DATA PROTECTION AND RESPONSIBLE USE OF ARTIFICIAL INTELLIGENCE

I. DATA PROTECTION

A. Data Controller

Plataforma del Voluntariado de España (PVE), with Tax Identification Number (CIF) G-78453362 and registered office at C/ Duque de Fernán Núñez, 2, 2nd Floor, Office 2, 28012 Madrid, Spain, is the data controller responsible for the processing of personal data collected through registration, participation and attendance forms in connection with events, activities, conferences, meetings, training sessions and other initiatives organised or coordinated by PVE.

For any enquiries relating to the processing of your personal data or the exercise of your data protection rights, you may contact PVE at info@plataformavoluntariado.org.

B. Purposes of Processing

The personal data provided will be processed by PVE for the purposes of managing registration and participation in, and the administration and follow-up of, events, conferences, meetings, training sessions and other initiatives organised or coordinated by PVE, as well as sending any communications necessary in connection with those activities.

Personal data may also be processed to compile statistics and internal reports, comply with legal obligations, and improve PVE's services, activities and internal processes.

PVE may use digital tools and supporting technologies, including artificial intelligence systems, to assist in the management and delivery of its activities and services. Where such tools involve the processing of personal data, they will be used in accordance with applicable data protection legislation and subject to appropriate safeguards and human oversight.

PVE does not use solely automated processing to make decisions that produce legal effects concerning individuals or similarly significantly affect them.

C. Applicable Legal Framework and Legal Basis

The processing of personal data by PVE is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – GDPR), Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) and any other applicable data protection legislation.

Depending on the purpose and circumstances of the processing, personal data will be processed on the appropriate legal basis provided for under applicable data protection law, which may include the data subject's consent, the performance of a contract or the taking of steps prior to entering into a contract, compliance with a legal obligation, or PVE's legitimate interests, where applicable and subject to the safeguards required by law.

Where PVE uses artificial intelligence systems in connection with its services or activities, such use will also be carried out in accordance with Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act or AI Act) and any other applicable EU or Spanish legislation.

PVE will seek to ensure that the use of artificial intelligence systems is consistent with applicable requirements concerning transparency, human oversight, data protection and the protection of individuals' fundamental rights and freedoms.

D. Recipients

Personal data may be disclosed or made accessible to service providers acting on PVE's behalf where this is necessary for the provision of services, as well as, where applicable, to partner organisations involved in the organisation or implementation of PVE's activities.

Personal data may also be disclosed to public authorities, courts or other competent bodies where PVE is required to do so by law.

Where third-party service providers process personal data on behalf of PVE, appropriate contractual and organisational safeguards will be put in place in accordance with applicable data protection legislation.

Where the use of a service provider involves the transfer of personal data outside the European Economic Area, PVE will ensure that such transfers are carried out in accordance with the requirements and safeguards established under applicable data protection law.

E. Data Retention

Personal data will be retained for as long as necessary to fulfil the purposes for which they were collected and, thereafter, for any additional period required by applicable law or necessary for the establishment, exercise or defence of potential legal claims or liabilities arising from the processing.

Once the applicable retention periods have expired, personal data will be securely deleted or irreversibly anonymised, as appropriate.

F. Rights of Data Subjects

Data subjects may exercise, where applicable, their rights of access, rectification, erasure, restriction of processing, objection and data portability, in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and other applicable legislation.

Data subjects also have the right, in the circumstances provided for by law, not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

Where the processing of personal data is based on consent, the data subject may withdraw that consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

If you consider that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD).

To exercise any of the rights referred to above, you may contact PVE using the contact details provided in Section A. PVE may request any information reasonably necessary to verify your identity where this is required to process your request.

II. USE OF ARTIFICIAL INTELLIGENCE

A. General Principles

Where applicable, PVE may use artificial intelligence (AI) systems and AI-enabled technologies in connection with the provision of its services, the management of its activities and its interactions with individuals. These technologies may include natural language processing systems and other tools used to support analysis, content generation, communication and administrative or management tasks.

Such systems may be used to support the management of activities, respond to enquiries, analyse information, generate or assist in the preparation of content, and improve PVE's services and internal processes. Where their use involves the processing of personal data, that processing will take place only where there is an appropriate legal basis and in accordance with applicable data protection legislation.

Where PVE uses an AI system that interacts directly with individuals, appropriate information will be provided in accordance with the transparency requirements applicable to PVE's role and to the AI system concerned.

PVE will also comply with any applicable transparency and disclosure requirements concerning content generated or manipulated using artificial intelligence.

B. Responsible Use of Artificial Intelligence Technologies

PVE's use of artificial intelligence systems will be guided by the principles of transparency, explainability where applicable, human oversight, data protection, prevention of harm, security, data minimisation, accountability, and respect for fundamental rights and freedoms.

PVE will not make decisions that produce legal effects concerning individuals or similarly significantly affect them based solely on automated processing.

Analyses, recommendations, summaries or other outputs generated by artificial intelligence systems will be used only as supporting tools and will be subject to appropriate human review where their use may affect individuals, organisational decisions or the exercise of rights.

The use of artificial intelligence does not restrict the rights available to data subjects under applicable data protection legislation, including, where applicable, the rights of access, rectification, erasure, restriction of processing, objection and data portability, as well as the safeguards applicable to automated decision-making.

C. Profiling and Automated Decision-Making

PVE does not use solely automated processing, including profiling, to make decisions that produce legal effects concerning an individual or similarly significantly affect them.

Any analyses, summaries, recommendations or predictive outputs generated using AI systems are intended to support PVE's staff and do not, in themselves, determine decisions with legal or comparable significant effects.

Any such decision will remain subject to appropriate human involvement and will be taken by an appropriately authorised member of PVE's staff.

D. Exercise of Rights

You may exercise your data protection rights by submitting a request to PVE using the contact details specified in Section I.A of this document.

Where necessary, PVE may request sufficient information to verify your identity before processing the request.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) if you consider that the processing of your personal data infringes applicable data protection law. Complaints may be submitted through the AEPD's Electronic Office.