Privacy Policy

Who is responsible for your data

[FULL LEGAL NAME OF THE ORGANISATION]
CIF/NIF: [XXXXXXXXX]
Address: [FULL ADDRESS]
Email: [DATA PROTECTION OR GENERAL CONTACT EMAIL]

What data we collect and why

Contact form
We collect your name, email address and the content of your message, solely to respond to your enquiry. Legal basis: your consent (Art. 6.1.a GDPR). We retain this data for as long as necessary to handle your request, and thereafter for the applicable legal limitation period.

Donation form
[COMPLETE ONCE DONATION PLATFORM IS DECIDED]
We collect your name, email address and the payment details necessary to process your donation. Legal basis: performance of a transaction (Art. 6.1.b GDPR). For any follow-up communications about the impact of your donation, we rely on your consent (Art. 6.1.a GDPR). Rights & Roots does not store card details — these are handled directly by our payment provider.

Newsletter
We collect your email address to send you updates about our work. Legal basis: your consent (Art. 6.1.a GDPR). You can unsubscribe at any time.

Cookies and analytics
See our Cookie Policy below.

We do not sell your data

Rights & Roots does not sell, rent or share personal data with third parties for commercial purposes. We may share data only with service providers acting as data processors (hosting, email platform, payment provider) under data processing agreements that comply with the GDPR, or with public authorities when required by law.

Your rights

At any time, you have the right to access, rectify, erase, restrict or port your personal data, to object to certain processing, and to withdraw your consent without this affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [EMAIL] with your name and the right you wish to exercise. You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — www.aepd.es).

Security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration.

Children

Our website is not directed at children under 14. If you are under 14, please do not provide us with your personal data without parental consent.

Last updated: [DATE]