LLEGENDÀRIUM is committed to protecting the privacy of people who visit this website, contact us or use its services. This policy explains what personal data may be processed, for what purposes, for how long, and what rights data subjects have.

Personal data are processed in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).

Basic data protection information

What data may we process?

Depending on how the website is used, Llegendàrium may process identification and contact data, principally a name or pseudonym, email address, and any information voluntarily included by the data subject in forms or communications.

Technical data strictly necessary for the operation and security of the website may also be generated, such as IP addresses, technical logs or similar information. The use of cookies and similar technologies is addressed separately in the Cookie Policy.

For what purposes do we process data?

• To respond to enquiries, requests or communications submitted through the website or the available contact channels.
• To manage subscriptions to and delivery of the Llegendàrium newsletter when a person has voluntarily subscribed.
• To maintain the technical operation, integrity and security of the website and prevent abusive or fraudulent use.
• To comply with applicable legal obligations.

Personal data will not be used for purposes incompatible with those for which they were collected without prior notice and, where necessary, obtaining new consent.

What is the legal basis for processing?

When a person voluntarily submits an enquiry, completes a form or subscribes to the newsletter, the legal basis for processing is their consent. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

Certain technical processing may be based on the legitimate interest in ensuring the security, stability and proper operation of the website, provided that the rights and freedoms of data subjects do not override that interest. Where a legal obligation applies, processing will be based on compliance with that obligation.

How long do we retain data?

Data relating to enquiries and communications will be retained for as long as necessary to respond to and manage the matter raised and, where applicable, for as long as necessary to address potential legal liabilities.

Data used to send the newsletter will be retained for as long as the person remains subscribed. Unsubscription may be requested at any time through the mechanism provided in the communications or through the website’s contact channels.

Who may receive the data?

Llegendàrium does not sell or trade personal data.

The operation of the website may involve providers of technology, web hosting, email, forms, security or newsletter services. These providers may access data only to the extent necessary to provide their services and will be subject to the applicable data protection obligations.

Data may also be disclosed to public administrations, authorities or public bodies where there is a legal obligation to do so.

International data transfers

Some technology providers may provide services from countries outside the European Economic Area. Where this entails an international transfer of personal data, the safeguards required by data protection law will apply, such as adequacy decisions, standard contractual clauses or other legally recognised mechanisms.

What rights do data subjects have?

Where provided by law, data subjects may exercise the following rights:

• Access: to know what personal data are being processed.
• Rectification: to request correction of inaccurate or incomplete data.
• Erasure: to request deletion of data when they are no longer necessary or another legal ground applies.
• Objection: to object to certain processing where provided by law.
• Restriction: to request restriction of processing in certain circumstances.
• Data portability: to receive data provided in a structured format and, where applicable, transmit them to another controller.
• Withdrawal of consent: to withdraw previously given consent at any time.

These rights may be exercised through the contact channels indicated on Llegendàrium. Additional information necessary to verify the identity of the requester may be requested where essential to prevent unauthorised access to third-party data.

A complaint may also be lodged with the Spanish Data Protection Agency (AEPD).

How do we obtain the data?

Personal data processed through Llegendàrium are obtained primarily from the data subject, when they voluntarily provide them through forms, newsletter subscriptions or other contact channels.

Cookies

Llegendàrium uses cookies and similar technologies in accordance with the user’s consent preferences and applicable law. Detailed information about the cookies used, their purposes and how to manage them can be found in the Cookie Policy.

Data security

Llegendàrium applies technical and organisational measures appropriate to the risk in order to protect personal data against loss, alteration, unauthorised access or improper disclosure, and reviews those measures when necessary.

Third-party links

This website may include links to third-party websites or services. Their privacy policies are the responsibility of their respective operators, and Llegendàrium does not control any processing of personal data carried out by those third parties.

Changes to this policy

This Privacy Policy may be amended when necessary to reflect changes in the operation of Llegendàrium, the services used or applicable law. The date of the latest update is shown at the beginning of the page.