Privacy Policy

Data Controller
In accordance with current regulations, we inform you that the data provided will be processed by Fundación Científica de la Asociación Española Contra el Cáncer (hereinafter, "Fundación"), whose contact details are as follows:
- ID: G-28655033
- Registered office: Teniente Coronel Noreña Street, 30, 28045, Madrid
- Email: dpo_fc@contraelcancer.es
Through Fundacion’s Grant Management System (GMS) platform, hereinafter referred to as the “Portal” or “Platform”, different users (hereinafter “Users”) are able to keep a centralised record of their involvement—whether in relation to applications and projects submitted, the evaluations of these, or the management of the contractual relationship with centres linked to research grants via the ‘Organisation Manager’ profiles.
Data Source
The data processed by Fundacion for the purposes set out in this Privacy Policy is provided directly by Users via the Platform or whilst participating in activities organised by Fundación.
Obligation to provide Data
The data requested in the forms are, in general, mandatory (unless otherwise specified in the required field) to comply with the purposes for which they are being collected.
Therefore, if the user does not provide them or does not provide them correctly, the user's requests will not be able to be attended, without prejudice to the fact that they will be able to freely view certain content of the Platform.
Purposes, legitimacy and category of Data Subjects and Data Subjects
The data will be processed primarily for the purpose of managing the various processes involved in activities relating both to centres linked to research grants and to the various research projects submitted, including the management of applications, the award of grants, the evaluation and management process, and communications, amongst other things.
1. General Purposes of Processing Relating to the Platform:

1) To manage the registration and participation of Users in the Platform, based on the execution of the contractual relationship.

Data processed: Fundación may process the following categories of personal data

Identification data: Name and surname, ID number. Image

Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic training, certifications and qualifications, work experience, current role within the organization.
Economic and bank details: account number, financial and tax documents.

2) Preparation of anonymised statistical analyses and reports, which will be used both by Fundación and, in an anonymised form by duly authorised and regulated third parties, being legitimate interest, the lawful basis.

Data processed: Fundación may process the following categories of personal data

Personal and social characteristics data: Date of birth, place of birth, nationality and gender.
Academic and professional data: CV, academic training, certifications and qualifications, work experience, current position in the organization.
Other: User activity within the platform in terms of participation in the various calls for entries.

3) To keep the Users' Profile accessible on the Portal, being the performance of the contractual relationship the lawful basis

Data processed: Fundación may process the following categories of personal data

Identification data: Name and surname, ID number, Image
Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current position in the organization/research centre.

4) To send Users information about projects, services, and/or events in which Fundación participates in or organises, being the lawful basis the express consent.

Data processed: Fundación may process the following categories of personal data

Identification data: Name and surname
Contact details: Phone number, email address, postal address.

5) To control the Users' access to the Platform, as well as to give them access to the different services provided by the Platform for each User, the lawful basis for the processing being the legitimate interest of Fundación.

Data processed: Fundación may process the following categories of personal data

Identification data: Name and surname, username and password.
Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current position in the organization/research centre.

6) To carry out surveys of the quality and satisfaction of the Users, linked to the use of the Platform in order to optimize and make modifications to improve the functionalities offered in it, the lawful basis of the processing being the legitimate interest of Fundación.

Data processed: Fundación may process the following categories of personal data

Identification data: Name and surname, ID number,
Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.

7) To produce anonymous statistical reports on Users’ browsing habits and activity on the Portal, based on Fundación’s legitimate interest.

Data processed: Fundación may process the following categories of personal data:

Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research centre.

8) To comply with the legally established obligations, being compliance with Fundación's legal obligations the lawful basis.

Data processed: Fundación may process the following categories of personal data:

Identification data: Name and surname, ID number, image.
Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research centre.
Financial and banking details: account number, financial and tax documents.

B. Specific purposes and category of data for users: Applicant, Grant Manager; Collaborator; and Organization Manager

If you are part of this category, in addition to the intended purposes, your data may be used for the following purposes:

1) To manage applications for the various calls for proposals, including their assessment and award, with the legal basis being the performance of the contractual relationship.

Data processed: Fundación may process the following categories of personal data:

Identification data: Name and surname, ID card, image.
Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research centre.

On an exceptional basis, and in the event that an applicant voluntarily requests, via the relevant box on the specific form, to be covered by one of the exceptions to the seniority calculation set out in the legal provisions of the relevant calls for applications, additional data – including health and/or family circumstances – may be processed for the sole purpose of verifying the exceptional circumstances.

