FUNDACIÓN BILBAO ARTE FUNDAZIOA, we will ensure that personal data is always processed and located in the European Economic Area. However, in certain circumstances, we may make international transfers of data, for example, if it is necessary for the conclusion or performance of a contract, in the interest of the data subject, between FUNDACIÓN BILBAO ARTE FUNDAZIOA and another natural or legal person; or in case it is necessary for the performance of a contract between the data subject and FUNDACIÓN BILBAO ARTE FUNDAZIOA for example when using service providers located outside the European Union, who may have access to personal data, for the provision of services ancillary to our activity (hosting, housing, SaaS, remote backups, computer support or maintenance services, e-mail managers, sending e-mails and e-mail marketing, file transfer, etc …. ) or for the execution of pre-contractual measures taken at the request of the data subject.

These entities may be different and vary over time, but we will try to choose entities either belonging to countries that have a level of protection equivalent to the European level of data protection, or that have the appropriate guarantees to achieve that level, or on the basis of one of the exceptions provided for in the RGPD.

We currently work with the following entities or categories of entities from the following countries:

• A Use Google Work Space (country: USA): we use their virtual cloud infrastructure for backup purposes.
• MAILCHIP (country: USA): management program for mass mailings of e-mails, newsletters, bulletins, etc.

 social networks and instant messaging applications

• Use of social networks
  • Users have the opportunity to join the pages or groups that the organization has in different social networks. They should note that, unless the organization requests their data directly (e.g., to answer queries in a private setting), their data will belong to the relevant Social Network. Therefore, users are advised to carefully read the terms and conditions of use and privacy policies of the relevant Social Network, as well as to make sure to configure their preferences regarding the processing of their data.
  • Características Social Networking Features incorporated in our website
    Our services may include certain Social Media features and widgets, such as “Connect to Facebook” connectors, the “Like” button, the “Share” button or other common social media interactive mini-programs.  We are not responsible for the proper functioning of these
  • Rules for the use of social networks:

Please note that if you decide to participate, publish or share content through our official page on a social network, such content will be public, and it will be your sole responsibility that such content complies with legal regulations.

You can prevent your personal data associated with such participation from appearing by configuring your privacy settings, or by pseudonymizing your data (e.g.: using a “Nick” or “alias”).

We remind you that, with respect to other people’s data, you must respect their privacy, taking special care when communicating or publishing their personal data. Only the owner can authorize the processing of their personal data.

The user may only publish on this page, or on our official page on social networks, personal data, photographs and information or other content whose ownership and property belong to him/her or in respect of which he/she has the authorization of third parties. If you provide us with or publish data of third parties, it is your responsibility to have their prior and express consent to use, communicate and publish them, and it is your responsibility to inform them of the processing of their data by us or their publication by you. The publication of third parties’ data without their consent may infringe, in addition to data protection regulations, those relating to the right to honor, privacy or self-image of such third parties.

In any case, we may remove from both this website and our pages on social networks, any content posted by the user when we detect that it has violated the law, and as indicated in this privacy policy.

Social Networks are not hosted directly on our Services. Your interactions with them are governed by their policies and not ours. Please read the privacy policies of these social networks for detailed information on the collection and transfer of personal data, your rights and privacy settings.

Data we collect through social networks

We collect data through these applications, and in particular, through functional and analytical cookies to enable them to function properly.  These cookies may collect information about your IP address, or your browsing.

In addition, if you log in to one of these social networks during your visit to one of our websites or mobile applications, the social network may add that information to your profile and that information will be transferred to the social network. If you do not want this data transfer to take place, please log out of your session on the social network before entering our websites or mobile applications, as it is not in our power to influence this collection and transfer of data through social connectors.

Display of other third party sites within our website

Likewise, through our website, we can offer content or services of third parties (using framing techniques), preserving the appearance of our website, and showing within it the appearance of the third party providing the service. Please note that the information you provide will be supplied to these third parties, and not to us, so the policies of such third parties will govern and not ours.

what are your rights when you provide us with your data?

You can, where appropriate, exercise your rights of access, rectification, deletion, limitation and opposition to their treatment, as well as other rights, at the postal or email address indicated at the beginning of this privacy policy; in both cases by written and signed request attaching a copy of your ID card or passport or other valid document that identifies you. In case of modification of your data you must notify it at the same address, declining this entity any responsibility in case of not doing so.

• Right of access: You can ask us what personal data we are processing and even request a copy of it.
• Right of rectification: You can ask us to rectify inaccurate personal data or to complete incomplete personal data, including by means of an additional declaration.
• Right to erasure (right to be forgotten): You can ask us to delete your personal data when: it is no longer necessary for the purposes for which it was collected, you withdraw your consent, there has been unlawful processing of the data or in compliance with a legal obligation.
• Right to limitation of processing: You can ask us to limit the processing of your data, in which case we will only keep them for the exercise or defense of claims.
• Right to object: You may object to the processing of your data if such processing is based on the legitimate interest of the data controller or is for advertising purposes.
• Right to object to automated decisions: You can object to being subject to a decision based solely on automated processing of your personal data, including profiling that produces legal effects on you or significantly affects you. E.g. analyzing or predicting aspects related to job performance, financial situation, health, personal preferences or interests, etc. In this case we may profile your preferences, if you do not object

Upon receipt of any of the above requests we will respond within the legally established time limits. You can complain to the Spanish Data Protection Agency. For more information about the rights you can exercise and to request model forms for the exercise of rights you can visit the website of the Spanish Data Protection Agency, www.aepd.es.