Vitoria-Gasteiz City Council - Privacy policy

At the Vitoria-Gasteiz City Council and its autonomous organisations we are committed to protecting the privacy and ensuring the correct use of the personal data that we process and which you provide us with, both online on this website and via any of its sub-domains, micro-sites and/or mobile applications, and offline.

Please read this policy closely and ensure that you understand it and agree with it before providing us with your personal data. If you do not agree with it, do not use this website or its services and do not provide us with your data.

If you use this site, any of its services or provide us with your data, either online or offline, we will understand this to be a clear affirmative action via which you give us your consent (when necessary) to process your data for the purposes listed below.

If you wish to do so, you can also access the privacy policy of the municipal companies:

Policy

The personal data requested will be that which is strictly essential in order to identify and respond to the request made by the owner of said data or to provide the requested services and will not subsequently be processed in any way that is incompatible with said purposes.

The data gathered from each interested party will be appropriate, relevant and not excessive in relation to the purposes corresponding to each case and will be updated whenever necessary.

The owner of said data will be informed before their data is gathered and will also be informed of the general limits regulated in this policy so that they can expressly, precisely and unequivocally give their consent for the treatment of said data, in accordance with the following aspects:

1. Party responsible for processing of your data

The party responsible for your data is the Vitoria-Gasteiz City Council.

Postal address: Calle Pintor Teodoro Dublang, 25, 01008 Vitoria-Gasteiz, Álava
Telephone: 945 16 11 00
Data Protection Delegated Person: Miguel Moro
DPD Contact: dbo-dpd@vitoria-gasteiz.org

2. How your data is gathered

The Vitoria-Gasteiz City Council can obtain personal data in the following ways:

From the interested party themselves

You may have provided us with your data yourself, either online or offline, by requesting our services to be able to maintain the relationship with you.

If you have supplied data on this website or any of its sub-domains, micro-sites and/or mobile applications, you should know that we gather information, for example, when you register as a user, fill in any form with your personal data or when you communicate with us directly by e-mail.

When you provide us with your personal data, you guarantee that you are the person who is authorised to provide this information and that the information is correct, true, exact and up-to-date; that it is not confidential; that it does not violate any contractual restriction or third-party rights and that you agree not to impersonate other users by using their registration data for the different services and/or content on the website.

It is your responsibility to keep your data and profile correct and up-to-date and the Vitoria-Gasteiz City Council disclaims any responsibility if this is not completed.

Obtained automatically when you visit our website

When you visit our website, data is sent from your browser to our server in order to optimise our services and improve your experience as a user; for example, when you access the website or when you sign into our services via third party services, such as social networks or Google. This data can be collected and stored automatically by ourselves or by third parties on our behalf

In these cases, this data may include:

the user's IP address
the date and time of the visit
the URL of the website that the user has been directed from
the pages visited on our website
information about the browser used (type and version of the browser, operating system, etc.).

We can process and register said uses, sessions and associated information, be it independently or with the help of third party services, including via the use of "cookies" and other tracking technologies such as "flash cookies" and web analytics.

Cookies policy

Through disclosure of the interested party's data by a third party

In compliance with art. 28.2 of the Law 39/2015 of the 1st of October on the Common Administrative Procedure of Public Administrations, the Vitoria-Gasteiz City Council can consult or gather documents elaborated by any administration whenever the processing of data is necessary in order to comply with a mission carried out in the public interest or when exercising the public powers conferred to the City Council (art. 6.1 e) RGPD), as the Law 39/2015 of the 1st of October establishes that the public administrations are not to ask the interested parties for data or documents which are not required by the applicable governing regulations or which they have previously provided to any administration.

As well as in the previous case, if it is not you, the party concerned, but a third party, who provides us with your data, this may have been provided by relatives, entities and public and private organisations with whom we have established an agreement to develop social, cultural, or sports projects or collaboration agreements, etc. The categories of data that we process can be: identification data; personal characteristics; social, academic, professional, economic, financial circumstances and those regarding insurance; property and services transactions; employment details and even specially protected data regarding the health of the person concerned.

By accepting this policy, you authorise the Vitoria-Gasteiz City Council to gather from third entities or organisations, public and private, with whom we have established an agreement to develop social, cultural, or sports projects or collaboration agreements... additional data which may be necessary for the aforementioned purposes.

Sensitive data which is subject to special protection and the legitimacy to process said data is the express consent of the interested party. Therefore, it is the responsibility of said third party which provides us with data (entities or organisations, public and private, with whom we have reached an agreement to develop social, cultural, or sports projects or collaboration agreements...) both to obtain your prior and express consent to use your data and transfer it to us, as well as to inform you that your data will be processed by us, the City Council.

If it is not the interested party themselves (that is, you), but a third party which provides us with your data, said third party expressly guarantees that they have the authorisation for said transfer, releasing us from any responsibility should there be any complaint on your part, said responsibility corresponding solely and exclusively to the party who provided us with your data on your behalf or in your interest.

