Privacy policy

Data controller

Data processed

• Data provided through the form: full name, organisation, email address, reason for contact and message.
• Technical data needed to secure the form, processed through Cloudflare Turnstile, such as IP address, browser characteristics and signals used to detect automated traffic.
• Anonymous browsing statistics through Umami, self-hosted and configured without cookies or direct visitor identification.
• Technical server logs required to ensure the security and operation of the website.

Purposes and legal bases

• Managing and responding to enquiries: taking pre-contractual steps at the data subject's request where applicable and, for general enquiries, the Foundation's legitimate interest in responding to communications.
• Protecting the form and website against abuse and automated traffic: legitimate interest in ensuring system security.
• Obtaining aggregate usage statistics: legitimate interest in understanding and improving the website using anonymous information.

Data will not be used for marketing communications without a specific legal basis and the relevant prior information.

Recipients and providers

Enquiries are received by the people who coordinate AFRA in the organisations that make up the alliance, and are used solely to handle and answer them.

The following technology providers are involved: OVH for hosting in the European Union; Brevo for sending form submissions by email; Cloudflare for Turnstile anti-spam protection; and self-hosted Umami for anonymous statistics.

International transfers

Cloudflare operates a global infrastructure and may process technical signals outside the European Economic Area. Where applicable, such processing will rely on mechanisms and safeguards recognised under European data protection law.

Retention

Enquiries and related emails will be retained for as long as required to handle them and subsequently for any period in which liabilities may arise or the relationship initiated needs to be maintained. Technical logs will be retained for the periods configured to ensure service security and operation.

Rights

You may request access, rectification, erasure, objection, restriction and, where applicable, portability by writing to info@afra-bc.eus. You may also lodge a complaint with the Spanish Data Protection Agency (opens in a new tab).

Required information and automated decisions

Fields marked as required are necessary to manage your enquiry. If they are not provided, we will be unable to process it. No automated decisions or profiling are carried out using the form data.