In compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (hereinafter the “GDPR”), and Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights, we inform you that your personal data will be processed by:
Data Controller: Grasshopper Weed Club
Trade name: Grasshopper Weed Club
Registered address: Carrer de Calàbria, 29, Barcelona
Website: https://grasshopperclubsocial.es/
Grasshopper Weed Club is a private non-profit association. Access to its premises and activities is reserved for members who meet the requirements set out in the association’s bylaws and internal rules.
2. Scope of this policy
This policy explains how we collect, use, retain and protect the personal data of individuals who:
- Visit this website.
- Request information about the association.
- Complete the form to apply for membership.
- Contact the association by email, telephone, messaging apps or social media.
- Take part in events and activities organised by the association.
- Have a current or former membership relationship with the entity.
- Agree to receive informational communications about activities and news.
This policy applies to data collected through the website. The processing of members’ data may also be governed by additional privacy notices provided during the admission process.
3. Personal data we may process
Depending on your relationship with the association, we may process the following categories of data:
Identification data
First name, surname, date of birth, nationality and other data necessary to identify you or verify that you meet the requirements for access to the association.
Where necessary to process your membership application, we may ask you to show a valid photo ID document. A copy will only be retained where there is a justified need and you are expressly informed of this.
Contact data
Email address, telephone number, postal address and contact details through messaging applications.
Data relating to the membership application
Information provided in the application form, application date, application status, acceptance of the bylaws and internal rules, membership start date and membership number.
Financial data
Information relating to fees, payments, contributions, invoices or financial transactions arising from the membership relationship.
The association will not store full bank card details when payments are handled directly by a financial institution or external payment platform.
Data on events and activities
Registrations, attendance, organisational preferences and communications relating to activities, tournaments, gatherings or events reserved for members.
Images and audiovisual content
Photographs or videos taken during events and activities, provided there is an appropriate legal basis. Where images are to be published for promotional purposes, the relevant consent will be requested where necessary.
Technical and browsing data
IP address, browser type, device used, operating system, pages visited, date and time of access, online identifiers and cookie preferences.
Communications
The content of messages sent through forms, email, telephone, instant messaging or social media.
We recommend that you do not send, through the web form, particularly sensitive information or documentation that is not necessary to handle your request.
4. Purposes and legal bases for processing
Responding to enquiries and requests for information
We use your data to respond to enquiries you make about the association, its activities, the access conditions, the membership process or any other matter relating to the club.
The legal basis is your consent, given when you voluntarily send us an enquiry, and the taking of steps at your request prior to entering into a possible membership relationship.
Managing membership applications
We may use your data to:
- Verify that you meet the minimum age and admission requirements.
- Contact you to explain the onboarding process.
- Verify your identity.
- Assess and process your application.
- Manage acceptance of the bylaws, internal rules and access conditions.
- Formalise your admission as a member, where applicable.
The legal basis is the taking of steps at your request prior to membership, the management of the membership relationship and compliance with applicable legal obligations.
Submitting the form does not imply automatic acceptance as a member. Admission is subject to the internal rules, the bylaws and the procedure established by the association.
Managing the relationship with members
Once membership has been formalised, data may be processed to:
- Keep the membership register up to date.
- Manage fees and contributions.
- Issue receipts or administrative documentation.
- Notify members of calls to meetings, meetings and decisions of the association’s governing bodies.
- Manage access to premises and activities.
- Handle enquiries, requests or incidents.
- Apply the bylaws and internal rules.
- Process cancellations, suspensions or other changes to membership status.
The legal basis is the management of the membership relationship, compliance with the entity’s legal obligations and, where applicable, the association’s legitimate interest in properly organising and protecting its operation.
Organising events and activities
We may process your data to manage registrations, bookings, capacity, communications, schedule changes, cancellations and participation in events aimed at members.
The legal basis is the management of the membership relationship, the request to participate made by the data subject and the association’s legitimate interest in organising its activities.
Sending informational communications
The association may send its members necessary communications relating to:
- The operation of the club.
- Changes to opening hours.
- Calls to meetings and meetings.
- Internal rules.
- Fees and membership obligations.
- Safety or incidents.
- Events and activities connected with the ordinary life of the association.
These communications form part of the membership relationship and do not require separate consent when they are necessary to manage it.
Sending news and promotional communications
Where you have expressly authorised us, we may send you news about activities, special events, collaborations or promotional communications by email, telephone or messaging.
The legal basis is your consent. You may withdraw it at any time, without this affecting the communications necessary to manage your membership status.
Publishing photographs or videos
Images taken during events may be used to document the association’s activities or shared on the website and its social media profiles.
Where publication makes it possible to clearly identify a person and there is no other appropriate legal basis, their consent will be requested. Refusal to authorise the promotional use of one’s image will not prevent participation in the activities, unless the specific nature of the event makes it impossible to avoid being captured, a circumstance that will be notified in advance.
Ensuring security and preventing misuse
We may process data to control access, protect the premises, prevent fraud, investigate breaches of the internal rules, resolve incidents and defend the association’s legitimate rights and interests.
The legal basis is the legitimate interest in maintaining security, protecting members and ensuring the proper functioning of the entity, without prejudice to applicable legal obligations.
Where a video surveillance system is in place, notice will be given through visible signs and a specific notice on the data controller, the purpose and the exercise of rights.
Complying with legal obligations
Data may also be processed to meet accounting, tax, administrative, judicial, association-related or prevention and security obligations required of the entity.
The legal basis is compliance with a legal obligation.
