1. Who is responsible
Asociación para la Resolución Independiente de Conflictos Online, an independent non-profit association established in Spain (the Association, we, us), is the controller for personal data it determines is necessary to provide the P2B Disputes website, accounts, case-management Portal and mediation administration. Privacy questions and rights requests may be sent to info@rgoal.org.
A business user, online platform, representative, mediator, payment provider or other participant may separately be a controller for processing it determines for its own purposes. This Notice does not replace that party's privacy information.
2. Scope
This Notice applies to the public website and the P2B Disputes Portal, including registration, authentication, case intake, mediation communications, document handling, scheduling, payments, support, audit and account security. It should be read with the applicable Terms of Use, Online Mediation Rules and case notices.
3. Personal data we process
Depending on how you use the service, we may process: name and contact details; login, verification, session and multi-factor-authentication data; language and communication preferences; organisation, role, authority and representative data; platform account and business information; and correspondence with us.
For a mediation we may process complaint and response details, chronology, claimed amounts, platform decisions, submissions, messages, uploaded documents, disclosure instructions, mediator notes and assignments, meeting and availability information, recommendations, proposals, reactions, settlement or closure records and evidence of delivery or signature.
We may also process fee, invoice and transaction references; support requests; consent and legal-document versions; IP address, device and browser information; security, access and audit logs; and records required to investigate errors, abuse or suspected unauthorised access. Payment-card details are handled by the identified payment service and are not intended to be stored in the Portal.
Case material may exceptionally include sensitive personal data, criminal-offence data, trade secrets or information about other people. Submit such information only where it is relevant, lawful and reasonably necessary, and redact unnecessary data where possible.
4. Sources
We receive data directly from account holders and case participants; from the businesses, platforms and representatives for whom they act; from appointed mediators and authorised staff; from payment, communication and meeting services; and from technical and security events generated when the Portal is used.
5. Purposes and legal bases
We process data to take requested pre-contractual steps and perform agreements by creating and securing accounts, assessing intake, administering mediation, enabling communications and documents, arranging meetings, recording procedural acts, processing charges and providing support.
We process data to comply with legal obligations concerning dispute-resolution administration, accounting, tax, sanctions, security, data protection, lawful requests, audit and record keeping. We also process data for legitimate interests in operating an independent and efficient service, protecting users and systems, preventing fraud and misuse, resolving complaints, improving reliability, measuring aggregate service performance and establishing, exercising or defending claims.
Where consent is the appropriate legal basis, it is requested separately and may be withdrawn prospectively. Withdrawal does not affect earlier lawful processing and does not override processing required on another legal basis. Sensitive data is processed only where an applicable legal condition permits it.
6. Required information
Fields identified as required are needed to create an account, verify authority, assess a request, administer a case or comply with law. Without them we may be unable to provide the relevant function or accept or continue a mediation. Optional data may be omitted unless it later becomes necessary for the requested service.
7. Who receives personal data
Within a case, data is available only according to role, object access and disclosure classification. Recipients may include the other party and its authorised contacts, the appointed Case Mediator, authorised supervisors or administrators, finance or support personnel, and professional advisers subject to appropriate duties.
We use service providers where necessary for hosting, data storage, email delivery, security, backups, payment processing, remote meetings and technical support. They receive only the access needed for their function and are subject to contractual and legal safeguards. Data may also be disclosed where required by law, a court or a competent authority, or where necessary to protect rights, safety or service security.
8. International transfers
We aim to process data within the European Economic Area. If a service requires a transfer to a country without an adequacy decision, we use an available lawful transfer mechanism and supplementary safeguards where required. Information about the relevant safeguard may be requested through the contact address above.
9. Retention
We keep personal data only as long as necessary for the purposes described here. Retention depends on case status, procedural and contractual needs, limitation periods, legal holds and legal, accounting, audit and regulatory obligations.
After a case closes, authorised retention decisions may reduce, delete or anonymise case content and party links while purpose-bound financial, audit, integrity and aggregate records are retained where required. Backup copies expire through the controlled backup cycle unless preservation is legally necessary.
10. Security
We use role- and case-based access controls, secure sessions, password hashing, multi-factor authentication for privileged roles, transport encryption, audit logs, protected storage, backups and operational monitoring. Users must protect their own credentials and devices. No internet service can guarantee absolute security.
11. Cookies and similar storage
The Portal uses strictly necessary session and security mechanisms to authenticate users, maintain protected access and prevent misuse. The public service does not use marketing or behavioural-tracking cookies and does not set a locale cookie. Blocking necessary session storage may prevent sign-in or protected Portal functions.
12. Automated processing and AI support
No solely automated system decides a dispute or issues an Early Resolution Recommendation. Where controlled technology assists with an internal case summary, its output is treated as untrusted and is not shown to parties unless an authorised human reviews and approves it. It does not itself determine eligibility, liability, settlement or case outcome.
13. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction or portability of your personal data, and may object to processing based on legitimate interests. You may withdraw consent where processing relies on consent. We may need to verify identity and authority and may retain information where a legal obligation, legal claim, confidentiality duty or another lawful exception applies.
You may complain to the competent data-protection supervisory authority, including the authority in the EU Member State of your habitual residence, place of work or the alleged infringement. We encourage you to contact us first so that we can try to address the concern.
14. Children
The mediation service is intended for businesses, professional users and authorised adult representatives. It is not directed to children and accounts must not be created for them. If information about a child is genuinely relevant to a dispute, submit it only where lawful and necessary and identify its sensitivity.
15. Changes to this Notice
We may update this Notice to reflect changes in law, processing, security or service operation. The Portal displays the current version and effective date. Material changes affecting active users or requiring renewed acknowledgement will be notified through an appropriate channel.
16. Contact
Privacy questions and rights requests may be sent to info@rgoal.org. Do not send confidential case attachments by ordinary email unless requested; use the secure Portal for case material.