4. For which purposes we use your data

4.1 The main purposes for which we use your personal information are:

a. To provide our services to you
To handle your training programs we need to process most of the information described above. For example, we need your name, surname and other identifying information to proceed to your enrollment. To confirm your coming and to inform you about changes, we need your contact details. And, to ensure that you receive the required care, we require your specified medical (dietary) needs.

c. To provide our online services and mobile apps to you
• For example, we use your name and details when you register to a training by email.
• To ease your use of our online services or apps, we may analyze the data we collect when you use our digital media and combine it with information collected via cookies and similar technologies (please see above). For example, to understand which digital channel (email, social media) or device (desktop, tablet or mobile) you prefer, so we can restrict our communication to that channel or device.

d. For statistical research
• General. We use automatic tools to perform statistical research into general trends regarding the use of our services, websites, apps and social media and the behavior and preferences of our customers and users.
• Categories of data. To perform our research, we may use the categories of personal data described above and personal details (gender, postal code). We combine this data with the data we collect with cookies and similar technologies when you visit our websites or use our apps. And we merge it with (aggregated) data collected by third party providers using analytical or marketing cookies or similar technologies. For more information on cookies and similar technologies, please check the cookie policy on our website. We only use aggregated data for our analysis and do not use your name or e-mail address. Without your consent, we will not use special categories of data for this statistical research.
• Example. We use customer surveys to measure customer satisfaction and to understand what is important for our customers so we can improve our service. And we use cookies and similar technologies to evaluate how our website visitors navigate our website so we can make it more intuitive.
• Legal basis. We process your personal data for our legitimate interests to develop better services and offers for our customers, to provide more responsive customer support and to improve the design and content of our websites and mobile apps.
• Right to object. You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data for statistical research (please see below ‘Your rights’).

e. To send you updates and special offers tailored to your interests
• Communication. For example, you can subscribe to the Foundation for Clusters and Competitiveness newsletter which keeps you informed on new trainings and the latest news. With your consent, we may also send you emails on specific occasions, such as a special trainings.
We may also use other communication channels to send you personalized messages and special offers, such as postal mail or, with your consent, social channels (such as Facebook Messenger or WhatsApp).
• Categories of data. We use your contact details to communicate with you. To understand what is relevant to you, we use automatic tools to analyze your personal data. For this purpose, we may use the categories of personal data described above, information about you (gender, zip code). We combine this data with data that we collect with cookies and similar technologies when you visit our websites or use our apps. And we merge it with (aggregated) data collected by third party providers using analytical or marketing cookies or similar technologies. For more information on cookies and similar technologies, please check the cookie policy on our website. Without your consent, we will not use special categories of data.
• Personalized offers. In our communication (see under above), we include personalized offers from us and our partners relating to our services and products. All communication is sent by the Foundation for Clusters and Competitiveness alone or in combination with our partners, no contact details are shared with our partners for this purpose without your consent. More information on our partners and the products and services they offer is provided when you subscribe and can be found on our websites.
• Legal basis. We process your personal data as described in this paragraph for our legitimate interest and the interests of third parties to provide you with relevant updates and offers.
• Opt-in and opt-out, unsubscribe and right to object. We only send you emails and notifications with updates and special offers with your prior opt-in. You can opt-out from receiving more messages from us or unsubscribe from any time by clicking the unsubscribe link in the email or by contacting us (please see ‘Your Rights’ below). You may object to the use of your personal data for direct marketing purposes anytime (please see below ‘Your rights’).

f. To communicate with you
We use your contact details to communicate with you in relation to our services, to answer your questions or to handle your complaints.

g. For record keeping and to comply with statutory obligations
We collect, store and use your data for internal business purposes, such as record keeping and to comply with our legal and fiscal obligations. We may be required by law to collect and share your identifying information with public authorities or governmental organizations for the purpose of control, security or combating terrorism.

