Privacy Statement for UPWELLING
1.1 Who we are and why do we require your information?
UPWELLING is an INTERREG Atlantic Area project, co‑funded by the European Regional Development Fund (ERDF). For the purposes of applicable data protection legislation, UPWELLING partners act as joint data controllers in relation to the personal data processed within the framework of the project.
UPWELLING is required to collect, process and use certain types of information about individuals and organisations. Depending on the service requested or activity carried out, this information may include personal data as defined in Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and in Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (Ley Orgánica de Protección de Datos Personales y garantía de los derechos digitales, LOPDGDD).
Personal data may relate to current, former or prospective project participants, stakeholders or service users. In addition, UPWELLING may be required to process personal data in order to comply with legal or regulatory obligations or where such processing is necessary for the performance of tasks carried out in the public interest.
1.2 Why do we have a privacy statement?
This privacy statement, together with our cookie policy, explains why we collect personal data, how it is processed and the rights of data subjects. UPWELLING is committed to protecting privacy and ensuring that all personal data is processed lawfully, fairly and transparently.
UPWELLING processes personal data obtained through project application forms, event registrations, the project website and direct correspondence. We are committed to ensuring that all personal data is:
- Processed lawfully, fairly and transparently;
- Collected for specified, explicit and legitimate purposes;
- Adequate, relevant and limited to what is necessary;
- Accurate and, where necessary, kept up to date;
- Stored securely and protected against unauthorised or unlawful processing;
- Retained only for as long as necessary for the purposes for which it was collected;
- Processed in a manner that ensures appropriate confidentiality and integrity.
Where personal data is provided to UPWELLING, it may be shared with project partners where such internal sharing is relevant, proportionate and necessary for project implementation. Personal data may also be shared with public authorities, programme bodies or third‑party data processors where required by law or necessary for the performance of project activities. All third‑party processors are subject to appropriate contractual safeguards.
The legal basis for processing personal data includes compliance with legal obligations, performance of tasks carried out in the public interest, performance of a contract, and, where applicable, the data subject’s consent.
Personal data will be retained only for as long as necessary for the performance of project functions and compliance with applicable legal and funding obligations. Where personal data is transferred outside the European Economic Area (EEA), such transfers will only take place where appropriate safeguards are in place and in accordance with the GDPR.
For further details on the purposes and legal basis for processing personal data, data subjects may contact the Data Protection Officer, as indicated below.
1.3 Data Protection Policy
UPWELLING has a Data Protection Policy which sets out its commitment to full compliance with data protection obligations and to ensuring that personal data is processed only to the extent necessary for the performance of project activities.
1.3.1 What personal data do we need?
The types of personal data that may be requested by UPWELLING include:
- Contact details to allow effective communication;
- Professional or organisational information required for participation in project activities or services;
- Administrative or eligibility information required for reporting and compliance with EU funding rules.
1.3.2 Contact Details
To communicate with you, UPWELLING may request contact details such as name, email address, telephone number or organisation. You are not required to provide all contact details; however, providing sufficient information facilitates effective communication.
1.3.3 Record Retention
Personal data will be retained only for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal, financial and audit obligations, including those arising from EU funding regulations. For further information on specific retention periods, data subjects may contact the Data Protection Officer: data_protection@innovalia.org
1.3.4 How We Keep Your Information Safe
UPWELLING applies appropriate technical and organisational security measures to protect personal data, including IT security controls, secure storage and restricted access. Project staff and partners receive training in data protection and confidentiality.
All third parties processing personal data on behalf of UPWELLING are required to apply equivalent security standards.
1.3.5 Your Rights
In accordance with the GDPR and the LOPDGDD, data subjects have the following rights, subject to applicable legal limitations:
- The right to access personal data held about them;
- The right to rectification of inaccurate or incomplete personal data;
- The right to erasure of personal data;
- The right to restriction of processing;
- The right to object to processing;
- The right to data portability, where applicable.
To exercise these rights, data subjects must submit a request to the Data Protection Officer. Identity verification may be required to protect personal data.
All valid requests will be addressed without undue delay and, in any event, within one month of receipt, subject to extensions permitted under the GDPR.
1.3.6 Right of Complaint to the Data Protection Commission
If you are not satisfied with the response received from UPWELLING, you have the right to lodge a complaint with the competent supervisory authority.
In Spain, this authority is:
Agencia Española de Protección de Datos (AEPD) Website: www.aepd.es Postal address: Calle Jorge Juan, 6, 28001 Madrid, Spain
Telephone number: +34 900 293 183
1.3.7 Cookies
Cookies are small text files stored on the user’s device to collect standard internet log information and information about visitors’ browsing behaviour. This information is used to analyse website usage and to compile statistical reports.
The UPWELLING website uses cookies in accordance with European Union and Spanish cookie regulations and manages user consent through the Complianz GDPR Cookie Consent plugin. Cookies are only placed after the user has given explicit consent, except for strictly necessary cookies, which are required for the proper functioning of the website.
Where applicable, the website may use analytical cookies (such as Google Analytics) in anonymised form to help us understand how visitors interact with the website. These cookies are only activated if the user has consented to their use.
Users can manage their cookie preferences at any time via the cookie consent banner or by reopening the cookie settings on the website. Consent may be modified or withdrawn at any time, and the Complianz plugin records consent choices in accordance with applicable data protection requirements.
1.3.8 Other Websites
The UPWELLING website may contain links to other websites. This privacy statement applies only to UPWELLING services and websites. Users should review the privacy statements of external websites they visit.
1.4 Changes to our privacy statement
We keep our privacy statement under regular review and we will place any updates on this web page. This privacy policy was last updated on 21th January 2026.
- Governing Law and Jurisdiction
This privacy statement is governed by Spanish law. Any disputes relating to data protection matters shall fall under the jurisdiction of the competent courts of Spain, without prejudice to the rights of data subjects under applicable data protection legislation.