The International Criminal Bar (BPI-ICB) is committed to protecting the privacy and security of the personal data of its members, event participants, website visitors, and collaborators. This Privacy Policy explains how we collect, process, use, and protect your personal information in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data Controller Identity

The entity responsible for processing your personal data is:

• Legal Entity: International Criminal Bar / Barreau Pénal International / Colego de Abogados Penal Internacional (BPI-ICB)
• Registered Address: Carrer de Pau Claris nº 158, 08009 Barcelona, Spain
• Tax / Identification: Registered non-profit international association (Spain)
• Privacy Contact Email: Cette adresse e-mail est protégée contre les robots spammeurs. Vous devez activer le JavaScript pour la visualiser.

2. Information We Collect and Purposes of Processing

We process personal data only when necessary to achieve our organizational objectives:

• Membership Management: Processing registration details, professional accreditation, contact information, and payment records to maintain bar membership, issue credentials, and manage committee participation.
• Event & Webinar Registration: Processing delegate contact details, professional titles, and logistics requirements to host international conferences, assemblies, and legal training programs.
• Communications & Newsletters: Sending updates on legal developments, human rights alerts, bar events, and official press releases (requires opt-in consent).
• Website Inquiries & Support: Responding to contact form submissions, general inquiries, and legal support requests.
• Website Security & Analytics: Collecting basic server log data (IP addresses, browser type, timestamps) and aggregated analytical data to maintain website security and optimize performance.

3. Lawful Basis for Processing (Article 6 GDPR)

We rely on the following legal bases to process your personal data:

• Contractual Necessity (Art. 6.1.b): Processing required to perform our membership agreement or facilitate event registration.
• Legal Obligation (Art. 6.1.c): Processing necessary to comply with applicable Spanish and European legal, accounting, and tax regulations.
• Consent (Art. 6.1.a): Sending newsletters, promotional communications, or sharing member directory details publicly (where explicitly opted into). You may withdraw consent at any time.
• Legitimate Interest (Art. 6.1.f): Maintaining network security, preventing fraud, and managing organizational outreach directly aligned with our non-profit mission.

4. Data Sharing and Third Parties

BPI-ICB does not sell, rent, or lease personal data to third parties. We share data only under the following conditions:

• Data Processors: Trusted technical service providers bound by strict data processing agreements (e.g., website hosting platforms, email dispatch providers, secure payment gateways).
• Legal Mandate: When required by competent judicial authorities or governmental bodies under applicable law.
• Member Directories: Professional profile details are published in public or member-only directories only with prior explicit consent.

5. International Data Transfers

Given our global mission, some service providers or organizational partners may be located outside the European Economic Area (EEA). Whenever personal data is transferred outside the EEA, BPI-ICB ensures appropriate safeguards are in place, such as EU Standard Contractual Clauses (SCCs) or adequacy decisions adopted by the European Commission.

6. Data Retention

We store your personal information only for as long as necessary to fulfill the purposes for which it was collected:

• Active Memberships: Retained for the duration of membership plus applicable legal prescription periods under Spanish law (typically up to 5–6 years for tax/financial records).
• Event Participants: Retained until the event is concluded and financial auditing obligations expire.
• Newsletter Subscribers: Retained until you click the "Unsubscribe" link or withdraw consent.
• General Inquiries: Retained for up to 12 months after resolving the request.

7. Your Data Subject Rights

Under Articles 15 to 22 of the GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure (Right to be Forgotten): Request deletion of your personal data when it is no longer needed.
• Restriction: Request temporary suspension of data processing under specific circumstances.
• Data Portability: Request transfer of your data to another controller in a structured format.
• Objection: Object to processing based on legitimate interests or direct marketing.