SCOPE

This Privacy Policy XarSMART, fully managed by the INSTITUT D’INVESTIGACIÓ BIOMÉDICA DE BELLVITGE (hereinafter IDIBELL) regulates the collection, use and other forms of processing of personal data provided by users on this website or any of the Internet environments of the entity, and includes additional information to the processing of data from different strategic areas of our institution.

Through the implementation of the forms included in the different websites, related to services provided by XarSMART, Users accept the inclusion and processing of data provided in a personal data processing, which is owned by IDIBELL and may exercise their rights as set out in the following clauses.

All legal texts are available to users and/or interested parties on the corresponding website. These texts may be modified and/or updated according to the needs and activities carried out by IDIBELL.

In the following sections we answer some of the questions that may arise in relation to how such data are treated, and what are the commitments we assume when accessing, storing and disposing of the information that may eventually be collected.

What regulations do we apply when we manage your personal data to provide you with our services?

For these purposes, our activity is governed by the commonly known as the General Data Protection Regulation (GDPR), which is Regulation (EU) 2016/679 of the Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC; Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights, and other applicable national regulations.

How can I contact the person responsible for the processing of my personal data?

Who collects the personal data for processing?

The collection and processing of personal data that you may provide us, are carried out by IDIBELL, where appropriate, its processors. In relation to the latter case, these processors are third parties with whom IDIBELL has established an express service contract and in which the conditions have been set so that the management of the data is in accordance with the Law. It is required by contract to these third parties that their activity respects the law and implement appropriate security measures to protect such data.

At the time of collection of personal data, the data subject will be informed whether it is done through IDIBELL or a joint controller. In any case, the interested party may request further information at dataprotection@idibell.cat.

What is the basis for the processing of your data?

The main legal basis for the processing of your data by browsing through the website of XarSMART is your consent, which is given with the acceptance of the notice of cookies, or in case of not accepting or rejecting the same, by the continuity with the navigation knowing the existence of the same.

Regardless of the information collected through cookies, you can browse most pages of XarSMART without providing any personal information, but in some cases this information may be necessary to perform the registration on the Intranet service, give answers to your requests, especially those made through the contact form or through emails enabled by IDIBELL. In these cases, the legal basis for the processing will be your consent and/or the need to comply with an obligation arising from the provision of services by the entity.

In the event that the processing of your data may be based on some other basis of legitimacy, you would be expressly informed prior to the registration of personal information.

For what purpose(s) do we collect your data?

IDIBELL only collects the data strictly necessary to offer the services derived from its activity and other services, management and activities attributed by law.

On this website, only the data provided by users are processed. The data that may be collected from the user will be processed for the purposes of:

– Management of your contact data to resolve doubts or suggestions, the legal basis being your consent.
– Management of your identification and banking data to process the process of financial donations, the legal basis being your consent.
– Management of your identification, academic and professional training data for personnel selection processes, with the legal basis of your consent.

As a registered user and member of XarSMART, the treatment will be carried out with the purpose of providing the services offered by the entity, as well as to regulate and comply with the legal obligations of the relationship that binds us, either as an employee or as a member. We inform you that the information in the databases may be used to identify users and to carry out statistical studies of registered users.

Also, as a member of XarSMART, you may also receive emails about training and other current issues of XarSMART. If you wish to unsubscribe from these communications, you can do so through the email you receive the same or by making a request to dataprotection@idibell.cat.

As a user follower in social networks, the treatment will be carried out in order to manage and publish content or information that may appear on their profiles or walls, and we think that may be of interest.

How do we treat your personal data?

IDIBELL only collects personal information to the extent necessary to achieve a specific purpose. The information will not be used for a purpose incompatible with the one described.

These data will be guarded and managed as diligently as possible applying the criteria of limitation and minimization.

