This Privacy Policy has the purpose of providing information on your rights under the General Data Protection Regulation (GDPR), and under applicable national legislation. It also explains how we process your personal data. If you have any doubts about how your personal data is processed, or you wish to exercise your rights, you can contact privacidad@sansebastianfestival.com.

1. Who is responsible for processing your data?

FESTIVAL INTERNACIONAL DE CINE DE DONOSTIA SAN SEBASTIAN
Tabakalera – Centro Internacional de Cultura Contemporánea,
Plaza de las Cigarreras 1, 2ª planta
Donostia-San Sebastián (Gipuzkoa)
Tax no. A-20219283
Tel.: 943-481212
Email: ssiff@sansebastianfestival.com

2. How is your data collected?

The data requested on forms accessible from the FESTIVAL DE CINE DE DONOSTIA SAN SEBASTIAN website are, generally speaking, mandatory (unless specified otherwise in the required field) in order to fulfil the purposes established. This means that if you do not provide your data, or if you do not provide them correctly, we will be unable to fulfil said purposes.

3. What personal data do we process?

Personal data are processed differently depending on the request made by the User and the form completed in each case: name, surname/s, date of birth, country, address, email, telephone number, nationality, sex, photograph, ID or passport number, digital signature, academic details.

4. Why do we process your personal data?

Your personal data will be processed by the FESTIVAL, according to the requests made by the User and to the form completed in each case, to:

• Manage your browsing experience on our Website.
• Manage your subscription to the Festival newsletter and send it to you.
• Manage your user registration and identify you as a "registered user".
• Manage film submission, and process film crew data for publication of the information on the website and in the corresponding catalogues.
• Manage accreditation formalities and publish lists of attendees in the Festival guides and website area reserved for accredited guests; also, to send you information, communiqués, announcements and/or notifications.
• Manage the registration of candidates who sign up to work or intern at the Festival.
• Manage the registration of candidates who sign up to sit on the Youth Jury.
• Manage participation in contests, draws or promotions linked to campaigns called by the Festival with your express and informed consent.
• Proceed with e-commerce activities, where appropriate, always offering payment services with your express and informed consent.
• Manage payment for products and/or services acquired by you, using payment gateways contracted for the purpose. The financial information you provide may be stored in said gateways to make repeat payments simpler.
• Manage Customer Services.
• Manage the attention of user requests and queries.
• Manage the ethics, communication and complaints channel.
• Carry out statistical studies and manage profiles.
• Manage the carrying out of surveys and/or evaluations related to the services provided.
• Any other purpose specifically reflected in the corresponding captions and/or particular conditions of the data collection form
• Meet all applicable obligations imposed by laws, regulations or legislation.

5. Lawful basis for data processing.

The lawful basis for processing data is to provide the services requested. Processing of the data required to fulfil any purposes entailing User consent in order to proceed will not be carried out without having received said consent. Furthermore, should the User wish to withdraw their consent for any kind of data processing, doing so will not affect the lawful nature of any data processing previously carried out.

To revoke said consent, the User can contact the FESTIVAL through the following channels: by writing a letter to the FESTIVAL, TABAKALERA, Plaza de las Cigarreras 1, 2ª Planta, 20012 Donostia-San Sebastián, or by sending an email to privacidad@sansebastianfestival.com, in both cases indicating the reference "Data Protection".

6. For how long do we store your data?

Your data will be stored for as long as is required to respond to the requests or applications made by the User and, in any case, while no request has been made for them to be deleted; also, for the amount of time necessary to meet the corresponding legal obligations in each case, depending on the type of data in question. In the specific case of a curriculum vitae, the data will be stored for a maximum of three years, unless otherwise indicated by the interested party.

7. To whom will your data be communicated?

The Festival will not convey your personal information to third parties, with the exception of the following cases:

• Personal data and details of means of payment whose communication to credit card companies, banks and companies may be necessary in order to process transactions related to registrations and purchases made by the User.
• Personal data required by hotels and travel agencies to manage accommodation and travel bookings.
• Personal data required by third-party companies in order to provide a service offered by the Festival to its accredited guests.
• Personal data whose transfer or communication is subject to express consent.
• Personal data when instructed to do so under current legislation by court order, or by a competent authority.

In any event, in accordance with existing law on the subject, the FESTIVAL will only communicate the personal data which are strictly necessary, and the third parties receiving said data can only use them to fulfil the task for which they were provided.

Other than the suppositions specified above, under no circumstances will the FESTIVAL transfer or communicate your personal data to third parties.

8. User's responsibility

The User guarantees that they are of legal age or are legally emancipated, that they are fully able, and that the data they have provided to the FESTIVAL are true, exact, complete and up to date. The User is therefore liable for the truthfulness of all data provided and will update their data where necessary to ensure that it coincides with their real situation. Furthermore, and in the event of doing so,the user guarantees that they have informed the third parties whose data they have provided, prior to their inclusion, of the aspects contained in this document.

9. What are your rights on providing your data to us?

You can write to the FESTIVAL (TABAKALERA, Plaza de las Cigarreras 1, 2ª Planta, 20012 Donostia-San Sebastián), or send an email to privacidad@sansebastianfestival.com, in both cases with the reference 'Data Protection', enclosing a photocopy of their valid ID document or passport, at any time and free of charge, in order to:

• Revoke the consent given.
• Obtain confirmation of whether the FESTIVAL is processing your personal data.
• Access your personal data.
• Rectify inexact or incomplete data.
• Request the deletion of your data when, among other reasons, they are no longer required to meet the purposes for which they were collected.
• Obtain from the FESTIVAL a restriction on the processing of your data when any of the conditions anticipated in data protection regulations have been fulfilled.
• Request the portability of your data.

Lastly, we inform you that you can approach the Spanish Data Protection Agency and other competent public bodies with any complaints you may have in respect to the processing of your personal data.

10. Safety measures

The FESTIVAL will process your data with absolute confidentiality at all times, observing its duty of secrecy as per the applicable regulation. It will therefore take all necessary technical and organisational measures to guarantee the safety of your data and prevent their unauthorised alteration, loss, processing or access, taking account of the state of technology, the nature of the data stored and the risks to which they are exposed.