PRIVACY POLICY

The website www.rmcr.org is a website owned by the Real Maestranza de Caballería de Ronda (hereinafter and interchangeably, the “Website” and/or “RMCR”). RMCR provides information on the Website about its institutional, cultural, museum, equestrian, and outreach activities, as well as about visits, events, services, and activities organized or promoted by this entity. The Website also allows tickets to be purchased for visits and activities enabled for that purpose, and allows users to contact RMCR through the forms and contact channels available.

The Website does not require prior registration to be viewed. However, the entity’s activities and purposes require the processing of personal data. Such processing is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the “GDPR”), and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (the “LOPDGDD”).

Therefore, in compliance with current data protection regulations, we want to be transparent about what we intend to do with the information you provide us. Please read this Privacy Policy carefully, and if you have any questions, do not hesitate to contact us.

Among other things, the Privacy Policy contains information about:

Who is responsible for your data
Data collected by RMCR, and the processing that will be carried out.
The purpose pursued in the processing of the data.
The legal basis for the processing of the data.
Disclosure of personal data to third parties, if any, and its justification.
The period during which we retain the data.
The rights you have and how to exercise them.

We will notify you in advance of any changes made to this Privacy Policy and will not make retroactive changes that reduce your privacy rights unless legally required, and your consent will always be necessary. However, you may request at any time to unsubscribe from the services offered on the Website if you disagree with the changes made.

In accordance with the provisions of the GDPR and the LOPDGDD, RMCR and/or the data controller informs you of the processing of your data by this entity as controller, to which the technical and organizational security measures provided for in current regulations apply.

In this regard, and in accordance with the provisions of current legislation, we detail below the information about the processing that RMCR carries out on your data.

a) Data controller

Company name: REAL MAESTRANZA DE CABALLERÍA DE RONDA Tax ID: G29151787 Registered address: Calle Virgen de la Paz, 15, 29400, Ronda, Málaga, Spain Contact email: protecciondedatos@realmaestranza.org

b) Scope of application

This Privacy Policy applies to the activity carried out by RMCR and, in full, to its content, functions, and services offered on the Website at https://www.rmcr.org

c) Processing of personal data

The personal data processed by RMCR in carrying out its activity are as follows:

I. Contacts

Although the Real Maestranza de Caballería de Ronda allows its Website to be viewed without prior registration — in which case data processing is limited to the use of cookies as detailed in the corresponding Cookie Policy — contact with RMCR can be made through the forms enabled on the Website, by email, by telephone, or through the various channels made available to users.

Identification data: first and last name.
Contact data: email address and telephone number.
Additional information: subject, content of the message, and any other information voluntarily provided by the user in their inquiry or request.

The purpose of processing the data provided is to manage inquiries, requests for information, reservations, authorizations, or communications received from users through the contact channels enabled by RMCR. Additionally, provided the data subject has expressly consented, RMCR may send informational, institutional, or promotional communications related to its activities, services, and events, through various means, including WhatsApp and other electronic means.

The legal basis for processing data provided through the Website in order to contact RMCR is the application of pre-contractual measures, in accordance with Article 6.1.b) of the GDPR, when the request comes from the data subject themselves. The sending of commercial or informational communications by electronic means will be legitimized by the data subject’s consent, in accordance with Article 6.1.a) of the GDPR.

Use of the WhatsApp communication channel means that the service provider, WhatsApp LLC, may process certain personal data in accordance with its own terms of use and privacy policy.

In any case, the consent given may be revoked at any time, without affecting the lawfulness of the prior processing carried out by RMCR.

II. Candidates

At present, RMCR has no open selection process and does not have a “Work with us” section on its Website. However, if a user voluntarily sends their curriculum vitae to any of the email addresses included on the website, RMCR will not carry out any processing beyond its immediate deletion, without retaining or using such data for any purpose.

Should specific selection processes or open vacancies be enabled in the future, and the user voluntarily decides to participate in them, RMCR may process the following categories of personal data:

Identification data: first and last name.
Contact data: postal address, email address, and telephone number.
Academic background and professional experience.
Any other data expressly required in the job posting or its terms.
No specially protected data will be processed.

The data will be processed for the purpose of managing candidates’ participation in personnel selection processes that RMCR may carry out, assessing their professional profile, and managing, where applicable, their incorporation into the entity. RMCR may also retain spontaneously submitted CVs for a reasonable period in order to assess future vacancies or selection processes that may match the candidate’s profile, unless the data subject objects or requests deletion.

