Privacy and data protection policy

Through the website of the Independent Authority for Whistleblower Protection, personal data of the users are not collected without their knowledge, except as provided in the cookie policy that you can review separately. In no case will the aforementioned data be processed or transferred to third parties, except with the unequivocal consent of the affected person.

This privacy policy applies to the AIPI website; it is not guaranteed in the accesses through links to this site, nor to the links from this site to other websites.

The current regulations in the field of personal data protection are composed of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (RGPD) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). In accordance with these regulations, the AIPI undertakes to comply with its obligation of secrecy with regard to personal data and the duty to treat them confidentially. For these purposes, it will adopt the necessary measures to prevent their alteration, loss, treatment or unauthorized access.

Information on data protection

Below we inform you about the data protection policy of the Independent Authority for Whistleblower Protection.

Responsible for the treatment

The person responsible for the processing of your personal data is the Independent Authority for Whistleblower Protection, A.A.I. (AIPI), with address at C/ Luis Cabrera, 9. 28002, Madrid.

The personal data that AIPI may collect directly from the interested person will be treated confidentially and will be incorporated into the corresponding processing activity owned by the Record of Processing Activities (ROPA).

The updated list of AIPI’s treatment activities is available in the AIPI Record of Processing Activities (ROPA), published and downloadable on this site.

Purposes of the treatment activities and their legitimation

Through the web portal and the electronic headquarters no personal data are collected without due legitimacy. The data provided by the interested party will be used, solely and exclusively, for the purposes foreseen in each procedure or action.

The purpose of the processing of the data corresponds to each of the processing activities carried out by the AIPI and which are accessible in the Record of Processing Activities (ROPA).

The processing of your data is carried out for the fulfilment of legal obligations by the AIPI, for the fulfillment of missions carried out in the public interest or in the exercise of public powers conferred on the AIPI, as well as when the purpose of the processing requires your consent, which must be provided by means of a clear affirmative action.

You can consult the legal basis for each of the treatment activities carried out by the AIPI in the AIPI Record of Processing Activities (ROPA).

Retention of data

The personal data provided will be kept for the time necessary to fulfill the purpose for which they are collected and to determine the possible responsibilities that may arise from the purpose, in addition to the periods established in the regulations of archives and documentation.

Communication of data

In general, personal data will not be communicated to third parties, unless there is a legal obligation, among which may be communications to the Ombudsman, Judges and Courts, persons interested in the procedures related to the complaints filed.

You can consult the recipients for each of the treatment activities carried out by the AIPI in the published Record of Processing Activities (ROPA).

Exercise of rights under the European Data Protection Regulation (GDPR)

The interested parties may exercise their rights of access, rectification, deletion, limitation and opposition to the treatment before the data controller, where appropriate, withdraw their consent, as well as their right not to be subject to decisions based solely on the automated processing of their data, through this form available at the electronic headquarters of the AIPI or in person at any registry office of the General Administration of the State.

If you believe that your personal data protection rights have not been properly addressed by the AIPI, you can file a complaint with the Spanish Data Protection Agency. C/ Jorge Juan 6, 28001 MADRID, through the following link.

Prior to submitting such a claim, you can contact the Data Protection Officer in accordance with the provisions of art. 37.1 of the aforementioned Organic Law through the e-mail box dpd@aipi.gob.es

For any questions regarding the processing of your personal data or the exercise of your rights under the GDPR, you can contact the Data Protection Officer, whose function is to monitor compliance with the regulations on the subject.

Contact details of the data protection officer

In accordance with the provisions of Article 37.7 of the GDPR, it is made public that you can contact the data protection officer of the Independent Data Protection Authority at the following email address: dpd@aipi.gob.es

Register of Personal Data Processing Activities

AIPI’s Record of Processing Activities (ROPA)