We at the Provincial Council of Alava are committed to the protection of privacy and the correct use of the personal data that we process and that you provide to us, both online on this website and on any of its subdomains, microsites and/or mobile applications, and offline.
Please read this policy carefully and make sure that you understand and agree with it before you provide us with your personal data. If you do not agree with it, please do not use this website or its services or provide us with your data.
By accessing this site, using any of its services or providing us with your data, whether online or offline, we will take this as a clear affirmative action by which you give us your consent (where consent is required) to process your data for the purposes set out below.
The personal data requested will be those that are strictly necessary to identify and respond to the request made by the data subject or to provide the services requested and will not be further processed in a way that is incompatible with those purposes.
The data collected from each data subject shall be adequate, pertinent and not excessive in relation to the corresponding purposes in each case, and shall be updated whenever necessary.
The data subject will be informed, prior to the collection of his/her data, of the general points regulated in this policy so that he/she may give his/her express, precise and unequivocal consent to the processing of the same, in accordance with the following aspects:
Responsible for the processing of your data
The Diputación Foral de Álava is responsible for your data.
- Postal address: Plaza de la provincia, s/n, 01001 VITORIA-GASTEIZ
- Telephone: 945 16 11 00
- Data Protection Delegate: Mr. Miguel Jesús Moro López
- Contact DPD: dbo-dpd@vitoria-gasteiz.org
How your data is obtained
The Provincial Council of Alava may obtain personal data in the following ways:
From the person concerned
You may have provided them to us, either online or offline, when requesting our services in order to maintain our relationship with you.
If you have provided us with the data through this website or any of its subdomains, microsites and/or mobile applications, you should be aware that we collect information, for example, when you register as a user, fill in any form with personal data or when you communicate with us directly by e-mail.
When you provide us with your personal data, you guarantee that you are the person authorised to provide this information and that the information is true, accurate, truthful, exact and up-to-date; that it is not confidential; that it does not violate any contractual restrictions or third party rights and that you undertake not to impersonate other users by using their registration data for the different services and/or contents of the website.
You are responsible for keeping your details and profile correct and up to date, and the City Council of Vitoria-Gasteiz declines all responsibility in the event of failure to do so.
Automatically collected when you visit our website
When you visit our website, data is sent from your browser to our server to optimise our services and improve your user experience, for example, when you access the site or when you log in to our services via third party services such as social media or Google. This data may be collected and stored automatically by us, or by third parties on our behalf.
In such cases, this data may include:
- the user's IP address
- the date and time of the visit
- the URL of the site the user came from
- the pages visited on our website
- information about the browser used (browser type and version, operating system, etc.).
We may process and record such usage, sessions and related information, either independently or with the help of third party services, including through the use of cookies and other tracking technologies such as flash cookies and web analytics.
Through communication by a third party of the data of the interested party.
Pursuant to art. 28.2 of Law 39/2015 of 1 October on the Common Administrative Procedure of Public Administrations, the Provincial Council of Álava may consult or collect documents drawn up by any administration provided that the processing of the data is necessary for the performance of a task carried out in the public interest or in the exercise of public powers conferred on the Council (art. 6.1 e) RGPD), as Law 39/2015 of 1 October establishes that public administrations shall not require data or documents from the interested parties that are not required by the applicable regulatory regulations or that have been previously provided by them to any administration.
In addition to the previous case, if it is not you as the interested party, but a third party, who provides us with your data, these may have been communicated to us by family members, public or private entities or organisations with which we reach agreements to develop social, cultural or sporting projects or collaboration agreements, etc. The categories of data we process may include: identification data, personal characteristics, social, academic and professional circumstances, economic, financial and insurance data; transactions of goods and services, employment details and even specially protected data relating to the health of the person concerned.
By accepting this policy, you authorise the Provincial Council of Alava to request from third party entities or public or private organisations with which it reaches agreements to develop social, cultural or sporting projects or collaboration agreements... additional data that may be necessary to complete the information required for the above purposes.
Sensitive data are subject to special protection and the legitimacy to process them is the express consent of the person concerned. Therefore, it is the responsibility of the third party that provides us with data (public or private entities or organisations with which we reach agreements to develop social, cultural or sports projects or collaboration agreements...) to have your prior and express consent to use your data and communicate it to us, as well as to inform you that your data will be processed by us as the City Council.
In the event that it is not the interested party (i.e. you) but a third party who provides us with your data, it is the third party who expressly guarantees that he/she has the authorisation for said provision, exonerating us from any responsibility in the event of any claim on your part, a responsibility that is assumed solely and exclusively by the person who has communicated the data to us on your behalf or in your interest.
Through communication by the person concerned of third party data.
