PRIVACY NOTICE FOR MEMBERS
THE ANDALUCIA PERFORMING ARTS SOCIETY (T.A.P.A.S.)
Version: 1.0
Date: 18 June 2026
1. WHO WE ARE
The Andalucia Performing Arts Society is a registered not-for-profit organisation based in Spain. Registration Number: G 92552454
For the purposes of data protection law, The Andalucia Performing Arts Society is the Data
Controller for the personal data it holds about its members.
Contact details:
Registered Address: The Andalucia Performing Arts Society, Papeleria Christina, P.O.Box 375, Ctra.Cártama 3, L1, Alhaurin el Grande, 29120, Málaga, Spain
Email: secretary.tapassociety@gmail.com
2. WHAT PERSONAL DATA WE COLLECT
3. HOW WE COLLECT YOUR DATA
4. WHY WE USE YOUR DATA
5. OUR LEGAL BASIS FOR USING YOUR DATA
6. WHO HAS ACCESS TO YOUR DATA
7. WHO WE SHARE YOUR DATA WITH
8. INTERNATIONAL DATA TRANSFERS
9. HOW LONG WE KEEP YOUR DATA
10. HOW WE PROTECT YOUR DATA
11. YOUR RIGHTS
12. WITHDRAWING CONSENT
13. COMPLAINTS
14. CHANGES TO THIS PRIVACY NOTICE
We may collect and hold the following information about members:
• Name
• Postal address
• Telephone number
• Email address
• Membership status
• Records of membership payments
• Records of communications with the Society
We may also hold information contained in correspondence between members and the
Committee, including emails relating to Society business.
In some cases, this may include sensitive information, such as financial information, complaints,
disputes, or information shared with the Committee in confidence.
We collect personal data when you:
• Apply to become a member;
• Renew your membership;
• Contact the Society or Committee;
• Attend Society meetings or events;
• Make a complaint or raise a concern;
• Take part in Society activities.
We use members’ personal data to:
• Maintain the membership register;
• Administer membership subscriptions;
• Communicate with members;
• Send notices of meetings, events and Society business;
• Manage the Society in accordance with its rules and statutes;
• Keep financial and accounting records;
• Respond to questions, complaints or concerns;
• Comply with legal obligations.
We process personal data under one or more of the following lawful bases:
Contract
To administer your membership and provide member services.
Legal Obligation
To comply with legal, accounting or regulatory duties.
Legitimate Interests
To manage and operate the Society effectively and communicate with members.
Consent
Where consent is required, for example for optional communications or activities not directly connected with membership administration.
Special Category or Sensitive Information
Where sensitive information is provided to us, we will only process it where necessary and
where a lawful condition applies, such as handling complaints, protecting members’ interests, or complying with legal obligations.
Access to member data is limited to Committee members and authorised persons who need it for Society purposes.
Committee members are required to treat personal data as confidential and to use it only for legitimate Society business.
We do not sell members’ personal data.
We may share personal data where necessary only with:
• Banks, accountants or other professional advisers;
• Insurers;
• Public authorities or regulators where required by law;
• Service providers supporting Society operations
Where we use service providers, we will take reasonable steps to ensure they protect personal data appropriately.
We aim to keep personal data within Spain or the European Economic Area.
If personal data is transferred outside the European Economic Area, we will ensure appropriate safeguards are in place in accordance with GDPR.
We keep personal data only for as long as necessary.
Indicative retention periods are:
Type of Data Retention Period
Current membership records While you remain a member
Former membership records Up to 6 years after membership ends
Financial and payment records As required by Spanish accounting and tax law
Complaints or dispute records Up to 6 years after resolution, unless longer
retention is necessary
General correspondence For as long as required for Society purposes
When data is no longer needed, it will be securely deleted or destroyed.
We take reasonable steps to protect personal data, including:
• Restricting access to authorised Committee members;
• Using password-protected systems;
• Keeping paper records secure;
• Using secure email and cloud storage where possible;
• Deleting data when it is no longer needed;
• Taking care when sending emails containing personal information.
Under data protection law, you have the right to:
• Be informed about how your data is used;
• Access the personal data we hold about you;
• Ask us to correct inaccurate data;
• Ask us to delete your data in certain circumstances;
• Ask us to restrict processing in certain circumstances;
• Object to processing based on legitimate interests;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with the Spanish Data Protection Agency.
To exercise your rights, please contact:
The Secretary, The Andalucia Performing Arts Society by email:
secretary.tapassociety@gmail.com or via WhatsApp +34 711 088 767
We aim to respond within five working days.
Where we rely on your consent, you may withdraw it at any time by contacting us.
Withdrawing consent will not affect any lawful processing carried out before consent was
withdrawn.
If you are unhappy with how we handle your personal data, please contact us first so that we can try to resolve the matter.
You also have the right to complain to:
Agencia Española de Protección de Datos (AEPD)
Website: www.aepd.es
We may update this Privacy Notice from time to time.
The latest version will be made available to members by email, on request, or through the
Society’s usual communication channels.
Approved by the Committee of The Andalucia Performing Arts Society
Date: 18/06/2026
For our data protection protocol click on the link: Data protection protocol