Pursuant to the principle of transparency set out in applicable data protection regulations (EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and the Personal Data Protection and Digital Rights Safeguards Act 3/2018 of 5 December), below we provide you with information on the processing of your personal data through the “Espai Client” Platform hosted on the website www.espaiclient.icf.cat (hereinafter, the “Platform”).
Please note that if you purchase any of our products, the privacy policy for this product will also apply and so you should refer to the privacy policy applicable to the product in question.
Who is the controller for your data?
The controller is the INSTITUT CATALÀ DE FINANCES, Tax Code (CIF) Q5855055I, registered address Gran Via de les Corts Catalanes, 635, 6a planta, 08010 Barcelona and contact email address protecciodedades@icf.cat.
You can contact our Data Protection Officer by emailing dpolCF@icf.cat.
What type of data, for what purposes and with what legal standing may we process your data?
| Purpose | Type of data | Lawful basis/Legal standing |
|---|---|---|
| Enabling registration on the Platform to do business as a registered user. Evaluating applications for new products and monitoring the products and services applied for or taken out. | Identifying data together with economic and financial data. | Contractual relationship or taking steps prior to entering into a contract requested by you. Legitimate interest (appropriate and efficient compliance with obligations concerning assessment of creditworthiness for accepting financing applications). |
| Profiling and risk segmentation in relation to the ICF Group’s products and services. | Identifying data together with economic and financial data. | Legitimate interest (better meeting your expectations and improving the commercial relationship with the data subject). |
| Complying with applicable money laundering regulations. | Identifying data. | Complying with legal obligations under the Money Laundering Prevention Act 10/2010. |
| Sending marketing messages by electronic or conventional means to users registered on the Platform. | Contact details and application history and ICF products taken out. | Section 21(2) of the Information Society Services and Electronic Commerce Act or legitimate interest (promoting our products and services). |
| Marketing profiling to send marketing messages to you. Please note that no automated decision-making that has a legal effect on you or similarly significantly affects you will be performed on the basis of this marketing profiling. | Identifying data and application history and ICF products taken out. | Legitimate interest (improving the outcome of our marketing messages and building customer loyalty). Where legitimate interest does not apply, we will ask for your consent. |
| Conducting satisfaction surveys in relation to ICF products and services. | Identifying data. | Legitimate interest (improving our products and services). |
| Preventing sending marketing messages when you have objected to them. | Identifying data. | Legitimate interest under section 23(1) of the Personal Data Protection and Digital Rights Safeguards Act 3/2018 of 5 December. |
| Ensuring the security of the Platform and preventing fraudulent access and attacks. | Identifying data, location data and data on the devices you use to connect to the Platform. | Legitimate interest (protecting our assets and interests and those of our customers). |
| Transferring data to public bodies, financial institutions and/or collaborating mutual guarantee companies for processing applications. | Identifying data together with economic and financial data. | Contractual relationship or taking steps prior to entering into a contract requested by you. |
| Entering data into the Administrative Integration and Collaboration Platform (PICA) run by the Secretariat of Public Administration in the Ministry of Governance and Institutional Relations of the Government of Catalonia. | Identifying data. | Data subject’s consent. |
How long will we keep the data for?
We will retain your personal data in general for as long as the contractual relationship between us lasts and you do not ask to unsubscribe as a registered user of the Platform.
However, please note that we may keep your data if we are obliged to do so or when this is required until the period of limitation for legal liabilities has ended. In this case, they will be duly blocked for the exclusive use of judges, courts and government authorities.
Which recipients will we disclose the data to?
When you ask for information and/or to take out products offered by other organisations in our group through the Platform, we may transfer your personal data to the organisation in the group in question to provide you with the required information and/or to attend to and handle your request. This transfer is covered by the application of taking the steps prior to entering into a contract you ask us for and will be restricted to the transfer of the data strictly necessary to comply with the purpose described above.