With regard to other people's data, you must respect their privacy and take special care when communicating or publishing their personal data. Only the data subject may authorise the processing of his or her personal data. If you provide us with data of third parties, it is your responsibility to have their prior and express consent to use and communicate them to us, and it is your responsibility to inform them of the processing of their data by us. The publication of third party data without their consent may infringe, in addition to data protection regulations, the right to honour, privacy or the right to privacy of such third parties. If you provide us with personal data of third parties, by accepting this privacy policy, you expressly guarantee that you have the authorisation of the person concerned for such provision, exonerating us from any liability in the event of any claim by the latter, a liability that is assumed solely and exclusively by the person who has communicated the data to us on their behalf.
Processing of your data
The data provided to us, as well as any other data generated during the development of the relationship with the citizen/interested party, may be processed for different purposes depending on the municipal services provided and, in any case, to maintain contact and communication with them and to manage the provision of the services requested and/or provided by this City Council.
Where appropriate, more explicit and specific purposes may be indicated in the informative clauses included in each of the data collection methods (web forms, paper forms, voice messages or posters and information notes) for specific cases.
In compliance with article 30 of the RGPD, the Provincial Council of Alava has a Register of processing activities (version 15/05/2020) of personal data required by its activity.
How long your data will be kept
In general, the personal data provided to us will be kept in order to keep a record of our attention and to manage our services efficiently, for as long as you remain a citizen of Vitoria-Gasteiz and the person concerned does not request its deletion. Even if deletion is requested, they will be kept blocked for the necessary time, and their processing will be limited to one of the following cases: to comply with legal/contractual obligations of any kind to which we are subject and/or during the legal periods established for the prescription of any liability on our part and/or the exercise or defence of claims arising from the relationship maintained with the citizen/interested party.
In other cases, the period of conservation of the data will depend on what is specified for each processing of personal data in the register of processing activities.
Legitimation for the processing of your data
The legal basis that legitimises us to process your data may be diverse: in some cases it may be the consent of the persons concerned, in others the fulfilment of a legal obligation on our part, in others the fulfilment by the City Council of a mission carried out in the public interest or in the exercise of Public Powers, in others the protection of vital interests and in others the execution of a contract.
The provision of the requested data is compulsory as it is essential to deal with your request and/or provide our services; if you do not provide it, we will not be able to carry out or provide it.
When the processing is based on your consent, you give it to us unequivocally when you provide us with your data, this being considered a clear affirmative act on your part that manifests this consent. You may withdraw this consent at any time by sending us an e-mail to that effect to dbo-dpd@vitoria-gasteiz.org.
Recipients to whom we may communicate your data to
The data you provide us with may be communicated to third parties for the fulfilment of purposes directly related to the legitimate functions of the transferor and transferee, such as entities or bodies to which there is a legal obligation to communicate data, public or private entities or organisations with which we reach agreements to develop social, cultural or sporting projects or collaboration agreements, etc.
We inform you that in the event that we use American suppliers, who may have access to personal data, for the purpose of providing us with auxiliary services to our activity (hosting, housing, software as a service, remote backups, computer support or maintenance services, e-mail managers, sending e-mails and e-mail marketing, file transfer, etc.), these companies may be different and different from those we use. ), these companies may be different and vary over time but, in any case, we will choose companies adhering to the Privacy Shield agreement between the USA and the EU, or belonging to countries that have been declared as countries with an adequate level of protection, which means that they are obliged to comply with equivalent requirements to the European ones in terms of data protection. In any case, by accepting this data protection policy you expressly and unequivocally authorise the communication of data to these companies, knowing that this involves an international transfer of data to a country outside the European Economic Area and giving your unequivocal consent to such transfer.
Your rights when you provide us with your data
- Right of access: You can ask us what personal data we are processing and even request a copy of it.
- Right to rectification: You can ask us to rectify inaccurate personal data or to complete incomplete personal data, including by means of an additional declaration.
- Right to erasure (right to be forgotten): You can ask us to delete your personal data when it is no longer necessary for the purposes for which it was collected; you withdraw your consent; there has been unlawful processing of your personal data or in compliance with a legal obligation.
- Right to limitation of processing: You can ask us to limit the processing of your data, in which case we will only keep them for the exercise or defence of claims.
- Right to data portability: You can ask us to return (to you or to a third party you specify) your personal data in a structured, commonly used and machine-readable format.
- Right to object: You may object to the processing of your data if such processing is based on the legitimate interest of the data controller or is for advertising purposes.
Exercising your rights
To exercise all these rights, you can contact the City Council by sending a written and signed request, enclosing a copy of your ID card, to the postal or e-mail address indicated in the initial section of this privacy policy. In the event of modification of your data, you must notify the same address. Once we have received any of the above requests, we will respond to you within the legal deadlines.
You may file a complaint with the Basque Data Protection Agency. If you would like more information about the rights you can exercise and to request model forms for exercising your rights, please visit the Basque Data Protection Agency website, http://www.avpd.es.
The aforementioned rights may also be exercised online through the Electronic Headquarters of the Vitoria-Gasteiz City Council.