PRIVACY POLICY
 

For the purposes of the applicable personal data protection legislation, this Privacy Policy informs data subjects of the key aspects of the processing of personal data carried out by Fundación Banco Santander (the “Foundation”) in the promotion of culture, including activities undertaken in the context of the Faro Santander cultural centre, social action initiatives, and support for higher education, employability and entrepreneurship.

 

At all times, the Foundation processes personal data in accordance with the applicable personal data protection legislation and, in particular, Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation or “GDPR”) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights.

 

This Privacy Policy sets out the purposes for which personal data are processed, the legal grounds on which such processing is carried out, the periods for which personal data are retained, the entities with whom they are shared, the rights available to data subjects, and other matters considered relevant.

 

Data subjects are therefore encouraged to read this Privacy Policy carefully. It will remain available for consultation on the Foundation's website and on the Faro Santander website.

 

1. Data Controller
 

Fundación Banco Santander, with tax identification number (NIF) G-80576200, processes personal data in its capacity as Data Controller.

 

The Foundation’s contact details, in relation to the processing of personal data carried out, are as follows:

• Postal Address: Calle Serrano 57, 28006 - Madrid.
• E-mail: privacidadfundacionbs@gruposantander.com

 

2. Personal Data Processed
 

"Personal Data" means any information that identifies or may identify a data subject, whether provided directly by the data subject or obtained directly by the Foundation.

 

As a general rule, the data requested in the corresponding forms are mandatory in order to fulfil the purposes set out in the section below, unless otherwise indicated in the relevant field. Therefore, if such data are not provided, or if they are not provided accurately, it may not be possible to process the relevant request (for example, participation in project calls, contacting the Foundation regarding a matter of interest, or purchasing tickets for Faro Santander).

 

Furthermore, and as a general rule, data will only be requested from individuals aged 18 years or over. Where, due to the specific nature of a particular activity, it is necessary to collect personal data relating to individuals under the age of 18, such data may only be provided by a person holding parental responsibility for, or acting as legal guardian of, the minor or, where applicable, by an adult who has obtained the prior informed consent of a person holding parental responsibility for, or acting as legal guardian of, the minor. The Foundation may verify such consent and, for this purpose, an email address may be requested.

 

The email address provided for the purpose of verifying consent to process a minor's personal data, where those data are supplied by a person who does not hold parental responsibility for, or act as legal guardian of, the minor concerned, will be processed in compliance with the Foundation's legal obligation to make reasonable efforts to verify that consent has been granted or authorised by the holder of parental responsibility or legal guardian of the individual under 18 years of age.

 

Where a user provides personal data relating to third parties, the user represents that they have obtained the prior consent of those third parties and/or have an appropriate legal basis for providing such data. The user further undertakes to provide those third parties with the information contained in this Privacy Policy, releasing the Foundation from any liability in this regard.

 

In any event, the Foundation may carry out such checks as it deems appropriate to verify the accuracy of the information provided, as well as the right to provide such information, adopting any due diligence measures required under applicable data protection legislation.

 

3. Purposes and Legal Bases for Processing Personal Data

Where appropriate and where a valid legal basis exists, the Foundation will process personal data for the following purposes:

 

a. Institutional Communications
 

As part of its activities, Fundación Banco Santander may send institutional communications to individuals with whom it maintains an institutional, professional or cultural relationship, or any other similar type of relationship, in order to inform them of relevant developments concerning its initiatives, as well as to invite them to exhibitions, cultural activities or institutional events held at the Faro Santander cultural centre or in any other context.

 

The legal basis for these communications is the Foundation's legitimate interests in involving individuals who are relevant within the social or cultural sphere, or who have an existing relationship with the Foundation through its cultural, social and/or educational activities, in its initiatives.

 

b. Management of Activities and Events
 

Fundación Banco Santander will use the personal data provided during the registration process or confirmation of attendance in order to organise activities and events properly. This may include, where applicable, managing attendance, access to Banco Santander's Financial City (Ciudad Financiera) or the Faro Santander cultural centre (or other event venues), accessibility arrangements for persons with disabilities, and the handling of any special requirements such as food allergies.

