PRIVACY POLICY

In strict compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), we inform you about the processing of your personal data in the management and development of the Congress.

1. Identity of the Data Controller

• Controller: ASOCIACIÓN CLÚSTER DE VEHÍCULOS AÉREOS Y AEROESPACIALES DE CANARIAS “CLÚSTER CAAC” – Organising Entity of CIAC 2026.
• Tax ID (NIF): G06965289
• Postal Address: C/ José Franchy Roca. 5, Office: 602.
• Privacy Contact: privacidad@ciac.org.es

2. Purpose of Processing and Mandatory Nature

The data collected will be processed for the following main purposes. Please note that providing the data requested during registration is mandatory; refusal to supply it will prevent the processing of your accreditation and access to the venue (ITER) for strict security reasons.

• Accreditation and Security Management: To process your attendance, issue a nominal accreditation for access to ITER facilities, and handle accounting/tax management.
• Operational Communications: Sending strictly logistical communications related to the Congress (agenda, transport, accreditations, and access rules).
• Communications about CAAC activities and services: Sending information about activities and services of the Canary Islands Aerospace Cluster, provided that the data subject has previously given their express consent.
• Image Capture: The Congress may be photographed and recorded. Attendance implies that your image may appear incidentally as part of the audience in photographs or recordings intended for the dissemination of the Cluster’s activities through its website, social networks, activity reports, and other institutional communication channels. If you do not wish your image to be captured during a specific activity, you may inform the Organization.

3. Legal Basis

The processing of your data is based on the following legal grounds (Art. 6 GDPR):

• Performance of a contract and/or pre-contract: For the management of your ticket purchase, registration, or sponsorship agreement.
• Consent of the data subject: For voluntary participation in professional networking activities, which involve access to certain contact details by other attendees, as well as for sending commercial or informational communications about future Cluster activities, provided that the data subject has previously given their express consent. Such consent may be withdrawn at any time.
• Legitimate interest: For the capture of ambient images, as well as for access control and perimeter security at ITER facilities.

4. Data Retention

Your personal data will be kept for as long as strictly necessary to fulfil the purpose for which they were collected. Once the congress is over, billing data will be retained for the applicable legal periods (generally 6 years according to the Spanish Commercial Code and 4 years according to tax regulations). Networking data will be deleted 30 days after the close of the event, unless you consent to receive information about future editions.

5. Data Disclosure and International Transfers

Your data will not be transferred to third parties, except by legal obligation, with the following exceptions necessary for the operation of the congress:

• To the Institute of Technology and Renewable Energy (ITER) and to the State Security Forces and Corps, for the sole purpose of access control and integrity of the facilities.
• To technology service providers (ticketing platforms and B2B App) acting as Data Processors.

Please be aware that the use of the Networking App / mailing tools may involve international data transfers to the United States. These transfers are carried out using providers adhering to the EU-US Data Privacy Framework or through Standard Contractual Clauses approved by the European Commission.

6. Exercise of Rights and Complaint to the AEPD

As a data subject, you have the right to exercise your rights of Access, Rectification, Erasure, Restriction, Portability, and Objection to the processing of your data. In the case of networking and mailing, you have the right to withdraw your consent at any time.

You may exercise these rights by sending an email to privacidad@ciac.org.es, indicating in the subject line "GDPR Rights Exercise".

Furthermore, in compliance with the GDPR, we inform you that if you consider that your rights have not been duly addressed, you may file a complaint with the competent Supervisory Authority, which in Spain is the Spanish Data Protection Agency (AEPD), through its website: www.aepd.es.