1. Who We Are

Symbiotic Roots is a non-profit organisation based in Barcelona, Spain, dedicated to fostering collaboration, education, sustainability, social innovation, and community engagement through local and international projects.
We are committed to protecting your privacy and handling your personal data in accordance with:
Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)
Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD)
Other applicable European and Spanish legislation.

2. Data Controller

Symbiotic Roots, Méndez Núñez 18, 1º 2ª
08010, Barcelona

Email: info@symbioticroots.org
Website: https://symbioticroots.org

3. What Personal Data We Collect

Depending on how you interact with us, we may collect:
– Contact Information,
– Name
– Email address
– Telephone number (if provided)
– Organisation
– Country

Project Participation: For project applications and participation in activities we may collect:
– Name
– Contact information
– Organisation
– Professional background
– Motivation statements
– CV or supporting documents
– Country of residence
– Dietary or accessibility requirements (only where necessary for events)

Newsletter Subscription: When you subscribe to our newsletter we collect:
– Email address
– Name

Event Registration: For workshops, meetings and events we may collect:
– Name
– Email
– Organisation
– Country
– Participation preferences
– Attendance records

Communications: When you contact us we may keep copies of:
– Emails, apps messages
– Contact form messages

4. How We Collect Data

We collect personal information through:
– Contact forms
– Newsletter subscription forms
– Project application forms
– Event registration forms
– Embedded Google Forms
– Email communications
– Project participant lists
– Direct communication during project implementation

5. Why We Process Your Data

We process personal data only when there is a lawful basis under Article 6 GDPR.
Our purposes include:
– Managing project applications
– Selecting participants
– Organising events
– Managing Erasmus+, European and international cooperation projects
– Communicating with participants
– Sending newsletters (only with consent)
– Responding to enquiries
– Maintaining our internal contact database
– Meeting legal and financial obligations
-Producing anonymous statistics regarding participation

We do not sell personal information.
We do not use your information for automated decision-making or profiling.

6. Legal Basis

Depending on the activity, processing is based on:
– Your consent (Art. 6(1)(a))
– Performance of a contract or pre-contractual measures (Art. 6(1)(b))
– Compliance with legal obligations (Art. 6(1)(c))
– Legitimate interests in managing our activities and communications (Art. 6(1)(f))
– Where consent is required, you may withdraw it at any time.

7. How Long We Keep Data

We retain personal information only for as long as necessary. Generally:
– Data Retention Contact enquiries: Up to 2 years
– Newsletter: Until unsubscribe
– Project applications: Up to 5 years after project closure
– Participant lists: According to project and funding requirements
– Legal documentation: As required by Spanish law
After this period, information is securely deleted or anonymised.

8. Who Receives Your Data

We never sell your personal information.
Your information may be shared with:
– European project partners when necessary for project implementation
– Public authorities where legally required
– Funding agencies where participation documentation is mandatory
– Professional advisers where necessary
– Service providers hosting our website and digital services
– All processors are required to comply with GDPR.

9. International Transfers

Some services we use may process data outside the European Economic Area.
Where this occurs, transfers are protected through appropriate safeguards, including:
1. European Commission adequacy decisions
2. Standard Contractual Clauses (SCCs)
3. Other safeguards recognised under GDPR

10. Third-Party Services

Our website may use services provided by third parties, including:
IONOS: Website hosting.
WordPress: Website content management.
Google Forms: Used for applications and registrations.
Google Drive: Used to share project documents and resources.
YouTube: Embedded videos.
When interacting with embedded services, your browser may connect directly to the provider.
Please consult each provider’s own privacy policy for further information.

11. Cookies

Our website uses cookies necessary for the operation of the site.
At present, we do not use analytics cookies.
If analytics tools are introduced in the future, this Privacy Policy and our Cookie Policy will be updated and your consent will be requested where legally required.

12. Security

We implement appropriate technical and organisational measures to protect personal data against: unauthorised access, accidental loss, misuse, alteration, disclosure.
However, no internet transmission is completely secure.

13. Your Rights

Under GDPR you have the right to:
– access your data
– correct inaccurate data
– request deletion
– restrict processing
– object to processing
– receive your data in a portable format
– withdraw consent
– lodge a complaint with a supervisory authority
To exercise your rights, contact:
info@symbioticroots.org
We will respond within one month unless legally permitted to extend this period.

14. Supervisory Authority

If you believe your rights have been violated, you may lodge a complaint with the competent supervisory authority.
For Spain:
Agencia Española de Protección de Datos (AEPD)
https://www.aepd.es
If you reside in another EU Member State, you may also contact your local Data Protection Authority.

15. Children’s Data

Our website is not intended for children under the age of 16 without parental or guardian consent.
Where activities involve minors, personal data will be collected and processed in accordance with applicable legal requirements and with the appropriate authorisation.

16. Changes to this Policy

We may update this Privacy Policy to reflect legal, technical or organisational changes.
The latest version will always be published on this website with the date of revision.

17. Contact

If you have any questions regarding this Privacy Policy or the processing of your personal data, please contact: info@symbioticroots.org