With this privacy policy, Icrowd Andorra (hereinafter, we or ICA) informs you of the personal data we collect through the services we offer and which are reflected through this website (hereinafter “our website” or “this website”), how we process it and the rights that the personal data protection legislation applicable to us confers on you in relation to your personal data and our processing activities.
– Law 29/2021, of 28 October, qualified law on the protection of personal data of the Principality of Andorra (hereinafter, “the LQPD”).
– Decree 391/2022, of 28-9-2022, approving the Regulation implementing the LQPD.
– Decree 45/2023, of 25-1-2023, approving the Regulation amending the Regulation implementing the LQPD.
– Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, “the GDPR”).
Although we hope you will read this privacy policy in full, here is a brief overview of its content:
– Our aim is to limit the information we collect to what we need in order to provide you with our Services. We do not sell and will never sell your data. We process it in a way that ensures adequate security.
– We undertake to use your personal data only for the purposes we have informed you about.
– We do not disclose data to third parties unless necessary, and we use a small number of trusted providers to help us process it (for example, by storing it) and to deliver our services.
– You may exercise your data protection rights at any time.
Below you will find the index of the sections of this policy:
1. Who does this privacy policy apply to?
2. Who is the controller of your personal data?
3. How do we obtain your personal data?
4. What do we use your data for and on what legal basis?
5. Who may we share your personal data with?
6. How long do we keep your personal data?
7. What rights do you have?
8. What responsibilities do you have?
9. How do we protect your personal data?
10. Modifications to this privacy policy
This policy applies to people who interact with ICA through this website, to users of the services ICA offers for the purposes described in section 4 of this policy (the services), and to all persons whose personal data (for example, images) may appear on our website or in the context of the services.
The sole controller of your personal data in accordance with what is set out in this policy is:
Icrowd Andorra, S.L., with registered office at carrer Isabelle Sandy 4, Edifici Sandy 4, 3rd Floor, Office 301, AD700 – Escaldes-Engordany (Principality of Andorra), contact telephone +376 324 544 and email info@icrowdandorra.com.
ICA is not responsible for the activities you carry out on other websites, even if you access them through links on our website. That is why we strongly recommend that you carefully read the information provided by the controllers of those other websites before giving them your personal data (especially the privacy and cookie policies of each website you visit), and that you contact those controllers if you have any concerns or questions.
In general, it is you who directly provides us with your personal data — for example, through the forms on this website. The only exceptions to this rule are:
– Personal data provided to us by third parties who request the services on your behalf (as a beneficiary).
– Contact details provided to us by our service and product providers, if you represent them.
– Images corresponding to website content for which we hold the relevant rights.
– Personal data about you that may appear in the emails and instant messages we receive, or through the forms on our website; and
– The cookies on this website, about which you will find more information in our cookie policy.
If we do not know you, we may use your personal data to confirm your identity and, if necessary, the entity you work for and your role within it. We do this when we are subject to legal obligations that require us to authenticate your identity before further processing your personal data, or when it is our legitimate interest to ensure that your request is genuine and is not made for fraudulent reasons or is spam.
We collect the optional data you voluntarily provide in the forms (those not marked with “*”) in order to offer you a more personalised service in relation to the specific purpose of the form, and to extract statistics that help us improve our service and support.
The basis that legitimises our processing of this personal data for this purpose is the consent you express when you provide it. As always, you may change your mind and withdraw your consent at any time, with the sole effect that we will no longer use this personal data and, therefore, the services associated with the form will be less personalised from that moment on.
If you represent a supplier of products or services, we collect your contact details and your signature in order to:
a) Manage our relationships of all kinds with the supplier you represent.
b) Manage the corresponding record in our list of authorised suppliers.
c) Manage the quotations and invoices of the supplier you represent.
The processing linked to purposes a) and b) is legitimised by the employment or services contract signed with the supplier you represent and by our legitimate interest in contacting them. The processing linked to purpose c) is legitimised by being necessary for the performance of the contract or contracts you have signed with us.
We collect your data received orally or in writing directly from you or from a third party who represents you or of whom you are a beneficiary, when you contract a service from us, for the purpose of preparing the corresponding contract, managing it, providing you with the contracted service and invoicing you.