In other words, no applicant is obliged to invoke this mechanism.

The verification will be limited to checking that the periods declared match the documentation provided and that the resulting calculation, once deductions have been applied, complies with the requirements. It will then be returned or securely destroyed within a maximum of 30 days from the final decision on the call for applications.

The only information that will be retained by Fundación is an internal record confirming that the verification has been carried out, excluding any personal data, family details or health information. This record will be retained for the period required by law for the purposes of an audit or by the relevant authority, and in no case for a period exceeding five years from the date of the decision on the call for applications.

2) To manage the follow-up of awarded projects, from an administrative and financial perspective, being the with the performance of the contractual obligations the lawful basis.

Data processed: Fundación may process the following categories of personal data:

Identification data: Name and surname, ID number,
Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research centre.
Economic and bank details: account number, financial and tax documents.

3) To manage the scientific and public dissemination aspects of the awarded projects, being the performance of the contractual relationship the lawful basis.

Data processed: Fundación may process the following categories of personal data:

Identification data: Name and surname, image
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research centre.

4) To manage direct communication between members of the Research Team via the Platform, being the performance of the contractual relationship the lawful basis.

Identification data: Name and surname,
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research centre.

5) To produce statistical reports on the supervising and management of calls for applications, based on the performance of the contractual relationship.

Data processed: Fundación may process the following categories of personal data:

Identification data: Name and surname, ID number, image.
Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research centre.

6) To carry out quality surveys on Fundación’s management of the project application, award and follow-up processes in order to produce reports containing aggregated data for statistical and analytical purposes by Fundación, the legal basis for this being Fundación’s legitimate interest.

Data processed: Fundación may process the following categories of personal data:

Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research centre.

C. Specific purposes of users with the category: Evaluators

If you fall into this category, in addition to the intended purposes, your data may be used for the following purposes:

1) To carry out profiling based on the internal data held by Fundación, for the sole purpose of assigning projects to the Evaluator that are of interest to them or fall within their field of expertise, the lawful basis for such profiling being Fundación’s legitimate interest.

2) Allocate the projects to be assessed to each assessor, based on the performance of the contractual relationship.

Data processed: Fundación may process the following categories of personal data relating to professional evaluators in the scientific field

Identification data: Name and surname, ID number.
Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research centre.
Financial and banking details: account number, financial and tax documents.

Data processed: Foundation may process the following categories of personal data of Patient Advocate Evaluators, in accordance with the information provided in the relevant form and, specifically, with regard to the registration and use of GMS.

Identification data: Name and surname, and ID number.
Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research center.
Health data: relationship with the illness, type of cancer and treatment.

D. Specific purposes and category of data for users: AECC Community

Within the framework of the "AECC Community" platform, the personal data of users will be processed by Fundación for the following specific purposes:

1)Management of training programmes: registration, supervising and evaluation of training activities, based on the performance of the contractual relationship.

Data processed: Fundación may process the following categories of personal data:

Identification data: Name and surname, ID, image.
Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research centre.

2)Development of research awareness campaigns: participation in outreach, educational or awareness-raising initiatives promoted by Fundación, including the management of communications, materials and results, being Fundación’s legitimate interest the lawful basis.

Data processed: Fundación may process the following categories of personal data:

Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research centre.

3)Assignment and follow-up of mentoring arrangements: processing of data necessary for matching mentors/trainers with mentees/students, as well as for carrying out support, guidance and assessment activities within the framework of the mentoring programme, based on the performance of the contractual relationship.

Data processed: Fundación may process the following categories of personal data:

Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research centre.

4)Invitations to events related to the Fundación’s research, training or outreach activities, based on the legitimate interest of Fundación and the purposes relating to the organisation and management of the event in question, will be expressly stated in each invitation.

Data processed: Fundación may process the following categories of personal data:

Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.

E. Specific purposes for applicants for technology transfer assessment

When applying and completing the relevant forms to apply for grants under the published calls for applications, and also if they are awarded a grant, users may give their consent to take part in specific programmes aimed at assessing the technology transfer potential of the funded projects. Specifically, participation involves the following processing operations:

1) Request for analysis and assessment of the technology transfer potential of funded projects:

Data processed: Fundación may process the following categories of personal data:

Identification data: Name and surname, ID number.
Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research centre.

2) Management of programme-specific activities: i) to provide strategic, expert and tailored support to projects with transfer potential (Mentoring), ii) conduct an in-depth analysis of the transfer potential of projects at an intermediate stage of maturity, iii) support the development of strategic projects with high transfer potential, with a view to maximising commercialisation opportunities and facilitating their interaction with external stakeholders in the innovation ecosystem, iv) facilitate the evaluation by venture capital funds of technology transfer in the health sector.

