Privacy policy

The Repsol Foundation wishes to make the Data Subjects aware of the policy implemented with respect to the processing and protection of personal information. We want to maintain a transparent relationship with you and inform you about the way we securely collect and process any information that you provide us. To this end, we have drafted this Privacy Policy, (hereinafter the “Policy”), which will allow you to access the information you need and clear any doubts you may have.

Furthermore, we hereby inform you that your data will be processed in accordance with current personal data protection legislation, in particular Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data.

You must read this Policy carefully, as it contains the information you need to make an informed choice about providing us with your personal data.

You must know that the Policy applies to all processing of personal data that carried out in any of the Repsol Foundation programs or activities.

This Policy may be supplemented by additional local regulations if the country where you are located requires that these measures be taken. This Policy is not applicable to third-party websites, including the ones that you may access via web links on from our websites.

We hope that you find this information useful. However, if you have any additional questions, please do not hesitate to contact us.

What definitions do i need to know to understand the Policy better?

Firstly, here are the definitions for some terms that you will find in this document:

“Personal data” - refers to any information regarding an identified or identifiable natural person (i.e. a person who can directly or indirectly be identified).
"User" or "data subject” - except in cases where you provide us with information from third party data subjects, you must understand that you are the owner of your data.
"Data controller” - the natural or legal person, public authority, service or other body that, alone or jointly with others, determines the purpose and mean of processing.
“Data processor”- the natural or legal person, public authority, service or other body that processes personal data on behalf of a data controller.
“Third Party” - natural or legal person, public authority, service, or organization; apart from the data subject, data controller, data processor, or other person authorized to process personal data under the direct authority of the controller or processor.
“Recipient” - the natural or legal person, public authority, service, or other organization that receives the personal data, regardless of whether they are a Third Party.
"Consent” - equivalent to any freely given, unambiguous, specific, and informed expression of your will, through which you accept processing of your data, either by means of a declaration or a clear affirmative action.
“Personal data processing” - any operation or series of operations carried out on personal data or personal data sets,whether or not with automated procedures, such as collection, registration, organization, structuring, conservation, adaptation or modification, extraction, consultation, use, disclosure by transfer, dissemination, or any other means of enabling access, collation or interconnection, limitation, deletion, or destruction.
“Transfer” or “Communication of Data” - any disclosure of data to a natural or legal person, public authority, service, or other organization, regardless of whether they are a Third Party.
"Foundation” - abbreviation of the Repsol Foundation, which in all cases will be the Data Controller.

1. Does the Foundation have a Data Protection Officer?

The Foundation does not have a Data Protection officer as it is not a legal requirement, because the activity it carries out is unrelated to commercial processing and the data processing it performs is limited to what is necessary to fulfill its purposes and objectives contained in its Articles of Association.

However, if you have doubts about how your personal data is processed, you can send an us an email to: protecciondedatos@fundacionrepsol.com .

2. Who is the Data Controller?

Every time we collect your personal data, we will provide you with the necessary information as to why and what we are going to use it for, the legal basis for its processing, as well as your rights, and contact information.

3. Which personal data do we process and how do we obtain it?

The personal data we process includes, but is not limited to, the following:

those that you provide us freely
information derived from access to and use of the service or from your relationship with the Repsol Foundation, including your image in the case that you are informed in advance of the possibility of recording images
data resulting from your communications with us
your image in video-surveillance processing or when you attend an event with a certain public impact; having always informed you of the possibility that these images will be recorded
information that we may lawfully infer from the data we process
that which corresponds to your own browsing on our website, including your IP address or information from cookies or similar devices (find out more in the Cookies Policy on our website)
that which correspond to your social networking profiles
information which we could legitimately access, as it is publicly available
third-party data that you provide, with the prior consent of the Data Subject,data provided by third parties with your prior consent, or when there is a lawful basis.

4. For what purposes do we process your personal data, and which lawful basis applies in each case?

1. Managing your application to sign up to any of the Repsol Foundation programs

Participation in our programs requires prior registration, for which we will request the only the strictly necessary data according to the program, and we will process it in accordance with the information we provide you upon registration. If you are not sure, consult our Policy or send us an email.

Your registration request and your consent upon registering is the lawful basis that enables us to process your data.

2. Managing the relationship you have with us

We process your personal data mainly to manage the relationship you have with us as an intern, volunteer, participant in our projects—

including the Entrepreneurs Fund—user or data subject connected to the Repsol Foundation in any way, as well as to deal with possible complaints, doubts, questions or suggestions that you send us.

The relationship itself constitutes the lawful basis which enables us to process data.

3. Managing the volunteering program

If you join any of our volunteering programs, we will process your data to manage your participation, provide you with the necessary training, and make the volunteering activity possible. As an company that organizes volunteering activities, we are legally obliged to check your criminal record, as such, we can request any related documentation from you. We will process this information solely for the purpose of complying with our legal obligation.

In addition, depending on the case, we will allow you to bring someone. Remember, before providing us with third party data, you must obtain their consent.

The lawful basis of this processing is to carry out the volunteering activities you have registered for.

