Privacy Notice · AI Safety Barcelona

Who we are

AI Safety Barcelona (AISBAR) is a non-profit association registered in Spain. We help people who want to upskill, collaborate and work in technical AI safety, governance or adjacent research areas, through a community, events and programmes.

We are the data controller: we decide how and why your personal data is used. Contact: aisafetybcn [at] gmail.com. We have not appointed a Data Protection Officer. We process your data under the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD). We collect only what we need for the purposes below.

What data we collect and why

Membership forms

We keep a database of our members. Most of it stays private, and a small part is published only if you agree.

Category	Data	Who sees it
Private	Name, surname, email, phone number, familiarity with AI safety, why you are interested in AI safety, what you hope to get from AISBAR, how you heard about us, other comments and feedback, the professional profile you give when signing up. Also the dates you submitted or updated your forms, your membership status, your visibility choice and your preferred language.	Organisers only. If you choose "Private, organisers and recruiters", your profile and email may also be shared with recruiters (see Who can see your data).
Public, only with your consent	Name and surname, LinkedIn or other professional profile, website or portfolio, city or country of residence, job title or role, organisation, current situation, background and expertise, interests in AI safety, projects and interests, what you are currently looking for, location preferences, how others can help you, how you can help others, and "more about me".	Anyone visiting our website

In your profile form you choose one of three options: "Public" (your profile appears in the member directory), "Private, organisers only", or "Private, organisers and recruiters". Nothing is published unless you choose "Public". You can also leave any field marked as optional blank, and only the answers you give are shown. You can change your choice at any time by updating your profile or writing to us. Your public profile can reveal, for example, that you are between roles or open to relocating, so choose "Public" only if you are comfortable with that.

Why we collect this:

To review your application, admit you to the community, and contact you about your membership and profile reminders;
To understand our members' situation and needs so we can adapt our activities, using aggregated information wherever possible;
To apply the community norms and handle reports;
To publish your profile in the public directory, if you consent, in order to help members find and collaborate with each other.

Events and community

If you attend our events or join our online spaces, we'll collect some basic data to help things run smoothly and make the experience better for everyone. This might include:

Your RSVP and attendance for things like meet-ups, hackathons, or retreats.
Your WhatsApp number and general activity (e.g. which subgroups you join, how active you are).
Feedback you give in post-event surveys or check-ins, where collecting it in an anonymous format is not feasible.
Details about your career progression (e.g. if you are hired as a result of the support we've provided you).

Why we collect this: To manage logistics, understand what works, improve inclusivity and report on our reach and impact, often in anonymised form, for ourselves and sometimes for funders.

Photos and videos at events

We sometimes take photos or videos at our events to document and promote our activities, and publish them on our website, LinkedIn and WhatsApp under our legitimate interest in showing what we do. We announce this in the event description and at the event. If you are the main subject of a photo, we ask for your consent first.

You can opt out at any time by telling an organiser at the event, and we will not photograph you or will delete the image. To have a published photo removed, write to aisafetybcn [at] gmail.com and we will remove it within 3 days. We cannot remove copies that others have already saved or shared.

Programme applications and participation

When you apply to one of our programs (whether it's a fellowship, workshop, retreat, or recurring course), we collect the details we need to understand who you are and how we can best support you. This may include:

Your name, email, and basic contact info;
Your background or affiliation (e.g. student, researcher, professional);
Your responses to application questions, including motivation statements or CVs;
Your preferences for program topics (e.g. introduction to AI safety, technical research, governance, etc.);
Your general availability for calls, mentoring, or events (via tools like Google Meet and Cal.com).

Why we collect this: To select participants fairly, coordinate logistics, and tailor our programs to your needs and goals. It also helps us make sure we're reaching a diverse and relevant community.

Career support and referrals

If you're receiving career advice or ongoing support from us, we may keep track of a few things to better tailor that support. This could include:

Notes from 1:1 conversations or mentoring calls (always with your awareness).
Your stated interests, skills, and long-term career goals.
A record of any introductions we've made to other orgs, job boards, or funding opportunities.

Why we collect this: To support your career more effectively and, if you have agreed, to refer you to relevant people, organisations or opportunities.

Sensitive data

We do not ask for sensitive data such as health, political opinions or religion. Please do not include any in free-text answers.