4.2 Legal basis. We collect, use and store your personal data to provide services and our programs to you, to comply with the legal obligations we are subject to, if necessary for our legitimate interests or the interests of a third party or on the basis of your consent.
You may withdraw your consent at any time by following the specific instructions in relation to the processing for which you provided your consent. For example, by clicking the unsubscribe link in the email, adjusting your communication preferences in your account (if available) or by changing your smart phone settings (for mobile push notifications and location data). You may also contact us to withdraw your consent (please see ‘Your Rights’ below).
If you refuse to provide personal data that we require for the performance of the contract or compliance with a legal obligation, we may not be able to provide all or parts of the services you have requested from us. For example, we may have to cancel your registration to a training or we may not be able to provide you with the ancillary services requested by you (such as special meals).
When we process your personal data for our legitimate interests or the interests of a third party, we have balanced these interests against your legitimate interests. Where necessary we have taken appropriate measures to limit implications and prevent unwarranted harm to you. Our legitimate interests may for example include security and safety purposes or to provide better services and offers to you. For more information on these interests, please see the ‘For which purposes we use your data’ above. Where we process your personal data for our legitimate interests or the interests of a third party, you have the right to object at any time on grounds relating to your particular situation (please see ‘Your Rights’ below).

5. Disclosing or sharing data with third parties

5.1 General. We may disclose or share your personal data with our partners, service providers or subcontractors for the following purposes.

a. To facilitate your registration and general arrangements
To handle your registration to our trainings we may have to share your personal data with our partners and other companies involved in facilitating your stay with us. For more information on the partners we work with, please see our website under the adequate section.

b. For support services
We use third parties to provide our services, such as IT suppliers, social network providers, marketing agencies, credit and charge card companies and anti-fraud screening service providers. All such third parties will be required to adequately safeguard your personal data and only process it in accordance with our instructions.
Business activities are carried out (and business efficiencies are achieved) by processing or consolidating information (including personal data) in centralized databases and systems. These central databases and systems may be hosted or managed by external companies. In addition, for efficiency purposes certain operational functions may be performed by external companies. This means that our partners may have access to your personal data for these purposes. Our partners may only process your personal data as required for the relevant business function and in accordance with this privacy policy.

c. Statistical research and direct marketing
We may share your personal data with group companies and third parties for statistical research and direct marketing. Please see above ‘Statistical research’, ‘To send you updates and special offers’ and ‘Other direct marketing purposes’ for more information.

d. To secure order and safety in the premises of our trainings

5.2 Public authorities. We may also be required by law to collect and share your identifying information with public authorities or governmental organizations for the purpose of control, security or combating terrorism.

5.3 Third party websites. Our websites and mobile apps contain links to third-party websites. If you follow these links, you will exit our websites or mobile apps. This privacy policy does not apply to websites of third parties. The Foundation for Clusters and Competitiveness cannot accept liability for the use of your personal data by these third parties. Your use of these websites is at your own risk. For more information on how these third parties treat your personal information, please check their privacy policy (if available).

6. Security and retention

6.1 The Foundation for Clusters and Competitiveness will take appropriate technical and organizational measures to protect your personal data against loss or unlawful use.

6.2 Your personal data will be retained for as long as required for the purposes described in this privacy policy or in so far as such is necessary for compliance with statutory obligations and for solving any disputes.

7. International transfer of your data

7.1 The Foundation for Clusters and Competitiveness may transfer your personal data to countries other than your country of residence (including countries outside the European Economic Area). This may occur because our partners or service providers have operations in countries across the world. The laws of these countries may not afford the same level of protection to your personal data.

7.2 The transfer of personal data to countries other than your country of residence is often necessary to provide our services to you. In other cases, the Foundation for Clusters and Competitiveness will ensure that adequate safeguards are in place to comply with the requirements for the international transfer of personal data under applicable privacy laws. For transfers of personal data outside the European Economic Area, the Foundation for Clusters and Competitiveness may use Commission approved Standard Contractual Clauses as safeguards.

7.3 We may also be required to disclose your personal data to foreign public or government authorities
Laws in some other countries may require us to give government agencies access to your information. In addition, laws in several countries require the Foundation for Clusters and Competitiveness to collect your associated information prior to travel to or from those countries. When required, we will provide this information to the relevant customs and immigration authorities. We may also disclose your personal data to government authorities if applicable law requires disclosure.