 

The legal basis for processing personal data relating to registration for, participation in and/or attendance at activities or events organised by the Foundation is the performance of the contractual relationship between the Foundation and the individual wishing to register for, participate in and/or attend the relevant activity or event.

 

Where information relating to special requirements or requests is provided, or special assistance is requested in relation to attendance or accessibility, from which information concerning health may be inferred, such processing will be carried out on the basis of the explicit consent freely given by the data subject for that purpose. The Foundation undertakes to process such information discreetly and confidentially in order to fulfil its purpose and legal obligation to ensure accessibility for all individuals attending its activities and events.

 

The above-mentioned consents may be withdrawn at any time in accordance with the procedure described in this Privacy Policy. Withdrawal of consent will not prevent participation in the relevant activity or event, nor will it affect any processing carried out prior to such withdrawal. However, it may prevent the Foundation from accommodating special requirements or requests, or from providing special assistance relating to accessibility or attendance at the relevant activity or event.

 

c. Ticket sales
  

The Foundation provides a platform for the purchase of tickets for activities held at or organised by Faro Santander. Accordingly, where an individual purchases tickets, the Foundation will process the personal data provided during the purchase process, or already held in its databases, in order to manage the sale and to issue and send the purchased tickets through the relevant channel.

 

Where an individual is entitled to a discount or other benefit, the Foundation may carry out the necessary verification processes and request additional information where required.

 

The ticket sales platform is managed by Clorian, a ticketing technology provider, which processes personal data relating to ticket purchases on behalf of the Foundation. Fundación Banco Santander and Clorian have entered into the corresponding data processing agreement in accordance with the applicable data protection legislation.

 

The legal basis for processing personal data for this purpose is the performance of the contractual relationship between the individual and the Foundation arising from the purchase and sale of tickets.

 

d. +Faro Membership Management 
  

Where the data subject purchases a +Faro membership, their personal data will be processed for the purpose of managing that membership and collecting the corresponding fee, as well as providing access to its benefits, maintaining the relationship with membership holders, informing them about activities associated with this programme and, where applicable, managing subsequent renewals, all in accordance with the specific +Faro Membership Terms and Conditions. In addition, if the data subject purchases this membership, their personal data will also be processed for the purpose of carrying out surveys relating to the programme and sending them informational communications about the Foundation and Faro Santander activities, under the terms described in sections (e) and (f) respectively of this Privacy Policy. The legal basis for this processing is the performance of the contractual relationship between the data subject and the Foundation arising from acceptance of the specific +Faro Membership Terms and Conditions. 

 

e. Venue Hire 
 

The data provided by the data subject through the Faro Santander venue booking request channel will be processed for the purpose of managing such requests and enabling the formalisation of the booking (either on their own behalf or on behalf of the individual or legal entity they represent). The legal basis for this processing is the implementation of pre-contractual measures, insofar as discussions are conducted at the request of the data subject and may lead to the execution of a venue hire agreement for Faro Santander. 

 

f. Connection to the Wi-Fi Network 
 

Where a data subject requests access to and use of the free Wi-Fi network provided at Faro Santander, the personal data supplied through the relevant form will be processed for the purpose of managing that request and providing access to the Wi-Fi network. In addition, data relating to the user’s connection to the Wi-Fi network will be processed in order to carry out the necessary checks to ensure the proper functioning of the network and maintain the security of equipment and connections, enabling users to enjoy a secure browsing experience within our environment. The legal basis for processing related to Wi-Fi access is the performance of the contractual relationship arising from the User’s acceptance of the Wi-Fi Terms of Use. Processing related to maintaining network security is based on the Foundation’s legitimate interest in safeguarding cybersecurity and the proper functioning of the network. 

 

g. Management of Participation in Project Calls Organised by the Foundation 
 

In order to participate in project calls organised by the Foundation, the data subject must first register. Once registered, the data subject may apply to participate in the relevant project call and any others of interest, using the same username and password associated with their registration. Applications submitted and related information may be consulted in the private area linked to the registration. Accordingly, the data associated with the registration, as well as any additional information requested in connection with a specific project call, will be used to manage the data subject’s participation in the relevant Foundation project call. Any specific aspects relating to the processing of personal data for a particular project call will be explained in the relevant application form. Personal data relating to participation in a specific project call may be reviewed by members of the Evaluation Committee appointed for that purpose. The legal basis for processing personal data for the management of participation in project calls, including the required registration, is the performance of the contractual relationship between the parties in accordance with the terms of the relevant project call. 

