Privacy and data protection policy

The Independent Authority for the Protection of the Informant, A.A.I. (AIPI) is committed to the protection of personal data and respect for the privacy of the users of its website.

In general, browsing this website does not require the provision of personal data. However, certain services, procedures or electronic procedures may require the provision of personal data, which will be treated in accordance with current regulations on data protection.

This privacy policy applies exclusively to the AIPI website and does not extend to third-party websites accessible through links included on this page.

The processing of personal data will be carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (RGPD) and with Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

Responsible for the treatment

The person responsible for the processing of personal data is the Independent Authority for the Protection of the Informant, A.A.I. (AIPI), with address at C/ Luis Cabrera, 9. 28002, Madrid.

The personal data provided or collected in the exercise of the powers of the AIPI will be treated confidentially and incorporated into the corresponding processing activities.

The updated list of treatment activities managed by the AIPI carries out is available in the Register of Treatment Activities (RAT), published and downloadable at the end of this page.

Purpose and legitimation of the treatments

Personal data will be processed only for the fulfillment of specific, explicit and legitimate purposes linked to the exercise of the functions and competences of the AIPI.

The specific purpose of each treatment, as well as its legal basis, is described in the corresponding treatment activity published in the Registry of Treatment Activities (RAT).

In general, the treatments carried out by the AIPI are based on the fulfilment of legal obligations, in the performance of a mission carried out in the public interest or in the exercise of public powers conferred on the AIPI, for the execution of contracts or based on the consent of the person concerned.

You can consult the legal basis of each of the treatment activities carried out by the AIPI in the Registry of Treatment Activities (RAT).

Categories of recipients

In general, personal data will not be communicated to third parties except when there is a legal obligation or legal authorization that allows it.

When necessary for the development of the actions of the AIPI, the data may be communicated to jurisdictional bodies, public administrations, competent authorities, Ombudsman or other recipients provided for in the applicable regulations.

Specific information on the recipients of each treatment can be consulted in the corresponding activity of the Registry of Treatment Activities.

Retention of data

Personal data will be kept for the time necessary to fulfill the purpose for which they were collected and, subsequently, during the periods required by the applicable regulations for the attention of possible legal responsibilities, as well as by the regulations on archives and documentary heritage.

Rights of interested persons

The interested persons may exercise their rights of protection before the person responsible for the treatment, where appropriate. Access, rectification, deletion, limitation and opposition to the processing, withdrawal of consent, as well as your right not to be subject to decisions based solely on the automated processing of your data.

The rights may be exercised through the procedures enabled in the electronic headquarters of the AIPI or through any of the means provided in the current regulations.

Right to file a claim

If you consider that the personal data protection rights referred to in the previous section have not been properly attended to by the AIPI, you may file a complaint with the Spanish Data Protection Agency, located in the Cuzco IV Building, Paseo de la Castellana, 141, floor 9. 28046 MADRID, through the following link.

Prior to submitting such a claim, you can contact the AIPI Data Protection Officer to raise any issue related to the processing of your personal data or the exercise of your rights.

Information about the Data Protection Officer

In accordance with the provisions of Article 37.7 of the GDPR, the AIPI has a Data Protection Officer, with whom you can contact at the following email address: dpd@aipi.gob.es

Record of Processing Activities (RoPA)

The AIPI maintains a Record of Processing Activities that collects the processing of personal data carried out in the exercise of its powers. Through the following link you can consult general information about each treatment activity and its main characteristics:

AIPI’s Register of Processing Activities

Additional information on data protection

Article 13 of the GDPR determines the Information to be provided by the controller when personal data are obtained from the data subject. In compliance with the information requirement set forth in the aforementioned article, the AIPI makes available to the interested parties the Additional Information or “second layer” of information on the processing of personal data for which it is responsible.

The document linked below aims to detail in a clear and accessible way the purposes of the processing of your data, the storage periods, the communications to third parties planned and the mechanisms available for the exercise of your rights.

Additional information on data protection