4. Fulfilling our accounting, legal, administrative, and tax-related obligations

The Repsol Foundation is required to comply with applicable regulations related to accounting, law, taxation, and administrative matters. We will process your data to the extent necessary to fulfill our legal obligations.

The lawful basis for such processing is compliance with legal obligations.

5. Managing customer service

In the different relations that we have with you, you will find our contact information, postage address, telephone and/or email, in case you wish to send us any type of suggestion, complaint or query.

In the event that contact any of our customer services, through any of the available channels, your data will be processed in order to be able to respond to your request.

6. Analyzing your browsing habits

We will process your data from browsing our websites in accordance with our Cookies Policy in order to analyze your browsing habits, personalize your experience, and improve our services and online content.

Your consent, is the lawful basis for us to process your data.

7. Find out more about your social networking profiles

The Repsol Foundation processes any information you share with us through your social networking profiles. For more information, see the section “How does the Repsol Foundation process your social networking profiles?

8. Organizing and managing draws, contents and events

In these cases, the data subject wishing to participate will voluntarily register by filling out any forms that the Repsol Foundation provides for this purpose and we will process the data to manage the data subject’s participation, prize delivery, where applicable, and any publication related to these activities.

In this case, data will only be processed with the consent of the data subject; granted by participation and management of their participation in the activity.

9. Managing contact information within the framework of contractual relationships or in order to send non-commercial information and invitations to events

The Repsol Foundation may process your contact information or of third-party representatives with whom we have contractual relationships, for the sole purpose of managing the contractual relationship.

The lawful basis that enables us in this case to process your data is the performance of the contract.

However, in addition, the Repsol Foundation may process contact information of potential legal entity clients, institution representatives, public body representatives, journalists, analysts or investors who have voluntarily provided us their data, in order to send them non-commercial information and invitations to Repsol Foundation events.

The lawful basis that enables us in this case to process their data is the consent of the data subject; granted by providing us with their contact information.

10. Avoiding liability before the General Social Security Treasury, and guaranteeing the quality of our suppliers’ services

The Repsol Foundation may process personal data of supplier employees, provided either by the supplier or by the employee. The purpose of this processing is to guarantee the quality of the supplier’s service, facilitate access to the Foundation's facilities, and avoid possible liabilities before the General Social Security Treasury for possible supplier overdrafts, within the framework of articles 42 and 43 of the Statute for Workers' Rights.

Our legitimate interest in controlling the relationship with our suppliers and the responsibilities and the associated responsibilities is the lawful basis for this processing.

11. The Repsol Foundation Compliance Channel

The Repsol Foundation has a compliance channel, accessible to anyone, to attend to and manage questions and/or messages in order to guarantee compliance with our Code of Good Governance, and which allows the Repsol Foundation to analyze and the necessary actions aimed at the investigation and prosecution of possible crimes that could occur within the framework of a relationship with the Repsol Foundation. This channel ensures the confidential processing of the person who reports the incident's information.

The data subject's consent, given by submitting a report, together with Repsol Foundation's legitimate interest in prosecuting criminal offenses which may affect it, serves as the lawful basis to process data in this case.

12. Security at Repsol Foundation facilities

The Repsol Foundation has video surveillance cameras to increase security at its facilities.

The lawful basis for processing is Repsol Foundation's lawful interest in preventing or investigating, where appropriate, potential incidents that occur at its facilities.

13. Events

The management of those people who are invited or sign up for an event organized or promoted by the Repsol Foundation is included in processing that the Repsol Foundation may carry out. The Repsol Foundation may record images of events for the purpose of publicly sharing them; the Data Subject will be informed , so they can decline the opportunity to attend the event or exercise their rights.

The lawful basis that enables us in this case to process their data is the consent of the data subject.

14. Candidates

In the event that you contact us showing interest in joining Repsol Foundation team, we will process your data, along with all the documentation you send us, in order to assess your profile and consider you for possible vacancies, in the event there is a hiring process.

5. How do we process your personal data?

We commit to processing your data in accordance with the applicable regulations and, in particular, using the appropriate organizational and technical measures to guarantee an appropriate level of security, ensuring the confidentiality, integrity, availability, and resilience of processing services and systems at all times.

6. Who will your data be shared with?

If we plan to lawfully transfer or communicate your personal data, we will inform you about the identity or category of recipients when collecting your data. These may include:

Third parties to whom we are legally required to transfer your data, such as Social Security or administrative and tax authorities.
Third parties to whom we are legally required to transfer your data, such as Social Security or administrative and tax authorities.
Third parties to whom we must communicate your data to fulfill the basic purposes of the relationship.

Lastly, we advise you that we have relationships with suppliers that provide us with certain services. These providers may access your information, although they will process it as Data Processors with the same guarantees that we apply in when processing your data.

We advise you that the Repsol Foundation limits the processing of personal data to the European Union, and we will inform you of any access carried out outside the European Union by any of our data processors, through this Policy.