Below are the organisations which together with the INSTITUT CATALÀ DE FINANCES make up the ICF Group (hereinafter, the “ICF Group”):
| Organisation | Instruments Financers per a Empreses Innovadores | Institut Català de Finances Capital SGEIC SAU |
|---|---|---|
| Tax ID No. | B65007494 | A65288037 |
| Address | Gran Via de les Corts Catalanes, 635 – 08010 Barcelona | |
Except for the transfer envisaged in the previous paragraph, your personal data will not be shared with other third parties unless they have to be disclosed to public bodies, financial institutions and/or partner mutual guarantee companies to attend to and handle your request or we are legally obliged to do so, i.e. on receipt of an administrative or court order requiring us to disclose your data to an administrative authority or court, in which case we will only disclose the data we are strictly obliged to provide.
The foregoing is notwithstanding any providers we may use for the delivery of the services requested and who will process them in their capacity as data processors solely and exclusively for the provision of the services. If these providers are based outside the European Economic Area (EEA) we will try to use ones in territories which offer an appropriate level of data protection, and if they are outside the EEA we will put in place appropriate safeguards using the standard data protection clauses adopted by the Commission which ensure you have enforceable rights and effective legal remedies. You can learn more about these appropriate safeguards by getting in touch with us or our Data Protection Officer using any of the contact options listed above.
Where do we get your data from?
We gather your personal data which we process as part of the Platform in most cases at the time of your registration and afterwards when you use the Platform.
However, please note that you can register on the Platform as a partner if you have been invited to register by a proxy of the organisation you work for. In this case, we will obtain your personal data required to invite you to register on the Platform, such as your first and last name and email address, from the proxy of the organisation you work for.
Finally, please note that if you are a customer of any of the other organisations making up the ICF Group (you can see the organisations which are part of it together with the INSTITUT CATALÀ DE FINANCES in the previous section), your registration on the Platform will entail the transfer of data relating to the products you have taken out with them to the INSTITUT CATALÀ DE FINANCES for the sole and exclusive purpose of enabling you to view and manage your products taken out through the Platform. The legal basis for this transfer by these organisations to the INSTITUT CATALÀ DE FINANCES is maintaining and fulfilling your contractual relationship with the INSTITUT CATALÀ DE FINANCES and this transfer is strictly necessary to enable you to do business and manage these products taken out through the Platform.
What are your rights when you provide us with your data?
You may exercise the following rights at any time:
Rights of access, rectification and erasure: accessing your personal data, asking for rectification of inaccurate data and asking for them to be erased.
Right to object to receiving marketing communications: you have the right to object at any time to receiving marketing messages about our products by emailing protecciodedades@icf.cat using the means provided for this purpose and which includes any marketing messages you receive or through the privacy section of your user account on the Platform. In this case, we will keep your data for the purpose of not sending you these marketing messages from that time onwards.
If you object either when you register on the Platform or at any time thereafter to receiving marketing messages from us, please note that there are advertising opt-out systems which you can sign up to if you do not wish to receive marketing messages in general. You can learn more about the advertising opt-out systems currently in place at https://www.aepd.es/areas/publicidad/index.html.
Restriction and portability: in some circumstances, you may have the right to ask us to restrict our processing of your data. In this case, we will only keep them for the exercise or defence of legal claims and for requesting the portability of your data.
You can exercise the rights set out above by writing to the INSTITUT CATALÀ DE FINANCES (Gran Via de les Corts Catalanes, 635, 6a planta, 08010 Barcelona) or emailing protecciodedades@icf.cat, specifying the right you are requesting and identifying yourself with a photocopy of your ID card or equivalent document, or through the Privacy section on the ICF’s website: https://www.icf.cat/en/privacitat.
We will respond to your request within the statutory time limits and you also have the right to file a complaint with the Catalan Data Protection Authority (www.apdcat.cat) or with the Spanish Data Protection Agency (www.aepd.es).