Managing cookies
Strictly necessary cookies may be used to enable the operation and security of the website.
Analytical, advertising, personalisation or third-party cookies will only be used where there is a valid legal basis and, where required, after obtaining the user’s consent.
Detailed information about cookies can be found in the Cookie Policy.
5. Mandatory nature of the data
Fields identified as mandatory in the forms must be completed so that we can process the relevant request.
The user warrants that the data provided is true, accurate, complete and up to date. They also undertake to report any relevant changes.
The association may decline to process a request where essential data is missing, there are reasonable doubts about its authenticity or the admission requirements are not met.
6. Retention periods
Data will be retained for the following periods:
General enquiries
For as long as necessary to respond to and follow up on the enquiry. Afterwards, the data may be kept restricted for the period necessary to address potential liabilities.
Membership applications not accepted or not completed
For a reasonable period to manage the application and, afterwards, for as long as liabilities related to its processing may exist.
Members’ data
For as long as membership status is maintained. After cancellation, the necessary data will be kept restricted for the periods established by tax, accounting, association-related or other applicable regulations.
Promotional communications
Until you withdraw your consent or ask to stop receiving them.
Photographs and videos
For as long as they are necessary for the stated purpose or until consent is withdrawn, where this is the legal basis for the processing, without prejudice to publications already made and applicable legal obligations.
Browsing data and cookies
For the periods indicated in the Cookie Policy and in the consent settings panel.
Once the relevant periods have elapsed, the data will be securely deleted or anonymised.
7. Data recipients
As a general rule, personal data will not be sold, rented or disclosed to third parties for commercial purposes.
Data may be accessed by providers that supply services to the association, such as:
- Web hosting and technical maintenance providers.
- Email and communications services.
- Administrative, tax, accounting or legal advisory firms.
- Banks and payment platforms.
- Membership management system providers.
- Security or access control companies.
- Storage and backup providers.
- Analytics tools, provided they have been authorised.
These providers will process the data on behalf of the association and will be subject to the corresponding contractual obligations of confidentiality, security and data protection.
Data may also be disclosed to public authorities, courts, tribunals, law enforcement bodies or other authorities where there is a legal obligation or a valid request.
8. International data transfers
Some technology providers may be located outside the European Economic Area or use infrastructure located in third countries.
Where an international data transfer takes place, the association will verify that a valid basis exists, such as an adequacy decision by the European Commission, standard contractual clauses or another safeguard recognised by the GDPR.
You can request additional information about the safeguards applied by writing to emidell@gmail.com.
9. Rights of data subjects
You may exercise the following rights:
- Access: to find out what personal data we process about you.
- Rectification: to request the correction of inaccurate or incomplete data.
- Erasure: to request the deletion of your data when it is no longer necessary.
- Objection: to request that we stop using your data in certain circumstances.
- Restriction: to request that processing be temporarily restricted.
- Portability: to receive your data in a structured format and transmit it to another controller where applicable.
- Withdrawal of consent: to withdraw consent given at any time.
- Not to be subject to automated decisions: to request human intervention where decisions are based solely on automated processing that produces legal or similar effects.
To exercise these rights, you can send a request to:
Email: emidell@gmail.com
Postal address: Carrer de Calàbria, 29, Barcelona
The request must state the right you wish to exercise and contain sufficient information to verify your identity. Additional documentation will only be requested where necessary to prevent third parties from improperly accessing your data.
The exercise of these rights is free of charge, except in cases of manifestly unfounded or excessive requests as provided for by the regulations.
10. Complaints to the supervisory authority
If you consider that the processing of your data does not comply with the regulations, you may file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos).
Before filing a complaint, you may contact the association through our contact form so that we can review and resolve the situation.
11. Minors
Membership applications and access to the association are reserved for persons over 18 years of age.
Minors must not use the form to apply for membership or provide their data for this purpose. When we become aware that data from a minor has been received, we will delete it, unless there is a legal obligation requiring its retention.
The association may request age verification before processing a membership application or allowing access to its premises.
12. Security and confidentiality
The association will apply reasonable technical and organisational measures to protect data against:
- Unauthorised access.
- Accidental loss or destruction.
- Alteration of information.
- Improper disclosure.
- Fraudulent use.
- Unauthorised processing.
Staff, collaborators and providers with access to personal data must respect confidentiality and use the information solely for the functions assigned to them.
Although security measures are in place, no system connected to the internet can be considered completely invulnerable. We therefore recommend that you do not send unnecessary or particularly sensitive information through open forms.
13. Third-party data
When you provide personal data of another person, you declare that you are authorised to do so and that you have informed them of the essential content of this policy.
Third-party data must not be provided without their knowledge or without a legitimate basis for doing so.
14. Social media and external services
Grasshopper Weed Club may maintain social media profiles and use external services to display maps, reviews, audiovisual content or links to third-party platforms.
When you interact with these services, the processing of data may also be subject to the privacy policies of each platform. The association does not control the processing carried out directly by those third parties.
The publication of comments, photographs or other information on social media should be done bearing in mind that such content may be accessible to other people.
15. Links to other websites
The website may contain links to third-party sites. Grasshopper Weed Club is not responsible for their privacy policies, terms of use or data processing practices.
We recommend that you review the privacy policy of each site before providing personal information.
16. Changes to the privacy policy
This policy may be amended to reflect legislative changes, criteria from supervisory authorities, new services or changes to the processing carried out by the association.
The current version will be available on this page and will state the date of its last update.
Where changes are relevant to members, they may be communicated through the usual contact channels.