This privacy policy outlines how Tucana Global SLU (Tucana) collects, uses, and protects personal data in compliance with data protection laws across the EU, UK, US, and Australia, including the General Data Protection Regulation (GDPR).

1. Data Collection

Tucana collects personal data via the website, forms, event platforms, and third-party sources, including names, job titles, and contact details. Data may also be collected automatically (e.g., via cookies and IP addresses). We may collect sensitive data if explicitly provided by you, and we follow strict procedures for its processing.

2. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Legitimate Interest: For business operations, event management, and improving user experiences.
• Contract Necessity: When processing is necessary for fulfilling contractual obligations, such as event registrations.
• Consent: For marketing communications, where explicit consent is obtained, or under soft opt-in where appropriate. You may withdraw consent at any time.
• Legal Obligations: When processing is required to comply with legal obligations.

3. International Data Transfers

Data may be transferred outside the European Economic Area (EEA), including to the US and Australia. We ensure compliance with GDPR and other privacy regulations through appropriate safeguards such as Standard Contractual Clauses (SCCs) and binding corporate rules. We assess third-party compliance with GDPR standards before transferring any data.

4. Data Subject Rights

Under GDPR, you have the right to:

• Access: Request copies of the personal data we hold about you.
• Rectification: Correct inaccuracies in your data.
• Erasure: Request deletion of your data.
• Restriction: Limit how we process your data.
• Data Portability: Transfer your data to another service provider.
• Objection: Object to processing, particularly for direct marketing or processing under legitimate interests.

To exercise these rights, contact us at contact@tucana-global.com. We will respond promptly and comply with your requests unless legal grounds for refusal apply. You also have the right to lodge a complaint with the relevant supervisory authority, such as the ICO in the UK, if you’re unsatisfied with our response.

5. Data Security

Tucana implements robust technical and organizational measures to safeguard your data, including secure servers, encryption, and access controls. We monitor and address potential data breaches and will notify affected individuals and relevant authorities within 72 hours if required by GDPR.

6. Data Retention

We retain personal data only as long as necessary for the purposes outlined in this privacy policy or as required by law. Even after deletion, data may persist in backup systems for legal, tax, or regulatory reasons.

7. Third-Party Sharing

Tucana shares data with event sponsors, partners, and service providers, all of whom are required to comply with data protection laws. Where data is transferred to third parties outside the EEA, appropriate safeguards are in place to ensure the security and privacy of your data.

8. Cookies

Tucana uses cookies to enhance user experience and gather analytical data. Users can manage their cookie preferences through browser settings. Disabling cookies may impact website functionality. Tucana complies with the UK and EU Cookie Law and informs users of any cookies placed on their devices.

9. Data Breach Notification

In the event of a data breach, Tucana will notify affected individuals and the relevant supervisory authorities within 72 hours, as required by GDPR. We will provide clear information on the nature of the breach, the data affected, and the steps taken to mitigate the risk.

10. Children’s Data

Tucana does not knowingly collect data from individuals under the age of 16. If we become aware that we have collected such data without parental consent, we will take steps to delete it promptly. Please contact us if you believe we have collected data from a child under 16 without the necessary consent.

11. Data Protection Officer (DPO)

If Tucana’s processing activities require the appointment of a Data Protection Officer (DPO), their contact details will be provided here. For any inquiries related to data protection, please contact our DPO at dpo@tucana-global.com.

12. Data Protection Impact Assessment (DPIA)

Tucana conducts Data Protection Impact Assessments (DPIAs) for high-risk processing activities to ensure that data protection risks are identified and mitigated effectively in compliance with GDPR requirements.

13. Links to Other Websites

Our website may contain links to third-party websites. Tucana is not responsible for the privacy practices of these websites, and we encourage users to review the privacy policies of any site they visit.

14. Changes to Business Ownership

If Tucana undergoes a business transition, such as a merger, acquisition, or sale, personal data may be transferred as part of the business assets. The new owner will continue to use your data in accordance with this privacy policy.

15. Changes to this Privacy Policy

Tucana reserves the right to update this privacy policy as necessary. Any changes will be posted on our website, and you will be deemed to have accepted the updated terms upon your continued use of the website.

16. Governing Law

This privacy policy is governed by the laws of England and Wales. However, Tucana will comply with relevant privacy laws in other jurisdictions where applicable (e.g., CCPA for California residents, APPs in Australia).

For further information or to exercise your data rights, contact Tucana at contact@tucana-global.com.