1. Acceptance of the Privacy Policy

The access and use of this Digital Directory by the user (hereinafter the “User”) implies the acceptance by the user of this Privacy Policy in its entirety and is obliged to comply with what is contained therein as well as with what is indicated in the Legal Notice.

2. Content of the Privacy Policy

Users of this website are informed that any personal data they provide through this website, whether by completing any form, email, or any other means, will be processed by the website owner in accordance with this Data Protection Policy.

Who is responsible for processing your data?

Identity: Spanish Association of Retail Centers and Parks; Tax ID: G-78922275; postal address: Calle Mauricio Legendre, 19, 1º A, 28046 – Madrid (Spain); telephone: 913084844; and email: asociacion@aedecc.com.

For what purpose do we process your personal data?

The data may be processed for the following purposes, depending on the reason for which it was provided:
• Manage membership registration requests.
• Manage subscription to the Directory, as well as the test request, if applicable.
• Manage registration for our Congress.
• Manage participation in other events (fairs, presentations, activities, etc.).
• Respond to requests for information, petitions, queries, or complaints made by the user, and subsequently follow up on them.
• Send newsletters and other commercial communications by electronic means, unless the user expresses his or her wishes to the contrary by any means. These communications will inform users about the various services, sweepstakes, promotions, contests, and other events offered by the AECC.

What is the legitimacy for processing your data?

The legal basis for processing personal data for the purpose of managing membership applications, Directory subscriptions or tests, registrations for our Congress, and participation in various events is the contractual relationship or the adoption of pre-contractual measures with the AECC. Therefore, it is mandatory that you provide your data; otherwise, the fulfillment of the contract will be impeded.

The legal basis for processing personal data for the purpose of responding to requests for information, petitions, inquiries, or complaints will be the data subject’s consent to the processing of their data, which is expressed by completing and submitting the various forms available on the AECC website or by contacting us by any other means. This consent may be revoked at any time. In any case, authorization to process your data for these purposes is voluntary, and refusal to do so would only result in the specific request being unable to be processed.

Finally, in the case of partners, the prospective offer of products and services is based on the satisfaction of legitimate business interest. This legitimate interest is recognized by applicable law, which expressly permits the processing of personal data on this basis for direct marketing purposes. However, we remind you that you have the right to object to this processing of your data at any time, and you may do so through any of the means provided in this clause. In any case, authorization to process data for this purpose is voluntary, and the user’s refusal would only result in the user not receiving commercial information. However, if you provide us with your data to receive the newsletter, it will be processed based on your consent, expressed by completing the appropriate form.

How long will we process your data?

The data retention periods for the various processing processes will be:
• Personal data provided to manage membership applications and subscription or proof of membership in the Directory will be retained for as long as the legal relationship between the company and the AECC is maintained and, even afterward, until any potential liabilities that may arise have expired and for as long as required by applicable regulations.
• The personal data provided for registration to our Congress or to various AECC events will be retained until the end of the activity. Afterwards, the data will be retained until any potential liabilities arising from the activity in question expire.
• Personal data provided to make requests, inquiries, or complaints will be retained for the time necessary to respond to them and definitively close them. They will then be retained as a communications history, unless the interested party requests their deletion, for a maximum of one year.
• Personal data provided for the purpose of sending commercial communications will be retained indefinitely, until the user expresses their wish to delete it.

To which recipients will your data be communicated?

Personal data will be treated confidentially and will be disclosed only to public authorities, in the cases provided for by law and for the purposes defined therein, and to financial institutions through which collections and payments are processed, where applicable.

We use MailChimp to send commercial communications via email, and it adheres to the EU-US Privacy Shield Framework (https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAAG&status=Active). Data will be transferred to Atlanta, Georgia.

What’s happening with social media?

If you become our friend or follower on social media, we will process your data to keep you informed of our activities and promotions through these channels. This data will be processed on the legal basis of your consent and will be retained as long as you remain our friend or follower. You may revoke your consent at any time, although this will not affect the legality of any previously processed data. Providing your data for this purpose is voluntary; however, if you do not do so, you will not be able to become our friend or follower on the social media platforms we operate. The categories of data processed for this purpose are identifying data.

In cases where user registration is carried out through social networks, the personal data we process will come from the relevant social network, to which the data subject will have previously provided said data for the purposes set forth in their corresponding privacy policies. The categories of data we will collect from the relevant social network are those listed in our registration form and those you have provided to said social network. If, in order to register on our website, more data than that provided by the social network is essential, you must additionally complete them on our registration form, subject to the privacy conditions set forth in this clause.

What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation as to whether or not we are processing personal data concerning them. Data subjects have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

Under the conditions provided for in the General Data Protection Regulation, data subjects may request the restriction of the processing of their data or its portability, in which case we will only retain it for the exercise or defense of legal claims. In certain circumstances and for reasons related to their particular situation, data subjects may object to the processing of their data. If you have given consent for a specific purpose, you have the right to withdraw it at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal. In these cases, we will stop processing the data or, where appropriate, we will stop doing so for that specific purpose, except for compelling legitimate reasons or the exercise or defense of potential legal claims.

All of the aforementioned rights can be exercised through the contact methods listed at the beginning of this clause.

In the event of any violation of your rights, especially when you have not obtained satisfaction in exercising them, you can file a complaint with the Spanish Data Protection Agency (contact details available at www.agpd.es) or another competent supervisory authority.

You can also obtain more information about your rights by contacting these organizations.

If you provide third-party data, you are responsible for informing them in advance of everything provided for in Article 14 of the General Data Protection Regulation under the conditions established therein and for obtaining their consent.

The AECC is committed to using the personal data provided for the purposes indicated in this Data Protection Policy, respecting their confidentiality and fulfilling its obligation to store them and adopt all measures to prevent alteration, loss, unauthorized processing, or access, in accordance with current data protection regulations.