Privacy Policy

1. Identity and contact details of the data controller

The data controller is the Ramón Areces Foundation, with Tax Identification Number (C.I.F.) G 28459311, with its registered office at Calle Vitruvio, 5, 28006 Madrid; it can be contacted by email at protecciondedatos@fundacionareces.es and by telephone on 91 515 89 80.

2. Purposes of data processing by data collection point

The Foundation processes personal data for specific, explicit and legitimate purposes, linked to the various data collection points available on the website and in its calls for applications, as detailed below.

2.1. Enquiries and suggestions (Contact)

The identifying and contact details provided via the Contact form will be used to process requests, opinions, suggestions, enquiries, queries and proposals received in the best possible way; the data will be retained for 30 days from receipt of the email and may be retained, in aggregated form, for statistical purposes.

2.2. Personal Area/Registration (“Ágora”) and activity enrolments

The purpose of creating a digital account in the Personal Area is to generate a single record enabling the user to register for activities organised by the Foundation, thereby streamlining procedures and avoiding the need to re-enter data, as well as to manage the documentation and procedures associated with calls for applications in which the user is interested in participating or for which they have been selected; your data will be used to send you operational notifications regarding the activities in which you have registered, to verify your identity and grant physical access to the premises where applicable, and to send communications and manage procedures relating to the calls for applications in which you have participated; furthermore, if you consent, it will be used to send you electronic communications about activities of interest to you. These activities are free of charge, but require you to complete the registration form available on the website for the purposes of managing capacity and communications, in accordance with the published FAQs.

2.3. Calls for scholarship and grant applications

The personal data included in applications and accompanying documentation is used to process the application and ensure the call for applications runs smoothly; with the applicant’s consent, informative communications, including by electronic means, may be sent regarding the Foundation’s future activities; if the application is rejected, the documentation submitted in electronic format will be destroyed as stipulated in the call for applications.

2.4. Institutional publication of successful applicants

Successful applicants consent to the publication of their name, course of study and host institutions on the website, in the Annual Report and/or in other Foundation publications, for the purposes of transparency and publicising the Foundation’s activities.

2.5. Website navigation and cookies

The website uses cookies that are necessary for the site to function and, subject to consent, analytical cookies and, where applicable, advertising/marketing cookies, as detailed in the Cookie Policy and the settings panel available on the site. Certain versions of the portal include third-party cookies such as those from Google (_ga, _gid, collect) and ScorecardResearch (UID, loc), the processing of which is governed by their respective policies; users are made aware of this via the aforementioned specific cookies policy.

2.6. Anti-fraud security during registration: use of Google reCAPTCHA

3. Legal bases for processing

The Foundation applies the following legal bases, appropriate to each purpose and point of collection, with the utmost precision and proportionality.

3.1. Contact

Consent of the data subject when submitting their enquiry; where the enquiry relates to a pre-contractual or contractual relationship initiated by the data subject, performance of a contract or pre-contractual measures.

3.2. Personal Area/Registration and enrolment for activities

Performance of a contract or pre-contractual measures for account management, registration and operational communications; consent for informational communications.

3.3. Calls for scholarship and grant applications

Pre-contractual measures to process the application; performance of a contract or legal relationship in the event of an award; compliance with applicable legal obligations; consent for informational communications.

3.4. Institutional publicity

Consent of the successful applicant for their names and institutions to appear on the website, in the Annual Report and/or in the Foundation’s publications, in accordance with the terms of the call for applications.

3.5. Cookies

Legitimate interest in the use of necessary cookies; the user’s consent, freely given via the settings panel, for analytical cookies and, where applicable, advertising/marketing cookies, in accordance with the Cookies Policy.

3.6. Anti-fraud security with reCAPTCHA

The Foundation’s legitimate interest in the security of its systems and in preventing abuse and automated fraud during registration and other high-risk processes, given the strictly necessary and proportionate nature of the anti-bot control, in accordance with the stated purpose of the service by Google (security, fraud prevention and abuse prevention), and bearing in mind that reCAPTCHA sets a necessary cookie (_GRECAPTCHA) for its risk analysis; the implementation will respect the principle of minimal intrusion and will be clearly explained in this policy, without reference to Google’s policies, with effect from 2 April 2026.

4. Recipients or categories of recipients

The Foundation will not disclose personal data to third parties unless legally obliged to do so or where necessary for the proper provision of services or the conduct of its activities, in which case this will be stated in this section or in the specific information provided at the point of collection.

4.1. Suppliers acting as data processors

The Foundation may grant access to data to suppliers who provide services necessary for the operation of the website, the management of the Personal Area, the sending of communications, system maintenance or the processing of calls for applications; all such suppliers act under a data processing agreement and in accordance with the Foundation’s instructions. In particular, Google acts as a data processor for reCAPTCHA under the Google Cloud Terms and the Cloud Data Processing Addendum.

4.2. Co-organisers of events

In the case of co-organised events, registration data may be disclosed to the co-organiser, for the sole purpose of providing information on those registered for the event, as set out in the Personal Area policy.

4.3. Assessment bodies and universities/centres

In the case of calls for applications, data may be made available to committees or panels for the assessment of applications and, where an award is made, for the subsequent assessment and management of the relevant grants, as well as for communication with universities or research centres for the purposes of formalising and implementing the grant or contract.

