This is an English translation provided for information purposes. The original Spanish version of this privacy policy (Política de privacidad) is the reference text.
Last updated: 17 October 2026
1. Data controller
The controller of the personal data collected through this website is:
- Entity: Asociación Española de Familiares y Afectados por la Encefalopatía Epiléptica y del Desarrollo en el gen SLC6A1 (SLC6A1-Spain), the Spanish association of relatives and people affected by SLC6A1 developmental and epileptic encephalopathy
- Tax ID (NIF): G13747555
- Registered address: Camelia 62, 29630 Benalmádena (Málaga), Spain
- Email: [email protected]
- Website: https://slc6a1-spain.org
2. Data we process and how we obtain it
We process the data you provide to us when using the website:
- Enquiries: name, email address and the content of the message you send using the contact form.
- Membership applications: name and email address. If the application is formalised, we may also process the information needed to manage the membership relationship and fees.
- Donations and fees: data related to the transaction, such as the amount, date, payment status and the contact details associated with the transaction. Payments are processed through Stripe.
When you make a donation or set up a membership fee, you will be taken to a payment page managed by Stripe. Card details and other payment information are provided directly to Stripe. The association does not receive or store the full card number or its security code. Stripe may provide the association with the transaction information needed to identify and reconcile the payment, according to how the service is configured.
The website may publish stories, images or other information about affected people and their families. This content is used to raise awareness of the disease and of the association’s activities, and is published with the corresponding authorisation of the people concerned or, where applicable, their legal representatives.
Please do not include medical or genetic information in the general contact form. If this is necessary to handle a specific request, the association will tell you about a suitable channel and inform you about the corresponding processing.
Basic technical data needed for the security and operation of the website, such as IP addresses and access logs, may also be processed.
3. Purposes and legal bases
The association processes data for the following purposes:
| Purpose | Legal basis |
|---|---|
| Responding to enquiries sent using the contact form | The association’s legitimate interest in responding to the enquiries it receives and, where applicable, taking the steps requested before entering into a relationship with the data subject (Article 6(1)(f) GDPR). |
| Processing membership applications and managing the membership relationship | Taking pre-contractual steps at the request of the data subject and, if membership is accepted, managing the membership relationship (Article 6(1)(b) GDPR). |
| Managing and reconciling payment of fees and donations | Managing the transaction requested by the data subject and complying with applicable accounting or tax obligations (Articles 6(1)(b) and 6(1)(c) GDPR, as applicable). |
| Maintaining the security and operation of the website | The association’s legitimate interest in protecting the website and handling technical or security incidents (Article 6(1)(f) GDPR). |
| Publishing authorised profiles, images or testimonials | Consent of the affected person or, where applicable, their legal representative (Articles 6(1)(a) and 9(2)(a) GDPR where health data is published). |
If the association processes health data in the course of its legitimate activities, it will do so only where the conditions laid down in Article 9(2)(d) GDPR are met, with appropriate safeguards and within the scope of the association’s activities. This exception applies only in the cases and within the limits established by law. Health data will not be disclosed outside the association without consent, unless another applicable legal basis exists.
4. Payments, fees and Stripe
Donations and fees are managed through Stripe. When you use its payment pages, Stripe processes the data needed to carry out the transaction and, where applicable, to manage the subscription. Stripe may act as a processor for certain services and as an independent controller for its own processing, such as processing related to its legal obligations, fraud prevention or the security of its services.
You can read Stripe’s Privacy Policy. Information about Stripe’s data processing agreement and data transfers is available in its data processing agreement.
The association will use the information it receives from Stripe to manage the donation or fee, keep its records and answer questions about payments. To manage or cancel a subscription, you can contact the association at [email protected]. The management options that Stripe provides on its payment page or in its communications may also be available.
5. Recipients and international transfers
We do not sell personal data or pass it on to third parties for their own commercial purposes.
Providers that supply services the association needs, such as web hosting, technical maintenance, email and payment management, may have access to the data. These providers will only process the data within the scope of the services contracted and with the safeguards required by law.
Stripe may process data from different countries. Where there is an international transfer of data, the mechanisms and safeguards provided for in data protection law and in the agreements applicable to the service will apply.
We may also disclose data to public authorities where there is a legal obligation to do so.
6. Data retention
We will keep the data for as long as necessary to answer the enquiry, process the membership application, manage the membership relationship or complete the donation or fee payment.
Once the relationship has ended or the request has been handled, we may keep the information blocked for the periods needed to meet legal obligations or deal with possible liabilities. Accounting and payment data will be kept for the periods required by the applicable tax and accounting regulations.
Profiles, images or testimonials will remain published for as long as authorisation exists and their publication remains appropriate for the association’s purposes. You can request the removal of content at [email protected]. Removal from the website does not always make it possible to delete copies previously made by third parties or stored on external services.
7. Rights of data subjects
You can request access to your data, its rectification or erasure, the restriction of its processing and, where applicable, its portability. You can also object to certain processing or withdraw consent previously given. Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.
To exercise your rights, write to [email protected] stating which right you wish to exercise. We may ask you for additional information to verify your identity.
If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos).
8. Security
The association applies reasonable technical and organisational measures to protect personal data and to limit access to the people who need it to carry out their duties. No system connected to the Internet can guarantee absolute security.
9. External services
The payment links take you to Stripe pages. When you access them, Stripe’s terms and privacy policy will apply. If the website includes videos, maps, posts or other content from external services, those services may receive technical information about the visit in accordance with their own policies.
10. Changes to this policy
We may update this policy if the association’s activities, the website or the applicable law change. The current version will be available on this page and will show the date it was last updated.