Last updated: 21 October 2026
This policy explains how we process the personal data we collect through www.ipatarragona.org and through the contact channels shown on it, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
Data controller
- Controller: IPA Agrupació Província de Tarragona (“IPA Tarragona”), a non-profit association.
- Tax ID (CIF): G43715598.
- Address: Carrer de l'Arquebisbe Josep Pont i Gol, 8 (Guardia Urbana de Tarragona headquarters), 43005 Tarragona, Spain.
- Contact for privacy matters: ipatarragona@ipatarragona.org (please write “Data protection” in the subject line).
- Phone: +34 625 784 617.
Membership applications
When you submit the membership application form:
- Data we process: identification data (first name, surname(s), preferred name, gender, date of birth and NIF, NIE or passport number); contact details (home address, postcode, town or city, province, phone number, personal email address and, if you provide it, work email address); professional details (police force or organisation, province and town where you work, unit or department, position or rank and police ID (TIP) or service number); any comments you add; and the authorisations and preferences you tick. At this stage we do not ask for a copy of your police ID card, a photograph, bank details or any payment.
- Purposes: to check that you meet the requirements, contact you, process your application and, if you join, manage your membership (fees, activities, the association’s own communications and dealings with the Spanish Section). When you submit the application, a private tracking link is generated; it is valid for 90 days and is only shown on your screen.
- Legal basis: taking steps at your request before entering into membership and, afterwards, the membership relationship itself (Article 6(1)(b) GDPR), which includes the use of your image for identification and the association’s internal management and, if you request it, the wallet with IPA badge; compliance with the association’s legal obligations (Article 6(1)(c) GDPR); and your consent (Article 6(1)(a) GDPR) for the optional items: receiving information about services, functions and events, and the use of your image to publicise activities. You can withdraw these consents at any time by writing to ipatarragona@ipatarragona.org; this will not affect your membership or the lawfulness of earlier processing.
- Retention: for as long as the application is being processed. If the application does not go ahead, we delete or anonymise the data within 12 months at most. If you join, we keep it for as long as you remain a member and, afterwards, for the statutory periods during which liabilities may arise.
- Recipients: the Spanish Section of the IPA (IPA Spain), to which the branch belongs, where necessary to process your membership; and the website hosting provider, as a data processor.
- Mandatory data: fields marked with an asterisk are needed to process the application; without them we cannot handle it.
IPA World Football 7 Tournament
For the team pre-registration for the 2nd IPA World Football 7 Tournament (Cambrils 2027) and each team’s private dossier:
- Data we process: team details (name, country, IPA national section and category); team manager details (full name, email address and phone number); squad and logistics details (number of players, staff and accompanying persons, transport, accommodation needs and details, arrival and departure dates and points, and comments); details of each player (full name, position, IPA membership number, gender, whether they have life insurance and, only where relevant to the organisers, allergies or special needs); and the authorisation document from the national section.
- Purposes: to manage pre-registration and registration, communicate with the team, organise the competition, accommodation and transfers and, where each player agrees, publish their name and position on the team’s public page.
- Legal basis: managing the registration requested (Article 6(1)(b) GDPR); each player’s consent to appear on the public page (Article 6(1)(a) GDPR); and, for allergies or health-related needs, the explicit consent of the person concerned (Article 9(2)(a) GDPR). Without consent to publication, the player still takes part and their name is not shown.
- Source of the data: player and staff data is provided to us by the team manager or their national section, who confirms that they are authorised to do so and that they have informed the participants of this policy.
- Retention: until the tournament and its financial settlement have been completed and, afterwards, for the applicable statutory periods.
- Recipients: the Spanish Section of the IPA (IPA Spain), as co-organiser of the tournament; where necessary for logistics, the hotel and transport companies, with only the data they strictly need; and the website hosting provider, as a data processor. If online payment of the entry fee is activated, it will be made through the Stripe payment gateway, which processes payment data under its own privacy policy; IPA Tarragona does not receive full card details.
Enquiries by email, phone or WhatsApp
- Data: whatever you give us when you contact us (name, contact details and the content of your message).
- Purpose: to deal with and answer your enquiry.
- Legal basis: our legitimate interest in answering the enquiries we receive (Article 6(1)(f) GDPR) or, if they relate to a membership application or a tournament entry, taking steps at your request before entering into an agreement (Article 6(1)(b) GDPR).
- Retention: for as long as needed to reply; it is then deleted, unless it has to be kept for the matter you have asked us to deal with.
- WhatsApp: if you write to us on WhatsApp, the service is provided by a third party under its own terms and privacy policy, which may involve transfers of data outside the European Economic Area. If you prefer to avoid this, please use email or phone.
Browsing and security
- Server logs: when you visit the website, the server records technical data about each request, such as the IP address, the date and time and the page requested, to keep the service secure and working properly and to detect abuse. Legal basis: legitimate interest (Article 6(1)(f) GDPR). Logs are kept for a short period, only as long as needed for these purposes, unless they are required to investigate a specific incident.
- Form protection: to prevent bulk submissions, when you send a form a pseudonymised identifier, derived from your IP address and email address, is kept for one hour.
- Map of delegations: the map loads its tiles from OpenFreeMap (tiles.openfreemap.org), a third-party service that receives your device’s IP address in order to deliver them. We do not give it any other data.
- Cookies and local storage: the website only uses one technical language cookie and a local cache so that it can work offline. Full details are in the cookie policy.
Recipients and processors
We do not sell your data or share it for commercial purposes. We only disclose it:
- to the Spanish Section of the IPA (IPA Spain), in the cases described for membership and the tournament;
- to the tournament hotel and transport companies, where necessary for logistics;
- to the payment gateway, if online payment for the tournament is activated;
- to public authorities and courts where there is a legal obligation to do so.
The provider that hosts the website and the management panel (panel.ipatarragona.org) only accesses the data in order to provide that service, as a data processor under Article 28 GDPR.
International transfers
We do not intend to transfer your data outside the European Economic Area. Transfers could only take place if you use third-party services linked from the website (such as WhatsApp, Facebook or Instagram) or where providers with international infrastructure are involved, such as the map service or, if activated, the payment gateway. In those cases, the safeguards provided for in the GDPR and in their own policies apply.
Your rights
You may exercise the following rights at any time:
- access, to find out what data we hold about you;
- rectification of inaccurate or incomplete data;
- erasure, when the data is no longer needed or you withdraw your consent;
- objection to processing based on legitimate interest;
- restriction of processing in the cases provided for in the GDPR;
- portability of the data you have given us; and
- withdrawal of any consent you have given, at any time.
To exercise them, write to ipatarragona@ipatarragona.org stating which right you wish to exercise and attach a copy of an identity document, which we will only use to verify your identity (if you act through a representative, please include proof of representation). We will reply within one month, which may be extended by two further months in complex cases.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es). We would be grateful if you contacted us first so that we can try to resolve it.
We do not make automated decisions or create profiles using your data.
Security and minors
We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), a management panel with access restricted to the branch’s authorised staff, documents stored outside the public website, and private tracking and dossier links that are not stored in the browser cache.
You are responsible for ensuring that the data you give us is accurate and up to date. If you provide data about other people, you must have informed them beforehand and, where necessary, have their permission.
The website is not aimed at minors. Membership is reserved for police professionals, who are adults, and tournament entries are managed by each team’s manager.
Changes to this policy
We may update this policy to reflect changes in the law or in how the website works. The current version will always be published here with the date it was last updated and, if the change is significant, we will let you know through our usual channels.