4.4. Assessment bodies and universities/centres

In the context of scholarships involving stays abroad, the necessary data may be disclosed to the insurance company and the travel agency, and, where there is a legal obligation to do so, to the Tax Authority or other public authorities and supervisory bodies, in accordance with the additional data protection information for scholarships abroad.

4.5. Institutional publication

The names and, where applicable, the courses and institutions of the successful applicants may be published on the website, in the Annual Report and/or in other publications of the Foundation, in accordance with the consent obtained in the call for applications.

4.6. Third-party cookies

The Cookies Policy identifies third parties such as Google and ScorecardResearch as being associated with analytical and, where applicable, marketing cookies; the activation of such cookies means that these third parties process data in accordance with their own policies, as set out in the aforementioned specific policy.

5. International transfers

Generally speaking, the Foundation’s core data processing activities (Contact, Personal Area, calls for proposals) are carried out within the European Economic Area or with suppliers subject to adequate safeguards; however, the use of third-party cookies and reCAPTCHA may involve international transfers by such providers under their contractual and compliance frameworks; Google reCAPTCHA acts as a data processor under the Google Cloud Terms and the Cloud Data Processing Addendum, and the Foundation will record in its activity log and, where applicable, in impact assessments or transfer notifications, the configuration and safeguards applicable to its implementation. For details and updates on cookies and their providers, please refer to the Cookie Policy available on the website.

6. Retention periods

Data will be retained only for as long as necessary to fulfil the purposes for which it was collected and, subsequently, for the duration of the limitation periods for legal liability; the criteria by data collection point are as follows.

6.1. Contact

30 days from receipt of the email, with the possible additional retention of statistical data.

6.2. Personal Area/Registration

For as long as there is mutual interest in maintaining the digital account or until the data subject requests the erasure or restriction of processing; informational communications will be retained until consent is withdrawn.

6.3. Calls for applications

For unsuccessful applications, electronic documentation will be destroyed in accordance with the provisions of the call for applications; for successful applicants, data will be retained for the duration of the grant agreement or contract and for the periods necessary to comply with applicable legal, tax and audit obligations.

6.4. Institutional publicity

The publication of successful applicants will remain on the website and in institutional publications in accordance with the aims of transparency and publicity, whilst respecting reasonable retention periods for archiving and institutional records.

6.5. Cookies and reCAPTCHA

Retention periods correspond to the lifespan of each cookie as set out in the Cookies Policy; reCAPTCHA uses a necessary cookie (_GRECAPTCHA) for as long as is necessary for its risk analysis and operation, although its presence does not in itself imply disproportionate retention of personal data by the Foundation.

7. Rights of data subjects

Data subjects may exercise their rights of access, rectification, erasure, objection, restriction of processing and data portability, as well as withdraw their consent at any time, without retroactive effect, by sending a request to the postal address Calle Vitruvio, 5, 28006 Madrid, quoting the reference “Data Protection”, or to the email address protecciondedatos@fundacionareces.es, providing proof of their identity, in accordance with the terms published in the Contact and Registration sections. Furthermore, data subjects have the right to lodge a complaint with the Spanish Data Protection Agency if they consider that the processing does not comply with current regulations, as indicated on the Foundation’s website.

8. Information on cookies and other technologies

The Foundation uses cookies to provide a better service and enhance the browsing experience; the Cookies Policy clearly explains what cookies are, what they are used for, the types used (essential, analytical and, where applicable, marketing or behavioural advertising cookies), the specific list of cookies, and how they can be configured or disabled via the browser or through the settings panel. To access multimedia and embedded content, you must enable the relevant categories in the settings panel, in accordance with the published instructions.

9. Anti-fraud security during registration: reCAPTCHA

To protect registration forms and other high-risk workflows against automated abuse, the Foundation uses reCAPTCHA as a bot detection and fraud prevention service; reCAPTCHA analyses risk using technical signals and sets the necessary _GRECAPTCHA cookie, which is considered strictly necessary for the security of the service and is therefore exempt from consent under the terms of the provider’s documentation; From 2 April 2026, Google acts as a data processor under the Google Cloud Terms and the Cloud Data Processing Addendum, and references to Google’s Privacy Policy and Terms of Service have been removed from the badge and the Foundation’s web pages, in accordance with the official recommendation. The applicable legal basis is legitimate interest in security and the prevention of fraud and abuse, with transparent information provided in this policy and measures to ensure data minimisation and proportionality in its implementation.

10. Procedure and channels for exercising rights and making enquiries regarding privacy

To exercise your rights or make enquiries regarding privacy, you may write to the Ramón Areces Foundation at Calle Vitruvio, 5 – 28006 Madrid (Ref. “Data Protection”), or send an email to protecciondedatos@fundacionareces.es; the Foundation will respond to requests within the statutory time limits and will provide mechanisms for unsubscribing from informational communications. If you consider that your rights have not been adequately addressed, you may lodge a complaint with the Spanish Data Protection Agency via www.aepd.es , as stated on the Foundation’s website.

11. Changes to the policy

The Foundation may amend this Privacy Policy to bring it into line with regulatory changes or developments in its data processing activities, announcing the changes on its website and, where appropriate, obtaining the necessary consent for the purposes that require it; the versions in force at any given time will remain accessible.

Privacy policy