Data processed: Fundación may process the following categories of personal data:

Identification data: Name and surname, image.
Personal and social characteristics: Date of birth, place of birth, nationality and gender.
Contact details: Phone number, email address, postal address.
Academic and professional data: CV, academic background, certifications and qualifications, work experience, current role in the organization/research centre.

In order to carry out the valuation by Venture Capital funds, your details will be communicated to the relevant funds so that they may independently assess the potential for technology transfer, business development and investment in projects, in accordance with their own criteria for analysis and investment decision-making. For this processing activity, a separate consent would be required.

5. Third-Party Data

In the event that data relating to third parties is provided via the Portal, such Users declare that they are legally authorised to do so or, where applicable, that they have the consent of the data subjects, undertaking to pass on to the data subjects the information contained in this Privacy Policy and exempting Fundación from any liability in this regard. However, Fundación may carry out the necessary checks to verify this, taking the appropriate due diligence measures in accordance with data protection regulations.

6. Storage

Data relating to the various categories of Users will be retained until you request your account to be deleted, object to or withdraw your consent, or, where applicable, except for data for which there is a legal obligation to retain it for a longer period.

In any event, data relating to invoicing or the fulfilment of legal obligations will be retained for the legally required period of 10 years.

Similarly, where data is held which, due to its nature, is subject to specific regulations, it will be retained for the period set out in those regulations.

7. Data Communication

Evaluators, in accordance with their profile and contractual duties, (may access certain information relating to Applicants, Grant Managers, Organisation Managers and/or Collaborators) in their capacity as data processors, provided that such processing has been contractually regulated. Similarly, in the cases set out in certain Calls for Proposals, their data may be disclosed to the Spanish Research Agency (AEI) for the sole purpose of carrying out the external evaluation of the projects. None of this shall involve the use of such data for the Agency’s own purposes.

For the management of the technology transfer programme, external providers are engaged for the sole purpose of assisting with the preliminary assessment of projects with transfer potential, using advanced analytical tools, including artificial intelligence. It is confirmed that these technologies ensure compliance with applicable regulations and appropriate security measures; under no circumstances is the information collected used for the providers’ own purposes, and the results are supervised without any automated decisions being made that would affect legal or contractual decisions.

Furthermore, regarding anonymised statistical analyses and reports, service providers or duly authorised third parties may be engaged, provided that such processing is in all cases governed by a contract.

All of this takes place without those parties using the data for their own purposes; Fundación always remains the data controller.

In addition, your data may be disclosed to a third party in the following circumstances:

1) In cases where required by law, to public authorities (for example, courts and tribunals, law enforcement agencies, the tax authorities, etc.).

2) In cases where payments are made, to the banks and financial institutions involved in processing the payment.

3) To venture capital funds specialising in technology transfer within the healthcare sector, where the transfer is expressly authorised for evaluation within the technology transfer programme, with such funds acting as independent entities.

8. International Data Transfers

In order to fulfil the contractual relationship with Users, it is absolutely necessary to process data outside the country. Should data processing take place outside the country, an adequate level of protection will be guaranteed in accordance with applicable legislation, either because the destination country offers such a guarantee, or because the person or entity responsible for the processing has contractually committed to this through its own mechanisms.

In any event, we would like to inform you that the Portal is hosted on systems provided by a supplier whose servers are located at AWS EU Frankfurt, and which guarantees compliance with the appropriate standards in accordance with European regulations. For further information, please contact our Data Protection Officer at dpo_fc@contraelcancer.es.

9.User Responsibility

The User warrants that they are over eighteen (18) years of age and that the details they provide to Fundación are true, accurate, complete and up to date. For these purposes, the User is responsible for the accuracy of all details they provide and shall keep the information supplied duly up to date, so that it reflects their actual circumstances.

In any event, the User shall be liable for any false or inaccurate information provided via the Platform and for any direct or indirect damages that this may cause to Fundación or to third parties.

