1. Data controller
Spanish Glioblastoma Multiforme Association (AEGBM), operating as GlioSpain, a non-profit organisation with registered office in Murcia (Spain). Its registry details (Tax ID and registration number in the Register of Associations) are currently being processed and are available, in the meantime, on request. Contact email for data protection matters: info@aegbm.org.
2. What data we process
We only process the data you voluntarily provide through the contact form, the newsletter sign-up or the membership process — typically your full name, email address, postcode, the content of your message and, if you volunteer it, your mobile number. When you make a contribution or become a member, we also process the amount and frequency you indicate. If you choose to dedicate your contribution to another person, we process the name you give us, the message you write and, if you provide it, their email address, for the sole purpose of passing your message on to them. By giving us a third party’s details you declare that you are entitled to do so and undertake to have informed them accordingly. You order the transfer yourself from your own bank, so we never access your account and never process card or online-banking data. We do not request or process special-category (health) data through this website; please do not include clinical details in your messages.
3. Purpose
We use your data to respond to your enquiries, send you the information you request, manage your membership, identify your contribution on our bank statement so we can thank you, and, where you consent, send you our newsletter with advances and updates. If you give us your mobile number, we use it only to contact you on WhatsApp and, if you wish, to add you to our WhatsApp groups for patients, families or working groups, as applicable or at your request; providing it is always voluntary and you may leave the group or ask us to delete it at any time. Where you dedicate a contribution to another person, we use their email address solely to send them your message once, naming you as its sender; we do not add them to any mailing list or send them any further communications, and the message is always sent by a person at the association after reviewing it, never automatically. We do not currently issue tax-deductible donation certificates, so we do not collect data for that purpose. We do not make automated decisions or profiling based on your data.
4. Legal basis
The legal basis is your consent, given when you contact us or sign up, and, where applicable, the performance of the membership relationship you request. Where you dedicate a contribution to another person, the legal basis for processing their data is your own consent in giving it to us (art. 6.1.a GDPR) together with the association’s legitimate interest in carrying out the dedication you requested (art. 6.1.f GDPR), limited to a single message. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
5. Retention period
We keep your data only for as long as necessary to fulfil the purpose for which it was collected and to determine any liabilities arising from it. Newsletter data and your mobile number are kept until you unsubscribe or ask us to delete them. The details of a person to whom you dedicate a contribution are kept only for as long as needed to pass your message on and are deleted thereafter, unless they ask us otherwise. Data on members and financial supporters is kept for as long as the relationship lasts and thereafter for the periods required by accounting and tax law.
6. Recipients and transfers
We do not share your data with third parties except where legally required or where you expressly ask us to: if you dedicate a contribution to another person, we disclose your name and the message you wrote to that person, which is precisely what you asked us to do. We do not sell your data. If you take part in a WhatsApp group, your number is visible to the other participants, so we only add you if you ask us to or give it to us for that purpose; WhatsApp (Meta Platforms Ireland Ltd.) acts as the provider of that messaging service. Some technical service providers (for example, our email or hosting providers) may process data on our behalf as processors, under a data-processing agreement and with appropriate safeguards.
7. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability by writing to info@aegbm.org, indicating the right you wish to exercise. These same rights are available to any person whose data we process without their having contacted us, such as the recipient of a dedicated contribution, and may be exercised by the same means. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) if you consider that your rights have not been properly addressed.
8. Security measures
We apply the technical and organisational measures appropriate to the risk in order to protect your data against loss, misuse, unauthorised access, alteration or disclosure.
9. Cookies and third-party services
Cookies and similar technologies are only used as described below. Nothing that identifies you personally, nothing shared for advertising.
Essential storage (no consent required)
We store your language preference and your own cookie decision in your browser. Both stay on your device, are never sent to us, and exist so the site does not ask you the same thing on every page.
Measurement (only if you accept)
We use Google Analytics 4 to count visits and understand which pages are actually useful. It does not run until you accept it: until then it is blocked and writes no cookies. We have disabled Google advertising signals and ad personalisation, so your data is never used to profile you or to target ads. We measure pages viewed, approximate country and city, device type, traffic source, and specific actions (sending the contact form, printing a guide, searching for trials). Data is retained for two months. Google Ireland Limited acts as processor and may transfer data outside the EU under the European Commission's standard contractual clauses.
You can withdraw or change your decision at any time from the “Cookie settings” link in the footer of any page. Refusing changes nothing about how the site works.
Server-side counting (no cookies)
Our hosting provider, Netlify, counts requests to the site from its own server logs. This uses no cookies and does not build any profile: it is aggregate statistics on visits, pages and errors, which is why it needs no consent.
Third-party services
The site loads typefaces from Google Fonts, fetches public data from ClinicalTrials.gov, the EU CTIS register, the Spanish REEC register and PubMed (NCBI), and embeds videos from YouTube in privacy-enhanced mode (youtube-nocookie.com), which sets no cookies unless you press play. Forms are processed by Netlify Forms. When your browser connects to any of these services it may transmit standard connection data such as your IP address, processed under each provider's own privacy policy.