Privacy Policy - Red Micelio Federation

Informative translation. In the event of any discrepancy, the original Spanish version shall prevail.

Confidentiality and Security

Confidentiality and security are core values for the Red Micelio Federation (FERM) (hereinafter “FERM”) and, accordingly, we are committed to guaranteeing your privacy at all times and to not collecting unnecessary information. Below we provide you with all the necessary information about our Privacy Policy in relation to the personal data we collect, explaining:

– Who is responsible for processing your data.

– For what purposes we collect the data we ask you for.

– What the legal basis for processing it is.

– How long we keep it.

– To whom your data are disclosed.

– What your rights are.

Who Are We?

We are the Red Micelio Federation (FERM), a non-profit organisation. For the purposes of the data protection laws of the European Union, in particular the General Data Protection Regulation (REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC) and Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights), FERM is the data controller. Strategic decisions regarding the purposes and means of processing the personal data of users of our website and of the services offered on it are always taken by our team in Barcelona.

If you have any questions or concerns regarding this Privacy Policy or the processing of your personal data, or wish to exercise any of your rights under the applicable legislation, please contact us at:

Red Micelio Federation (FERM)

Tax ID (NIF) G44797934 · Registro Nacional de Asociaciones (Spanish National Register of Associations), section 2, no. 51458

C/ Sepúlveda, 65, oficina 2

C.P. 08015, Barcelona, Spain

Email: info@redmicelio.org

How Do We Collect Personal Data?

We collect personal data directly from people who join the FERM community by visiting this website, subscribing to our email newsletter, contacting us through the contact form and attending our events. We also collect personal data directly when you make a donation, become a member or sign up for an activity through our management platform, Playoff.

You may also give us information indirectly when you contribute to FERM through fundraising sites, when you visit and browse our website (you can read our cookie policy below) or when you access FERM’s social media channels, such as Facebook, Twitter, YouTube, Instagram, Telegram or LinkedIn.

We may obtain publicly available data about people who may be interested in supporting organisations like ours. This information may include newspaper or other media coverage and public posts on social media sites.

What Data Do We Collect and Why?

We collect and process personal data of people who support FERM, make donations to us or use FERM’s services, for several reasons:

– Because we have a legitimate interest in providing you with information about our activities and services which we believe will benefit our mission. We will consider and balance any potential impact on you and your rights under data protection laws and any other relevant law. We will not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are required to do so by law);

– Because you have given us your consent to process your data;

– Because we need to comply with a contractual or legal obligation.

We only collect personal data that are relevant to the type of transactions you carry out with FERM. We do not intend to collect personal data from people under the age of 18. People under 18 should never provide personal information on this website and may not make donations on this website without their parents’ consent.

FERM will never sell, rent or trade the information we obtain from you, whether online or offline.

Personal Information We Process:

If You Visit Our Website

We may obtain, collect and process your personal data for the following purposes:

– To provide the website and keep it secure. Like any server, our hosting provider’s server records technical data about each visit (IP address, date and time, page requested and browser type), which are used only to maintain the service and prevent abuse.

– To ensure that the content of the website is presented to you in the most effective manner.

– To inform you of changes made to the website or to our services.

We process these data on the basis of our legitimate interest in ensuring that the website runs smoothly and securely. We do not use any visitor statistics, advertising or tracking tools. You can review our cookie policy below.

If You Follow or Interact with Our Social Media

We may obtain, collect and process your personal data made public on the web for the following purposes:

– To understand the demographic characteristics, preferences and interests of our audience so as to provide the most relevant information and news through our social media profiles;

– To optimise and segment our audience;

– To send personal, individual messages through the Social Network’s channels.

We have access to and process the user’s public information, in particular their contact name. These data are only used within the Social Network itself. They are not incorporated into any processing system.

We use these data to monitor and improve all our communications on social media and on our website. The legal basis for doing so is our legitimate interest. If you have joined our page, you give us your consent to process the personal data published on your profile.

You may at any time consult the privacy policies of the social network itself and configure your profile to guarantee your privacy.

