“SOS Himalaya” is deeply committed to compliance with Spanish and European regulations on the protection of personal data, and ensures full compliance with the obligations established, as well as the implementation of the security measures provided for in the General Data Protection Regulation (GDPR) (EU) 2016/679, of April 27, and in Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (LOPD and GDD, hereinafter LOPD).

In accordance with these regulations, we inform you that the use of our website may require certain personal data to be provided through registration or contact forms, or by sending emails, and that these will be processed by “SOS Himalaya”, Data Controller, whose details are:

• Company Name: Fundación Iñaki Ochoa De Olza SOS Himalaya
• VAT Number: G71019640
• Registered Address: C/ Monasterio de Urdax nº15, 9º A – 31011, Pamplona, Navarra, Spain
• Phone: 646 841 240
• Email: fundacion@soshimalaya.org

Collection and Processing of Personal Data

Personal data is any information relating to an individual: name, email, address, phone number, NIF/NIE, etc. Additionally, when a User visits our website, certain information is automatically stored for technical reasons, such as the IP address assigned by their Internet access provider.

“SOS Himalaya”, as Data Controller, has the duty to inform Users of its website about the collection of personal data that may be carried out, either by sending email or by filling out the forms included on the website.

Only the necessary data will be collected to provide the contracted service, or to adequately respond to the information request made by the User. The collected data are identifying and correspond to a reasonable minimum to carry out the activity. In particular, no specially protected data are collected at any time. Under no circumstances will the data be used for purposes other than those for which they were collected.

Membership Registration Forms

Purposes:

• Manage your registration as a member of our foundation.
• Provide information about the membership process.
• Sending communications about events, activities, and/or relevant information.
• Sending communications via email and/or phone, in order to inform the User of possible incidents, errors, problems, and/or the status of the processing.

Legitimation:

The legal basis legitimizing this processing is the User’s consent, which can be revoked at any time, and the legal relationship derived from our relationship.

Data Transfer:

Personal data will be processed through servers managed by RaiolaNetworks, which will be considered Data Processors. “SOS Himalaya” will not transfer or communicate your data to any other third party, except in cases legally provided for or when strictly necessary for the provision of a service. Specifically, the data may be transferred to:

Technological or computer service providers. Payment service providers. Courier and parcel companies. Third parties or intermediaries, as service providers, operating on our behalf (accounting, consultancy…). Data transfers will be made with the strictest confidentiality, using necessary measures, such as signing confidentiality agreements, or adhering to their privacy policies established on their respective websites. The User may refuse the transfer of their data to Data Processors, by written request, through any of the previously referenced means.

Furthermore, in cases where necessary, Customer data may be transferred to certain organizations, in compliance with a legal obligation: Spanish Tax Agency, banking entities, Labor Inspection, etc.

Purchase Forms

Purposes:

Provide information about the processing and status of purchases. Sending communications via email and/or phone, in order to inform the User of possible incidents, errors, problems, and/or the status of orders. Legitimation: The legal basis legitimizing this processing is the execution of a contract.

Data Transfer: Personal data will be processed through servers managed by RaiolaNetworks, which will be considered Data Processors. “SOS Himalaya” will not transfer or communicate your data to any other third party, except in cases legally provided for or when strictly necessary for the provision of a service. Specifically, the data may be transferred to:

Technological or computer service providers. Payment service providers. Courier and parcel companies. Third parties or intermediaries, as service providers, operating on our behalf (accounting, consultancy…). Data transfers will be made with the strictest confidentiality, using necessary measures, such as signing confidentiality agreements, or adhering to their privacy policies established on their respective websites. The User may refuse the transfer of their data to Data Processors, by written request, through any of the previously referenced means.

Furthermore, in cases where necessary, Customer data may be transferred to certain organizations, in compliance with a legal obligation: Spanish Tax Agency, banking entities, Labor Inspection, etc.

Minors

Only individuals over 14 years of age may provide personal data on this website. As required by the LOPD and GDD, in the case of minors under 14 years of age, the consent of their parents or legal guardians will be a mandatory condition for us to process their personal data.

Furthermore, only individuals over 18 years of age may contract our services. In the case of individuals under 18 years of age, the consent of their parents or legal guardians will be a mandatory condition for us to provide the offered services unless the minor is emancipated.

Security Measures

Users of the “SOS Himalaya” website are informed that security measures, technical and organizational, within our reach, have been adopted to prevent the loss, misuse, alteration, unauthorized access, and theft of data, thus ensuring the confidentiality, integrity, and quality of the information contained therein, in accordance with current regulations on data protection. The personal data collected in the forms are processed only by the staff of “SOS Himalaya” or the designated Data Processors.

The “SOS Himalaya” website also has SSL encryption, which allows the User to securely send their personal data through the contact or registration forms on the website.

Accuracy of Data

The User declares that all data provided by them is true and correct and undertakes to keep it updated. The User shall be responsible for the accuracy of their data and shall be solely responsible for any conflicts or disputes that may arise from their falsity. It is important for the User to inform “SOS Himalaya” whenever there has been any modification to their personal data, so that we can keep the personal data updated.

Data Transfer

“SOS Himalaya” will not transfer or communicate your data to any third party, except in cases legally provided for or when the provision of a service implies the need for a contractual relationship with a Data Processor. Thus, the User accepts that some of the personal data collected may be provided to these Data Processors (payment platforms, consultancy, intermediaries, etc.), when necessary for the effective performance of a contracted service or purchased product. The User also accepts that, in the provision of services, these may be, wholly or partially, subcontracted to other individuals or companies, who will be considered Data Processors, with whom the corresponding confidentiality contract has been agreed, or who have adhered to their privacy policies established on their respective websites. The User may refuse the transfer of their data to Data Processors, by written request, through any of the previously referenced means.

