Data Protection Policy

This data protection policy refers to the processing of personal data carried out by the Museum of Contemporary Art of Alicante, in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016) and Organic Law 3/2018, of 5 December, on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).

Who is responsible for the processing of personal data?

The data controller is the Museum of Contemporary Art of Alicante (hereinafter, MACA), with tax ID XXXXX, located at Plaza de Santa María, No. 3, Alicante (CP 03002), telephone 965 213 156, email maca@alicante.es and website Home MACA - MACA Museum of Contemporary Art of Alicante.

Who is the Data Protection Officer?

The Data Protection Officer (DPO) supervises compliance with MACA’s data protection policy and ensures that personal data is properly processed and that individuals’ rights are protected. Among their duties is handling any questions, suggestions, complaints, or claims from individuals whose data is processed. The DPO can be contacted in writing at the email address dpd@alicante.es.

For what purpose do we process data?

At MACA, personal data is mainly processed for the following purposes:

• Contact. To respond to inquiries made through our website contact forms or by telephone.
• Museum services. User registration to access press kits and newsletters.
• Information about our services. With explicit consent, contact data is used to communicate information about activities, events, or programs organized by MACA.
• Supplier management. We process data from suppliers providing goods or services. This may include self-employed individuals and representatives of legal entities. Only essential data is collected to maintain the business relationship and is used solely for that purpose.
• Video surveillance. CCTV cameras are installed at our facilities with proper signage. Images are recorded only in necessary areas to ensure the safety of people and property and are used exclusively for that purpose.

What is the legal basis for processing data?

Data processing is based on different legal grounds depending on the nature of each processing activity:

Performance of a contract, such as relationships with suppliers or users purchasing tickets or services.

Compliance with legal obligations, such as tax reporting requirements and commercial regulations.

Consent, for sending information about services, activities, events, or programs.

Public interest mission, such as video surveillance to protect the cultural heritage we manage.

Who do we share data with?

As a general rule, data is only shared with public authorities when legally required. In justified cases, data may be shared with law enforcement agencies or judicial authorities. No international data transfers outside the European Union are carried out.

How long do we retain data?

Data retention periods depend on several factors, mainly the need to fulfill the purpose for which the data was collected. Data may also be retained to address potential legal liabilities or comply with requests from public authorities or courts.

Therefore, data is retained only for as long as necessary for legal or informational purposes and never longer than required.

In some cases, such as accounting or billing records, tax regulations require retention until statutory limitation periods expire.

Data processed based solely on consent is retained until such consent is withdrawn.

Video surveillance footage is retained for a maximum of one month, unless incidents require longer retention for investigation by authorities.

Public records regulations and rulings from the Records Appraisal Commission guide data retention and deletion criteria.

What rights do individuals have regarding their data?

Under the General Data Protection Regulation, individuals have the following rights:

To know whether their data is being processed.

To be informed at the time of data collection.

To access their data.

To request rectification of inaccurate data.

To request erasure of data under certain circumstances.

To request restriction of processing.

Data portability.

To object to processing.

To opt out of receiving information.

How can rights be exercised or defended?

Requests can be submitted in writing to MACA, Plaza de Santa María, No. 3, Alicante (CP 03002), or by email to maca@alicante.es, stating “Personal Data Protection”.

If a satisfactory response is not obtained, a complaint may be filed with the GVA Data Protection Authority via its official channels at the GVA Data Protection Office.

In any case, for complaints, clarifications, or suggestions, the Data Protection Officer can be contacted at dpd@alicante.es.