IDIBELL has included all technical and organizational measures at its disposal to prevent the loss, misuse, alteration, unauthorized access and theft of personal data in its custody. Also, in the event of a security incident that jeopardizes the confidentiality and availability of your data, IDIBELL will follow the mandatory notification protocols to the competent authority, and affected stakeholders.

How long will your personal data be kept?

When the legitimate basis for the processing is the consent of the data subject, the personal data will be kept for as long as he/she does not express otherwise, unless for obvious and logical reasons they have lost their usefulness or the legitimate purpose for which they were collected.

When the legitimate basis for processing is based on compliance with a legal obligation and / or contractual, personal data will be retained, once the relationship linking the person concerned with XarSMART, for the time necessary to respond to the legal responsibilities that may arise. In this sense, it is expressly informed that the legally established retention periods are:

•10 years in cases of economic donations or donations in kind made free of charge according to Law 10/2010 of 28 April on the prevention of money laundering and terrorist financing.
•10 years for all issues related to accounting and taxation of IDIBELL, as provided in the General Tax Law and according to the periods of limitation of criminal liability provided in the Organic Law 10/1995 of 23 November.

• 10 years for all contractual obligations acquired by IDIBELL, except those referring to periodic payment obligations made for years or shorter periods; remunerations for services rendered and works executed; claims for collection of consumer sales price, which shall be kept for a period of 3 years, according to the provisions of Law 29/2002, of December 30, the First Law of the Civil Code of Catalonia.
• 5 years with respect to obligations arising from the prevention of occupational hazards, as provided for in Royal Legislative Decree 5/2000, of August 4, approving the revised text of the Law on offenses and penalties in the social order.
• 3 years with respect to data related to other non-contractual obligations, in accordance with the provisions of Law 29/2002, of December 30, the First Law of the Civil Code of Catalonia.

Finally, and with regard to the conservation periods specific to the legislation applicable in the field of biomedicine, and as long as the corresponding rights are not exercised by the interested parties, the legal conservation periods established are:

• 10 years for all contractual obligations acquired by IDIBELL, except those referring to periodic payment obligations made for years or shorter periods; remunerations for services rendered and works executed; claims for collection of consumer sales price, which shall be kept for a period of 3 years, according to the provisions of Law 29/2002, of December 30, the First Law of the Civil Code of Catalonia.
• 5 years with respect to obligations arising from the prevention of occupational hazards, as provided for in Royal Legislative Decree 5/2000, of August 4, approving the revised text of the Law on offenses and penalties in the social order.
• 3 years with respect to data related to other non-contractual obligations, in accordance with the provisions of Law 29/2002, of December 30, the First Law of the Civil Code of Catalonia.

Finally, and with regard to the conservation periods specific to the legislation applicable in the field of biomedicine, and as long as the corresponding rights are not exercised by the interested parties, the legal conservation periods established are:

• 30 years for data associated with cells, tissues and any biological material of human origin according to Law 14/2007, of July 3, 2007, on biomedical research, once the project, study or trial for which they were collected is completed.
• 15 years for data included in the informed consent, according to Law 21/2000, of 29 December, on the rights of information regarding health and patient autonomy, and clinical documentation of the Department of the Presidency of the Autonomous Community of Catalonia.
• 5 years with respect to genetic data, since they were obtained, unless they are necessary for their conservation in order to preserve the health of the person from whom they come or of third parties related to them according to Law 14/2007, of July 3, on biomedical research.

To which recipients will your data be communicated?

Your data may be communicated to third parties that help us to provide services related to information technology, as well as to comply with legal and contractual obligations assumed by IDIBELL.

IDIBELL has appropriate technical and organizational measures to ensure the proper use of data by these third parties, and in the event that the aforementioned data processing involves the international transfer of data, especially through the use of cloud-hosted services, it ensures that the third party complies with the obligations under current data protection regulations.

If you would like more information on what transfers may have been made of your data to third parties, you can request further information by emailing dataprotection@idibell.cat.

