Privacy Policy

1. Who processes your data

The controller is Fundación Civitana, with NIF G72932239 and registered office at Avenida de Valladolid, 59, 1.º, 28008 Madrid (Spain), entered in the State Register of Foundations under number 2776.

You can write to us about any matter relating to your data at dpo@civitana.org.

2. What data we process

Only the data you provide in the website’s forms, which varies by form: your full name and email address in all of them; and, depending on the case, the message you write to us, the name of your organisation, your telephone number, your position, your company’s details (name, website and size), your country and city, the link to your LinkedIn profile or the CV you attach, the working group you choose, your answers to the forms’ questions, the proposal you submit to the Entrepreneurs’ Manifesto and, if you make a contribution, its amount, your NIF and your province of residence.

Your card details are processed directly by Stripe; the Foundation neither sees nor stores them.

We do not need special categories of data (health, ideology, religion, ethnic origin, trade union membership, sex life, biometric data). We ask you not to include them in your messages or in the files you attach; if we receive them, we will delete them.

If you provide us with another person’s data (for example, a colleague at your company), you must have informed them beforehand.

3. What we use it for and on what legal basis

• Newsletter. To send you the Foundation’s news, only if you ask for it when subscribing or by ticking the optional box in another form, which never affects the submission. Basis: your consent (Art. 6(1)(a) GDPR and Art. 21 of Ley 34/2002, LSSI). You can withdraw it at any time using the unsubscribe link in every email.
• Contact and project submissions. To reply to your message and study the project you submit to us. Basis: handling your request and taking steps prior to a possible collaboration (Art. 6(1)(b) GDPR).
• International collaboration and working groups. To assess your proposal or application and your professional profile and, if you collaborate, to manage your participation. Basis: Art. 6(1)(b) GDPR.
• Entrepreneurs’ Manifesto. To review your application to join and, if it is accepted, to publish the name, website and description of your project on the website and in the initiative’s communications, in accordance with the terms. Basis: Art. 6(1)(b) GDPR. Your name or image is only published if you expressly authorise it (Art. 6(1)(a) GDPR).
• Corporate patronage. To inform you about patronage, study your company’s request and, where applicable, manage its contribution. Basis: Art. 6(1)(b) GDPR.
• Personal contributions. To manage your annual contribution (payment, renewal and cancellation), issue the donation certificate and report it to the Spanish Tax Agency in the informative return on donations. Basis: the patronage relationship (Art. 6(1)(b) GDPR) and compliance with legal obligations, in particular Art. 24 of Ley 49/2002 (Art. 6(1)(c) GDPR). If you do not provide your NIF and province, we will not be able to issue the certificate or include the contribution in the return, and you will not be able to claim the deduction.
• Security. To protect the website and forms against abuse and automated submissions. Basis: our legitimate interest in the security of the website (Art. 6(1)(f) GDPR).

4. Use of artificial intelligence in the company form

If, when collaborating as a company, you give us its website, an artificial intelligence assistant (Claude, by Anthropic) reads the public content of that website to suggest the company’s name and size, which you can change before submitting. The assistant only accesses the website you give us and does not receive the rest of the form data.

The assistant does not make decisions about you or your company: every request is reviewed by a person at the Foundation. Anthropic processes the information on behalf of the Foundation and, under its commercial terms, does not use it to train its models.

5. Who we share your data with

With the providers that supply services to us and process the data on behalf of the Foundation, with whom we have signed the corresponding data processing agreement (Art. 28 GDPR): Amazon Web Services EMEA SARL (hosting of the website and attached files, and sending of emails), Mailchimp, by The Rocket Science Group LLC (newsletter management), Anthropic Ireland, Limited (reading companies’ websites) and Stripe Payments Europe, Limited (collection of contributions). Stripe may process some data as an independent controller to prevent fraud and comply with its own legal obligations, in accordance with its privacy policy.

With the Agencia Estatal de Administración Tributaria (Spanish Tax Agency), in the case of contributions, and with other authorities where required by law. If your application to join the Entrepreneurs’ Manifesto is accepted, your project details will be public. We do not sell your data or disclose it to anyone else.

6. International transfers

Some of our providers belong to groups headquartered in the United States and may process data there. These transfers are based on the safeguards in Chapter V of the GDPR: the recipient’s participation in the EU-US Data Privacy Framework, found adequate by the European Commission (Commission Implementing Decision (EU) 2023/1795), or the standard contractual clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914). Specifically:

• Amazon Web Services: our contract is with Amazon Web Services EMEA SARL (Luxembourg) and the data is hosted in the European Union (Ireland). Should it be necessary to transfer it to Amazon Web Services, Inc. (US), the transfer is based on its participation in the Data Privacy Framework and on the standard contractual clauses incorporated into its data processing agreement.
• Mailchimp: The Rocket Science Group LLC (US) participates in the Data Privacy Framework. Should this not apply, the transfer is based on the standard contractual clauses incorporated into its data processing agreement.
• Anthropic: our contract is with Anthropic Ireland, Limited (Ireland). The processing may be carried out by Anthropic, PBC in the US; the transfer is based on the standard contractual clauses incorporated into its data processing agreement.
• Stripe: our contract is with Stripe Payments Europe, Limited (Ireland). The data may be transferred to Stripe, LLC (US), which participates in the Data Privacy Framework. Should this not apply, the transfer is based on the standard contractual clauses in its data transfer addendum.

You can check each entity’s participation at www.dataprivacyframework.gov and ask us for a copy of the applicable safeguards by writing to dpo@civitana.org.

7. How long we keep it

• Newsletter: for as long as you remain subscribed.
• Contact, projects, collaborations, working groups and Entrepreneurs’ Manifesto: while the request is being studied or for as long as the relationship lasts, and for up to two years after the last contact. CVs and other attached files are deleted when they are no longer needed and, at the latest, one year after receipt.
• Contributions and patronage: for as long as the relationship lasts and, afterwards, for the limitation periods of tax obligations and the periods for keeping accounting records (generally, six years).

Once these periods have elapsed, we delete or anonymise the data.

8. Your rights

You can exercise your rights of access, rectification, erasure, restriction of processing, objection and portability, and withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before its withdrawal. Write to us at dpo@civitana.org or at the Foundation’s postal address, stating the right you are exercising.

If you consider that we have not handled your request properly, you can lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency, www.aepd.es).

9. Minors

The forms on this website are not intended for children under 14 (Art. 7 LOPDGDD); if you are under that age, do not send us your data. You must be of legal age to make a contribution.

10. Security

We apply technical and organisational measures appropriate to the risk to protect your data, including encryption of communications, checks on attached files and restricted access to information.

11. Cookies and changes to this policy

Cookies and similar technologies are covered in the Cookie Policy. If we amend this policy, we will publish the new version with its date on this page and, if the change is significant, we will notify newsletter subscribers. This policy is offered in several languages; in the event of any discrepancy, the Spanish version prevails.