Data Controller: Fundación Antonio Oteiza – Carlos Ciriza.
Tax Identification Number (N.I.F.): G71555445.
Address: Rocamador, 6 – 31200 Estella, Navarra.
Telephone: +34 643 89 58 14.
Data Protection Officer: dpd@hermanoscapuchinos.org.
This Privacy Policy informs users of the Museum Ciriza – Oteiza website about the processing of personal data they provide through the forms, communications and services available on the website. The Privacy Policy serves an informational purpose and does not, in itself, constitute general consent to the processing of personal data. Where processing requires consent, specific, informed and unambiguous consent will be requested for the relevant purpose.
Fields marked as mandatory on each form must be completed so that the corresponding request can be processed. All other fields are optional. The Foundation will endeavour to request only data that are adequate, relevant and limited to what is necessary for each purpose. If the necessary data are not provided or are incorrect, it may not be possible to process the request or provide the requested service.
| Processing Activity | Purpose | Legal Basis |
|---|---|---|
| Enquiries and requests for information | Manage and respond to enquiries received through the channels provided on the website. | The data subject’s consent arising from their request; where the enquiry concerns contracting a service, taking steps at the data subject’s request prior to entering into a contract. |
| Museum visits, bookings, registrations or services, where available | Manage the request, booking, registration, payment or provision of the requested service. | Performance of a contract or taking steps prior to entering into a contract; compliance with legal obligations where applicable. |
| Donations | Manage the donation and the associated administrative, tax and accounting obligations. | Performance of the requested relationship and compliance with legal obligations. |
| Communications about Museum activities, where enabled | Send information about exhibitions, activities, events or other Museum initiatives. | The data subject’s consent and legitimate interest. |
| Applications for employment or collaboration, where a dedicated channel is available | Manage selection processes and assess applications submitted by the individual concerned. | Taking steps at the applicant’s request prior to entering into a contract and, where applicable, consent to retain the application for future selection processes. |
| Ethics Channel / Internal Reporting System | Receive, manage and investigate reports concerning possible breaches within the scope of the system. | Compliance with applicable legal obligations. Specific information on data protection and confidentiality safeguards will be provided for this processing activity. |
Personal data will be retained only for as long as necessary to fulfil the purpose for which they were collected. Once the relationship has ended or the request has been addressed, the data may be retained in a duly blocked state for the periods during which legal liabilities may arise. Where processing is based on consent, the data subject may withdraw it at any time without affecting the lawfulness of processing carried out before its withdrawal. Where specific statutory periods exist — for example, in relation to tax, accounting, contractual matters or the Internal Reporting System — those periods will apply.
Data will not be disclosed to third parties unless there is a legal obligation, disclosure is necessary to address the request or provide the service described, or another valid legal basis applies. The Foundation may engage service providers — for example, web hosting, IT maintenance, email, form management, booking platforms or professional services — that access personal data to provide their services. When acting on behalf of the Foundation, they will act as data processors and follow the contractually established instructions.
No international data transfers are envisaged unless they arise from the providers or services actually used. If such transfers take place, the Foundation will provide information about them and implement the safeguards required by data protection legislation.
The data subject may exercise, free of charge and where applicable, the rights of access, rectification, erasure, objection, restriction of processing and data portability, and may also withdraw any consent given. To do so, they may write to Fundación Antonio Oteiza – Carlos Ciriza, Rocamador, 6 – 31200 Estella, Navarra, or contact the Data Protection Officer at dpd@hermanoscapuchinos.org.
The request must enable the applicant to be identified and specify the right they wish to exercise. Where there are reasonable doubts about their identity, the Foundation may request additional information strictly necessary to confirm it. As a general rule, a copy of an identity document will not be required if identity can be verified by other proportionate means.
If the data subject considers that the processing of their personal data infringes the applicable legislation, they may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), the competent supervisory authority in Spain.
Where the Foundation has an Ethics Channel or Internal Reporting System subject to Law 2/2023, data processing carried out through that system will be governed by the specific legislation applicable to it and its own privacy notice. The system must preserve the confidentiality of the identities of the reporting person, the persons concerned and any third parties mentioned, restrict access to legally authorised persons, and apply the specific time limits and safeguards established for this type of report.
The Foundation will treat personal data confidentially and adopt appropriate technical and organisational measures to ensure a level of security appropriate to the risk, aimed at preventing accidental or unlawful destruction, loss or alteration of the data, as well as unauthorised disclosure of or access to them. These measures will be reviewed in light of the nature, scope, context and purposes of the processing and the risks to individuals’ rights and freedoms.
The Foundation may update this Privacy Policy when changes are made to the processing carried out through the website, the available services or the applicable legislation. The current version will remain permanently available on the website.
Last updated: September 2026