1. Contact Management and Marketing Communications

   1. Purpose.

      • Contact potential clients or interested parties.

      • Respond to requests for information or services submitted through any channel or contact form.

      • Send products, communications, and information through various means, including electronic communications.

   2. Legal Basis. Legitimate interest and the data subject's consent.
   3. Recipients. No data will be disclosed to third parties unless required by law.

2. CV Submission and Job Applications

   1. Purpose. Manage recruitment and personnel selection processes.
   2. Legal Basis. The data subject's explicit consent.
   3. Recipients. No data will be disclosed to third parties unless required by law.

3. Professional Contacts Only.

   1. Purpose. Maintain the professional relationship between the parties.
   2. Legal Basis. Legitimate interest.
   3. Recipients. No data will be disclosed to third parties unless required by law.

4. Security.

   1. Purpose. Monitoring and protection of individuals, property, facilities, access control, and visits.
   2. Legal Basis. Public interest, legitimate interest, and consent (where visitor access control is implemented).
   3. Recipients. No data will be disclosed to third parties unless required by law.

5. Donors and Voluntary Contributions.

   1. Purpose. Manage obligations arising from voluntary contributions or donations.
   2. Legal Basis. Compliance with obligations arising from the voluntary contribution.
   3. Recipients. No data will be disclosed to third parties unless required by law.

6. Human Resources

   1. Purpose. Management of the employment relationship, personnel records, payroll, employee welfare programs, labour claims, administrative proceedings, working-time control, and absenteeism monitoring
   2. Legal Basis. Consent, compliance with legal obligations, contract performance, and legitimate interest.
   3. Recipients. No data will be disclosed to third parties unless required by law.

7. Exercising Data Subject Rights

   1. Purpose. Respond to requests concerning rights established under the General Data Protection Regulation (GDPR).
   2. Legal Basis. Compliance with a legal obligation.
   3. Recipients. No data will be disclosed to third parties unless required by law.

8. Security Breach Management

   1. Purpose. Management and assessment of security breaches.
   2. Legal Basis. Compliance with legal or contractual obligations.
   3. Recipients. No data will be disclosed to third parties unless required by law.

9. Foundation Services and Clients:

   1. Purpose. Management of projects related to the Foundation’s objectives and participation of users/clients in activities organized or integrated by the Foundation (care services, training, residential centers, technological services, leisure services, job placement, and career guidance services)
   2. Legal Basis. Performance and development of contractual or pre-contractual relationships, consent of data subjects or their representatives, compliance with legal obligations, and legitimate interest
   3. Recipients. No data will be disclosed to third parties unless required by law.

You have the right to:

• Access your personal data.

• Rectify inaccurate data.

• Request erasure of your data.

• Restrict processing.

• Object to processing.

• Data portability.

• Withdraw consent at any time.

• Object to direct marketing communications.

Further information is available at https://www.intras.es/politica-de-privacidad or by contacting the Data Controller.

Personal data may be collected through website use, browsing activity, forms, email communications, or contractual relationships with us. Certain data fields may be mandatory, and failure to provide them may prevent the intended purpose from being fulfilled.

Information may also be collected through website navigation and cookies, as explained in our Cookie Policy.

The Data Controller reserves the right to amend this Privacy Policy at any time. Users are encouraged to review it periodically. Registered users will be informed of any substantial changes affecting the processing of their personal data.

Personal data will be retained for as long as necessary to fulfill the purpose for which they were collected and to determine any liabilities arising from such processing.

Specific retention periods include:

• Tax data: 4 years under Spanish General Tax Law 58/2003.

• Commercial data: 6 years under the Spanish Commercial Code.

• Anti-Money Laundering obligations: up to 10 years.

• Civil liability matters: for the applicable statutory limitation period.

• Employment-related data: for the legal limitation period applicable to labour actions.

Data will not be disclosed to third parties except where required by law or with the data subject's consent. Where necessary, data may be disclosed to:

• Public authorities (tax, labour, social security, etc.).

• Law enforcement agencies.

• Banking and financial institutions.

• Healthcare providers and insurance mutuals.

• Courts and tribunals.

You have the right to obtain confirmation as to whether your data are being processed, access your personal data, request correction of inaccurate data, request erasure where appropriate, restrict processing, object to processing, request data portability, and withdraw consent at any time.

You may exercise your rights using the contact details provided above. Forms for exercising these rights are available, although you may also use those provided by the Spanish Data Protection Agency (AEPD).

You also have the right to lodge a complaint with the Spanish Data Protection Agency if you believe your rights have not been properly addressed.

The maximum period for responding to requests is one month from receipt.

If your personal data change, please notify us in writing so that we may keep our records up to date.