Privacy Policy

For the purposes of current regulations on personal data protection, through this Privacy Policy, Fundación Banco Santander (hereinafter, the “Foundation”) informs data subjects of the essential aspects of the processing of personal data provided to the Foundation, through any of the means enabled for this purpose, as well as any other data that may be processed subsequently.

At all times, the Foundation processes the personal data of data subjects in accordance with the regulations on the protection of personal data and, in particular, with Regulation (EU) 2016/679 of April 27, General Data Protection Regulation, and Organic Law 3/2018 of December 5, on the Protection of Personal Data and Guarantee of Digital Rights.

This Privacy Policy explains the purposes for which we process the personal data of data subjects, the legal basis for such processing, the retention periods, the entities with which data may be shared, the rights available to data subjects, as well as other relevant information.

Therefore, data subjects are advised to carefully read this Privacy Policy, which has been drafted in clear and straightforward language to ensure easy understanding, so that they can freely and voluntarily determine whether they wish to provide their personal data to the Foundation.

This Privacy Policy will remain available for consultation on the Foundation's website.

1. Data controller
   Fundación Banco Santander, with Tax ID Number: G-80576200, will process personal data in its capacity as Data Controller.
   If you wish to contact the Foundation in relation to the processing of personal data, the contact details are:
   • Postal address: Calle Serrano 57, 28006 Madrid.
   • E-mail: privacidadfundacionbs@gruposantander.com
     
     
2. Personal data processed
   When we refer to "personal data," we are referring to all identifying information that data subjects provide to the Foundation, that is generated in the course of the relationship between the data subjects and the Foundation, or that can be inferred about them (provided they have given their prior consent).
   The data requested in the forms provided for this purpose are, in general, mandatory in order to fulfil the purposes defined in the following section (unless otherwise specified in the required field).
   Therefore, if you do not provide this information or do not provide it correctly, we will not be able to respond to your requests (for example, to participate in calls for projects or contact the Foundation regarding a matter of interest).
   Likewise, and in general, only data from data subjects over the age of 18 will be requested. If, due to the requirements of the specific action, it is necessary to collect data from minors under the age of 18, this data may only be provided by a parent or guardian of the minor or, where applicable, by an adult who has the prior informed consent of a parent or guardian of the minor. Such consent from the parent or guardian may be verified by the Foundation, for which purpose an email address will be requested.
   The email address provided for the verification of consent for the processing of the minor's data, in the event that it is provided by a data subject who is not the parent or guardian of that minor, is processed in compliance with our legal obligation to verify, with reasonable effort, that consent was given or authorized by the parent or guardian of the minor under 18 years of age.
   