Through disclosure of third party data by the interested party

With regard to other people's data, you must respect their privacy, taking special care when disclosing or publishing their personal data. Only the owner can authorise the processing of their personal data. If you provide us with third party data, it is your responsibility to obtain their prior and express consent to use and disclose said data to us, and it is your responsibility to inform them of the fact that we intend to process their data. The publication of third party data without their consent may infringe, along with the data protection regulations, the regulation regarding said third party's right to honour, right to privacy or image rights. If you provide us with third party personal data, by accepting this privacy policy, you expressly guarantee that you have the authorisation of said party for said transfer, releasing us from any responsibility should there be any complaint on their part, said responsibility corresponding solely and exclusively to the party which has provided us with their data in their name.

3. Processing of your data

We can process the data that you provide us with, as well as any other data generated during the development of the relationship with the interested party/citizen for different purposes according to the municipal services which are object of the provision and, in all cases, to maintain contact and communication with said party/citizen and to manage the provision of the services requested and/or provided by this City Council.

Where applicable, more explicit and specific purposes may be indicated in the informative clauses included in each of the data collection avenues (web forms, paper forms, locutions or posters and information notices) for specific cases.

In compliance with article 30 of the GDPR, the Vitoria-Gasteiz City Council has a [[archive:88883.pdf Registry of treatment activities (version of 15 May 2020)]] of personal data that its activity requires.

4. Storage time of your data

In general, we store the personal data transferred to us in order to maintain a record of attention and to manage our services efficiently, while the condition of citizen of Vitoria-Gasteiz is intact and the interested party does not request the deletion of said data. Even when deletion is requested, said data will remain blocked for as long as necessary, their processing being limited to any of the following cases: to comply with legal/contractual obligations of any type which are required of us and/or during the legal time limits for the handling of any responsibilities on our part and/or to exercise or defend complaints resulting from the relationship maintained with the interested party/citizen.

In other cases, the duration of the storage of the data will depend on what is specified for each personal data processing case in the processing activities register.

5. Legitimacy for the processing of your data

The legal basis that authorises us to process your data can be diverse: in some cases, it can be the consent of interested parties, in others compliance with a legal obligation on our part, in others the compliance, by the Council, of a mission carried out in the public interest or to exercise Public Powers, in others the protection of vital interests and, in others, the execution of a contract.

The provision of the data requested is obligatory as it is essential in order to grant your request and/or provide our services; if you do not provide said data, we will not be able to comply with your request or provide said services.

When processing relies on your consent, you unequivocally provide said consent when you provide us with your data, considering said provision a clear affirmative action on your part which is proof of said consent. You can withdraw said consent at any time by sending an e-mail stating this to dbo-dpd@vitoria-gasteiz.org.

6. Recipients to whom we can disclose your data

The data that you provide us with can be disclosed to third entities in order to comply with purposes directly related with legitimate functions of the assigner and the assignee, such as to entities or organisations where there is a legal obligation to disclose data, public or private entities or organisations with whom we have established an agreement to develop social, cultural, or sports projects or collaboration agreements, etc.

We inform you that, should we use American supplier companies, they may have access to your personal data in order to provide us with services which are auxiliary to our activity (accommodation, housing, software as a service, remote safety copies, computer maintenance or support services, e-mail managers, e-mail sending and e-mail marketing, the transfer of files, etc...), these companies may differ and vary over time but, in all cases, we will choose companies which conform with the Privacy Shield agreement between the USA and the EU, or those belonging to countries which have been declared countries with a suitable level of protection, which means that they are obliged to comply with requirements that are equivalent to European ones in terms of data processing. In all cases, by accepting this data protection policy, you expressly and unequivocally authorise the disclosure of your data to said companies, aware that this implies an international transfer of data to a country that doesn't belong to the European Economic Area and give your unequivocal consent for said transfer.

7. Your rights when you provide us with your data

Right to access: You can ask us which personal data we are processing and even request a copy of said data.
Right to rectification: You can ask us to rectify your incorrect personal data or to add to any incomplete data, even by means of an additional statement.
Right to deletion (right to be forgotten): You can ask us to delete your personal data when said data is no longer necessary for the purposes for which it was gathered; you withdraw your consent; it has been unlawfully processed or in order to comply with a legal requirement.
Right to limitation of processing: You can ask us to limit the processing of your data, in which case we will only store said data in order to exercise or defend any complaints.
Right to data portability: You can ask us to return your personal data (to you or to a third party nominated by you) in a structured format, which is in common use and machine readable.
Right of opposition: You can oppose the processing of your data if said processing is based on the legitimate interest of the party responsible for the file or for advertising purposes.

Exercising your rights

In order to exercise all of these rights, you can contact the City Council with a signed written request, in all cases accompanied by a copy of your DNI (National Identity Card), sent to the postal address or e-mail address at the beginning of this privacy policy. If you want to modify your data, notify us of this using the same address. Once any of the aforementioned requests are received, we will respond to you within the legal deadlines.

Any complaints should be made to the Basque Agency for Data Protection. If you require more information regarding the rights that you can exercise and to request models of forms in order to exercise your rights, visit the website of the Basque Agency for Data Protection: http://www.avpd.es.

Said rights can also be exercised online at the electronic headquarters of the Vitoria-Gasteiz City Council.

Related information

If the information on the page does not match your information requirements, please apply via the Citizens' mailbox.