The legal basis for the processing of the data will be the application of pre-contractual measures, in accordance with Article 6.1.b) of the GDPR, when the data subject participates in a specific selection process, as well as the data subject’s consent in the case of unsolicited applications or additional processing requiring it.

RMCR will not make automated decisions or create profiles based solely on the automated processing of candidates’ data.

The consent given for the processing of your data may be revoked at any time, without affecting the lawfulness of the processing carried out previously.

III. Clients/visitors

RMCR will process the following categories of personal data of its clients, visitors, activity attendees, and users of its services and facilities:

Identification data: first and last name, national ID/foreigner ID number or other identification document, and signature, where applicable.
Contact data: postal address, email address, and telephone number.
Professional data: position, entity, or organization to which the data subject belongs, where applicable.
Data related to reservations, ticket purchases, requests for authorization, participation in activities, or use of facilities managed by RMCR.
Financial, administrative, and billing data necessary for managing payments, reservations, and contracted services.
Images and/or videos captured during activities, visits, cultural, institutional, or outreach events organized by RMCR, where applicable.
Other data voluntarily provided by the data subject in their requests, forms, or communications with RMCR.
No special categories of data are processed, unless strictly necessary under applicable regulations or voluntarily provided by the data subject.

The data will be processed for the purpose of managing the relationship with clients and visitors, including the organization and development of cultural, institutional, and educational activities; the management of reservations, ticket sales, and access control; handling inquiries and requests; administrative, accounting, and tax management arising from the services provided; the security of people and facilities; and the management of requests related to photographic or audiovisual reports, or the reproduction and assignment of images and documentary collections owned by RMCR.

Additionally, where appropriate and authorized by the data subject, RMCR may capture and disseminate images and/or videos of activities and events through its website, social media, publications, and other corporate channels for outreach, cultural, historical, or institutional purposes.

The legal basis for processing the data will be the performance of a contractual relationship or the application of pre-contractual measures, in accordance with Article 6.1.b) of the GDPR; compliance with legal obligations applicable to RMCR, in accordance with Article 6.1.c) of the GDPR; the entity’s legitimate interest in ensuring the organization, security, and proper conduct of its activities, in accordance with Article 6.1.f) of the GDPR; and, where applicable, the data subject’s consent for specific processing, particularly regarding commercial communications or image processing, in accordance with Article 6.1.a) of the GDPR.

RMCR will not make automated decisions or create profiles based solely on the automated processing of clients’ or visitors’ data.

The data will be retained for as long as necessary to fulfill the purpose for which it was collected and, thereafter, for the legally required periods to address any liability arising from the processing.

The consent given for certain processing may be revoked at any time, without affecting the lawfulness of the processing carried out previously.

IV. Suppliers

RMCR may process personal data of suppliers, external collaborators, and contact persons of supplier entities with which it has or may have a commercial or contractual relationship.

In this context, RMCR may process the following categories of personal data:

Identification data: first name, last name, national ID/foreigner ID number, and signature.
Contact data: postal address, email address, and telephone number.
Professional data: position or role held at the supplier entity.
Financial and banking data: bank details and payment methods necessary for managing collections and payments.
Contractual and commercial data: information related to quotes, contracts, orders, billing, service provision, and communications exchanged between the parties.
Representation data: powers of attorney or authorization data, where applicable.

No special categories of data are processed.

The data will be processed for the purpose of managing and developing the contractual relationship maintained with suppliers and external collaborators, including handling requests for information, quotes, and pre-contracting processes; the formalization, monitoring, and execution of contracts; operational coordination of services provided; administrative, accounting, tax, and financial management arising from the contractual relationship; the management of payments, incidents, and communications between the parties; and compliance with legal obligations applicable to RMCR.

The legal basis for processing the data will be the performance of a contract or the application of pre-contractual measures, in accordance with Article 6.1.b) of the GDPR; compliance with legal obligations applicable to RMCR in tax, accounting, and administrative matters, in accordance with Article 6.1.c) of the GDPR; and the entity’s legitimate interest in ensuring proper organizational management, internal coordination, and maintenance of professional and contractual relationships, in accordance with Article 6.1.f) of the GDPR and Article 19 of the LOPDGDD.

RMCR will not make automated decisions or create profiles based solely on the automated processing of suppliers’ or collaborators’ data.

V. Students

RMCR may process the following categories of personal data of students of the Riding School and, where applicable, their legal representatives:

Identification data: first name, last name, national ID/foreigner ID or identification document, date of birth, and signature.
Contact data: postal address, email address, and telephone number.
Academic and training data: level, classes, participation in activities, and training progress.
Financial and banking data necessary for managing enrollment, fees, and payments.
Attendance and participation data for activities.
Image and/or voice captured during activities, exhibitions, competitions, or events organized by RMCR.
Data of legal representatives, parents, or guardians when the student is a minor.