Furthermore, in cases where necessary, Customer data may be transferred to certain organizations, in compliance with a legal obligation: Spanish Tax Agency, banking entities, Labor Inspection, etc.

Exercise of User Rights

The LOPD and GDD and the GDPR grant interested parties the possibility to exercise a series of rights related to the processing of their personal data. To do so, the User must address, providing documentation that proves their identity (ID card or passport), by email to fundacion@soshimalaya.org, or by written communication to the address provided in our Legal Notice. This communication must reflect the following information: name and surname of the User, the purpose of the request, the address, and the supporting data.

The exercise of rights must be carried out by the User themselves. However, they may be executed by an authorized person as the legal representative of the User, provided that the documentation proving such representation is provided.

The User may request the exercise of the following rights:

• Right to request access to personal data, which is the right to obtain information about whether their own personal data are being processed, the purpose of the processing that may be taking place, as well as the information available on the origin of such data and the communications made or planned for them.
• Right to request rectification, in the event that personal data are incorrect or inaccurate, or deletion of data that prove to be inadequate or excessive. Right to request the limitation of their processing, in which case only the data strictly necessary for the exercise or defense of claims will be retained by “SOS Himalaya”.
• Right to object to the processing: it refers to the right of the interested party to prevent the processing of their personal data or to cease such processing in cases where their consent is not necessary for the processing, where it concerns commercial prospecting files, or where it has the purpose of making decisions concerning the interested party and based solely on the automated processing of their data, except where legitimate reasons or the exercise or defense of possible claims require the processing to continue.
• Right to data portability: in the event that they wish their data to be processed by another company, “SOS Himalaya” will facilitate the portability of their data in an exportable format. In the event that consent has been given for a specific purpose, the User has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

We undertake to execute all these rights within the maximum legal period (1 month).

If a User believes that there is a problem with the way “SOS Himalaya” is handling their data, they can direct their complaints to the Security Officer or to the relevant data protection authority, with the Spanish Data Protection Agency being the appropriate authority in the case of Spain.

Retention of Data

The personal data of Users who use the contact form or send us an email requesting information will be processed for the strictly necessary time to respond to the information request or until consent given is revoked.

The personal data of the Customer will be processed until the contractual relationship ends. The retention period of personal data will be the minimum necessary, and may be maintained for:

• 4 years: Law on Social Order Infringements and Penalties (obligations regarding affiliation, registration, deregistration, contribution, salary payment, etc.); Arts. 66 et seq. General Tax Law (accounting books, etc.)
• 5 years: Art. 1964 Civil Code (personal actions without a special deadline)
• 6 years: Art. 30 Commercial Code (accounting books, invoices, etc.)
• 10 years: Art. 25 Money Laundering Prevention and Terrorist Financing Law.
• Indefinitely: disaggregated and anonymized data. On the other hand, the data of Users who subscribe to the bulletin or newsletter will be retained indefinitely, until the consent given is revoked.

In the case of processing of candidate data (CVs), “SOS Himalaya” may keep their resume stored for a maximum of two years to include it in future calls, unless the candidate expresses otherwise.

Social Networks

“SOS Himalaya” has profiles on some of the main social networks on the Internet (Facebook, Twitter, Instagram, Youtube), being recognized in all cases as the Data Controller of the data of its followers, fans, subscribers, commentators, and other User profiles (hereinafter, followers) published by “SOS Himalaya”.

The purpose of processing data by “SOS Himalaya”, when the law does not prohibit it, will be to inform its followers about its activities and offers, through any means allowed by the social network, as well as to provide personalized User service. The legal basis legitimizing this processing will be the consent of the interested party, which may be revoked at any time.

Under no circumstances will “SOS Himalaya” extract data from social networks, unless the User expressly and punctually consents to it (for example, for a contest).

International Data Transfers

“SOS Himalaya” uses the electronic communications services of the company Mailchimp, which is located in the United States. Standard contractual clauses approved by the European Commission have been signed with this entity, in order to ensure the appropriate level of protection in the processing of your personal data, in accordance with the criteria established by the GDPR.

Staff Selection

The applicant who sends electronic communications to “SOS Himalaya”, in order to access the personnel selection processes of the controller, authorizes us to analyze the documents sent (for example, the CV), all content directly accessible through Internet search engines (for example, Google), the profiles they maintain on professional social networks (for example, LinkedIn), the data obtained in access tests, and the information revealed in the job interview, with the aim of assessing their application and being able, where appropriate, to offer them a job. In case the candidate is not selected, “SOS Himalaya” may keep their CV stored for a maximum of two years, to include it in future calls, unless the candidate expresses otherwise. The legal basis legitimizing this processing will be the consent of the interested party, which may be revoked at any time.

Confidentiality

The information provided by the User will always be considered confidential and may not be used for purposes other than those described here. “SOS Himalaya” undertakes not to disclose or reveal information about the intentions of the User, the reasons for the advice requested, or the duration of their relationship with it.

Validity

This privacy and data protection policy has been drafted by ExpertosLOPD®, a law firm specializing in data protection for online stores, as of November 16, 2023, and may vary depending on changes in regulations and jurisprudence that occur, it being the responsibility of the data subject to read the updated document, in order to know their rights and obligations regarding it at all times.