What rights do you have over your personal data?

Right of access

You can ask the center if it is processing your data and in what way.

Right of rectification

You can ask us to update your personal data if it is incorrect, and delete it if you wish.

Right to limitation of processing

In this case they will only be kept by IDIBELL for the exercise or defense of claims.

Right to object

Following your request to object to the processing, IDIBELL will stop processing the data in the manner you indicate, unless for compelling legitimate reasons or the exercise or defense of possible claims, the data must continue to be processed.

Right to data portability

In case you want your data to be processed by another company, IDIBELL will facilitate the portability of your data to the new data controller.

Right to erasure

You can request that we delete your data when it is no longer necessary for processing, you withdraw your consent, it is unlawful processing or there is a legal obligation to do so. We will analyze the situation and apply the law.

If you need more information on what rights you have recognized in the Law and how to exercise them, we recommend that you contact the Spanish Data Protection Agency, which is the supervisory authority on data protection, with whom you also have the right to request protection in the event of a possible data protection breach.

Right not to be subject to automated decisions

The right not to be subject to fully automated decisions without human intervention if they are likely to have a legal effect on the data subject or are likely to significantly affect him or her, provided that the data subject’s explicit consent has not been obtained or is authorized by EU or national law.

If you require further information about your legal rights and how to exercise them, we recommend that you contact our Data Protection Officer at the following address dpd@ticsalutsocial.cat or the Catalan Data Protection Agency, which is the supervisory authority for data protection of IDIBELL, with whom you also have the right to request its protection in case of a possible breach of data protection.

If I want to exercise my rights, who should I contact?

For the best handling of your request, please send us the following:

• An e-mail to the e-mail address dataprotection@idibell.cat., indicating your full name, together with a copy of your ID card or similar and the right you wish to exercise over your personal data.
• A letter with the same information to the following address: Gran Via de l’Hospitalet, 199-203, 2nd floor, l’Hospitalet de Llobregat.
• If you have any doubts about how to do this, you can also call us at 93 260 74 11.

Communication of incidents and irregularities

In the event of any conduct or situation that could be susceptible to generate an incident or irregularity of any kind, please contact us via e-mail at dataprotection@idibell.cat.

Commitment of the user to ensure that their data are registered in a treatment

IDIBELL recommends that, before entering the data in any or some of the data collection sheets of this website, carefully read the legal notice, cookies policy and privacy policy.

In any case, the user is responsible for the authenticity of the data provided, that they are accurate, current and complete for the purpose for which they are provided, assuming liability for damages, both for lost profits and consequential damages, which could be generated by such inaccuracies or falsehoods. In any case, if the data provided in the corresponding forms were owned by a third party, the user is responsible for the correct acquisition of consent and information to the third party on the aspects reflected in the legal notice and privacy policies.

Responsibility of the users for the use and content

Both access to the website and the use that may be made of the information and content included therein, will be the sole responsibility of the user. Therefore, the use that may be made of the information, images, contents and/or products described and accessible through the same, shall be subject to the applicable national or international legality, as well as to the principles of good faith and lawful use by the Users, who shall be entirely responsible for said access and correct use. Users shall be obliged to make reasonable use of the services or content, under the principle of good faith and with respect for the law in force, morality, public order, good customs, the rights of third parties or IDIBELL itself, all according to the possibilities and purposes for which they are designed.

IDIBELL assumes no liability, whether direct or indirect, for consequential damages or lost profits, arising from the misuse of services or content made by Users or third parties.

Information LSSI-CE

In compliance with the duty of information provided for in Article 10 of the current Law 34/2002, of July 11, Services of the Information Society and Electronic Commerce, we inform you that the developer and content manager of the website where you can download different applications and / or information is IDIBELL residing in and managing the Internet domain https://www.idibell.cat/ registered in the corresponding registry, attending to communications from users and/or interested parties via e-mail info@idibell.cat.