If You Have Joined the FERM Community (Newsletter)

If you have joined our FERM community by signing up to receive our newsletter, we will always collect your email address.

We will use these data to keep you informed. We will send you our general newsletter, communications about our services and information about our fundraising campaigns.

All your data are stored in Mailchimp, our system for managing relationships with people connected with FERM (CRM). This includes details of email correspondence added to our CRM through an email integration.

Mailchimp is hosted outside the EEA and is only accessible to staff through individual login and password.

Mailchimp is a service of The Rocket Science Group LLC (Intuit), based in the United States. International data transfers are covered by the safeguards provided for in the GDPR, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. For more information on the privacy policies of its services, click on Mailchimp.

We will process the data provided because you have given us your consent. You will be given the option to remove your email address from our mailing list or to update your preferences at the end of each email update.

If You Contact FERM

If you interact with us by email, through our contact forms, by telephone or in person, we may also collect and process information about the date, time and method of contact, details of the donations you make to us, the events or activities you sign up for or attend, and any other information you provide to us.

If you contact FERM regarding a job or volunteering position and send us your Curriculum Vitae, your personal and CV data may be included in our databases in order to take part in our current and future selection processes.

The legal purpose of processing these data is to respond to your requests for information, to manage selection processes, to deal with your requests and to answer your questions or enquiries.

We will process the data provided because you have given us your consent.

If You Make a Donation or Pay for a Service or Product

If you make a donation, or purchase a service or product, we will collect and process the data relating to the financial transaction.

When you make a donation within the EU, in addition to collecting your first name and surname, your email address, your postal address and your credit card details, we will also ask you for your tax identification number.

We will use your data to process credit card payments and to keep a record of the donation in our accounts. The legal basis for processing the data is your consent and Ley 49/2002, de 23 de diciembre, de régimen fiscal de las entidades sin fines lucrativos (Spanish Law 49/2002 of 23 December on the tax regime of non-profit entities), and other applicable tax regulations.

We will share your donation data with the tax authorities in order to comply with our legal obligations regarding charitable donations, such as Ley 10/2010, de 28 de abril, de prevención del blanqueo de capitales y de la financiación del terrorismo (Spanish Law 10/2010 of 28 April on the prevention of money laundering and terrorist financing).

FERM uses Stripe and PayPal as payment processors for donations and activity payments. You enter your card details directly on the payment processor’s secure page: FERM neither receives nor stores them. These providers comply with EU data protection regulations and apply the GDPR safeguards to international transfers.

If you make a donation through a fundraising site, these independent third parties will pass your data on to FERM once you have indicated that you wish to support us. We use these data to keep a record of your donation. The legal basis for this processing is your consent or a contractual obligation, depending on the platform. We encourage you to read their privacy policies when you make your donation.

If You Access and Use Any of the Services Offered by FERM

6.1 Support Services

Through its website and its email address support@redmicelio.org, FERM offers several services aimed at supporting users who request them (hereinafter, jointly, the Support Services):

– Information and advice service.

– Support and accompaniment service.

– Legal defence and protection service.

Use of any of the Support Services entails, in addition to the express acceptance of this Privacy Policy, the full and unreserved acceptance of each and every one of the Conditions that may apply and are communicated to users of the services through the various Support Services. You can access the Legal Notice and Terms of Use here.

6.1.1. Access Forms

To access the Support Services you will need to complete a data collection form providing FERM with the information necessary to provide the service; such data must in all cases be truthful, accurate and complete as to your identity, and the user must expressly consent to their processing by accepting this FERM Privacy Policy.

When you request access to a Support Service through our website, we obtain your personal data. This information may include:

– Email address.

– Gender.

– Year of birth.

– Country in which you are located.

– City.

– Information about the reason for your interest in, or need to access, the Support Service. In some cases, where you consider it necessary, you may provide us with sensitive personal data concerning health or relating to criminal convictions and offences.

– Any additional information you have shared or uploaded (for example, questionnaires or additional data) in the access form.