7. How long do we store your personal data for?

In each case, we will inform you of the duration of the processing that will be sufficient to fulfill our obligations to you and to the corresponding authorities. In any case, the personal information you provide us will be kept for the duration of our relationship, and providing you do not request it to be deleted. Subsequently, and where appropriate, we may store them until the statute of limitations for criminal, civil, commercial, and/or administrative liability has passed.

8. What are your rights when you provide us with your data?

At any time, you may exercise a series of rights regarding the processing of your data. Every person has these rights and, consequently, they are unwaivable. You can find a description and an explanation about each of these below:

Right of access. By exercising this right, you can find out about how we process your personal data.

Right of Rectification. You may correct or modify your data if it is inexact or incomplete, in order to ensure that we have the correct details.
Right of Erasure (or Right to be Forgotten). You may request the erasure of your personal data when any of the scenarios provided applies. For instance, the unlawful processing of your data or when the purpose that gave rise to the processing or collection disappears. However, a series of exceptions to this right are regulated. For instance, when the right to freedom of expression and information must prevail.
Right to object. Through this right, you may object to the processing of your personal data: (i) when, for reasons related to your personal circumstances, your data must no longer be processed, except for when there is an accredited legitimate interest or it is necessary for the exercise or defense of legal claims, or (ii) when processing is carried out for direct marketing purposes.
Right to the restriction of processing. You may request that we restrict the processing of your personal data (i) while we are investigating the accuracy of data, when this accuracy has been contested (ii) when this processing is unlawful but you are opposed to your data being erased and, instead, request this limitation (iii) when you need your data to exercise or defend a legal claim (iv) and even when you have opposed the processing of your personal data to fulfill a mission of public interest or satisfy a lawful interest, which must be checked. In these cases, we will only keep data for the exercise or defense of legal claims.
Right to data portability. You can request the portability of your data in electronic format, as well as its transfer to another entity.

To exercise these rights, you can contact the Repsol Foundation, sending an email to protecciondedatos@fundacionrepsol.com, attaching a copy of your ID or an equivalent document, and indicating the processing you refer to.

Furthermore, at any time, you may revoke the consent you have given without this affecting the lawfulness of the processing already carried out, by sending a request to the same address specified in the previous paragraph. In this case, it is also necessary to include a copy of your ID or an equivalent document proving your identity.

Should you believe that your data has been processed improperly and not in compliance with personal data protection regulations, or should you believe that we have not acted accordingly with respect to exercising your rights; you may contact the supervisory authority, in the case of Spain, the Spanish Data Protection Agency.

9. What is our policy concerning the personal data of minors?

In most cases, the Repsol Foundation only processes data of persons above the age of 18 years. Nevertheless, there may be specific cases, especially any promotional action, program or activity where the personal data of minors are used, in this case, the consent and authorization of the parents or guardians will be requested if the minor is under the age of 14. If you are a minor and you are not sure you understand something that has been explained, ask your parents or guardians for help.

Regarding the use of social networks, we recommend that parents or guardians regularly check and supervise their children’s internet activity. Please make sure that your children do not provide us with personal data without asking for your authorization and consent.

You may exercise the rights of persons under 14 years of age at any time by evidencing your legitimate right to do so.

10. What happens if you provide us with the data of third parties?

In the event that, in relationship with us, you provide us with the data of third parties, we remind you that you have solely responsibility for obtaining their prior consent to sharing their data with the Repsol Foundation, for the purpose you have been notified of in each case; in addition to informing said party of its existence and the terms included in this Policy.

You are responsible for holding the Repsol Foundation harmless for any liability derived from the lack of information and/or consent from or to the third party.

11. How do we process your data on social networks?

We recommend that you avoid including personal information—your own or that of third parties—when you interact with us on social networks. However, if despite this, you decide to include personal information, you should know that your data will be processed by us in accordance with this Policy.

Specifically, the data you provide us through any social network will be processed with the purpose of relating and interacting with you on different social networks so you can get to know us better, as well as learn about our activities or values. This channel is not ideal for you to make complaints or suggestions, however, in the event you send us any type of request, claim, suggestion or complaint related to any of our programs or activities via social networks, we will provide you with an answer.

The lawful basis of this processing is your status as a friend or follower of our social networking profile. We advise you that we will process your data for a period of 2 years once you stop following our social networking profile. It is important to bear in mind that, when interacting with us through social networks, the terms and conditions established by the social network are beyond our control. Therefore, they are not covered by the content of this Policy. We recommend you make sure that you understand and agree to their legal terms and conditions and privacy regulations before using them or providing any type of personal information.

12. Can we change the terms of the Policy?

We may change this Policy at any time, but will always inform you of any significant changes through relevant notifications. Modifications, in any case, shall not be applied retroactively and will enter into force from the date of their publication. We advise you to regularly consult the Policy.

13. What are my responsabilities?

You are responsible for all the data you provide us with, for the veracity, accuracy, updates, validity, and authenticity of these, as well as for the consent you provide for their use and/or processing. You are also responsible for Third Party data that you provide us with, and for which you agree to obtain consent from these. Remember that you are responsible for checking this policy frequently, including any updates that may be made to it.