   
3. Purposes and legal basis for the processing of personal data
   The Foundation will process the data of data subjects, when applicable and provided there is a legitimate basis for doing so, for the following purposes:
   • a. Management of participation in any of the calls for projects offered by the Foundation
     To participate in the calls for projects offered, interested parties must first register. Once the corresponding registration has been created, data subjects may apply to participate in the relevant call and in any other that may be of interest to them, using the same username and password associated with their registration. The calls for participation, as well as related information, can be consulted in the private area associated with each registration.
     Therefore, the data associated with the prior registration, as well as any additional data requested in relation to the specific call for applications for which participation is requested, will be used to manage the interested party's participation in the corresponding project call offered by the Foundation. Specific aspects of the processing of personal data related to each specific call for applications will be reported on the corresponding registration form.
     Personal data related to participation in the specific call for applications may be consulted by the members of the Evaluation Committee appointed for this purpose.
     In this regard, the legitimate basis for the processing of personal data for the management of participation in project calls in which the data subject registers, including the necessary prior registration, is the execution of the legal-contractual relationship existing between the parties, which will comply with the terms of the specific project call.
   • b. Activity and event management
     In this case, we use the data for the proper organization of activities and events, including, where applicable, access and parking management (for events held at Santander Group's Financial City), as well as accessibility for people with disabilities or special needs.
     The legal basis for processing personal data related to registration, participation, and/or attendance at any activity or event organized by the Foundation will be consent and, where applicable, the execution of the legal-contractual relationship between the Foundation and the interested party who wishes to register, participate, and/or attend an activity or event carried out by the Foundation.
     In the event that special assistance is requested for attendance and accessibility to the event, a circumstance from which the existence of a disability or limitation of any kind related to health could be inferred, the processing will be carried out based on the consent duly granted by the data subject. The Foundation ensures the discreet and confidential treatment of this information, in order to comply with our purpose and legal obligation to facilitate universal accessibility to the activities and events organized.
     The aforementioned consents may be revoked at any time, in accordance with the procedure set out in section 8 of this Privacy Policy. However, withdrawal of consent may make it impossible to participate in the specific activity or event and will not affect any processing carried out prior to the withdrawal.
   • c. Conducting satisfaction surveys
     In certain cases, the Foundation will send interested parties a satisfaction survey by email to gather their opinions on activities, events, calls for applications, publications, and other initiatives carried out or offered by the Foundation.
     The legal basis for sending these surveys and compiling the resulting statistics is the Foundation’s legitimate interest in understanding the satisfaction of interested parties and in analysing and improving the management, organization, and objectives of its activities.
     The Foundation has carried out an analysis of the proportionality of this processing in order to determine that carrying it out on the basis of the Foundation's legitimate interest does not unfairly undermine the rights and freedoms of the data subjects. However, data subjects may object to the processing of their data for this specific purpose, in the manner set out in section 8 of this Privacy Policy.
   • d. Newsletters and informational communications
     We will use the personal data (identification and contact details) of data subjects who give their consent to receive the newsletter and informative communications about relevant news from the Foundation.
     Therefore, the processing of data carried out for this purpose will be done by virtue of the consent given by the data subject. Such consent may be withdrawn at any time, in accordance with the procedure set out in section 8 of this Privacy Policy, as well as by requesting to unsubscribe from receiving the aforementioned communications through the unsubscribe mechanism provided therein and/or on the Foundation's website, without this affecting the data processing carried out previously.
   • e. Sending informative communications based on the interests of the recipients
     It is important for the Foundation to be able to publicize its activities so that they are known to people who may be most interested in participating in them. Therefore, when interested parties have given their prior and explicit consent to do so, the Foundation will send out informative communications aimed at specific segments (for example: residents of a specific area, students, researchers, people in a specific social or personal situation, etc.) or to people identified with specific interests (such as art, cultural heritage, architecture, etc.), based on the information provided directly by the interested party, generated from the existing legal-contractual relationship or inferred by virtue of the interested party's participation in the Foundation's activities. This allows us to send communications to those recipients who, we believe, may be most interested in receiving them.
     This information will not be shared with any third party, except when a specific action requires it, and only with the data subject’s prior informed consent.
     Of course, if the data subject no longer wishes to receive these informational communications, they may unsubscribe using the mechanism provided in the communications themselves, or as set out on the Foundation’s website, or in the manner described in section 8 of this Privacy Policy. Revocation of consent will not affect processing or communications carried out prior to the revocation.
   • f. Compliance with the Foundation’s legal obligations
     The Foundation will process the personal data of data subjects when necessary to comply with its legal obligations. For example, tax obligations, compliance with legal or administrative requirements, etc.
     The legal basis for this processing is the need to process the personal data of data subjects, where applicable, in order to comply with the legal obligations imposed on the Foundation.
      
4. Retention period for processed personal data
   Personal data will be retained as long as necessary to fulfil the purposes described above, provided that the data subject does not object to such processing or revoke their consent.
   Once the processing has been completed, the personal data of the data subjects will be securely blocked for a period of three years, except when the processing is carried out to ensure the proper execution of the legal and contractual relationship between the parties (for example, for the management of calls for applications), in which case the data will be retained for five years. This retention period allows the Foundation to address potential claims related to data protection arising from the processing. After this period, the data will be permanently deleted.
   