We will store these data on our platform and use them to decide whether the requirements/suitability are met for you to use the Support Service you have requested. If we believe that FERM can offer you support, we will process these data, including your special category personal data, in order to provide you with the requested service.

Where we consider it necessary, we will share your personal data with an external specialist. The specialist will process your personal data in order to provide the service and always under FERM’s instructions. FERM will remain the data controller and will sign service contracts with the team of external specialists to ensure that they comply with data protection laws.

For this purpose, we ask for your prior and explicit consent. We need your consent to process and, where applicable, share your data with the specialist team and to provide you with our services. Without such consent, we cannot provide you with these services.

The processing of your personal data concerning health or data relating to criminal convictions or offences on the basis of your consent complies with Article 9(2)(a) of the GDPR.

6.1.2. Use of the Support Services: Sessions, Interviews and Other Communications

While using the Support Services you may share additional personal data with the team managing the Service or with the team of external specialists during individual sessions and communications.

FERM will process these personal data, including data concerning health or data relating to legal and criminal proceedings, in order to provide you with the service and, for this purpose, we ask for your prior and explicit consent.

In some cases FERM will ask you to register on a specific platform in order to access the Support Services. FERM has selected these platforms after assessing their compliance with data protection laws.

Where individual communications take place by electronic means of your choice, we recommend that you read the privacy policies of the service providers carefully.

To report bad practice or request support, you can contact us at support@redmicelio.org.

6.2 Training Services

Through its website FERM offers various courses, seminars, and training and information sessions so that society can benefit from the potential of psychoactive plants while reducing negative consequences and mitigating risks (hereinafter, jointly, the Training Services):

– Integration and support course: For health professionals to provide appropriate support to people who choose to undergo such experiences with psychoactive plants, it is vital to develop a thorough understanding of these practices. In this way, they will understand the contexts of use, the pharmacology, the effects, the potential risks and benefits, as well as effective strategies for intervening in crisis situations.

– Educational seminars and workshops on the responsible and safe use of psychoactive plants.

Use of any of the Training Services entails, in addition to the express acceptance of this Privacy Policy, the full and unreserved acceptance of each and every one of the Conditions that may apply and are communicated to users of the various Training Services. You can also access the Legal Notice and Terms of Use.

6.2.1. Registration and Booking Forms

When you request access to a Training Service through our website, we obtain your personal data. This information may include:

– First name and surname.

– Email address.

– Information about the reason for your interest in taking part in the training.

– Any additional information you share (for example, data contained in your message to the FERM team) in the registration and booking form.

– In some cases, where you consider it necessary, you may provide us with sensitive personal data concerning health.

We will store these data on our platform and use them to provide you with the Training Service you have requested.

Registrations for workshops and activities, applications to join the Federation and the management of individual and organisational members are handled in Playoff, FERM’s management platform, provided by Playoff Informática, which processes the data on FERM’s behalf as data processor. Activity payments are processed through Stripe.

If you provide us with sensitive personal data through the booking form, we are required to ask for your prior and explicit consent to process these sensitive personal data in order to provide you with our technical and booking services. Without such consent, we cannot provide you with these services.

The processing of your personal data concerning health on the basis of your consent complies with Article 9(2)(a) of the GDPR.

6.2.2. Access to the Training Services: Sessions, Courses, Seminars and Other Communications

FERM will ask you to register on a specific platform in order to access the Training Services. FERM has selected these platforms after assessing their compliance with data protection laws. We recommend that you read the privacy policies of the service providers carefully.

Do We Share Your Personal Data with Third Parties?

FERM will only use your data within FERM for the purposes for which we obtained them. FERM will never sell, rent or trade this information to third parties.

We may need to share data with service providers or other organisations that help us carry out our projects and store and manage data. In all cases, FERM will remain the controller of your data and the service providers will be data processors acting only on our instructions. We sign agreements with all organisations with which we share data to ensure that they comply with the applicable data protection regulations. These partners or service providers may never use your data for their own commercial purposes or disclose them to third parties without our consent.

Our main providers with access to personal data are currently:

– Playoff Informática: management of individual and organisational members, membership applications and activity registrations.

