Privacy policy

AEICF does not sell or rent your personal data or share it with third parties for their own advertising campaigns. We use it to assist you, manage the association and provide the services you request. This policy explains access by authorized staff, instructors and necessary service providers.

Last updated: Oct. 27, 2026. This information relates to AEICF’s website, accounts, member services, training and communications. Reading it or browsing the website does not constitute consent to optional data processing.

Who is responsible and how to contact us

Data controller: Asociación Española de Imagen Científica y Forense (AEICF).
Tax identification number: G73962045.
Address: Calle Cánovas del Castillo 1, 2A, 30850 Totana, Murcia, España.
Contact: contact form or telephone +34 968 676 794.
Email: Show email address (anti-spam verification).

The coordinating instructor who delivers and invoices each course is identified on the course page and in the enrollment documentation. They manage academic selection, course delivery and their invoicing obligations. You may contact AEICF to identify the controller responsible for a particular matter and have your request directed appropriately.

What data we process and why

The data comes from information you provide, your activity on the services and records of your relationship with the association. We do not buy contact lists. Required fields are indicated on each form; without them, we may not be able to process your request. Optional fields do not affect the provision of the service.

Inquiries: name, email address, telephone number if you provide it, and message, so we can respond and follow up. If you write from a member’s profile, the inquiry is directed to that professional. The legal basis is your request and consent when you submit the form; when you inquire about a contract, it is also the taking of steps prior to entering into a contract.
Accounts and member services: identity, username, business and personal email addresses you add, communication preferences, linked access credentials and security data. These are used to identify you, restore access and provide the services associated with your account. The legal basis is the management of your membership or the requested service.
Membership applications and management: contact details, professional profile, CV, membership status and fees. These are used to review your application and administer the association, on the basis of your membership application, your membership relationship and applicable legal obligations.
Enrollment applications: first and last names, identity document, nationality, address, billing details, CV, comments and answers. These are used to check requirements and manage your application as steps taken at your request prior to entering into a contract. New applicants must confirm their email address before their application form and CV are sent to the coordinator. The coordinator makes the admission decision.
Training: enrollment, progress, exercises, submissions, assessments, forum contributions, tutoring requests and academic communications. These are used to deliver and organize the course and support the student as part of the contracted service.
Payments and billing: identity and billing address, purpose, amount, references and payment status. These enable us to process membership fees or course enrolments, reconcile transactions and meet tax and accounting obligations. The payment gateway collects payment method details; the website does not store the full card number or security code.
Public profile: photograph, biography, services and materials you choose to publish. Publishing your personal page is optional and you can disable it from your dashboard. You can manage the visibility of your directory listing from your account or contact AEICF.
Security: technical connection logs, access attempts, verification checks and transactions, to prevent abuse, investigate incidents and protect accounts and services. The legal basis is the legitimate interest in maintaining their security and applicable data protection obligations.

Provide only relevant information. Do not include health data, especially sensitive information or other people’s data in CVs, comments or exercises unless necessary and you are legally entitled to provide them.

Newsletter and communications

The public newsletter form requests only your email address and requires confirmation via a link. Optional subscription through the contact form also requires confirmation. Its purpose is to inform you of new articles, events and courses, based on your consent.

The full newsletter, featuring articles, events and courses, is the usual channel for keeping members informed about AEICF activities. New membership applications expressly request authorisation to receive it. Every new subscription requires authorisation and email confirmation; creating an account or enrolling in a course does not replace that permission. AEICF manages the list, preferences and unsubscribes on its own platform.

You can unsubscribe at any time using the link in each message or through your subscription settings. Your unsubscribe request is retained to prevent you from being automatically added again. It does not prevent you from receiving notices necessary to manage your account, fees, applications, payments or training.

Where your account allows it, you can choose a personal email address for communications while retaining your corporate mailbox. We do not use open-tracking pixels or individual click tracking in newsletters.

Who can access the data

Access depends on each person’s role and the service you use. We do not provide member or student lists to other organisations for their own advertising.

Management and support: authorised people who need the data to administer the association, respond to enquiries or maintain the services.
Coordination and teaching: once the enrolment application is confirmed, the coordinator receives it and the applicant’s CV, including a copy by email, and accesses the data needed for admission and billing. The teaching team accesses the academic information relevant to their role. Teaching a topic does not, by itself, grant access to candidates’ CVs.
Course participants: forum posts and replies are visible to authorised students and instructors on the course and generate email notifications. Any data you publish in a post forms part of that shared content. Shared tutorials display the necessary information to their participants.
Professional you contact with an enquiry: receives your contact details and message when you use the form on their profile.
Operational service providers: they are involved in transmitting communications, protecting the website or processing payments, as detailed below.
Competent authorities and bodies: when there is a legal obligation or a valid request.