We inform you that, as a result of this contractual relationship and on the basis of article 19.2 of Law 20/2014, of 16 October, regulating electronic contracting and operators carrying out their economic activity in a digital space, we may communicate to you orally or in writing commercial information relating to ICA’s services.
The processing of this data is legitimised by being necessary for the performance of the services contract to which you are a party, and by our legitimate interest in keeping you informed in relation to our services.
ICA collects the data provided directly by the data subject, or provided by third parties on their behalf (identification, contact, financial and, frequently, employment data), during the signing of agreements or contracts to which ICA and you are parties, for the purpose of formalising, managing and performing them, and keeping you informed about anything that may be of interest to you in relation to our products or services.
The processing of your data for the purpose of keeping you informed about our products and services is legitimised by our legitimate interest.
The processing of your data for the remaining purposes is legitimised, in these cases, by being necessary to perform the terms and conditions of the corresponding agreement or contract, or to establish pre-contractual conditions when you so request.
We process the CV data you voluntarily send us, together with the data appearing on your strictly professional social network profiles, such as LinkedIn, and any data we may collect during the interviews and tests you voluntarily agree to undergo, as well as the references you provide us, if you authorise us to do so, in order to manage our relationship with you regarding your application for a position at ICA, including the process of searching, filtering and storing the CV as a potential candidate, the staff selection process and the hiring process.
The legal basis for the aforementioned processing is your consent, expressed by sending us your CV, completing a test or attending an interview, as well as the necessity for the performance of pre-contractual measures if you request them, and — if we do not have an open selection process or you are not hired and we consider that you may fit future selection processes — our legitimate interest in retaining your CV for the purpose of including it in future selection processes. The basis that legitimises our consultation of your strictly professional social network profiles, such as LinkedIn, is our legitimate interest in enriching candidates’ professional information in order to reduce the time the selection process will take for both you and ICA. You may withdraw your consent or object to our legitimate interest as indicated in section 7 of this policy and, if you do so, there will be no effect other than the destruction of your CV (if you withdraw your consent) or the limitation of its retention to the selection process for which you sent it to us.
We use the data you provide in the forms on this website in order to extract aggregated statistics (in which it is not possible to identify any specific person) with the aim of improving the services we offer you.
The basis that legitimises our processing of your data for this purpose is our legitimate interest in improving our financial results and, at the same time, the services we offer you.
We collect the personal data you voluntarily and freely provide in your emails or instant messages, by telephone, through the website forms, or through requests to exercise rights, in order to handle your requests, enquiries or complaints in relation to our services or to the rights you have over your personal data.
The legal basis for this processing is our legal obligation to handle your rights requests and, for the remaining purposes, our legitimate interest in assisting you. Providing your personal data is therefore voluntary, although if you do not provide it we will not be able to process your request, enquiry or complaint. You may object to our legitimate interest whenever you wish, although such objection will likewise make it impossible to continue processing your request, enquiry or complaint.
We retain the data that may be necessary to manage your possible claims, or ours, on the basis of our legitimate interest in defending ourselves in order to safeguard our rights.
If you take part in our activities or attend our events or award ceremonies in person, the independent press and our own professionals may record your image and, on previously agreed occasions, your voice, in the context of the event or the award ceremony.
The legal basis for this processing of your image is your express consent whenever it is possible for us to request it, or where you express it unequivocally by posing for the photograph or video. Where this is not possible for us (for example, when time has passed since the recording and we do not have your contact details), the basis is the public interest in the media coverage of the events we organise or sponsor, with the purpose of using the recordings as promotional materials for our communication channels, including our website and our social media accounts.
You are not obliged to appear in a recording. If you wish, you have the right to object to our legitimate interest and to request the withdrawal of material in which you are identified. In order to assess your objection against our legitimate interest and, where appropriate, immediately withdraw the images identifying you, we will ask you to tell us where you saw them.
We use functional cookies to collect, store, consult and process personal information (linked to you through unique identifiers or IP addresses) from your device’s browser, for the purpose of ensuring the correct functioning of our website.
