This document regulates the processing of data provided by users, visitors, and individuals interested in the services offered by the Bilbao Chamber of Commerce, Industry, Services and Navigation (hereinafter CCISNB), in accordance with the provisions of the General Data Protection Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016, and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights.

The purpose of this Privacy Policy is to explain how personal data is collected, processed, and protected so that individuals whose data is processed by the Bilbao Chamber may freely and voluntarily decide whether they wish to provide such data through the forms made available for that purpose. Likewise, this Privacy Policy regulates the processing of personal data previously provided by the user through means other than the Website, or data that may be provided in the future with reference to this Policy, insofar as this does not contradict the terms expressly accepted at the time the data was provided, which will in all cases be respected.

Access to and use of this website implies full acceptance by visitors, who are obliged to comply with the terms and conditions set out in this Privacy Policy, which may be modified in accordance with subsequent regulations, judicial decisions, or the business needs of the CCISNB.

In the case of minors under 14 years of age, parental or guardian consent is required for the processing of their personal data.

Under no circumstances shall data relating to a minor’s professional or economic situation or to the privacy of other family members be collected without their consent.

If you are under 14 years of age and access this Website without informing your parents or guardians, you must not register as a user.

This Website respects and safeguards the data of all users. Users must know that their rights are guaranteed.

In each of the services offered on the Website, users will find a specific information clause relating to the processing of personal data requested for the execution of the corresponding service.

IDENTIFICATION AND DETAILS OF THE DATA CONTROLLER

The CCISNB is a public-law corporation that acts as an advisory and collaborative body to public administrations and whose purpose is the representation, promotion, and defense of the general interests of commerce, industry, services, and navigation, as well as the provision of services to companies.

You may contact the CCISNB as data controller:

In person or by postal mail addressed to CCISNB: Cámara de Comercio de Bilbao, Alda. Recalde 50, 48008 Bilbao
By email / telephone: atencionaclientes@camarabilbao.com / 944 70 65 00
Tax ID: Q4873001D
Email of the Data Controller: lopd@camarabilbao.com
Data Protection Officer: dpd@camarabilbao.com
Websites: camarabilbao.com, cubs.camarabilbao.com, idiomas.camarabilbao.com, formacion.camarabilbao.com

PROCESSING OF PERSONAL DATA AND PURPOSES OF USE

The Bilbao Chamber of Commerce, Industry, Services and Navigation processes personal data collected in order to fulfil, in general, the purpose and functions assigned to it by Law 4/2014 of 1 April, Basic Law of the Official Chambers of Commerce, Industry, Services and Navigation, and specifically for the following purposes:

Automated processing
Clients of business and individual services, collaborators, and suppliers
– Manage and process services to business and individual clients, or companies or self-employed individuals affiliated with the CCISNB (activities, events, etc., organized or provided by the CCISNB), and orders to suppliers and collaborators for the management and invoicing of the service.
– Manage administration and registration.
– Fulfil the purpose and carry out the public-administrative functions assigned to the CCISNB by Law 4/14 of 1 April.
– Manage and process the various programmes or activities in which the Bilbao Chamber participates within the framework of cooperation mechanisms with public administrations and other entities in matters such as internationalisation, cooperation, employability, or any actions aimed at improving competitiveness in the fields of commerce, industry, services, and navigation in Bizkaia.
Data disclosures: Gipuzkoa Chamber, Álava Chamber, Tax Administration, Spanish Chamber of Commerce, Basque Government, European Social Fund, ERDF, Provincial Council of Bizkaia, public bodies, financial institutions, and other collaborating or sponsoring entities.
International transfers: to countries identified in the International Missions service.

Training activities
– Manage training activities (business training, languages, university studies, postgraduate programmes, etc.) offered by the Bilbao Chamber.
– Manage admissions and placement tests taken by individuals interested in studying at Camarabilbao University Business School or other training programmes.
– Manage aspects related to student status at Camarabilbao University Business School or other academic activities.
– Manage, process, and invoice the service.
Data disclosures: UPV/EHU, Mondragón Unibertsitatea, Media Interactiva Formación, AERCE, ESIC, EMY, companies, and other partnering universities and entities.
International transfers: to countries where collaboration for language stays takes place.

Sending of commercial communications and information of interest
– Manage the sending of commercial communications and information of interest for the sale of products and/or provision of services in compliance with the purposes described in Law 4/2014, addressed to companies and individuals who, whether or not they are clients or affiliated with the Bilbao Chamber, have requested or consented to receiving such communications.

Programmes and activities to support employability
– Manage and process internship and scholarship programmes established to improve or facilitate individual employability.
– Manage the employment database for alumni of the Chamber’s training activities.
Data disclosures: national and international partner companies.
International transfers: for Global Training internships.

Management of information requests
– Process and respond to information requests and questions submitted by interested individuals through the website or other communication channels.
Data disclosures: ESIC, Mondragón Unibertsitatea, Media Interactiva Formación, AERCE, EMY, companies and collaborating entities.

Subscriptions to the Bilbao Chamber
– Management of the different existing subscriptions.