The website and its database are hosted on AEICF servers. This does not preclude the use of the following external services for specific functions:

Delivery of notices and newsletters — Mailjet: receives the recipient details, content and, where applicable, attachments to deliver messages and manage delivery issues. The subscription list is managed by AEICF. Privacy information.
Corporate mailboxes — Migadu: provides the association’s email service and processes messages sent or received through those mailboxes, even when you access them from the members’ area. Privacy information.
Website protection and distribution — Cloudflare: handles the connections and requests needed to access the website, including technical information such as your IP address. Privacy information.
Payments — Stripe: processes the data needed to collect payments, ensure their security and prevent fraud when you make a payment. It may act as a processor or controller depending on the transaction. Privacy information.

These operational uses do not authorise the use of our lists for third-party advertising campaigns. Processing on behalf of AEICF must comply with its instructions and the safeguards governing the engagement; providers acting as controllers for their own obligations explain those obligations in their policies.

Processing outside the European Economic Area

The use of international providers may involve processing outside the European Economic Area. The policies of Mailjet, Cloudflare and Stripe provide for international operations, including operations in the United States; Migadu is a provider established in Switzerland.

In the linked policies, the providers describe the mechanisms applicable to their transfers, such as adequacy decisions or standard contractual clauses, depending on the service and recipient. You may ask AEICF for information about the recipients and safeguards applicable to your data, including how to obtain a copy. Self-hosting does not mean that all communications or payments are processed exclusively in Spain.

Cookies and statistics

AEICF manages its own analytics system. By default, anonymous counts are collected. Only if you allow it are visits linked, using a pseudonymous code, to your status as a subscriber, member or student to understand use of the website and its campaigns. This linking is based on your consent and does not make the data anonymous.

Names, email addresses, identity documents, passwords, form data and private classroom content are not sent to the analytics system. We do not record sessions. Analytics do not determine your admission to a course.

You can choose anonymous counts only or disable all analytics without losing access to services. See Cookies and statistics and change your preferences whenever you wish. Technical security logs are separate.

How long data is retained

Enquiries and applications: while they are being handled and for as long as necessary to resolve related issues or liabilities. CVs are retained in connection with the review of the application; they are not used as an advertising contact list.
Accounts, members and training: for the duration of the relationship and for as long as the relevant history must be retained to document administration or address claims. Terminating access does not delete documents that must be retained by law.
Financial data: for the tax, accounting and limitation periods applicable to each transaction and the party responsible for invoicing.
Newsletter: while the subscription is active. After unsubscribing, the minimum exclusion information and evidence needed to respect and demonstrate your decision are retained.
Statistics: for a maximum of 25 months; operational copies are retained for 14 days. Analytics preferences and subscription recognition are stored in the browser for a maximum of six months. Withdrawing permission stops new data from being sent, but does not automatically delete previously collected data.
Security logs: for as long as necessary to prevent and investigate incidents and, if an incident occurs, to address the associated liabilities.

Once the data is no longer needed, it is deleted or, where required by law, blocked to address liabilities. You can request information about the retention period applicable to a specific record and exercise your rights.

Your rights and how to exercise them

You can find out what data we hold about you, obtain a copy, correct it or request its deletion, as well as request restriction of processing or object to it. You also have the right to data portability when the applicable requirements are met, particularly for data you have provided that is processed by automated means on the basis of consent or a contract. You can withdraw consent without affecting the lawfulness of prior processing.

Write to us using the contact form, the email address protected against automated harvesting or the address provided, explaining your request and how we can respond to you. You may act through an authorised representative. We do not generally require a copy of your identity document: we will only request proportionate additional information if there are reasonable doubts about your identity.

The standard response period is one month. If the complexity or number of requests requires an extension, we will inform you within that period of the reasons and the extension, which may be up to two additional months. Some rights are subject to legal limits, for example when we must retain an invoice.

If you believe your rights have been violated, you can lodge a complaint with the Spanish Data Protection Agency.

Security and external content

We implement access controls, antispam checks, encrypted connections and backups. Curricula and private materials require the appropriate permissions. Do not post confidential information on your profile or in the forum if you do not want its intended recipients to see it.

If a page includes a video or other resource from a third-party provider, loading it may establish a connection to that provider and transmit technical data to them. Links to external websites and interactions on social media are also subject to the policies of their respective operators.

Changes to this information

We will update this policy when the services or their associated data processing change, indicating the revision date. If a new use requires consent, we will request it before starting. Updating a text does not replace that consent.