 

h. Satisfaction Surveys 
 

In certain cases, the Foundation will send satisfaction surveys by email to gather opinions regarding activities, events, project calls, publications, the +Faro membership programme and other initiatives carried out or offered by the Foundation and Faro Santander. The legal basis for sending satisfaction surveys and preparing related statistics is the Foundation’s legitimate interest in understanding users’ satisfaction levels and improving the management, organisation and objectives of its activities. Participation in such surveys is entirely voluntary. Therefore, once a survey has been sent, only the personal data of individuals who choose to respond and provide information will be processed.

 

i. Sending Informational Communications 
 

The Foundation will use the personal data of data subjects who have provided their consent in order to send informational communications about the Foundation and Faro Santander activities. It is important for the Foundation to be able to inform interested individuals about its initiatives and Faro Santander activities, particularly those who may have a greater interest in taking part. To achieve this, the Foundation will create profiles based on information provided by data subjects or generated through their participation in Foundation activities. On this basis, the Foundation may send communications targeted at specific groups (for example, residents of a particular area, students, researchers or individuals in particular social or personal circumstances) or individuals with identified interests (such as art, cultural heritage or architecture). Under no circumstances will such profiling produce legal effects or otherwise significantly affect the data subject. The legal basis for this processing is the consent provided by the data subject. Consent may be withdrawn at any time in accordance with the procedure set out in this Privacy Policy and by unsubscribing through the mechanisms included in the communications and/or available on the Foundation’s website. Withdrawal of consent will not affect any processing carried out before consent was withdrawn. 

 

j. Preparation of Internal Reports, Statistics and Analysis 
 

The Foundation may prepare internal reports and statistics using aggregated information relating to participation in Foundation activities, including visits to the Faro Santander cultural centre and use of its exhibition spaces, in order to analyse results and identify opportunities for improvement in both Foundation activities and the visitor experience. The legal basis for this processing is the Foundation’s legitimate interest, as recognised under applicable data protection legislation. This legitimate interest is based on the need to organise and optimise Foundation activities and ensure the highest possible quality of exhibitions and events. The Foundation has carried out a proportionality assessment to determine that this processing, based on its legitimate interests, does not unjustifiably prejudice the rights and freedoms of data subjects. Nevertheless, data subjects may object to the processing of their personal data for this purpose in accordance with the provisions of this Privacy Policy. 

 

k. Management of Requests Submitted by Data Subjects 
 

Where a data subject submits a request through the “User Support” form or through any other communication channels made available by the Foundation, including social media channels through which the Foundation maintains an official presence, the personal data provided, together with any other personal data held by the Foundation and relevant to the request, will be processed for the purpose of responding to that request. The legal basis for this processing is the performance of the contractual relationship between the parties arising from the request submitted. 

 

l. Compliance with the Foundation’s Legal Obligations

The Foundation will process the personal data of data subjects where necessary in order to comply with applicable legal obligations, including, for example, tax obligations and compliance with legal or administrative requests and requirements. The legal basis for this processing is, where applicable, the necessity of processing the personal data of data subjects in order to comply with the legal obligations to which the Foundation is subject. 

 

4. Retention Period For Personal Data
 

Personal data processed by the Foundation shall be retained for as long as necessary to fulfil the purposes described above and, in any event, provided that the data subject has not withdrawn their consent or objected to such processing.

 

Once the relevant processing activity has ended, the personal data of the data subjects shall be retained in a duly restricted and blocked form for a period of three (3) years, unless the processing was carried out for the proper performance of an existing legal or contractual relationship between the parties (for example, the administration of calls for applications or invoicing related to ticket sales). In such cases, the data shall be retained for five (5) years in order to deal with any potential data protection claims arising from such processing, after which the data shall be permanently deleted.

 

5. Recipients Of Personal Data
 

The Foundation does not envisage disclosing personal data except where such disclosure is necessary for the fulfilment of the purposes described above, or in the following circumstances:

• Public authorities, in the cases provided for by law, on the basis of compliance with a legal obligation.
• Courts and tribunals, in the cases provided for by law, on the basis of compliance with a legal obligation. 
• Organisations hosting events and/or activities which the User wishes to attend, where this is necessary for the performance of the contractual relationship.

