At the Vitoria-Gasteiz City Council and its autonomous organisations we are committed to protecting the privacy and ensuring the correct use of the personal data that we process and which you provide us with, both online on this website and via any of its sub-domains, micro-sites and/or mobile applications, and offline.
Please read this policy closely and ensure that you understand it and agree with it before providing us with your personal data. If you do not agree with it, do not use this website or its services and do not provide us with your data.
If you use this site, any of its services or provide us with your data, either online or offline, we will understand this to be a clear affirmative action via which you give us your consent (when necessary) to process your data for the purposes listed below.
The personal data requested will be that which is strictly essential in order to identify and respond to the request made by the owner of said data or to provide the requested services and will not subsequently be processed in any way that is incompatible with said purposes.
The data gathered from each interested party will be appropriate, relevant and not excessive in relation to the purposes corresponding to each case and will be updated whenever necessary.
The owner of said data will be informed before their data is gathered and will also be informed of the general limits regulated in this policy so that they can expressly, precisely and unequivocally give their consent for the treatment of said data, in accordance with the following aspects:
- Party responsible for processing of your data
- How your data is gathered
- Processing of your data
- Storage time of your data
- Legitimacy for the processing of your data
- Recipients to whom we can disclose your data
- Your rights when you provide us with your data
1. Party responsible for processing of your data
The party responsible for your data is the Vitoria-Gasteiz City Council.
- Postal address: Calle Pintor Teodoro Dublang, 25, 01008 Vitoria-Gasteiz, Álava
- Telephone: 945 16 11 00
- Data Protection Delegated Person: Mrs Ana Novoa
- DPD Contact: email@example.com
2. How your data is gathered
The Vitoria-Gasteiz City Council can obtain personal data in the following ways:
From the interested party themselves
You may have provided us with your data yourself, either online or offline, by requesting our services to be able to maintain the relationship with you.
If you have supplied data on this website or any of its sub-domains, micro-sites and/or mobile applications, you should know that we gather information, for example, when you register as a user, fill in any form with your personal data or when you communicate with us directly by e-mail.
When you provide us with your personal data, you guarantee that you are the person who is authorised to provide this information and that the information is correct, true, exact and up-to-date; that it is not confidential; that it does not violate any contractual restriction or third-party rights and that you agree not to impersonate other users by using their registration data for the different services and/or content on the website.
It is your responsibility to keep your data and profile correct and up-to-date and the Vitoria-Gasteiz City Council disclaims any responsibility if this is not completed.
Obtained automatically when you visit our website
When you visit our website, data is sent from your browser to our server in order to optimise our services and improve your experience as a user; for example, when you access the website or when you sign into our services via third party services, such as social networks or Google. This data can be collected and stored automatically by ourselves or by third parties on our behalf
In these cases, this data may include:
- the user's IP address
- the date and time of the visit
- the URL of the website that the user has been directed from
- the pages visited on our website
- information about the browser used (type and version of the browser, operating system, etc.).
We can process and register said uses, sessions and associated information, be it independently or with the help of third party services, including via the use of "cookies" and other tracking technologies such as "flash cookies" and web analytics.
Through disclosure of the interested party's data by a third party
In compliance with art. 28.2 of the Law 39/2015 of the 1st of October on the Common Administrative Procedure of Public Administrations, the Vitoria-Gasteiz City Council can consult or gather documents elaborated by any administration whenever the processing of data is necessary in order to comply with a mission carried out in the public interest or when exercising the public powers conferred to the City Council (art. 6.1 e) RGPD), as the Law 39/2015 of the 1st of October establishes that the public administrations are not to ask the interested parties for data or documents which are not required by the applicable governing regulations or which they have previously provided to any administration.
As well as in the previous case, if it is not you, the party concerned, but a third party, who provides us with your data, this may have been provided by relatives, entities and public and private organisations with whom we have established an agreement to develop social, cultural, or sports projects or collaboration agreements, etc. The categories of data that we process can be: identification data; personal characteristics; social, academic, professional, economic, financial circumstances and those regarding insurance; property and services transactions; employment details and even specially protected data regarding the health of the person concerned.
By accepting this policy, you authorise the Vitoria-Gasteiz City Council to gather from third entities or organisations, public and private, with whom we have established an agreement to develop social, cultural, or sports projects or collaboration agreements... additional data which may be necessary for the aforementioned purposes.
Sensitive data which is subject to special protection and the legitimacy to process said data is the express consent of the interested party. Therefore, it is the responsibility of said third party which provides us with data (entities or organisations, public and private, with whom we have reached an agreement to develop social, cultural, or sports projects or collaboration agreements...) both to obtain your prior and express consent to use your data and transfer it to us, as well as to inform you that your data will be processed by us, the City Council.
