Privacy notice

1. Data controller

• Controller: Skål Club de Cádiz.
• Trading name: Skål Internacional Cádiz.
• Spanish tax identification number (NIF/CIF): G11237823.
• Address: Calle San Francisco 9, 11004 Cádiz, Spain.
• Contact for privacy and rights requests: info@skalcongresscadiz2027.com.

This notice applies to the processing of data on the Skål International World Congress Cádiz 2027 platform, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD).

2. Data and their sources

We collect the first name, surname, email address, telephone number with international prefix, country, Skål club, number of prebookings and optional information preferences directly from the person completing the form. We also record the language, order and payment references and status, amount, benefits associated with the advance payment, and the date and version of the texts accepted or read. Stripe provides the information required to verify payment; the platform does not store full card numbers or card security codes.

Browsing and using the service may generate technical logs, such as IP addresses, requests, dates and browser details, which are necessary for security and diagnostics. Cookies are explained in their dedicated policy.

Passports, health data and other special categories of data are not requested during prebooking. If you subsequently request visa documentation support, you will receive specific information before any additional data are collected. Avoid including sensitive information in free-text fields or enquiry emails.

3. Purposes and legal bases

• Prebooking and assistance: handling requests, orders, payments, confirmations, credit towards the final booking, priority access and service-related enquiries. Legal basis: requested precontractual steps and performance of the contract (Article 6(1)(b) GDPR).
• Visa documentation support: providing requested assistance relating to participation, on the same contractual basis, with additional information where appropriate. A visa being granted is not guaranteed.
• Legal obligations: invoicing, accounting and responding to official requests and the exercise of rights. Legal basis: compliance with legal obligations (Article 6(1)(c)).
• Security and claims: detecting abuse, investigating incidents and establishing, exercising or defending claims. Legal basis: the legitimate interest in protecting the service and the organiser's rights (Article 6(1)(f)), subject to necessity, proportionality and the data subject's rights.
• Promotional congress information: only with separate, optional authorisation (Article 6(1)(a) and the LSSI-CE), within the selected scope: congress; pre-congress and congress; congress and post-congress; or all three stages. You may withdraw consent without affecting your prebooking.

The mandatory form fields, including telephone number and email address, are necessary to process the request. If you do not provide them, the process cannot be completed. Acknowledging that you have read this notice does not constitute consent to all processing: contract management and legal obligations have their own legal bases. Necessary order messages are sent even if you do not authorise promotional information.

4. Recipients and international transfers

Authorised staff and the necessary providers of platform hosting, email, communications, support and invoicing may access the data, subject to the applicable data protection obligations. Listmonk is the application used to manage communications and does not in itself identify a company receiving data. Contasimple may act as an invoicing provider when used to issue and manage invoices.

Stripe processes the data necessary to handle payment and prevent fraud, with the roles and responsibilities described at https://stripe.com/es/privacy. It may act as a processor or an independent controller depending on the processing involved. Its policy provides information about its group entities and transfers, including transfers outside the European Economic Area and their safeguards.

Where a provider processes data outside the European Economic Area, an international transfer will only take place on a valid basis under Chapter V of the GDPR, such as an adequacy decision, standard contractual clauses or another legally recognised safeguard, with supplementary measures where necessary. You may request information about applicable transfers and a copy of their safeguards by writing to the privacy contact.

Data will also be disclosed to authorities where legally required. Visa assistance does not in itself authorise documents to be sent to consulates or other third parties; any additional disclosure will be notified in advance and must have a legal basis. Personal data are not sold.

5. Retention

Data are used for as long as necessary to handle the request and perform the contract. They are then erased or blocked where they must be retained to meet obligations or liabilities, in accordance with Article 32 of the LOPDGDD.

• Orders, payments and invoices: for the duration of the contractual relationship and the relevant statutory periods; generally, four years for tax obligations and six years for accounting documentation where commercial record retention is required, calculated under the relevant rules. Interruptions of limitation periods or ongoing proceedings may extend these periods.
• Enquiries and incomplete orders: until the enquiry is resolved or the request closed, after which only what is necessary for possible claims is retained during the relevant limitation period.
• Optional communications: until consent is withdrawn or the selected information purpose ends. Necessary evidence of consent and unsubscription is retained with restricted access to demonstrate compliance and prevent further messages.
• Security logs: for the time needed to investigate incidents and, where applicable, address resulting liabilities, with restricted access.
• Visa documentation: only for the requested assistance and the period necessary to address liabilities; the specific notice will define the period before collection.

These criteria do not mean that all data are retained for the longest period. Each retention period is limited to the data and purpose that justify it.

6. Rights and complaints

You may request access, rectification, erasure, restriction, objection and portability in the circumstances provided for by the GDPR. You may withdraw consent at any time; this does not affect earlier lawful processing. You may unsubscribe from optional information using the mechanism provided in the communication or by writing to the contact above.

Send your request to info@skalcongresscadiz2027.com or Calle San Francisco 9, 11004 Cádiz, Spain, specifying the right you wish to exercise and the information needed to locate your request. Additional identity information will only be requested where there are reasonable doubts; a full copy of an identity document is not routinely required.

As a general rule, a response will be provided within one month of receipt. If the complexity or number of requests requires an extension, you will be informed within the first month of the reasons and the extension, which may be up to a further two months. You may lodge a complaint with the Spanish Data Protection Agency at https://www.aepd.es, without first having to exhaust a complaint procedure with the organiser.

7. Automation and security

The platform ranks priority access by the date and time of confirmed payment and applies automated availability and duplicate checks. It does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals, nor does it create advertising profiles. You may request human review of an incident using the contact above; these checks do not replace the resolution of your complaints.

Security measures appropriate to the risk are applied, with access limited by role. Do not publish or share your prebooking code or private order enquiry links.

8. Updates

Where required, you will be informed of substantial changes affecting processing before they are applied. Updating this notice does not in itself extend any consent you have given.

Last updated: 21 September 2026.