In addition, special categories of data may be processed when strictly necessary to ensure the student’s safety during equestrian practice or activities organized by the Riding School, particularly health data related to allergies, injuries, physical limitations, relevant medical information, or emergency data.

RMCR will process your data for the purpose of managing the relationship maintained with students of the Riding School, including the administrative and academic management of enrollments and registrations; the organization and conduct of classes, training sessions, exhibitions, competitions, and equestrian activities; the financial and administrative management arising from this relationship; communication with students and legal representatives; the management of incidents, insurance, and legal obligations; and ensuring the safety and proper organization of the Riding School’s activities.

Additionally, RMCR may capture images and/or videos during activities, events, or exhibitions organized by the Riding School for informational, outreach, promotional, or institutional purposes through websites, social media, publications, and other corporate channels, in accordance with applicable regulations and, where necessary, subject to the prior consent of the data subject or their legal representatives.

The legal basis for processing your data will be the performance of a contractual relationship or the application of pre-contractual measures, in accordance with Article 6.1.b) of the GDPR; compliance with legal obligations applicable to RMCR, in accordance with Article 6.1.c) of the GDPR; and RMCR’s legitimate interest in ensuring the proper organization, operation, and safety of the Riding School’s activities and facilities, in accordance with Article 6.1.f) of the GDPR.

The processing of health data will be carried out only when necessary to protect the vital interests of the student or to ensure adequate care and safety during equestrian activities, in accordance with Article 9.2.c) and h) of the GDPR.

Lastly, the processing of images and/or videos for promotional or outreach purposes will be based on the consent of the data subject or their legal representatives when legally required, particularly in the case of minors, in accordance with Article 6.1.a) of the GDPR. This consent may be revoked at any time without affecting the lawfulness of the processing carried out previously.

RMCR will not make automated decisions or create profiles based solely on the automated processing of students’ personal data.

VI. Video surveillance

RMCR may process personal data through video surveillance systems installed on its premises and facilities for the purpose of ensuring the safety of people, property, and facilities, controlling access, and preserving the proper functioning and security of the spaces managed by the entity.

Through these systems, the following categories of personal data may be processed:

Image of persons accessing or moving through RMCR’s facilities.
Date and time of access or image capture.
Exceptionally, voice, only in the event that audio is captured and duly justified in accordance with applicable regulations.

Video surveillance systems may affect, among others, employees, teachers, students, visitors, facility users, suppliers, and collaborators who access RMCR’s premises.

The legal basis for processing your data will be RMCR’s legitimate interest in ensuring the safety of people, property, and facilities, in accordance with Article 6.1.f) of the GDPR, as well as the provisions of Article 22 of the LOPDGDD regarding processing for video surveillance purposes.

Images may be disclosed to Law Enforcement, Courts and Tribunals, or competent Public Administrations when necessary or legally required.

The data will be retained for a maximum period of one month from capture, except when they must be retained to document acts that threaten the integrity of persons, property, or facilities, or when they must be made available to the competent authority.

RMCR will not make automated decisions or create profiles based solely on the automated processing of captured images.

In all cases, video surveillance cameras will not capture areas intended for employee rest, changing rooms, restrooms, dining areas, or similar areas, and the principles and guarantees provided for in data protection regulations will be respected at all times.

VIII. Caballeros and Damas Maestrantes

RMCR may process the following categories of personal data of Caballeros and Damas Maestrantes, members of the entity, and, where applicable, applicants or candidates for admission:

Identification data: first name, last name, national ID/foreigner ID, signature, and image, where applicable.
Contact data: postal address, email address, and telephone number. Family and representation data, when necessary.
Professional and academic data.
Financial and banking data related to fees, contributions, or payments linked to membership status.
Data relating to membership status, institutional participation, positions, committees, and activities carried out within RMCR.

No special categories of data are processed.

RMCR will process your data for the purpose of managing the relationship maintained with Caballeros and Damas Maestrantes, including processing admissions and withdrawals, the administrative and financial management of membership status, the management of fees and contributions, the organization of and participation in institutional, cultural, equestrian, social, and ceremonial activities, and the management of internal communications, notices, and corporate events linked to the entity’s activity.

Additionally, your data may be processed to manage participation in governing bodies, committees, and other activities specific to RMCR, as well as for the preservation and management of documentation related to the entity’s historical and institutional activity.