   
5. Recipients of the processed personal data
   The data of the interested parties may be communicated to:
   • Public administrations with jurisdiction in the matter.
   • Courts and tribunals, in the event of specific requests made in accordance with applicable regulations.
   • State security forces and bodies, in the event of specific requests made in accordance with applicable regulations.
   • Any of the companies of the Banco Santander Group, exclusively in those cases where it is necessary for the performance of the specific action or for internal administrative purposes.
     
   In addition, the data may be accessible to the Foundation's suppliers, such access being necessary for the proper fulfilment of legal obligations and/or the purposes indicated above. These suppliers will not process your data for their own purposes that have not been previously communicated by the Foundation. By way of example and without limitation, the Foundation contracts professional and consulting services to form evaluation committees, technological services for the operation of its platforms, repositories, etc., and management services for the proper performance of its activities and compliance with its legal obligations.
   In this regard, the Foundation follows strict criteria for selecting service providers in order to comply with its data protection obligations and undertakes to sign a data processing agreement, as required by law, imposing the following obligations, among others: to apply appropriate technical and organizational measures to ensure the security of personal data; to process personal data for the agreed purposes and only in accordance with the documented instructions of the data controller; and to delete or return the data to the Foundation once the services have been completed.
   In the event that any of the services contracted by the Foundation involve the processing of your personal data outside the European Economic Area, the Foundation guarantees that this will be done with the appropriate safeguards, such as the signing of standard clauses or the selection of suppliers who adhere to specific agreements that recognize an adequate level of data protection (such as the EU Data Privacy Framework - US Privacy Shield Framework).
   
   
6. Social NetworksR
   The Foundation is present on several social networks. When interacting with any of its social media pages, data processing will be governed by the terms of use, privacy policies, and access regulations of the respective platform, which must be accepted by the interested party (i.e., the user).
   The Foundation will process the data of the interested party to inform them about the Foundation’s activities, events, announcements, and other communications permitted under the platform’s regulations.
   Please note that the Foundation has no control over the information collected by the social media platform or how it is processed.
   
   
7. Liability for the information provided by the data subject
   The data subject, or, where applicable, the person providing the information in each case:
   • Guarantees that they are over eighteen (18) years of age and that the data provided to the Foundation is true, accurate, complete, and up to date. For these purposes, the data subject is responsible for the veracity and legality of all information communicated and will ensure that the information provided is properly updated to reflect their actual situation.
   • Guarantees that they have informed any third parties whose data is provided, as well as, in the case of minors’ data, the holders of parental authority or legal guardians, about the matters contained in this document. Furthermore, they guarantee that they have obtained the necessary authorization to provide such data to the Foundation for the purposes indicated.
   • Will be responsible for any direct or indirect damages or losses caused to the Foundation or to third parties as a resultga.
      
8. Rights of the data subjects
   As the holder of the personal data being processed, the data subject has the right to request access, rectification, deletion, and portability of their data, as well as to request the restriction of processing, object to its processing, and, where applicable, revoke previously granted consent.
   Data subjects may exercise their rights under applicable data protection legislation by sending a letter to the following address: Calle Serrano No. 57, 28006 Madrid, and/or by email to: privacidadfundacionbs@gruposantander.com. If proper identification is not possible, the Foundation may request additional information.
   Furthermore, data subjects have the right to contact the Spanish Data Protection Agency at Calle Jorge Juan No. 6, 28001 Madrid, or via www.aepd.es, if they believe that their personal data is not being processed correctly or that their rights have not been properly upheld.
   
   
9. Security Measures
   The Foundation will process the data of data subjects by adopting the necessary technical and organizational measures to safeguard the security of the data and prevent its alteration, loss, unauthorized processing or access, taking into account the state of technology, the nature of the data stored and the risks to which it is exposed, whether from human action or from the physical or natural environment.
   
   
10. Changes
    The Foundation reserves the right to revise its Privacy Policy at any time, in accordance with applicable legislation, in which case it will notify the data subjects. For this reason, we ask that you read the most recent version of the policy in order to be aware of any changes that may have been made to the Foundation's Privacy Policy.