10. Exercise of Rights

As the data subject, the User may send a written request to Fundación, at the addresses indicated in the header of this Privacy Policy, providing proof of their identity, at any time and free of charge, in order to exercise the following rights:

Right of Access: You have the right to be informed by Fundación as to whether or not it is processing your personal data and, if so, to access that data and receive information on the purposes for which it is processed, the categories of data concerned, the recipients to whom your personal data has been disclosed, and the envisaged retention period for the data, amongst other information.
Right to Rectification and Erasure: You have the right to request the erasure of personal data provided that the legal requirements are met, and the rectification of any inaccurate data concerning you where, amongst other reasons, such data is no longer necessary for the purposes for which it was collected.
Restriction of processing, withdrawal of consent and full or partial objection to processing: In certain circumstances (for example, where the data subject disputes the accuracy of their data, whilst the accuracy of such data is being verified), they may request that the processing of their personal data be restricted, in which case such data will only be processed for the purpose of establishing, exercising or defending legal claims. You shall also have the right to withdraw your consent and to object to the processing at any time, on grounds relating to your particular situation, where the processing is based on our legitimate interests or on the legitimate interests of a third party (including processing for the purposes of direct marketing and the associated profiling). In this case, Fundación shall cease the processing, unless it can demonstrate legitimate grounds for continuing.
Data portability: You have the right to receive the personal data you have provided to Fundación in a structured, commonly used and machine-readable format, and to transmit that data to another data controller without the data controller to whom you provided it preventing you from doing so, in the cases provided for by law for this purpose.
Automated individual decision-making: Furthermore, in addition to the rights mentioned above, where automated decisions are made, including profiling, you have the right to obtain human intervention from Fundación, to express your point of view and to challenge the decision.
Other: Similarly, where personal data is transferred to a third country or to an international organisation, you have the right to be informed of how you can access or obtain a copy of the appropriate safeguards relating to the transfer.

Furthermore, you may lodge a complaint regarding the protection of your personal data with the Spanish Data Protection Agency at the following address: Jorge Juan Street, 6, 28001 – Madrid, should you consider that Fundación has infringed the rights granted to you under the applicable data protection legislation.

11. Specific data processing characteristics for users linked to the ‘External Projects’ category in GMS.

Should the User register on the Platform and be associated with the ‘External Projects’ category (hereinafter, the ‘Project’), the following specific provisions regarding the processing of their personal data shall apply, in addition to the general purposes set out in this Privacy Policy (4.A):

Data Controller: The data controller for the processing of personal data within the framework of the Project shall be the Spanish Association Against Cancer (hereinafter, the “Association”), with Tax Identification Number (NIF) G-28/197564 and registered office at Calle Teniente Coronel Noreña, 30, 28045 Madrid. The contact details of the Data Protection Officer (DPO) are as follows: dpo@contraelcancer.es.

Purposes and applicable legal bases: The processing of the personal data of Users participating in the Call for Applications will be carried out in accordance with the following purposes and legal bases:

a) The purposes and legal bases identified in section 4.B “Specific purposes and categories of data for users: Applicant, Grant Manager, Collaborator and Organisation Manager” (points 1 to 5).

The specific purposes relating to Fundación’s involvement in the management and follow-up of the call for proposals shall not apply in this section, nor shall they apply in the section ‘Specific purposes and categories of data for users: AECC Community’, as they are not linked to the purpose of this data processing.

Data communications and international data transfers: Data communications and, where applicable, international data transfers relating to Users of the Call for Proposals shall be governed by the provisions set out in sections “7. Data Communication”, with the exception of the use of suppliers linked to the technology transfer programme or the transfer of data to venture capital funds, and “8. International Data Transfers” of this Privacy Policy.

User liability: Users shall be liable both to Fundación and, in this case, to the Association for the information provided during the contractual relationship.

Exercise of rights: Users may exercise the rights set out in section 10. Exercise of rights, by contacting the Association’s Data Protection Officer at the following email address: dpo@contraelcancer.es.

Terms and Conditions of the Call for Applications: For further information on the specific conditions governing data processing within the framework of the Call for Applications, the User may consult the collaboration agreement between the parties.

Safety Measures

Fundación will treat the User’s data at all times with the utmost confidentiality and will uphold the mandatory duty of confidentiality in respect of such data, in accordance with the provisions of the applicable regulations, adopting for this purpose the necessary technical and organisational measures to guarantee the security of the data and prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data stored and the risks to which it is exposed.

Changes

Fundación reserves the right to revise its Privacy Policy at any time it deems appropriate, in which case Users will be notified. For this reason, we ask Users to check this privacy statement regularly to read the most recent version of Fundación’s Privacy Policy.

Declaration of Compliance

The User declares that they have been informed of the conditions regarding the protection of personal data and accept the content of this Privacy Policy.

Last updated: September 2026