In compliance with the provisions of Regulation (EU) 2016/679 of April 27, the European General Data Protection Regulation, and Organic Law 3/2018 of December 5 on Personal Data Protection and the guarantee of digital rights, we hereby provide you with information regarding the processing of your personal data obtained or collected through the LIFE MATRIX website, as well as through various forms and contact channels available.

1. Who is responsible for the processing of your personal data?

The processing of personal data will be the responsibility of:

• Cetaqua, Water Technology Center, Private Foundation, with CIF (tax identification number) G64386626 and registered office in Barcelona, at Ctra. d’Esplugues, No. 75 (08940) Cornellà de Llobregat.
• Galician Water Research Center, Private Foundation, with CIF G70312020 and registered office at Vila da Auga Rúa de José Villar Granjel, No. 33 (15890), Santiago de Compostela, A Coruña.
• Andalusian Water Research Center, Private Foundation, with CIF G93217743 and registered office at street Periodista Federico Alba, nº7 (29620), Torremolinos, Málaga.

These entities act as Joint Controllers (“Joint Controllers” or “CETAQUA”) of the treatments that are reported in the following sections. Concerning these treatments, the Joint Controllers have jointly determined the objectives and means of the processing of personal data and have regulated their respective responsibilities in compliance with data protection obligations in an agreement.

On the website www.cetaqua.com, you can find different links to platforms and pages managed by third-party entities. These pages have their own Privacy Policy detailing the entity responsible for processing the data and the purposes of it. CETAQUA assumes no responsibility for the processing of your data carried out on such pages.

2. For what purposes will your personal data be processed? What is the legal basis for?

CETAQUA may process your personal data as indicated below:

• Attend to your requests or inquiries. Personal data collected through the contact channels available on the website will be processed to attend to your query, suggestion, or request. This processing is based on the consent you provide when completing and submitting the form.
• Event registration. Personal data collected through the event registration form will be processed to manage your registration in the event or activity in which you want to participate, including sending you confirmation of registration information by electronic means and any other information regarding that event (changes in schedule, cancellations, access management, etc.). The legal basis is the consent you provide when completing the form and requesting your registration. If expressly authorized, your image and/or voice captured during the event may also be processed for dissemination in different media to promote the event. The legal basis is express consent.
• Communications and commercial calls. If you have expressly consented or requested it, CETAQUA may send you commercial communications by electronic means and/or contact you by telephone to inform you about requested updates, and upcoming events, send you the newsletter, etc. The legal basis is the consent you express when completing and requesting the sending of the communication or by checking the box enabled for this purpose.

At any time, you can revoke your consent or object to receiving electronic communications by unsubscribing from them or by sending an email to the Data Protection Officer, as indicated in the section ‘Rights of the data subjects’ of this Policy.

3. How long are they processed?

Your personal data will be kept for as long as necessary to fulfill the purpose for which they were collected. In the case of commercial communications, data will be kept until you request to unsubscribe from receiving such communications. Subsequently, the data will be blocked for an additional period of 3 years to respond to any legal responsibilities. After this period, your data will be permanently deleted.

4. What security measures are in place to protect your data?

CETAQUA has implemented adequate technical and organizational measures to ensure the security of personal data and prevent their destruction, loss, unlawful access, or unlawful alteration. In determining these measures, criteria such as the scope, context, and purposes of the processing, the state of the art, and existing risks have been taken into account.

5. With whom do we share your data?

CETAQUA uses service providers to perform certain tasks, such as technology service providers, providers for the organization and management of events, among others. These service providers act as data processors and may change over time. In any case, CETAQUA guarantees through the signing of agreements that these processors comply with appropriate security measures and follow its instructions in the processing of personal data to which they have access.

For the efficiency of the service, some of CETAQUA’s providers are located in countries outside the European Union (EU) or, being located in the EU, share information with other entities located outside that territory. CETAQUA ensures that:

• Transfers are made to countries for which the European Commission has declared that they provide a level of protection equivalent to the European one.

• In the absence of such a declaration of adequacy, the Standard Contractual Clauses approved by the Commission have been signed.

Communications will be made to third parties in the following cases:

(i) To public administrations, when required by legal obligation.

(ii) To agencies and media, in case you have authorized the use and dissemination of your image and/or voice.

(iii) In other cases, if you have expressly consented. When your consent is necessary to communicate your personal data to third parties, the data collection forms will inform you of the purpose of the processing, the data subject to communication, as well as the identity or sectors of activity of the possible data recipients.

6. Rights of those affected:

You have the following data protection rights:

To revoke your consents or to exercise your rights, the Joint Controllers have designated the email of the DPO dpo@cetaqua.com as the single point of contact, without prejudice to the fact that you can also send postal mail to the address of any of the Joint Controllers indicated in section 1 of this Policy.

The applicant must be sufficiently identified in the request. When the data controller has reasonable doubts about the identity of the individual making the request, it may request that additional information be provided to confirm their identity. If the request does not meet the specified requirements, CETAQUA may request that it be corrected.

In any case, you have the right to lodge a complaint with the competent data protection authority, in this case, by contacting the Spanish Data Protection Agency (www.aepd.es).

7. Data Protection Delegate

CETAQUA has appointed a Data Protection Officer. You can contact him to make any inquiries about the processing of your data or to exercise any of the rights indicated in the previous section at the contact email: dpo@cetaqua.com

8. Social media

As a general rule, CETAQUA’s corporate profiles on social media (X, Youtube, LinkedIn, etc.) are for informational purposes only. If you provide data through private messages on social media for a query or request made through that medium, the personal data provided will be used exclusively to address the request, as described in this Policy. We remind you not to include your own or third-party personal data (such as emails, names, phone numbers, or contract numbers) in open messages on any social network. If you are unsure whether your message can be read by third parties, we recommend contacting us through another channel.

9. Updating of this policy

This Policy may be revised by CETAQUA at any time. Please remember to review it periodically. In the event that the modifications involve a substantial change in the processing of your data or require your consent for any new processing, you will be informed about those changes in order to obtain your consent again in cases where it is necessary.

Privacy Policy revised on 30 January 2024.