Privacy Policy — NEXO

European Cultural Mobility and Cooperation Programme

Final version — 2 July 2026

1. Data Controller

ARTENARTE SL has not appointed a Data Protection Officer (DPO), as this is not mandatory under Article 37 of the GDPR for its current activity. Any data protection query may be sent to the contact address above.

2. What data do we process and why?

NEXO processes personal data in the following cases, depending on how the data subject uses the website and takes part in the programme:

2.1. Contact persons at partner organisations

• Data: name, position, organisation, email address, phone number, country.
• Purpose: managing the cooperation relationship and coordinating cultural and mobility projects. This data may be shared with partner organisations, exclusively for the purpose for which it was collected.
• Legal basis: performance of pre-contractual measures at the data subject’s request (Art. 6(1)(b) GDPR) and ARTENARTE SL’s legitimate interest in managing its cooperation projects (Art. 6(1)(f) GDPR).

2.2. Participants in mobility activities

• Data: name, date of birth, nationality, ID/passport number, email, phone number, health-related data relevant to the mobility (allergies, specific needs) when voluntarily provided, and bank details for expense reimbursement.
• Purpose: organising and managing exchanges, training courses and mobility activities; reporting to the National Agency/European Commission; travel insurance.
• Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b)), legal obligation under Erasmus+ regulations (Art. 6(1)(c)), and explicit consent (Art. 9(2)(a)) for health data, which is processed as a special category of data.

2.3. Contact form / information request

• Data: name, email address, message and, optionally, organisation.
• Purpose: responding to enquiries.
• Legal basis: consent given by the data subject when submitting the form (Art. 6(1)(a)).

2.4. Newsletter

• Data: email address and, optionally, name.
• Purpose: sending updates about calls, projects and news from NEXO.
• Legal basis: explicit consent (Art. 6(1)(a)), which may be withdrawn at any time via the unsubscribe link included in every communication.

2.5. Browsing and cookies

• Data: IP address, browser type, pages visited, time spent on the site, browsing behaviour.
• Purpose: technical operation of the website and usage statistics through Google Analytics.
• Legal basis: legitimate interest (technical cookies) and consent (Google Analytics analytical cookies), managed through the site’s cookie settings panel.
• Google Analytics is provided by Google Ireland Limited and may involve a transfer of data to the United States. This transfer is safeguarded by the European Commission’s Standard Contractual Clauses signed by Google. Users may withdraw their consent to analytical cookies at any time through the site’s cookie panel, or disable Google Analytics tracking via the official opt-out add-on at tools.google.com/dlpage/gaoptout.

3. Who do we share data with?

• The European Commission and Erasmus+ National Agencies (through official tools such as Mobility Tool+ or the Otlas/SALTO-YOUTH platforms), where required for the accountability of funded projects.
• Partner organisations, strictly to the extent necessary to coordinate the specific mobility or cooperation activity.
• Google Analytics (Google Ireland Limited), acting as data processor for website usage statistics.
• Technology providers delivering web hosting, email and site management services, acting as data processors under Art. 28 GDPR.

No data is shared with third parties for commercial or advertising purposes unrelated to those described here.

4. International transfers

NEXO cooperates with partner organisations located both inside and outside the European Economic Area. Where cooperation with a partner outside the EU involves the processing of personal data, ARTENARTE SL applies the safeguards set out in Chapter V of the GDPR, in particular:

• Standard Contractual Clauses approved by the European Commission, where the destination country has not been granted an adequacy decision.
• Limiting the transfer to the data strictly necessary for project coordination (name, position, email, organisation), avoiding the transfer of special categories of data wherever possible.

5. Data retention period

Personal data processed under NEXO is retained for a period of 5 years from the last interaction with the data subject or from the completion of the relevant activity or project, unless specific legislation (such as rules governing the justification of Erasmus+ funds) requires a different period, or the data subject requests earlier deletion.

For the newsletter, data is retained until the data subject withdraws their consent.

6. Data subject rights

Any person whose data is processed by ARTENARTE SL under NEXO may exercise, free of charge, the following rights:

• Access to their personal data.
• Rectification of inaccurate data.
• Erasure (“right to be forgotten”), where applicable.
• Restriction of processing.
• Objection to processing.
• Portability of data, where technically feasible.
• The right not to be subject to automated individual decisions.

These rights may be exercised by sending a request, together with a copy of an identity document, to info@arternativas.com.

Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es, if they consider that the processing of their data does not comply with applicable regulations.

7. Minors

NEXO’s activities are primarily aimed at young people and youth workers. Where an activity involves participants who are minors, the consent of their parents or legal guardians will be obtained before processing any personal data, in accordance with Article 8 of the GDPR and applicable Spanish legislation on the protection of minors.

8. Security measures

ARTENARTE SL applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encrypted connections (HTTPS), restricted access to data, and regular backups.

9. Changes to this policy

This privacy policy may be updated to reflect legislative developments or changes to how the NEXO programme operates. The date of the last update will be shown at the bottom of this page.

Last updated: 2 July 2026.

10. Contact

For any questions about this privacy policy, please write to: info@arternativas.com ARTENARTE SL — C/ Vendimiadores 16, 2ºD, 11140 Conil de la Frontera, Cádiz, Spain