If it is not the interested party themselves (that is, you), but a third party which provides us with your data, said third party expressly guarantees that they have the authorisation for said transfer, releasing us from any responsibility should there be any complaint on your part, said responsibility corresponding solely and exclusively to the party who provided us with your data on your behalf or in your interest.
Through disclosure of third party data by the interested party
3. Processing of your data
We can process the data that you provide us with, as well as any other data generated during the development of the relationship with the interested party/citizen for different purposes according to the municipal services which are object of the provision and, in all cases, to maintain contact and communication with said party/citizen and to manage the provision of the services requested and/or provided by this City Council.
Where applicable, more explicit and specific purposes may be indicated in the informative clauses included in each of the data collection avenues (web forms, paper forms, locutions or posters and information notices) for specific cases.
4. Storage time of your data
In general, we store the personal data transferred to us in order to maintain a record of attention and to manage our services efficiently, while the condition of citizen of Vitoria-Gasteiz is intact and the interested party does not request the deletion of said data. Even when deletion is requested, said data will remain blocked for as long as necessary, their processing being limited to any of the following cases: to comply with legal/contractual obligations of any type which are required of us and/or during the legal time limits for the handling of any responsibilities on our part and/or to exercise or defend complaints resulting from the relationship maintained with the interested party/citizen.
In other cases, the duration of the storage of the data will depend on what is specified for each personal data processing case in the processing activities register.
5. Legitimacy for the processing of your data
The legal basis that authorises us to process your data can be diverse: in some cases, it can be the consent of interested parties, in others compliance with a legal obligation on our part, in others the compliance, by the Council, of a mission carried out in the public interest or to exercise Public Powers, in others the protection of vital interests and, in others, the execution of a contract.
The provision of the data requested is obligatory as it is essential in order to grant your request and/or provide our services; if you do not provide said data, we will not be able to comply with your request or provide said services.
When processing relies on your consent, you unequivocally provide said consent when you provide us with your data, considering said provision a clear affirmative action on your part which is proof of said consent. You can withdraw said consent at any time by sending an e-mail stating this to firstname.lastname@example.org.
6. Recipients to whom we can disclose your data
The data that you provide us with can be disclosed to third entities in order to comply with purposes directly related with legitimate functions of the assigner and the assignee, such as to entities or organisations where there is a legal obligation to disclose data, public or private entities or organisations with whom we have established an agreement to develop social, cultural, or sports projects or collaboration agreements, etc.
We inform you that, should we use American supplier companies, they may have access to your personal data in order to provide us with services which are auxiliary to our activity (accommodation, housing, software as a service, remote safety copies, computer maintenance or support services, e-mail managers, e-mail sending and e-mail marketing, the transfer of files, etc...), these companies may differ and vary over time but, in all cases, we will choose companies which conform with the Privacy Shield agreement between the USA and the EU, or those belonging to countries which have been declared countries with a suitable level of protection, which means that they are obliged to comply with requirements that are equivalent to European ones in terms of data processing. In all cases, by accepting this data protection policy, you expressly and unequivocally authorise the disclosure of your data to said companies, aware that this implies an international transfer of data to a country that doesn't belong to the European Economic Area and give your unequivocal consent for said transfer.
7. Your rights when you provide us with your data
- Right to access: You can ask us which personal data we are processing and even request a copy of said data.
- Right to rectification: You can ask us to rectify your incorrect personal data or to add to any incomplete data, even by means of an additional statement.
- Right to deletion (right to be forgotten): You can ask us to delete your personal data when said data is no longer necessary for the purposes for which it was gathered; you withdraw your consent; it has been unlawfully processed or in order to comply with a legal requirement.
- Right to limitation of processing: You can ask us to limit the processing of your data, in which case we will only store said data in order to exercise or defend any complaints.
- Right to data portability: You can ask us to return your personal data (to you or to a third party nominated by you) in a structured format, which is in common use and machine readable.
- Right of opposition: You can oppose the processing of your data if said processing is based on the legitimate interest of the party responsible for the file or for advertising purposes.
Exercising your rights
Any complaints should be made to the Basque Agency for Data Protection. If you require more information regarding the rights that you can exercise and to request models of forms in order to exercise your rights, visit the website of the Basque Agency for Data Protection: http://www.avpd.es.
Said rights can also be exercised online at the electronic headquarters of the Vitoria-Gasteiz City Council.