Privacy Statement
Last updated: August 2026
1. Data controller
Fundación Plaza de Castilla, CIF G84070945, C/ Serrano Anguita 13, 28004 Madrid. Data protection contact: privacidad@captaru.org.
2. Data we process
Identification and contact data (name, email, organisation), tax data for invoicing, platform usage data, payment data handled through our provider and, with your consent, browsing and advertising-measurement identifiers (for example, Google Analytics/Ads identifiers and the Google Ads “gclid”).
3. Purposes
To provide and manage the contracted services, issue invoices, offer grant recommendations, send service-related communications, and, with your consent, commercial communications (newsletter).
4. Legal basis
Performance of the contract or pre-contractual measures, compliance with legal obligations (e.g. tax), legitimate interest in improving and protecting the service, and consent for analytics and marketing cookies and for commercial communications (newsletter).
5. Retention
We retain data for as long as the relationship with the user exists and, thereafter, for the legally required periods (for example, tax and accounting regulations require invoices to be retained).
6. Recipients
We do not sell your data. We use providers acting as processors with appropriate safeguards: the Stripe payment gateway, hosting services and analytics and advertising providers (Google, Meta, LinkedIn and Microsoft) where you have consented to the relevant cookies. We only disclose data to third parties where legally required.
Some of these providers are located outside the European Economic Area (for example, in the USA). In those cases, transfers rely on adequacy decisions (such as the EU-US Data Privacy Framework) or standard contractual clauses, ensuring an adequate level of protection.
7. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction, and portability by writing to privacidad@captaru.org. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
8. Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, or alteration.
9. Support team access to your account
To resolve issues that cannot be reproduced any other way, authorised Captaru staff may access the platform using your account and see the same as you do. The legal basis is our legitimate interest in providing the support needed for the service to work properly.
Every access requires a stated reason and is recorded with the identity of the person accessing, the date, the duration and the originating IP address. These records are kept for 24 months.
If you have any question about a particular access, write to privacidad@captaru.org.