As these are cookies necessary for the correct functioning of the website or personalisation cookies, their use does not require your express consent, and the basis that legitimises our use of them is our legitimate interest in being able to offer you the services of our website in accordance with your preferences.
You can find more information about these cookies in our cookie policy.
ICA has implemented security measures appropriate to the level of risk in order to protect personal information against loss, misuse and unauthorised access, disclosure, alteration and destruction, taking into account the risks entailed by the processing and the nature of the personal information. However, if we determine that your data has been misappropriated (including by an ICA employee or former employee), has been exposed through a security breach or has been improperly acquired by a third party, and this exposes you to a high risk, we will inform you immediately of that security breach, misappropriation or improper acquisition, and of the measures we have taken and those we recommend you take so that the breach does not affect you.
The basis that legitimises this processing is the legal obligation set out in article 37 of the LQPD (35 of the GDPR), and our legitimate interest in preventing this security breach from harming you.
We do not disclose your personal data to anyone, unless:
– It is you yourself who requests it.
– We have a legal obligation to do so.
– It is necessary to enforce the terms and conditions of our services, including the investigation of possible violations.
– It is necessary to detect, prevent or otherwise address fraud, security or technical issues.
– You contract our products or services through intermediaries to whom we must deliver services acquired on your behalf, whether with the consent you have given them, because they legally represent you, or because you have explicitly authorised us to do so.
– A company subcontracted by us needs to process it on our behalf (for example, the company that provides us with data protection officer services, and which must handle your rights requests), always under the terms and conditions of the corresponding data processor agreement.
– If we are involved in a merger, acquisition, financing due diligence, reorganisation, bankruptcy, receivership, purchase or sale of assets, or transition of the service to another provider, your personal information may be transferred as part of a transaction, as permitted by law and/or contract.
– We need to protect or defend the rights or property of ICA.
No international transfers of personal data are envisaged and, if we should eventually need to carry them out, we inform you that they will comply with the applicable regulations in force at any given time and, preferably, by selecting providers that guarantee that they only transfer your data when the recipient countries offer a level of protection equivalent to that provided for by Andorran law, in accordance with article 43 of the LQPD.
In general, ICA keeps your personal data exclusively for as long as the processing operations that require it last and, thereafter, for as long as it takes for the legal responsibilities applicable to us at any given time, arising from the processing in question, to lapse (including the obligation to be able to demonstrate that we have complied with your request for the destruction of personal data).
Personal data processed because it is necessary for the performance of a contract (art. 6.1.b of the LQPD) will be retained for as long as there is a mutual interest in maintaining the purpose of the processing and for the maximum legal period permitted by data protection legislation, including the limitation periods for legal actions in respect of any liability that could arise from the contractual relationship. When it is no longer necessary for any purpose, it will be deleted with security measures appropriate to guarantee its destruction.
Personal data processed by legal obligation (art. 6.1.c of the LQPD) will be retained for as long as we are subject to it.
During the retention periods established for filing or handling possible complaints and/or the retention periods provided for by law, personal data will remain blocked and will only be made available to auditors, the competent Public Administrations and the Batllia (Andorran court), upon official request.
When a piece of personal data is no longer necessary for any purpose, it will be destroyed with security measures appropriate to its sensitivity.
We will destroy your CV when it is more than five years old, as we consider it out of date in relation to the purpose for which it is used.
We will destroy any unnecessary or disproportionate personal data that may appear in the emails and instant messages we receive, or through the forms on our website, as soon as we receive it.
We will destroy (and rectify) any personal data we find to be inaccurate as soon as we verify its inaccuracy.
If you send us a copy of an identity document, we will destroy that copy as soon as we have verified that it fulfils the function for which you sent it to us.
When we no longer have a legitimate purpose for processing some of your personal data, we will delete or anonymise it and, if this is not possible (for example, because it is held in backups), we will store it securely and block it in order to isolate it from any further processing until it is possible to delete it.
You have the right to obtain confirmation as to whether or not we hold any personal data about you.
Below we explain what other rights you have and how to exercise them.
You may request that we act on the following rights:
– Access to your personal data.
