Privacy policy

Version in force as of 04/08/2022

This Privacy Policy (hereinafter, the "PRIVACY POLICY") regulates, in general, the collection and processing by SPRI, BASQUE BUSINESS DEVELOPMENT AGENCY (hereinafter, "SPRI") of (i) the personal data that you provide us with as a user of the website accessible through the domain name www.spri.eus/es (hereinafter, the "WEBSITE"), including the services available at all times through the WEBSITE; and (ii) other data collected through other collection systems duly identified below. All of the foregoing is without prejudice to the specific provisions established in sections, forms or services available on the WEBSITE in order to provide you with the relevant information and, where appropriate, to obtain your consent.

SPRI reserves the right to modify the PRIVACY POLICY in order to adapt it to new legislative, jurisprudential and/or administrative developments, as well as to the practices developed at any time through the WEBSITE, taking into account your rights and interests at all times.

In any case, SPRI will provide you with the appropriate technical resources so that you may access the PRIVACY POLICY in order to duly comply with the information obligations that we must observe in accordance with the applicable data protection regulations.

1. Who is the person/entity responsible for processing your data?

The person/entity responsible for the processing of your data is SPRI BASQUE BUSINESS DEVELOPMENT AGENCY, Public Entity under Private Law, with registered office in Bilbao (Bizkaia), C/ Alameda Urquijo, nº 36, 4º and with Tax ID n. Q-4800789-B, dedicated to the development of different initiatives and projects in the field of industrial policy and business competitiveness in the Basque Country.

Through the following link^[1] you will find the Register of Processing Activities (RAT - Registro de Actividades de los Tratamientos) that SPRI carries out in its capacity as Responsible person/entity.

In this document you will be able to identify the detailed description of all data processing, as well as the category of data processed, the applicable legal basis, the intended communications, the applicable storage period and other information relevant to all processing activity.

In compliance with the provisions of the applicable regulations on data protection, we have appointed a Data Protection Officer (DPO), responsible for the management and control of privacy in SPRI and whom you can contact through the email address dpd@spri.eus.

For any matter related to the PRIVACY POLICY and/or the processing of your personal data, you can contact our DPO or us directly by writing to the postal address indicated above and/or via the following email address: lopd@spri.eus.

2. How did we obtain your data?

The data we process at SPRI have been obtained from you, through (i) the different forms you fill in while browsing the WEBSITE and/or other channels (e.g. registration as a WEBSITE user -when applicable-, contact forms, forms referring to job offers and/or selection processes, forms relating to applications for grants or subsidies, registration forms for activities, events or projects organised or led by SPRI, etc.); (ii) by sending an email inquiry.

In the event that the personal data provided belong to a third party, you guarantee that you have informed such third party of the PRIVACY POLICY and have obtained their authorisation to provide their data to SPRI for the purposes set forth below.

Additionally, we inform you of the possible processing of your social network data through the corporate profiles that SPRI maintains available on each social network on which it is present, all under the terms and conditions established on each social network.

3. What type of data do we process?

In general, the data that we process at SPRI are those that you have provided us with while browsing the WEBSITE, through the appropriate forms that we use to formalise our contact with you and/or via email, as well as those others that, if applicable, we obtain through SPRI's corporate profiles on the social networks on which we are present.

In particular, SPRI processes the following categories of data:

• Identification and contact data (name, surname, ID number, postal and email address, telephone number, etc.).
• Professional data (company in which you perform your functions, position and functions, professional postal and email address, and professional telephone number) when (i) you provide them through the forms related to applications for grants or subsidies, activities, events and projects organised or led by SPRI, etc.; and (ii) they are necessary for your business location and/or for the maintenance of our business relationship with you or your entity.
• Codes and identification keys as a registered user of the WEBSITE and/or of the applications accessible through it.
• Internet browsing data (e.g. IP address, web page visits, Wi-Fi network connections, etc.).
• Data on personal characteristics, training, employment, etc. (in the case of applications/job offers and/or SPRI selection processes in which you participate voluntarily).

4. For what purpose do we process your data and under what legal basis?

Without prejudice to what is specifically indicated in the Register of Processing Activities available through the PRIVACY POLICY, in general, the processing of your personal data pursues the following purposes:

• To manage and process your registration as a user of the WEBSITE, when possible, and on the basis of your request for pre-contractual measures or the contractual relationship established with you in this regard.
• To manage your access and use of the contents and services that SPRI makes available to you through the WEBSITE, including blog services, social networks or any other functionalities that may be accessible from the WEBSITE at all times, and on the basis of your request for pre-contractual measures or the contractual relationship established with you in this regard.
• To process and manage your possible applications for grants and/or subsidies and, in general, to maintain, manage and control the legal relationship you establish with SPRI in this context, all on the basis of public interest (competencies legally attributed to SPRI in industrial policy and business competitiveness in the Basque Country).
• To process and manage the contracting of products or services that you may formalise with SPRI through the WEBSITE and/or by other means and, in general, to maintain, manage and control the contractual relationship that you establish with us as purchaser of our products or services, all on the basis of your request for pre-contractual measures or the contractual relationship established with you in this regard.
• To process and manage your request for participation in the activities, events and/or projects organised or led by SPRI, as well as your subsequent participation in these, all on the basis of your request for pre-contractual measures or the contractual relationship established with you in this regard.
• In cases where you have consented, and on the basis of such consent, to manage and disseminate activities and events organised by SPRI in which you have voluntarily participated.
• To process and manage the request for information, suggestions, complaints or claims that you make through the WEBSITE or email, and on the basis of your request for pre-contractual measures or the contractual relationship established with you.
• To send you by different means, including electronic means, commercial and advertising communications from SPRI, other companies/entities directly or indirectly linked to SPRI (identified in the URL www.spri.eus/en/who-we-are/) and/or SPRI collaborating entities, regarding products, services, offers, promotions and any other relevant information concerning such entities, provided that you have consented and on the basis of such consent.
• To manage your subscription to our newsletter service and the sending of the corresponding electronic communications, provided that you have consented and on the basis of such consent.
• To manage your job application and your participation in the corresponding selection process, all on the basis of your request for pre-contractual measures.
• To maintain accessible, through our Transparency Portal available on the WEBSITE, the data that we are legally obliged to make available to the public, all on the basis of compliance with our legal obligations (applicable regulations on transparency).
• To maintain accessible, through our Contractor Profile available on the WEBSITE, the data that we are legally obliged to make available to the public, all on the basis of compliance with our legal obligations (applicable regulations on public sector contracts).

Additionally, you will find detailed information on each kind of data processing on each of the online forms for collecting personal data available on the WEBSITE.

We remind you that, at any time, in cases where the processing is based on your consent, you may revoke it freely and free of charge, under the terms indicated in the following Section7.

5. To whom do we communicate your data?

We inform you that your personal data may be communicated to the following third parties:

• Authorities, Agencies and Public Administrations to which, when appropriate, SPRI has a legal obligation to communicate your data.
• When you have consented, entities of the business group in which SPRI is integrated (duly identified in the URL www.spri.eus/en/who-we-are/), in order to meet your requests and queries and/or send commercial communications concerning these entities and their respective activities or products.

Furthermore, we inform you that, as far as possible publications in our Transparency Portal and/or in our Contractor Profile are concerned, your personal data could be accessible to third parties from anywhere in the world, through the WEBSITE. Such international transfer of data will be limited, in any case, to the data that we are legally obliged to publish in these areas and, in accordance with the applicable regulations, is carried out because it is necessary for important reasons of public interest.

6. How long will we keep your data?

Without prejudice to what is specifically indicated in the Register of Processing Activities available through the PRIVACY POLICY, in general, personal data will be kept (i) as long as they are necessary for the purpose for which they were collected; and (ii) as long as you do not revoke your consent to the processing, upon legal basis, or request their deletion at an earlier time; as well as (iii) the additional time necessary to comply with the legal obligations that SPRI must observe.

In any case, we inform you that SPRI has established internal data purification policies aimed at controlling the retention periods of the personal data in its possession, so that they may be deleted when they are no longer necessary and/or appropriate for the purpose for which they were collected.

7. What are your rights?

The applicable data protection regulations grant you a number of rights relating to your personal data that you may exercise during the processing of your personal data. These rights are as follows:

• Access to your data: you have the right to access your data to find out what personal data concerning you we are processing.
• Request the rectification or deletion of your data: under certain circumstances, you have the right to rectify any inaccurate personal data concerning you that are subject to processing by us, or even request their deletion when, among other reasons, the data are no longer necessary for the purposes for which they were collected.
• Request the limitation of the processing of your data: under certain circumstances, you have the right to request the limitation of the processing of your data, in which case we inform you that we will only keep them for exercising or defending claims as set forth in the applicable regulations on data protection.
• The portability of your data: under certain circumstances, you have the right to receive the personal data concerning you, and which you have provided to us, in a structured, common use and mechanical reading format, and transfer them to another data controller.
• Objection to the processing of your data: under certain circumstances and for reasons related to your individual situation, you have the right to object to the processing of your data, in which case, we would stop processing them unless there are compelling legitimate reasons or they are needed to exercise or defend possible claims for which they must be conserved.

You also have the right to withdraw consent at any time, without affecting the legality of the processing based on the consent given prior to its withdrawal.

You may exercise these rights by sending a written request to SPRI at the postal address indicated in Section 1 or by sending an email to lopd@spri.eus.

Finally, we inform that you can file a claim with the competent Controlling Authority (in the case of SPRI, the Basque Data Protection Agency), especially when you have not obtained satisfaction in the exercise of your rights. You can contact this Authority through the following website: www.avpd.euskadi.eus.

8. Security measures

SPRI shall treat your data at all times in an absolutely confidential manner and shall keep the mandatory duty of secrecy with respect to them, in accordance with the provisions of the applicable regulations on data protection, adopting for this purpose the necessary technical and organisational measures to guarantee the security of your data and prevent its alteration, loss, processing or unauthorised access, taking into account the state of the technology, the nature of the data stored and the risks to which they are exposed.

9. Cookie policy

Additionally, please note that SPRI has established a Cookie Policy, which is accessible through the following link.

The Privacy Policy was last updated on 8 April 2022.