8. Your rights

8.1 You may contact our Privacy Officer (please see below) to exercise any of the rights you are granted under applicable data protection laws, which includes (1) the right to access your data, (2) to rectify them, (3) to erase them, (4) to restrict the processing of your data, (5) the right to data portability and (6) the right to object to processing.

1. Right to access
You may ask us whether or not we process any of your personal data and, if so, receive access to that data in the form of a copy. When complying with an access request, we will also provide you with additional information, such as the purposes of the processing, the categories of personal data concerned as well as any other information necessary for you to exercise the essence of this right.

2. Right to rectification
You have the right to have your data rectified in case of inaccuracy or incompleteness. Upon request, we will correct inaccurate personal data about you and, taking into account the purposes of the processing, complete incomplete personal data, which may include the provision of a supplementary statement.

3. Right to erasure
You also have the right to have your personal data erased, which means the deletion of your data by us and, where possible, any other controller to whom your data has previously been made public by us. Erasure of your personal data only finds place in certain cases, prescribed by law and listed under article 17 of the General Data Protection Regulation (GDPR). This includes situations where your personal data are no longer necessary in relation to the initial purposes for which they were processed as well as situations where they were processed unlawfully. Due to the way we maintain certain services, it may take some time before backup copies are erased.

4. Right to restriction of processing
You have the right to obtain the restriction of the processing of your personal data, which means that we suspend the processing of your data for a certain period of time. Circumstances which may give rise to this right include situations where the accuracy of your personal data was contested but some time is needed for us to verify their (in)accuracy. This right does not prevent us from continuing to store your personal data. We will inform you before the restriction is lifted.

5. Right to data portability
Your right to data portability entails that you may request us to provide you with your personal data in a structured, commonly used and machine-readable format and to have such data transmitted directly to another controller, where technically feasible. Upon request and where this is technically feasible we will transmit your personal data directly to the other controller.

6. Right to object
You also have the right to object to the processing of your personal data, which means you may request us to no longer process your personal data. This only applies in case the ‘legitimate interests’ ground (including profiling) constitutes the legal basis for processing (see ‘Legal basis’ above).
At any time and free of charge you can object to direct marketing purposes in case your personal data are processed for such purposes, which includes profiling purposes to the extent that it is related to such direct marketing. In case you exercise this right, we will no longer process your personal data for such purposes.

8.2 You may withdraw your consent at any time
You may withdraw your consent at any time by following the specific instructions in relation to the processing for which you provided your consent. For example, you may withdraw consent, by clicking the unsubscribe link in the email, adjusting your communication preferences in your account (if available) or by changing your smart phone settings (for mobile push notifications and location data). You may also contact the Privacy Officer of the Foundation for Clusters and Competitiveness.

8.3 For more information on how you can withdraw your consent for cookies and similar technologies we use when you visit our websites or use our apps, please check the cookie policy on our website or in the app. There may be situations where we are entitled to deny or restrict your rights as described above. In any case, we will carefully assess whether such an exemption applies and inform you accordingly. We may, for example, deny your request for access when necessary to protect the rights and freedoms of other individuals or refuse to delete your personal data in case the processing of such data is necessary for compliance with legal obligations. The right to data portability, for example, does not apply in case the personal data was not provided by you or if we process the data not on the basis of your consent or for the performance of a contract.

8.4 When you would like to exercise your rights, all you have to do is send your request to the Data Protection Officer at the Foundation for Clusters and Competitiveness:

Foundation for Clusters and Competitiveness
Data Protection Officer
Pujades, 1
08003 Barcelona
SPAIN
Email: dpo@clusterexcellence.org

8.5 You can also contact us if you have any questions, remarks or complaints in relation to this privacy policy. However, if you have unresolved concerns you also have the right to complain to the Spanish Data Protection Authority (Agencia Española de Protección de Datos, https://www.aepd.es/) located in Madrid, Spain.

9. How we look after this policy

9.1 This privacy policy was most recently amended on 24 May 2018 and replaces earlier versions. We may amend this privacy policy from time to time and will notify you of any changes prior to these changes taking effect.