 

In addition, personal data may be accessible to service providers engaged by the Foundation. Such providers shall not process personal data for their own purposes unless such purposes have been previously notified by the Foundation.

 

By way of example and without limitation, the Foundation engages professional and consultancy services to support evaluation committees, technology providers for the management of its activities, digital platforms and the Faro Santander cultural centre, as well as administrative services required to ensure compliance with accounting and tax obligations.

 

In this regard, the Foundation applies strict criteria when selecting service providers in order to comply with its data protection obligations and undertakes to enter into data processing agreements with such providers in accordance with applicable law. These agreements shall impose, amongst others, the following obligations: to implement appropriate technical and organisational measures to ensure the security of personal data; to process personal data solely for the agreed purposes and exclusively in accordance with the documented instructions of the data controller; to delete or return the personal data to the Foundation upon completion of the services.

 

Where any services contracted by the Foundation involve the processing of personal data outside the European Economic Area (EEA), the Foundation shall ensure that such transfers are carried out with appropriate safeguards in place, including, where applicable, the execution of Standard Contractual Clauses or the use of providers benefiting from recognised adequacy arrangements (such as the EU–US Data Privacy Framework, or any successor framework recognised as providing an adequate level of protection).

 

6. Social media
 

The Foundation maintains a presence on various social media platforms. When interacting with any of the Foundation's social media pages, the processing of personal data shall be governed by the relevant terms of use, privacy policies and access rules established by the respective social media platform and previously accepted by the data subject as a user of that platform.

 

The Foundation shall process the data subject's personal data for the purpose of providing information about the Foundation and Faro Santander's activities, as well as for any other purposes permitted under the applicable rules of the relevant social media platform.

 

In all cases, it should be noted that the Foundation has no control over the information collected by social media platforms or the manner in which such information is processed.

 

7. Responsibility for the Information Provided 
 

The data subject or, where applicable, the person providing the information in question in each case:

 

• warrants that they are over eighteen (18) years of age and that the data provided to the Foundation are true, accurate, complete and up to date. For these purposes, the data subject shall be responsible for the accuracy and lawfulness of all the data provided and shall ensure that the information supplied is kept duly updated so that it reflects their actual circumstances.
• warrants that they have informed any third parties whose data they provide, and, where the data relates to minors, the holders of parental responsibility or legal guardians, of the matters set out in this document. They also warrant that they have obtained the necessary authorisation to provide such data to the Foundation for the purposes indicated. 
• shall be liable for any direct or indirect loss or damage caused to the Foundation or to third parties as a result of any breach of the foregoing.

 

8. Data Subject Rights 
 

As the holder of the personal data being processed, the data subject has the right to request access to, rectification, erasure and portability of their personal data, as well as restriction of and objection to its processing and, where applicable, to withdraw any consent previously given. 

 

In addition, where processing is based on the Foundation's legitimate interests, the data subject may obtain further information regarding the balancing test carried out by requesting it through the channels indicated below. 

 

Data subjects may exercise the rights granted to them under the applicable data protection legislation and request additional information regarding the processing of their personal data by writing to: Calle Serrano 57, 28006 Madrid, Spain, and/or by email to: privacidadfundacionbs@gruposantander.com. Where it is not possible to identify the data subject correctly, the Foundation may request additional information. 

 

Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at Calle Jorge Juan 6, 28001 Madrid, Spain, or via https://www.aepd.es/enwww.aepd.es, if they consider that their personal data is not being processed correctly or that their rights have not been adequately addressed.

 

9. Safety measures

The Foundation shall process personal data by implementing the technical and organisational measures necessary to safeguard data security and prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data stored and the risks to which it is exposed, whether arising from human action or from the physical or natural environment. 

 

10. Changes 
 

Te Foundation reserves the right to review and amend its Privacy Policy at any time in accordance with applicable legislation. Where appropriate, data subjects will be informed of such changes. For this reason, we recommend that you consult the latest version of this Privacy Policy in order to remain informed of any amendments that may have been introduced. 
 

 

Last updated: August 2026