Privacy policy

1. Who is responsible for processing your data?

Name: Tipi Gara Koop Elk Txikia
Tax ID (CIF): F-95767737
Address: Uribitarte Kalea 18, 5.B. 48001, Bilbao, Bizkaia
Contact email: kaixo@tipigara.co

2. For what purpose do we process your data?

We process the data you provide through forms, emails, or participation in our activities in order to:

• Manage communications related to projects
• Send newsletters (if you subscribe voluntarily)
• Respond to requests for information or contact
• Manage registrations for events, workshops, or participation groups
• Comply with our legal obligations

We will only ask you for the personal data necessary to fulfill these purposes. Processing that is not necessary for this primary purpose (for example, subscribing you to the newsletter if you only wanted to participate in an activity) requires your separate consent. We do not make your participation conditional on accepting additional processing, as that would mean the consent is not “freely given”.

3. What is the legal basis for the processing?

• Explicit consent (for example, when you subscribe to a newsletter or submit a form)
• Contractual or pre-contractual relationship (when you participate in a project or activity)
• Legitimate interest in keeping you informed about related activities, where there has been prior contact
• Legal obligation, in cases required by applicable regulations

4. What personal data do we collect?

• Identifying data: first name, last name, email address, phone number
• In some cases, ID number (DNI), date of birth (e.g., for registrations)
• Only if necessary, data of the parent or legal guardian in the case of participation by minors

We do not collect sensitive or “special category” data (such as health, ideology, etc.), except in specific cases with explicit consent.

5. How long do we keep your data?

Data will be retained for as long as necessary for the purpose for which they were collected and, in any case, for the periods required by law or until you request their deletion.

6. To whom do we disclose your data?

We do not share your data with third parties, except where required by law or when necessary for the provision of a service.

7. Do we transfer data outside the European Union?

Yes, in a limited manner. In the course of our activity we use tools and digital services that, in some cases, involve the international transfer of data outside the European Economic Area (EEA). All of them apply the necessary safeguards through Standard Contractual Clauses, in accordance with Article 46 of the GDPR.

Depending on the case, we use support services such as Google (Drive, Gmail), Mailchimp (communications) and Typeform (forms). In all cases, we ensure that the providers to whom data are transferred offer adequate safeguards, in accordance with Articles 44 to 49 of the GDPR.

• Google Workspace (Drive, Gmail, Docs, etc.): cloud service provider. Google has adopted Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of protection in data processing.

You can consult Google’s privacy policy at the following link: https://policies.google.com/privacy?hl=es

• Mailchimp: tool for managing newsletters and communications. Mailchimp, operated by Intuit Inc., also applies Standard Contractual Clauses, as set out by the GDPR.

You can consult Mailchimp’s privacy policy at the following link: https://mailchimp.com/es/legal/

• Typeform: online forms platform based in the EU. In cases where external servers or services are used, Typeform also has active SCCs and security policies aligned with European regulations.

You can consult Typeform’s privacy policy at the following link:  https://admin.typeform.com/to/yFvrNI?typeform-source=www.google.com

8. What rights do you have as a user?

Everyone has the right to obtain confirmation as to whether or not we are processing personal data concerning them.

Data subjects have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request their deletion when, among other reasons, the data are no longer necessary for the purposes for which they were collected. They may also request the restriction of the processing of their data, in which case we will only keep them for the exercise or defense of claims.

In certain circumstances and for reasons related to their particular situation, data subjects may request their right to data portability, as well as object to the processing of their data. We will stop processing the data, except for compelling legitimate reasons, or for the exercise or defense of possible claims.

You can withdraw your consent at any time and exercise your rights of access, rectification, deletion, restriction, portability and objection by sending us an email to kaixo@tipigara.co including the following information: full name and surname, address for notification purposes, the request indicating the right you wish to exercise, stating “Data protection” in the subject line, and attaching a copy of your ID/Foreigner ID/Passport.

If any of your rights have been infringed, you have the right to lodge a complaint with the Spanish Data Protection Agency (https://www.aepd.es )

9. Protection of minors’ data

We do not process data of children under 14 years of age without the explicit consent of their mother, father, or legal guardian. In the event of participating in any activity, a signed authorization will always be required.

10. Data security

We adopt technical and organizational measures to ensure the security of your data and to prevent its loss, misuse, or unauthorized access.