RMCR may also capture and use images and/or videos of Caballeros and Damas Maestrantes during activities, institutional acts, or events for informational, outreach, historical, or institutional purposes through publications, websites, social media, and other corporate channels, in accordance with applicable regulations and, where necessary, subject to the data subject’s prior consent.

The legal basis for processing your data will be the performance of the associative or statutory relationship maintained with RMCR, in accordance with Article 6.1.b) of the GDPR; compliance with legal obligations applicable to the entity, in accordance with Article 6.1.c) of the GDPR; and RMCR’s legitimate interest in ensuring its proper organization, institutional functioning, and preservation of its historical and corporate activity, in accordance with Article 6.1.f) of the GDPR.

Lastly, any specific processing requiring consent, particularly related to the dissemination of images or publications not covered by legitimate interest, will be carried out in accordance with Article 6.1.a) of the GDPR, and the data subject may revoke such consent at any time without affecting the lawfulness of the processing carried out previously.

RMCR will not make automated decisions or create profiles based solely on the automated processing of the personal data of Caballeros and Damas Maestrantes.

IX. Governing body

RMCR may process personal data of persons who are part of its governing and representative body (executive positions, board members, members of committees or boards, and, where applicable, persons designated or proposed to hold positions), regardless of whether access to the position was initiated or formalized, in whole or in part, through channels or means available on the Website.

In these cases, RMCR will process the following categories of data:

Identification and contact data (first name, last name, identification document, postal address, email address, telephone number).
Data relating to the position, appointment, renewal, and removal, as well as representation, signature, and duties performed within RMCR.
Professional and institutional affiliation data linked to the exercise of the position.
Financial, banking, or tax data, where applicable, necessary for managing expense reimbursements, insurance, or other obligations arising from performing the position.
Data contained in notices, minutes, resolutions, certifications, internal communications, and other corporate documentation relating to the governing body.
Image and voice, where applicable, when captured during acts, meetings, events, or institutional activities of RMCR, provided there is a sufficient legal basis under applicable regulations.

RMCR will process this data for the following purposes:

Managing the appointment, renewal, removal, and, in general, the affiliation of the persons who make up RMCR’s governing and representative body.
Organizing, convening, and managing boards, meetings, committees, sessions, deliberations, votes, and other actions specific to the functioning of the governing body.
Preparing, filing, safeguarding, and preserving minutes, certifications, resolutions, internal communications, and other corporate documentation related to the entity’s governance and representation.
Complying with the legal, statutory, accounting, tax, registration, transparency, and accountability obligations applicable to RMCR as a private nonprofit corporation and, where applicable, as a public-interest entity.
Managing, where applicable, expense reimbursements, insurance, or other coverage linked to the exercise of the position, as well as any management of conflict-of-interest situations or incompatibilities.
Publishing or communicating, when necessary or appropriate, the identification data and position of members of the governing body in corporate documentation, activity reports, RMCR’s institutional information, communications addressed to third parties or public administrations, and, in general, in cases where it is necessary for the legal and institutional life of the entity.
Capturing and, where applicable, disseminating the image of members of the governing body through corporate media, publications, social media, or other RMCR communication channels, for institutional, cultural, historical, or outreach purposes, when there is a sufficient legal basis and, where applicable, the data subject’s prior consent.

The legal basis for processing this data will be:

The performance of the institutional, organizational, or statutory relationship arising from the position held in RMCR’s governing or representative body, in accordance with Article 6.1.b) of the GDPR.
Compliance with legal obligations applicable to RMCR, particularly those arising from associative, accounting, tax, registration regulations and, where applicable, its status as a public-interest entity, in accordance with Article 6.1.c) of the GDPR.
RMCR’s legitimate interest in ensuring proper institutional functioning, the traceability of resolutions and actions, the defense of its interests, internal organization, and the historical and documentary preservation of the entity, in accordance with Article 6.1.f) of the GDPR.
The data subject’s consent, in cases where necessary, particularly for the processing and dissemination of their image or for sending certain communications not strictly necessary for performing the position, in accordance with Article 6.1.a) of the GDPR and regulations on the right to honor, privacy, and one’s own image.

X. Promotional activities

RMCR may process the following categories of personal data of persons participating in promotional, institutional, or outreach activities organized or promoted by the entity:

Identification data: first name, last name, national ID/foreigner ID, and signature.
Contact data: postal address, email address, and telephone number.
Data related to participation in activities, events, or promotional actions organized by RMCR.
Images and/or videos captured during the activities, where applicable.

No special categories of data are processed.

RMCR will process your data for the purpose of managing your participation in promotional, cultural, institutional, outreach, or networking activities organized by the entity, including the management of registrations, invitations, accreditations, event access, communications related to the activity, and other actions necessary for the proper organization and conduct of these initiatives.