– Stripe and PayPal: processing of payments and donations.

– Mailchimp: sending of the newsletter.

– Our web hosting and email provider.

FERM reserves the right to disclose your personal data to third parties, organisations or public authorities if necessary to comply with any legal obligation (for example, to inform the tax authorities about your donation) or to enforce or apply any other agreement or to protect the rights, property or safety of FERM, our visitors, those who subscribe to our newsletters, our donors or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

If you access the Support Services, the team of professionals attending to you may share information with other professionals in the following circumstances:

– If there are sufficient reasons to believe that a third party is required to ensure protection (in relation to abuse, neglect, exploitation or abandonment), your data may be transferred to the local agency providing the social services required by the situation.

– If you express a serious threat, or intention to kill or seriously injure a person or group of people who can be personally identified, and if there are sufficient reasons

to believe that you may carry out that threat, the necessary measures will be taken to prevent any kind of harm. These reasonable measures may include warning the potential victim of the threat and the competent authorities.

– If there are sufficient reasons, based on the professional judgement of the service team, to suspect that a situation of child abuse exists.

Do We Transfer Your Personal Data to Countries Outside the European Economic Area?

Some of our providers (data processors) are based outside the European Economic Area, so we may transfer your personal data to third countries. We always ensure that these transfers comply with the requirements of the GDPR.

Use and Transfer of Data for Statistical and Research Purposes

FERM has a legitimate interest in processing anonymised and pseudonymised data of people who use its website, who access the Support and Training Services, or who are part of the FERM community.

We process these data to ensure that our programmes, services and initiatives have a greater impact, and for research purposes.

On occasion, we share this information with organisations and institutions with which we collaborate for research purposes. In all cases we will ensure that the collaborating entities apply the same standard of security and privacy as FERM and that under no circumstances do they attempt to re-identify the data subjects.

How Long Do We Keep Your Data?

We will only keep the information we collect about you for as long as necessary for the purposes set out above, or as necessary to comply with our legal obligations.

The period for which we retain your data will vary depending on the type of information and the purposes for which we use it. In general, we will keep our records for up to 6 years after your relationship with FERM has ended, in order to comply with our legal obligations. When we no longer need to use your personal data, they will be deleted from our systems and records or anonymised so that we can no longer identify them.

What Are My Rights Regarding the Processing of My Data?

Under the GDPR you have the following rights:

– You have the right to be informed about the processing of your personal data (i.e. for what purposes, what types of personal data, to which recipients they are disclosed, storage periods, any third-party source from which they were obtained, the existence of automated decision-making, including profiling, and the logic involved, the significance and the envisaged consequences). Reading this Privacy Policy forms part of your right to information.

– You have the right to lodge a complaint with FERM by emailing privacidad@redmicelio.org or with your supervisory authority (Agencia Española de Protección de Datos, the Spanish Data Protection Agency, C/ Jorge Juan, 6. 28001 – Madrid, https://www.aepd.es/es), if you consider that we are processing your personal data unlawfully.

– You have the right to request a copy of the personal data we process about you.

– You may ask us to erase (if you consider that we have no right to retain them) or rectify (if you believe they are inaccurate) your personal data.

– You may object to the processing of your personal data or (where we rely on your consent for the processing) withdraw your consent.

– You have the right to restrict the processing of your personal data.

– You may request that your data be provided in a portable format.

You may contact FERM (see the contact details in this policy) if you wish to exercise any of these rights. We will comply with our legal obligations with regard to your rights as a data subject.

Any request for access to your personal data must be made in writing; we will try to respond within a reasonable period and, in any event, within one month (or within the period we will notify you of immediately in the case of complex or numerous requests). We reserve the right to charge a reasonable fee (reflecting the costs of providing the information) or to refuse to respond where requests are manifestly unfounded or excessive: in this case, we will explain the situation to you and inform you of your rights.

Our aim is to ensure that the information we hold about you is accurate at all times. To help us keep your information up to date, please inform us of any changes to your personal data. If you so request, we will take reasonable steps to ensure that the data are accurate and will rectify any incorrect personal data immediately and, in any event, within one month of your request.

