Through this notice, “OPHTOS INSTITUT, S.L.” (hereinafter “OPHTOS”) informs users of the website www.inof.es, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation) and other applicable legislation, of its personal data protection policy so that users may decide, expressly, freely and voluntarily, to provide “OPHTOS” with the personal data requested of them in connection with a request for information or for the contracting of the various services offered within the field of medical and ophthalmological care and related services.
Unless specifically stated otherwise, it is necessary to complete all the required details on the form or similar document truthfully, accurately, fully and up to date. Failing this, “OPHTOS” may, depending on the circumstances, either not proceed with the user’s registration or refuse to provide the specific service requested. All data provided by the user/data subject will be processed in accordance with the details set out below.
Information regarding the processing of personal data
Identity of the data controller: “OPHTOS INSTITUT, S.L.”, with registered office at C/Vilana 12, Offices 156–157, 08022 Barcelona, Tax Identification Number (NIF): B63133227, registered in the Barcelona Commercial Register in Volume 35399, Folio 187, Page B266408, 1st Entry. Contact email: dpd@inof.es.
Identification of the Data Protection Officer: For all matters relating to personal data, such as enquiries, requests, suggestions, etc., you may contact the Data Protection Officer appointed by “OPHTOS” via the following email address: dpd@inof.es, by telephone on 93 393 31 56, or in person at our offices at C/Vilana 12, Offices 156–157, 08022 Barcelona.
Purpose of processing:
All data provided will be processed for the following purposes:
- To respond to requests made by the data subject.
- To maintain any relationship that may be established.
- To manage, administer, provide information on, deliver and improve the services that you choose to contract.
- To send commercial communications relating to our products and services.
The personal data provided will be retained for as long as the commercial relationship continues, unless the data subject requests its erasure or it is necessary for the purposes of the processing. The data will not be destroyed where there is a legal provision requiring its retention; in such cases, the data will be blocked and retained solely for the use of public authorities, judges and courts, to address any potential liabilities arising from the processing, for the duration of the limitation period for such liabilities.
At present, no automated decisions of any kind, including profiling, are made on the basis of your personal data. Should such automated decisions be made in the future, prior consent will be sought.
Legal basis for processing:
All processing of your personal data has been subject to your prior and express consent. You have been informed in advance of all the details required by law so that you may give your informed consent.
You may withdraw this consent at any time, as detailed later in this document.
Recipients, disclosures and data transfers:
Your data will not be disclosed unless it is strictly necessary for the fulfilment of the aforementioned purposes or to comply with a legal obligation.
Similarly, your data will not be transferred to countries outside the European Union unless it is essential for the fulfilment of the purposes and you have given us your prior and express authorisation.
Rights of data subjects:
You may exercise the rights set out below at any time by post to “OPHTOS”, C/Vilana 12, Office 156-157, 08022 Barcelona; or by email to dpd@inof.es. The request must include the first name, surname(s) and documentation proving the identity of the data subject or their legal representative, as well as a document proving the representation, a statement specifying the request, an address for notification purposes, the date and signature of the applicant, and supporting documents for the request being made. If the request does not meet the specified requirements, you will be asked to rectify it.
The rights of data subjects are: the right of access, rectification, restriction, data portability, objection and erasure; and these are defined as follows:
Right of access:
The data subject shall have the right to obtain from the data controller confirmation as to whether or not personal data concerning them are being processed and, where that is the case, the right of access to the personal data and to the following information:
- (a) the purposes of the processing
- (b) the categories of personal data being processed
- (c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients who are third parties or international organisations
- d) where possible, the envisaged period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period
- e) the existence of the right to request from the controller the rectification or erasure of personal data or the restriction of processing of personal data concerning the data subject, or to object to such processing
- f) the right to lodge a complaint with a supervisory authority
- g) where the personal data have not been obtained from the data subject, any available information as to their origin
- h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4), and, at least in such cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer. The data controller shall provide a copy of the personal data undergoing processing. The data controller may charge a reasonable fee based on administrative costs for any further copies requested by the data subject. Where the data subject submits the request by electronic means, and unless the data subject requests otherwise, the information shall be provided in a commonly used electronic format.
