Privacy Policy
This policy explains which personal data we process through this website, for what purpose, for how long, and which rights you can exercise.
Last updated: August 2026
1. Data controller
- Asociación Worldproject Canarias
- Tax ID (NIF) G76112044
- Calle Real de San Roque, 56, 35015 Las Palmas de Gran Canaria, Las Palmas, España
- Contact and data protection: info@worldproject.es
2. Data we may process
We only process data you voluntarily provide. Depending on the form you use, this may include:
- Identification data: first name, surname and, where genuinely necessary (membership application or donation certificate), national ID / tax number.
- Contact data: email, phone and country or province where applicable.
- Bank data: account holder and IBAN, only in the membership application, in order to set up the contribution.
- Professional data, in volunteering applications: profession, education, experience, availability, CV and whatever information you include in your proposal.
- Donation data, when you request a certificate: identity, tax number, amount, date of the contribution and the data required for tax purposes.
3. Data minimisation
We do not ask for social security number, marital status, family information, sex or date of birth. We do not request special categories of data (health, political opinions, religion, trade union membership or ethnic origin) and we expressly ask you not to include them in your CV or in the forms if they are not necessary to assess your professional experience.
4. Purposes and legal bases
A. Contact and enquiries. Purpose: to answer enquiries, collaboration proposals and communications addressed to WorldProject, using only the data needed to reply. Legal basis: handling the request made by the data subject and/or their consent.
B. Membership application. Purpose: to process the application, manage the membership relationship and contributions, and carry out the necessary administrative and accounting tasks. Data: identity, contact details, national ID where necessary, account holder, IBAN, amount and frequency. Legal basis: handling the request and the membership relationship, compliance with applicable legal obligations and, where relevant, consent.
C. Donations and certificates. Purpose: to identify the contribution, manage it administratively, issue the certificate where applicable and comply with tax and accounting obligations. Legal basis: the data subject's request and compliance with legal obligations.
D. Volunteering. Purpose: to assess your collaboration proposal, review your experience and CV, determine whether there is a suitable need in our projects and contact you afterwards. Legal basis: your consent.
We do not use this data for other purposes without an appropriate legal basis. In particular, members, donors and volunteers are not added to any promotional mailing merely because they used these forms.
5. Retention periods
- Enquiries: for as long as needed to resolve them and afterwards for the periods required to address possible legal liabilities.
- Members: for the duration of the membership relationship and afterwards for the legal periods applicable to administrative, tax, accounting obligations or possible liabilities.
- Donations and certificates: for the periods legally applicable to tax, accounting and certification obligations.
- Volunteering: while the application is under review and, for applications that are not selected, for a maximum of 12 months from receipt, unless you expressly authorise us to keep it longer. After that period the CV is deleted from storage by an automated process.
6. Recipients and processors
We do not sell or share your data for commercial purposes. The following technology providers may access it, strictly where necessary to provide their service and under a data processing agreement:
- Lovable: development and hosting platform for this website.
- Supabase: database and private storage for form submissions and CVs. The instance used by this project is hosted in the European Union (Ireland).
- Google Fonts: site typefaces are requested from Google servers, which may log the IP address in order to serve the file. No cookies are set for this purpose.
- YouTube (Google): only if you choose to play a video and accept loading external content.
- Banks: for the management of contributions and donations.
- Tax and accounting advisors, where necessary to comply with legal obligations.
- Public authorities, where there is a legal obligation (for example the Spanish tax agency in relation to donation certificates).
7. International transfers
The database and the storage holding form submissions and CVs are hosted in the European Union. Some of the technology providers listed above are companies whose parent entity is outside the European Economic Area and, while providing their services (support, content delivery network or delivery of fonts and videos), access or processing outside the EEA may occur. In those cases the transfer relies on the Standard Contractual Clauses approved by the European Commission or on an adequacy decision, depending on the provider.
We do not automatically send CVs, national ID numbers, IBANs or member data to the team in Uganda. If at any point it became necessary to communicate personal information outside the EEA for project reasons, a specific assessment of the transfer and its legal basis would be carried out beforehand.
8. Information security
The website is served entirely over HTTPS. Form data is stored in a database with restricted access and is not publicly reachable.
CVs are kept in private storage: there are no permanent public URLs, and access is granted through temporary signed links for authorised people within the organisation.
IBAN and national ID numbers never appear in URLs or analytics tools, are not stored in your browser, and are not included in full in internal notifications of a new application. Where an IBAN needs to be displayed internally, it is shown partially masked (for example ES40 **** **** **** **** 0211).
9. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability where applicable, and withdraw your consent at any time, by writing to info@worldproject.es.
We may request additional information only where there are reasonable doubts about the identity of the person exercising the right.
If you believe your request has not been properly handled, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es.
10. Images and data protection
Data protection also applies to the photographs we publish. We do not publish images in which a minor's face is clearly identifiable. For adults, we only publish images for which we have an appropriate legal basis or authorisation.
We are especially careful with photographs taken in healthcare settings (medical consultation, dentistry, ECG, maternity or physiotherapy), because they may reveal health-related information: if a patient is clearly identifiable, the image is not published.