Legal basis

Purpose	Legal basis
Review your application, admit you, contact you about your membership, send profile reminders	Steps you ask us to take to join (GDPR art. 6.1.b)
Deliver a programme or mentoring track you formally join	Our legitimate interests (art. 6.1.f)
Run events and programmes smoothly, learn what works, improve our outreach (anonymised or aggregated where possible), and share limited information such as your name or topic preference with facilitators and partners of the same programme	Our legitimate interests (art. 6.1.f)
Take and publish general photos and videos of our events	Our legitimate interests (art. 6.1.f), with advance notice and an easy opt-out
Publish photos or videos in which you are the main subject	Your consent (art. 6.1.a)
Apply the community norms, handle reports, and keep our internal systems (WhatsApp, Airtable) organised	Our legitimate interest for a safe, well-run community (art. 6.1.f)
Publish your profile in the public member directory	Your consent (art. 6.1.a)
Refer you to other organisations, jobs or funding; feature you in a testimonial or case study; send non-essential communications such as newsletters	Your consent (art. 6.1.a)
Share your profile and email with recruiters, if you choose that option	Your consent (art. 6.1.a)

Consent is always optional and separate, and we ask before each use. You can withdraw it at any time, as explained under Your rights. Newsletters and mailing lists include an unsubscribe link. You can object to any processing based on our legitimate interests.

Who can see your data

Organisers. The volunteers who run AISBAR see all private data, only for the purposes above.
The public. Only the profile fields you consented to publish, in the member directory on our website, and photos or videos from our events, published on our website, LinkedIn, and WhatsApp.
Other organisations. If you choose "Private, organisers and recruiters", we may share your profile and email with other AI safety or Effective Altruism organisations running fellowships, grants or jobs, to researchers or mentors relevant to your interests, or to employers or hiring platforms (such as 80,000 Hours).
Service providers. Google Workspace and Gmail (email, Drive, forms), WhatsApp (community group), Google Meet and Cal.com (meetings and scheduling), Airtable (member database and forms) and Superhuman (task management and collaborative workspace). They process data for us under data processing agreements and may store it outside the European Economic Area. We rely on safeguards such as Standard Contractual Clauses or the EU-US Data Privacy Framework.
WhatsApp. Meta also processes your phone number under its own terms. Other members of the group can see your name, number and messages.
Authorities. Only when the law requires it.
LinkedIn. If we publish photos there, LinkedIn also processes them under its own terms.

We do not sell or commercialise your data.

How long we keep it

Data	How long we keep it
Membership data	For as long as you are a member. We email you every 6 months to ask you to review your profile.
Event records linked to a member	As part of the membership record.
Programme and event data of non-members	24 months from last engagement.
Applications we do not accept, or that you never complete	Deleted after 6 months.
Event photos and videos	While they are useful to document our activities. Removed within 3 days of your request.
Referral and coaching notes	Deleted on your request, or after 12 months of inactivity.
Public directory entry	Removed within 7 days of you withdrawing consent or leaving.
If you leave or ask us to delete your data	We delete your record within 30 days, except what the law requires us to keep.
No reply to our reminders	After 18 months without a reply, we remove your public entry and write to ask whether you want to stay. If you do not reply, we delete your record.

Your rights and complaints

Under the GDPR you have the right to:

Access the personal data we hold about you.
Correct anything inaccurate or out of date.
Ask us to delete your data when it is no longer needed.
Limit or object to how we use your data in certain situations.
Receive a copy of your data in a portable format, where technically feasible.
Withdraw your consent at any time, for example to the public directory. This does not affect your membership or earlier lawful processing.
Opt out of being photographed at our events, or ask us to remove a published photo of you.

To exercise any right, write to aisafetybcn [at] gmail.com. We reply within a week and aim to reply sooner. We may ask you to confirm your identity.

If you have concerns, please contact us first. You also have the right to complain to Spain's supervisory authority:

Agencia Española de Protección de Datos (AEPD)
Website: www.aepd.es
Address: C/ Jorge Juan, 6, 28001 Madrid, Spain

Changes to this notice

By ticking the privacy box on our forms, you confirm that you have read this notice. Organisers may update it as the community grows, and will announce significant changes by email or in the WhatsApp community. The latest version is always on our website.