– Rectification of any of your personal data, specifying the reason.
– Erasure of some or all of your personal data.
– Restriction of the processing of your data, specifying the reason for the restriction.
– Objection to the processing of your personal data.
– Portability of your data where the legal basis for the collection was consent or a contract.
– The right not to be subject to automated individual decision-making.
The consent given, both for the processing and for the disclosure of data subjects’ data, may be revoked at any time by notifying us, as with any other right, as indicated in the following section. Such revocation or withdrawal will under no circumstances have retroactive effect. It therefore does not affect the lawfulness of processing based on consent prior to its withdrawal.
You may exercise your rights:
– By sending a written request to ICA, addressed to our postal address indicated in section 2 of this policy, telling us a means of contacting you so that we can respond to your request, or ask you for more information if necessary. We would be grateful if you would write “Exercise of personal data protection rights” on the envelope.
– By sending an email or the form associated with the right you wish to exercise to the email address info@icrowdandorra.com, indicating in the subject line “Exercise of personal data protection rights”. You will find these forms further on, in this same section of the privacy policy.
In both cases, if it is not possible for us to verify that you are who you say you are, we will ask you to send us proof of your identity, so as to ensure that we respond only to the data subject or their legal representative.
If the person sending the email does so as a representative of the data subject, the representative’s accreditation must be provided by means of documents or legal instruments that correctly identify the data subject and the representative and specify the mandate or procedure for which representation is delegated, as well as its scope.
Finally, and especially if you consider that you have not obtained full satisfaction in the handling of the exercise of your rights, we inform you that you may lodge a complaint with the national supervisory authority of your country, or by contacting the Andorran Data Protection Agency (APDA) for that purpose.
In order to make it easier for you to exercise your rights, we recommend using the relevant request forms from the following list and not filling in data you consider unnecessary to authenticate your identity or that of your representative:
– Form for exercising the right of access
– Form for exercising the right to rectification
– Form for exercising the right to object (model A and model B)
– Form for exercising the right to erasure
– Form for exercising the right to restriction of processing
– Form for exercising the right to data portability
– Form for exercising the right not to be subject to automated individual decision-making
By providing us with your data, you warrant that it is accurate and complete. Likewise, you confirm that you are answerable for the truthfulness of the personal data you have communicated to us and that you will keep it duly updated so that it reflects your actual situation, and that you are responsible for any false or inaccurate personal data you may provide us with, or that subsequently becomes inaccurate, as well as for any direct or indirect damages that may arise from its inaccuracy.
You may not provide us with other people’s data unless it is justified in relation to the services you request from us. In any case, if you provide us with third parties’ personal data, you assume responsibility for informing those third parties before providing us with their personal data. The information you must provide to the third parties whose data you supply to us must include all the provisions set out in this privacy policy, and it is you who is responsible for the lawfulness of this personal data and for conveying to the data subjects the rights they have in relation to their personal data.
In cases where you must provide us with data of a person under 16 years of age or of a person whose rights are restricted, in doing so you undertake to have the authorisation of the holders of parental authority or guardianship. Without such authorisation, you are prohibited from providing us with any personal data of these persons.
We are fully committed to protecting your privacy and your personal data.
However, if we determine that your data has been misappropriated (including by one of our employees), has been exposed through a security breach or improperly acquired by a third party, ICA will inform you immediately of that security breach, misappropriation or improper acquisition.
We may make changes to this policy from time to time (a) when such changes are necessary to comply with the data protection legislation applicable to us, or (b) when the changes: (i) are commercially reasonable; (ii) do not entail a material reduction in the level of security provided by ICA for personal data; and (iii) do not otherwise have a material adverse impact on the rights of data subjects or of any entity related to them under this policy.
If the changes are substantial, we will notify you before they take effect by sending you a notification or publishing a prominent notice on this website, and you will have the option of exercising your rights as set out in an earlier section. In any case, we recommend that you periodically review this privacy policy to find out how we protect your personal data.
If you have any questions about this policy, please do not hesitate to let us know by sending an email to info@icrowdandorra.com.
Last updated: 11 February 2025.