Video surveillance
– Manage personal information obtained through audiovisual recording mechanisms to ensure the safety of people and facilities.

Public Company Census
– Prepare and manage the Public Company Census in accordance with Article 8 of Law 4/2014.
– Fulfil the public-administrative functions assigned to the CCISNB.
Data disclosures: Spanish Chamber of Commerce and entities or individuals with legitimate interest.

Business Electoral Census
– Prepare and manage the Business Electoral Census in accordance with Article 17 of Law 4/2014.

Conflict resolution files
– Manage conflict resolution cases handled by the Arbitration Court.

Personnel selection
– Manage information about individuals applying for a job at the Bilbao Chamber or affiliated or collaborating entities.

Human resources management
– Manage personal data necessary for the employment relationship, payroll processing, social security, variable data generation, and planning of schedules, working hours, and duties.

Assistance and benefits for Bilbao Chamber employees
– Manage personal information related to applications for various social benefits offered by the CCISNB Collective Agreement.

Non-automated processing
Medical data
– Manage medical information provided or requested for services requiring it, generally training activities, language stays abroad, language school, or Camarabilbao University Business School.
International transfers: to countries involved in language stay programmes.

DATA OF SELF-EMPLOYED INDIVIDUALS AND CONTACT PERSONS IN ORGANISATIONS

In accordance with Article 19.3 of the Organic Law on Data Protection, the CCISNB is authorised to process the data of self-employed individuals, as well as the contact details of individuals who provide services in a legal entity, for professional location purposes, for maintaining relations of any kind with the entity for which they work, or, in the case of self-employed individuals, due to their business activity. All this is due to the legal obligation to manage the Bizkaia Public Company Census and the execution of the public functions established in Law 4/2014.

ORIGIN OF THE DATA

Personal data processed is obtained directly from the data subject or their legal representative or authorised person, or from public administrations in accordance with Law 4/2014, or from publicly accessible sources.

ACCURACY AND TRUTHFULNESS OF THE DATA PROVIDED

Users of CCISNB services guarantee and are responsible for the accuracy, validity, and authenticity of the personal data provided, and commit to keeping it duly updated.

RETENTION

Personal data will be kept for as long as necessary to fulfil the purposes for which it was collected, in order to maintain the relationship or link with the organisation, and until the data subject requests its deletion. Data will also be retained for the legally required time periods for compliance with mandatory obligations applicable to the CCISNB.

LEGAL BASIS FOR DATA USE

The legal basis for processing data shall be established under Articles 6 and 9 of the GDPR, as well as Article 19.3 of the LOPD. The data subject will be informed of the applicable lawful basis for each service provided, which may include consent, execution of a contractual or legal relationship, compliance with legal obligations, legitimate interest of the CCISNB, or its public interest.

Likewise, under Article 21.2 of Law 34/2002 on Information Society Services and Electronic Commerce, the CCISNB may send electronic commercial communications relating to the services it provides to clients or affiliated entities.

RECIPIENTS, TRANSFERS AND DISCLOSURES

During data processing, the CCISNB will not disclose data except in compliance with a legal obligation or with the prior authorisation of the data subject, who will be informed of the consequences of withholding consent, particularly the impossibility of providing the corresponding service.

Provision of services may require communication with IT service companies acting as data processors for the Bilbao Chamber under confidentiality and security conditions. These companies may be located outside the European Union under the EU–US Privacy Shield framework. Information available at: https://www.privacyshield.gov/.

SECURITY AND CONFIDENTIALITY MEASURES

The CCISNB undertakes to use and process users’ personal data with respect for confidentiality and in accordance with its intended purpose, and to take all measures necessary to prevent alteration, loss, unauthorised processing, or access, in accordance with applicable data protection regulations.

This Website includes an SSL certificate, a security protocol ensuring that data is transmitted safely and fully encrypted between the server and the user.

The CCISNB cannot guarantee the absolute invulnerability of the Internet and therefore cannot prevent possible fraudulent access by third parties.

With regard to confidentiality, personal data collected through the Website or through communications with users will be treated confidentially, and we undertake to keep them secret in accordance with applicable legislation.

In the event of a security incident, the CCISNB shall notify the client without delay and provide relevant information as soon as it becomes available or upon request.

RIGHTS

The CCISNB enables data subjects to exercise the following rights regarding their personal data:

– Right to request access to their personal data
– Right to request rectification or erasure
– Right to request restriction of processing
– Right to object to processing
– Right to data portability
– Right to withdraw consent at any time

Any person has the right to obtain confirmation as to whether the CCISNB processes their personal data, and may access such data, request its rectification if inaccurate, or request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

In certain circumstances, data subjects may request restriction of processing, in which case data will be retained only for the exercise or defence of legal claims. Data subjects may also object to processing based on their particular situation. In such cases, the CCISNB will stop processing the data unless compelling legitimate grounds exist or for the exercise or defence of legal claims.

If consent has been granted for a specific purpose, the data subject has the right to withdraw it at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

If you consider that your rights regarding the protection of your personal data have not been satisfied, you may lodge a complaint with the competent Data Protection Supervisory Authority at www.aepd.es.