PRIVACY POLICY DOKA STUDENT JUNIOR ENTERPRISE ASSOCIATION

NIF: G75475392 | dokateamcompany@gmail.com | Last updated: 08/05/2026

1. Identity of the Data Controller

The data controller is the DOKA STUDENT JUNIOR ENTERPRISE ASSOCIATION, with NIF G75475392 and registered address at Ibarrazelaia zelaigunea, 2, 20560. For any enquiries, please contact us at: dokateamcompany@gmail.com.

2. Purpose of processing and legal basis

DOKA maintains a Record of Processing Activities detailing all processing operations carried out as data controller. Below is the detail of each activity:

MEMBERS

• Purpose: Management of association members.

• Legal basis: Art. 6.1 b) processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.

• Source of data: The data subject themselves.

• Categories of data: Identification and contact data.

• Recipients: Association Registry, Banks and Savings Banks.

• Retention period: 4 years after the end of the membership relationship.

• International transfers: Not foreseen.

CONTACT PERSONS

• Purpose: Management of the contacts database (persons linked to clients, suppliers, institutions, public administrations and companies in general).

• Legal basis: Art. 6.1 f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

• Source of data: The data subject themselves or their legal representative.

• Categories of data: Identification and contact data.

• Recipients: None foreseen.

• Retention period: Indefinite until the data subject requests erasure or the data is no longer up to date.

• International transfers: Not foreseen.

ADMINISTRATION

• Purpose: Administrative and accounting management of clients.

• Legal basis: Art. 6.1 b) processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.

• Source of data: The data subject themselves or their legal representative.

• Categories of data: Identification, financial and contact data.

• Recipients: Tax public administrations.

• Retention period: 6 years from the last entry made in the books.

• International transfers: Not foreseen.

TAPETE & BARAJA

• Purpose: Registration and management of attendees at Mus txapelketa tournaments.

• Legal basis: Art. 6.1 a) consent of the data subject for one or more specific purposes; Art. 6.1 f) legitimate interest of the controller in relation to advertising and commercial promotion.

• Source of data: The data subject themselves.

• Categories of data: Identification, contact data and images.

• Recipients: None foreseen.

• Retention period: 5 years from the date on which fulfilment of the obligation may be required.

• International transfers: Not foreseen.

LURBIRA

• Purpose: Obtaining images and videos of participants in the organised gymkhanas.

• Legal basis: Art. 6.1 a) consent of the data subject for one or more specific purposes.

• Source of data: The data subject themselves.

• Categories of data: Images and videos.

• Recipients: None foreseen.

• Retention period: 5 years from the date on which fulfilment of the obligation may be required.

• International transfers: Not foreseen.

ACTIVITY WITH DATA PROCESSOR

• Purpose: Management of the contractual relationship with clients: invoicing, administration, accounting and tax, and provision of contracted services.

• Legal basis: Art. 6.1 b) processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.

• Source of data: The data subject themselves.

• Categories of data: Identification, financial and contact data.

• Recipients: None foreseen.

• Retention period: 5 years from the date on which fulfilment of the obligation may be required.

• International transfers: Not foreseen.

TXIKITXOKO

• Purpose: Administrative, labour and human resources management. Includes contract formalisation, payroll management, Social Security registration and compliance with tax obligations.

• Legal basis: Art. 6.1 b) performance of contract / pre-contractual measures; Art. 6.1 c) compliance with a legal obligation applicable to the controller (labour, Social Security and tax obligations).

• Source of data: The data subject themselves.

• Categories of data: Identification data (name, ID/NIE, address, phone, email, bank account). Certificate of Sexual Offences.

• Recipients: Labour consultancy/management firm, Social Security, AEAT, Zumarragako Udala.

• Retention period: General data: during the duration of the employment relationship and applicable statutory limitation periods (4-5 years). Certificate of offences: initial verification and immediate destruction, retaining only audit record.

• International transfers: Not foreseen.

NORTH VIBES

• Purpose: Collecting information from interested clients to contact them through a web form.

• Legal basis: Art. 6.1 a) consent of the user when filling in the web form.

• Source of data: The data subject themselves (through the North Vibes web form).

• Categories of data: Identification data: first name, surname, email address and phone number.

• Recipients: None foreseen. Data is managed internally by North Vibes.

• Retention period: Until the data subject withdraws consent or requests erasure. If the commercial relationship does not materialise, maximum 1 year from collection.

• International transfers: No international data transfers are carried out.

For further detail on the Record of Processing Activities, please contact DOKA through the channels identified above.

3. How long do we keep your data?

DOKA will retain data for the duration of the relationship with the organisation and, thereafter, in accordance with the periods indicated in the Record of Processing Activities and the applicable archiving and documentation regulations. If the data subject requests the exercise of any right, their data will be erased accordingly.

4. Who has access to your data?

DOKA may disclose personal data to Public Administrations when required by applicable legislation. The specific recipients for each activity are detailed in the sections above.

5. Rights of data subjects

You are entitled to exercise the following rights:

• Right of access to your personal data to find out which data is being processed.

• Right of rectification of any inaccurate personal data.

• Right of erasure of your personal data, where possible.

• Right to request restriction of processing where the accuracy, lawfulness or necessity of processing is in doubt.

• Right to object to processing where the legal basis is the legitimate interest of the controller.

• Right to data portability where the legal basis is consent.

These rights may be exercised free of charge by written request to: dokateamcompany@gmail.com.

The data subject also has the right to withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal. You also have the right to lodge a complaint with the competent Supervisory Authority.

6. Unsubscribing from commercial communications

The data subject may revoke at any time the consent given for the sending of commercial communications, either by clicking the cancellation link included in each communication, or by sending a notice to dokateamcompany@gmail.com.

7. Security measures

DOKA is committed to fulfilling its duty of confidentiality and has implemented the necessary technical and organisational security measures to guarantee the security of personal data and prevent its alteration, loss, processing or unauthorised access. These measures include restricted access via credentials and storage on encrypted servers.

8. Links to third-party websites

DOKA's website may include hyperlinks to websites not operated by DOKA. Therefore, DOKA accepts no responsibility for the content or privacy practices of such sites. Before providing your data on sites other than DOKA, please review their privacy policies.

9. Changes to this Privacy Policy

DOKA may modify this Privacy Policy in accordance with applicable legislation at any time. Any changes will be duly notified to the data subject and, where required by regulations, consent will be requested.

Last updated: 08/05/2026