Privacy Policy

In compliance with Regulation (EU) 2016/679 of 27 April (General Data Protection Regulation, GDPR) and Organic Law 3/2018 of 5 December on Personal Data Protection and guarantee of digital rights, the following information is provided regarding the processing of your personal data obtained or collected through this website.

1. Who is the controller of the personal data?

The controller is FUNDACIÓN AQUAE (“AQUAE”), a private foundation under Spanish law, with registered office at Paseo de la Castellana 259, 31st floor, Torre de Cristal, 28046 Madrid (Spain), tax ID (NIF) G86426574, and registered in the Register of Foundations of Madrid.
This website (https://www.act4water.org/) may include links to platforms and pages managed by third parties. Those pages have their own Privacy Policy, which specifies the entity acting as controller and the purposes of processing.

2. What categories of data are processed? For what purposes and on what legal basis will your personal data be processed? For how long?

Simply visiting the website and browsing its sections does not require you to provide personal data or register as a user. However, cookies may be placed on your device. For more detail on the cookies we use, how to set your consent, and how to disable them, please see our Cookie Policy (https://www.act4water.org/politica-de-cookies/).
Data collected through the contact channels available on the website will be used to respond to your enquiries or requests. The legal basis is your consent. We will reply using the same channel or other means you authorise.
Your personal data will be retained for the time necessary to fulfil the purpose for which they were collected. In the case of the newsletter, data will be kept until you request to unsubscribe. Thereafter, data will be blocked for an additional period of 3 years to address potential legal liabilities. Once this period has expired, your data will be permanently deleted.

3. What security measures have been implemented to protect your personal data?

Your data will be processed in strict confidence. Appropriate technical and organisational measures have been implemented to ensure their security and to prevent destruction, loss, unauthorised access or unlawful alteration. In determining these measures, criteria such as the scope, context and purposes of processing, the state of the art, and the risks involved have been taken into account.

4. With whom do we share your data?

AQUAE engages service providers (e.g. technology support) who may have access to your personal data. Data processing agreements have been signed with these providers, who implement appropriate security measures and follow AQUAE’s instructions regarding any personal data to which they have access.
For service efficiency, some of our providers are located in countries outside the European Economic Area (EEA) or, although located within the EEA, share information with other entities based outside that territory. AQUAE ensures that:
– Transfers are made to countries for which the European Commission has issued an adequacy decision recognising an equivalent level of protection to that of the EU.
– In the absence of an adequacy decision, the European Commission’s Standard Contractual Clauses have been signed. For more information, see the Spanish Data Protection Authority (AEPD): https://www.aepd.es/es/derechos-y-deberes/cumple-tus-deberes/medidas-de-cumplimiento/transferencias-internacionales
For further information on this matter, you may contact the Data Protection Officer.
AQUAE does not disclose your personal data to third parties unless you have given your consent, we are required to do so by law, or disclosure is requested by a public authority or law‑enforcement agency.

5. What are your rights?

You have the following data protection rights:

Right	What it involves
Right of access	To know what personal data we hold about you.
Right to rectification	To have your personal data corrected where inaccurate or incomplete.
Right to object	To request that we do not process your data for certain specific purposes.
Right to erasure	To request the deletion of your personal data.
Right to restriction	To request the restriction of processing in certain circumstances.
Right to data portability	To request that we provide your information in a machine‑readable format or transmit it to another controller.
Right to lodge a complaint with the competent authority	To lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

You may exercise your rights by contacting AQUAE by email at fundacionaquae@fundacionaquae.org or by post at the address indicated in section 1, with the reference “Data protection”.
You may withdraw your consent at any time using the same contact channels. This will not affect the lawfulness of processing carried out prior to withdrawal.
The applicant must be properly identified in the request, which must be signed. If the request is submitted by a third party, adequate proof of representation must be provided. Where the controller has reasonable doubts concerning the identity of the natural person making the request, additional information may be requested to confirm the person’s identity.

6. Data Protection Officer

AQUAE has appointed a Data Protection Officer (DPO). You may contact the DPO at: dpo.es@veolia.com

7. Social media

As a general rule, AQUAE’s corporate social media profiles (Twitter, Facebook, etc.) are for information purposes only. If you provide data by private message on social media for the purpose of an enquiry or request made through that channel, the personal data provided will be used solely to handle your request, as described in this Policy. Please do not include your own or third‑party personal data (such as email addresses, names, phone numbers or contract numbers) in public messages on any social network. If you are unsure whether your message can be read by third parties, we recommend contacting us through another channel.

8. Changes to this policy

This policy may be updated at any time. Please review it periodically. If any changes substantially affect the processing of your data or your consent is required for any new processing, you will be informed accordingly so that your consent can be obtained again where necessary.