Privacy Statement
Last updated: June 2026
1. Data controller
Fundación Plaza de Castilla, CIF G84070945, C/ Serrano Anguita 13, 28004 Madrid. Data protection contact: privacidad@captaru.org.
2. Data we process
Identification and contact data (name, email, organisation), tax data for invoicing, platform usage data, and, where applicable, payment data managed through our payment provider.
3. Purposes
To provide and manage the contracted services, issue invoices, offer grant recommendations, send service-related communications, and, with your consent, commercial communications (newsletter).
4. Legal basis
Performance of a contract or pre-contractual measures, compliance with legal obligations (e.g. tax requirements), legitimate interest in improving the service, and consent for commercial communications.
5. Retention
We retain data for as long as the relationship with the user exists and, thereafter, for the legally required periods (for example, tax and accounting regulations require invoices to be retained).
6. Recipients
We do not transfer data to third parties unless legally required. We use providers acting as data processors, such as the Stripe payment gateway and hosting services, with appropriate safeguards in place.
7. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction, and portability by writing to privacidad@captaru.org. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
8. Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, or alteration.
9. Support team access to your account
To resolve issues that cannot be reproduced any other way, authorised Captaru staff may access the platform using your account and see the same as you do. The legal basis is our legitimate interest in providing the support needed for the service to work properly.
Every access requires a stated reason and is recorded with the identity of the person accessing, the date, the duration and the originating IP address. These records are kept for 24 months.
If you have any question about a particular access, write to privacidad@captaru.org.