Right to rectification:
The data subject shall have the right to obtain from the controller, without undue delay, the rectification of any inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure:
The data subject shall have the right to obtain from the data controller, without undue delay, the erasure of personal data concerning him or her; the data controller shall be obliged to erase personal data without undue delay where any of the following circumstances apply:
- (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
- (b) the data subject withdraws the consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a), and the processing is not based on any other legal basis
- (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2)
- (d) the personal data have been unlawfully processed
- (e) the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject
- (f) the personal data have been collected in relation to the provision of information society services referred to in Article 8(1)
Where the controller has made public personal data in respect of which the data subject has exercised their right to erasure, the controller must take reasonable steps, having regard to the available technology and the cost of implementation, to inform third parties who are processing that information of the request for erasure of the data, as well as of any links to that data or to any copies or replicas thereof.
This right shall be subject to limitations arising from other rights, such as the right to freedom of expression and information, compliance with a legal obligation, or where there are grounds of public interest.
Right to restriction of processing:
The data subject shall have the right to obtain from the data controller the restriction of the processing of the data where any of the following conditions are met:
- (a) the data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the data
- (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests, instead, the restriction of its use
- c) the controller no longer needs the personal data for the purposes of the processing, but the data subject needs it for the establishment, exercise or defence of legal claims
- d) the data subject has objected to the processing pursuant to Article 21(1), whilst it is being assessed whether the legitimate grounds of the controller override those of the data subject
Where the processing of personal data has been restricted pursuant to paragraph 1, such data may only be processed, with the exception of storage, with the data subject’s consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of substantial public interest of the Union or of a specific Member State.
Any data subject who has obtained the restriction of processing in accordance with paragraph 1 shall be informed by the controller before that restriction is lifted.
Right to object:
The data subject shall have the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them based on Article 6(1)(e) or (f), including profiling based on those provisions.
The controller shall cease processing the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
Where the processing of personal data is carried out for the purposes of direct marketing, the data subject shall have the right to object at any time to the processing of personal data concerning him or her, including profiling in so far as it is related to such direct marketing.
Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for those purposes.
Where personal data are processed for scientific or historical research purposes or statistical purposes in accordance with Article 89(1), the data subject shall have the right, on grounds relating to their particular situation, to object to the processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Right to data portability:
The data subject shall have the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance from the controller to whom the data were provided, where:
- (a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a), or on a contract pursuant to Article 6(1)(b), and
- (b) the processing is carried out by automated means.
When exercising their right to data portability in accordance with paragraph 1, the data subject shall have the right to have their personal data transmitted directly from one controller to another where technically feasible.
The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The controller shall notify any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves a disproportionate effort. The controller shall inform the data subject of such recipients, if the data subject so requests.
Withdrawal of consent: The data subject, having previously given consent to the processing of their personal data, may also withdraw that consent just as easily. The withdrawal of consent shall not render the processing carried out prior to such withdrawal unlawful.
The data subject shall have the right to lodge a complaint with the competent supervisory authority.
Where personal data is to be further processed for different purposes, the data controller shall inform the data subject of this fact.
Security measures: The Data Controller declares that it has adopted the necessary technical and organisational measures to ensure the security of the data and to prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data stored and the risks to which it is exposed, whether arising from human action or from the physical or natural environment.
The website www.inof.es contains links to other websites that may be of interest to the data subject. “OPHTOS” accepts no responsibility for these links and cannot guarantee compliance with appropriate privacy policies; therefore, the data subject accesses the content of the aforementioned websites subject to the terms of use set out on those sites and at their own sole risk.
If you have any queries, questions or recommendations regarding our Privacy Policy, please contact us by email at the following address: dpd@inof.es
OPHTOS INSTITUT, S.L.
All rights reserved