1. Who is responsible for your data
The controller of the personal data collected through this website is [PENDIENTE — facilitar], tax identification number [PENDIENTE — facilitar], with registered address at [PENDIENTE — facilitar]. Registry details: [PENDIENTE — facilitar].
For any matter relating to your personal data, write to [PENDIENTE — facilitar].
2. What data we collect
We collect only what the membership application requires. Nothing on this site is collected by observation, profiling or tracking.
- Identification: title, given and family names, nationality, country and city of residence.
- Professional: current position, organisation, professional sector, niches of specialty, areas of interest for networking, professional biography, publications, honours and awards, professional memberships, motivation for joining.
- Contact: email address, WhatsApp number, professional website, LinkedIn and other social media.
- Supporting documents: two professional photographs, and optionally a curriculum vitae and further material you choose to attach.
- Declaration: the four consents you tick, your typed name as signature, and the place and date of signing.
- Reference: where you name a professional reference, their name, position, organisation and email address.
- Internal only: any observations you send us, and the notes our review team records on your application. These are never published.
3. Why we process it, and on what legal basis
- To assess your application and decide on admission — your consent, and the steps taken at your request prior to membership (GDPR Art. 6.1.a and 6.1.b).
- To publish your professional profile in the print and digital Directory — your explicit and separate consent (Art. 6.1.a), which you give by ticking the publication declaration.
- To include your photographs in that profile — your consent, which also covers your image rights.
- To contact you about your application and your membership — the performance of our relationship with you (Art. 6.1.b).
- To comply with accounting, tax and record-keeping duties — our legal obligations (Art. 6.1.c).
4. Data about other people that you give us
If you name a professional reference, you are giving us another person's data. Please make sure you have told them, before you submit, that you have given us their name, position, organisation and email, and that they can exercise the rights set out in section 8 with us at any time. We use a reference's data for one purpose only: to assess your application. We do not add referees to any list and we do not contact them for any other reason.
5. What we publish, and what we never publish
If your application is accepted and you have given the publication consent, the following appears in your Directory profile: your name and title, position and organisation, country and city of residence, professional sector, niches, areas of interest, professional biography, publications, honours and professional memberships, together with your professional photographs.
Your email address and WhatsApp number are not published on the open web. They are shown only to other signed-in members of the Directory.
Your observations, the identity of your reference, your CV, your consents record and our internal review notes are never published, in any edition.
6. Who else handles your data
We do not sell personal data and we do not share it for advertising. Your data is handled on our behalf only by the providers that run this service, each under a data processing agreement:
- Supabase — database, file storage and authentication, hosted in the European Union.
- Vercel — website hosting and content delivery.
- The printer and distributor of the print edition, in respect of the published profile only.
7. How long we keep it
- Accepted and published members: for as long as the membership lasts, and afterwards for the periods required to defend against any legal claim.
- Applications not accepted, or withdrawn: twelve months from the decision, then deleted, together with any documents uploaded with them.
- Invitations that are never used: until they expire, and twelve months thereafter.
- Record of consents: for as long as the underlying processing lasts, as evidence that it was lawful.
- One limit we must state plainly: an edition of the Directory that has already been printed and distributed cannot be recalled or amended. Erasure applies to our systems and to every future edition, digital and printed.
8. Your rights
You may ask us at any time for access to your data, its rectification or erasure, the restriction of its processing, its portability, and you may object to processing. Where processing rests on your consent, you may withdraw that consent at any time, which does not affect the lawfulness of what was done before you withdrew it. Withdrawing the publication consent removes your profile from the digital Directory and from all future printed editions.
Write to [PENDIENTE — facilitar]. We will reply within one month. So that we do not disclose your data to somebody else, we may ask you to confirm your identity.
If you believe we have not resolved your request properly, you may complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
9. Security
Data is transmitted over an encrypted connection and stored encrypted at rest. Access to applications is restricted to the review team, each with a personal account. Uploaded documents are held in private storage that is never publicly addressable and is reachable only through short-lived links issued to authenticated staff. Invitation links are stored only as a cryptographic hash and can be used once.
10. Changes to this policy
If we change how we handle personal data we will publish the revised policy here and update the date at the head of this page. Where a change materially affects you, we will tell you by email.