Automated Decision-Making and Profiling

No automated decisions are made. We do not use any profiling system or tool to process your data.

How Do We Protect Your Information?

We ensure that appropriate technical, physical, electronic and administrative security measures are in place to protect your personal data from unauthorised access. We follow industry-accepted standards to protect the personal information sent to us, both during transmission and after receipt. Unfortunately, the transmission of information via the Internet (including email) is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website, platform or email; users assume the risk arising from transmission. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

Changes to Our Privacy Policy

The regulations governing privacy and commerce on the Internet change frequently. Therefore, FERM reserves the right to update this Privacy Policy from time to time to reflect changes in regulations and in our privacy practices in general. We encourage you to review this privacy policy periodically. If the changes are significant, we will notify you by means of a prominent notice on our website.

Links to Other Websites

Our website or application may contain links to other sites, including through social media buttons. Although we try to include only links to websites that share our high standards and respect for privacy, we are not responsible for the content, security or privacy practices of other websites, and a link does not constitute an endorsement of their website. Once you follow a link from our website to another website, you are subject to the terms and conditions of that website, including, but not limited to, its Internet privacy policy and practices. Please consult these policies before submitting any data to these websites.

Cookie Policy

In accordance with Article 22.2 of Ley 34/2002, de 11 de julio, de Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI-CE) (Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce) currently in force, the Red Micelio Federation (FERM) must comply with the obligation to provide information about the cookies it uses and their purposes.

What Are Cookies?

Cookies are small files that are downloaded to your computer or other device that you use to browse our website. Almost all professional websites use cookies. Generally, a cookie contains the following information: the name of the website it comes from; how long the cookie will remain on your computer or device; and a value (usually a randomly generated unique number). Some cookies may contain additional data, in particular relating to your time zone or the language used to browse websites.

What Types of Cookies Do We Use?

This website does not set any first-party cookies for analytics, advertising or personalisation, and does not use Google Analytics or any other statistics or tracking tool.

Strictly necessary technical storage

To work, the website saves two items in your browser’s local storage (localStorage) that do not identify you: your choice in the cookie notice, for 6 months, and whether you have already closed a workshop’s information window, so that it is not shown to you again. They are necessary for the functionality you have requested and are exempt from consent under Article 22.2 of the LSSI-CE. You can delete them at any time by clearing this site’s data in your browser.

Content from other services

If you accept it in the cookie notice, some links, such as Playoff registration forms and other external websites, are displayed within a window on this website. Those services may set their own cookies, for which they are responsible under their own policies. If you do not accept it, those links open in a new tab and nothing from them is loaded within this website.

Links to social media and payments

Links to Instagram, X, Stripe and other external services do not load anything when you visit our website: they only take you to those sites when you click on them, and from that point on their privacy and cookie policies apply.

How to change your choice

You can accept or reject content from other services in the notice that appears when you first visit the website, and change your choice whenever you like using the “Cookie settings” link in the footer of every page.

Disabling cookies

You can prevent cookies from being set by adjusting your browser settings.

Please note that disabling cookies will affect the functionality of this and many other websites you visit. Disabling cookies will generally also result in disabling certain functions and features of our services and, therefore, we recommend that you do not disable them.

Here are the instructions for managing cookies in different browsers:

Google Chrome

Link to settings
Click on the three dots in the top right-hand corner, open Settings, and then click on Privacy and security to manage cookies.

Safari

Link to settings
Go to Preferences, click on Security, and there you can manage cookies.

Microsoft Edge

Link to settings
Click on the three dots in the top right-hand corner, open Settings, and under “Privacy, search and services” you can manage cookies.

Mozilla Firefox

Link to settings
Click on the three bars in the top right-hand corner, open Options, and under “Privacy and security” you can manage cookies.

Opera

Link to settings
Click on Settings, then on Advanced, then on “Privacy and security”, and finally on “Site settings”. There, click on “Cookies and site data” to manage cookies.