1. General information

This Privacy Policy provides information on the processing of personal data provided through the website digital-expo.eu, managed by Fundación Feiras e Exposicións de Ourense (Expourense).

Data processing shall be carried out in accordance with Regulation (EU) 2016/679, General Data Protection Regulation (GDPR), and Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights.

DIGITAL_EXPO is a cross-border cooperation project aimed at the digitalisation of trade fair venues and exhibition centres in Galicia and Northern Portugal.

Project 0447_DIGITAL_EXPO_1_E is co-financed by the European Union through the European Regional Development Fund (ERDF), within the framework of the Interreg VI-A Spain–Portugal (POCTEP) 2021–2027 programme.

2. Data controller

• Data controller: Fundación Feiras e Exposicións de Ourense (Expourense).
• CIF: G32164956.
• Address: Finca Sevilla, s/n, 32005 Ourense.
• Telephone: +34 988 366 030.
• Project email: info@digital-expo.eu.
• Data protection email: expourense@expourense.org.

The identification of Expourense as data controller corresponds to the portal processing activities under its responsibility.

Where other participating entities jointly determine the purposes and means of any processing activity, the corresponding responsibilities shall be identified in accordance with Article 26 of the GDPR.

3. Personal data collected

Depending on the forms and services used, the following categories of data may be processed:

• Identifying data:: name and surname.
• Contact: email address and, where necessary, telephone number, número de teléfono.
• Professional details: organisation, entity, position, role, and sector of activity.
• Participation: requested activity, registration date, attendance, participation format, and accreditations.
• Enquiries: information voluntarily provided in contact forms and messages.
• Technical data: certain connection data and logs necessary for the security and operation of the portal.

Only adequate, relevant, and necessary data shall be requested for each purpose.

As a general rule, special categories of personal data shall not be requested. Where an activity requires information of this nature, specific information shall be provided regarding its processing and the applicable safeguards.

4. Purposes of processing

4.1. Registration management

Managing registration and participation requests for events, seminars, workshops, conferences, and meetings linked to DIGITAL_EXPO.

This purpose includes confirming places, compiling attendee lists, sending reminders, organisational communications, and attendance management.

4.2. Organisation and monitoring

Organising activities and preparing the necessary documentation for their monitoring, evaluation, and justification.

This documentation may include participation indicators, attendance records, reports, and supporting documents required by the competent bodies within the framework of the POCTEP and ERDF programmes.

4.3. Handling enquiries

Addressing requests for information, questions, and communications received through the project’s forms or contact email.

4.4. Informative communications

Sending communications related to DIGITAL_EXPO activities, results, and news where an appropriate legal basis exists.

Where communications are not necessary to manage participation in an activity and are based on consent, such consent shall be requested separately.

4.5. Technical security

Maintaining the operation and security of the website, preventing unauthorised access, and managing technical incidents.

5. Legal basis

The lawfulness of processing shall depend on its purpose and the relationship established with the data subject.

• Consent (Article 6.1(a) of the GDPR): for processing based on freely given, informed, and specific authorisation, such as certain voluntary communications.
• Contractual relationship or pre-contractual steps (Article 6.1(b)): where processing is necessary to manage participation subject to contractual terms.
• Legal obligation (Article 6.1(c)): to comply with legally enforceable retention, justification, monitoring, or auditing obligations.
• Legitimate interest (Article 6.1(f)): where applicable, for certain website security and protection processing activities, subject to a prior balancing of interests.

Registration for activities shall be grounded on the legal basis corresponding to their specific nature and conditions.

Merely visiting the website does not constitute consent to the processing of data for any purpose.

6. Mandatory nature of data

Forms shall indicate which fields are necessary to manage the corresponding registration or request. Failure to complete these fields may prevent the request from being processed.

Failure to complete these fields may prevent the request from being processed.

Optional data may be omitted without affecting participation as a general rule.

7.Recipients and service providers

Data may be processed by authorised Expourense staff to manage DIGITAL_EXPO services and activities.

Where necessary and subject to an appropriate legal basis, data may be disclosed to entities legitimately participating in the organisation of activities or to bodies competent in the management, control, monitoring, and auditing of the project and European funds.

Companies providing technological, hosting, maintenance, form, or communication services may access the data as data processors, under the contractual safeguards laid down in Article 28 of the GDPR.

An entity’s participation as a project partner does not automatically imply access to all personal data collected.

Expourense shall not commercialise personal data collected through the portal.

8. Cross-border cooperation

DIGITAL_EXPO is implemented in the Galicia–Northern Portugal Euroregion.

The organisation of joint activities may require the involvement of entities from both territories, in accordance with their roles and responsibilities.

Where several entities jointly determine the purposes and means of a processing activity, the corresponding joint controllership arrangement shall be established pursuant to Article 26 of the GDPR.

9. International transfers

The exchange of data between Spain and Portugal, within the European Economic Area, does not in itself constitute an international transfer to third countries.

If service providers are used that involve transfers outside the European Economic Area, the mechanisms provided for in Chapter V of the GDPR shall apply, and the corresponding information shall be provided where applicable. correspondiente cuando proceda.

10. Data retention

Data shall be retained for the time necessary to fulfil the purposes for which they were collected.

Registration and attendance data may be retained for the periods required by the regulations applicable to the management and justification of European funds.

Enquiry data shall be retained for as long as necessary to address them and, subsequently, for the legally enforceable periods.

Data used exclusively for communications based on consent shall cease to be processed for that purpose once authorisation is withdrawn, without prejudice to statutory retention periods. 11. Rights of data subjects

11. Rights of data subjects

Data subjects may exercise, under the terms laid down by law, the following rights:

• Access to their personal data.
• Rectification of inaccurate data.
• Erasure of data where applicable.
• Objection to certain processing activities.
• Restriction of processing.
• Data portability where applicable.
• Withdrawal of consent given.
• Not to be subject to certain decisions based solely on automated processing, in the cases provided for by the GDPR.

To exercise their rights, they may contact Expourense:

• By post: Fundación Feiras e Exposicións de Ourense, Finca Sevilla, s/n, 32005 Ourense.
• By email: expourense@expourense.org.

The entity may request additional information to verify the identity of the applicant where reasonable doubts exist, avoiding requesting unnecessary identification documents.

The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

12. Complaints

Data subjects may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) where they consider that their rights have not been respected.

Agencia Española de Protección de Datos .

13. Security measures

Expourense shall implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or improper disclosure.

These measures shall be adopted taking into account the risks of processing and the provisions of Article 32 of the GDPR.

14. Event photographs and recordings

Certain DIGITAL_EXPO activities may include photographs or audiovisual recordings for documentation and dissemination purposes.

Where these materials allow natural persons to be identified, specific information shall be provided regarding their processing, purposes, and legal basis.

Where necessary, the corresponding authorisation shall be requested, respecting the rights of participants.

15. Cookies

The portal may use cookies and similar technologies necessary for its operation and others subject to consent.

Additional information may be consulted in the Cookies Policy.

16. Policy updates

Expourense may update this Privacy Policy to adapt it to regulatory, organisational, or project operational changes.

Modifications shall be published on this same page.

17. Contact

• Data controller: Fundación Feiras e Exposicións de Ourense (Expourense).
• Address: Finca Sevilla, s/n, 32005 Ourense.
• Project email: info@digital-expo.eu.
• Data protection: expourense@expourense.org.

Last updated: 29 de octubre de 2026.