Additionally, RMCR may capture and use images and/or videos obtained during the activities for informational, promotional, outreach, or institutional purposes through websites, social media, publications, and other corporate channels, in accordance with applicable regulations and, where necessary, subject to the data subject’s prior consent.

The legal basis for processing your data will be the performance of the relationship arising from participation in the activity or the application of pre-contractual measures, in accordance with Article 6.1.b) of the GDPR, as well as the data subject’s consent for any processing requiring it, particularly regarding the capture and dissemination of images, in accordance with Article 6.1.a) of the GDPR.

The consent given may be revoked at any time without affecting the lawfulness of the processing carried out previously.

RMCR will not make automated decisions or create profiles based solely on the automated processing of the personal data of participants in promotional activities.

XI. Disclosure of data

No disclosure of data to third parties is planned, except where legally required. Should such a possibility arise, RMCR will request your consent.

Notwithstanding the above, RMCR informs you that some of its activities require services from third-party entities with which RMCR has signed agreements, and this may involve these third parties accessing data for which RMCR is responsible, acting as data processors. For these purposes, RMCR will enter into the corresponding Data Processing Agreements with the guarantees required under current legislation.

XII. International data transfers

RMCR informs you that no international transfers of your personal data will be carried out. Should an international transfer of your data become necessary, RMCR will carry it out to countries that have an adequacy decision from the European Commission or to those whose data protection regulatory framework offers sufficient protection and guarantees in accordance with current legislation.

XIII. Rights

Any person has the right to obtain confirmation as to whether RMCR is processing personal data concerning them.

You may exercise the rights granted to you under current regulations: the right of access, rectification, erasure, and objection, restriction of processing, data portability, and the right not to be subject to automated individual decisions.

Access: allows the data subject to obtain information on whether RMCR processes personal data concerning them and, if so, the right to obtain information about their personal data undergoing processing.
Rectification: allows correction of errors and modification of data that is inaccurate or incomplete.
Erasure: allows data to be deleted and no longer processed by RMCR, unless there is a legal obligation to retain it and/or other legitimate grounds for its processing by RMCR prevail in accordance with current regulations.
Restriction: under the legally established conditions, allows the processing of data to be halted, so that RMCR avoids processing it in the future, retaining it only for the exercise or defense of claims.
Objection: allows the data subject, under certain circumstances and for reasons related to their particular situation, to object to the processing of their data. RMCR will stop processing the data, except for legal reasons or the exercise or defense of possible claims.
Portability: allows the data subject to receive their personal data and transmit it directly to another controller in a structured, commonly used, and machine-readable format. To exercise this right, the data subject must provide a valid email address.

RMCR guarantees that it will adopt the necessary measures to ensure the exercise of these rights free of charge; the request must be addressed to RMCR as data controller, at the postal or email address indicated in the “Data Controller” section of this Privacy Policy, indicating the reference “Data Protection.”

Since these are highly personal rights, the request must include: first and last name, the specific request being made, address for notification purposes and/or email address. If you are not satisfied with RMCR’s response to the exercise of your rights, you have the right to lodge a complaint with the Supervisory Authority (Spanish Data Protection Agency) seeking protection of these rights.

XIV. Data retention

RMCR informs you that it will process and retain your data for as long as necessary in order to use it in accordance with the purpose and legal basis of the processing for which it was collected, and provided you do not object or expressly revoke your consent where consent is the basis for legitimacy.

We will also process your data to comply with applicable legal requirements, prevent unlawful actions, resolve disputes, troubleshoot problems, perform our contract, and other actions permitted by law, such as the formulation, exercise, or defense of claims. Once the legal statute-of-limitations periods have elapsed, in accordance with applicable commercial and tax regulations, we will delete and/or block the data in accordance with our data retention and deletion policy.

Data processed for selection processes will be processed only for as long as necessary in accordance with the purpose and legal basis of the processing for which it was collected, provided the data subject does not object or expressly revoke their consent where consent is the basis for legitimacy. RMCR will process and store the data you provide, unless you revoke your consent or object to such processing, only for the duration of the selection process for which you submitted your application, deleting it once RMCR informs you that your application has been rejected, unless that communication requests your consent to retain it for other selection processes deemed appropriate.

In accordance with industry standards, RMCR informs you that it maintains technical and organizational measures against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and other unlawful forms or procedures. In this regard, RMCR will adopt appropriate security measures to prevent unauthorized alteration, loss, processing, or access to your data. It will also inform anyone with access to your data of their security and confidentiality obligations and their duty of secrecy.