The VALL D’HEBRON INSTITUTE OF ONCOLOGICAL RESEARCH PRIVATE FOUNDATION (hereinafter, VHIO) is fully aware of the importance of the fundamental right to protect your data. Accordingly, it complies with the current regulations on personal data protection.

Therefore, for website registration, only the data strictly necessary for providing the service or managing the relevant activity will be required in compliance with current regulations on personal data protection.

Additionally, we recommend that you review the privacy policies of any website accessed through the www.vhio.net website, as these websites are outside VHIO’s control and will have different privacy policies. VHIO is not responsible for these websites or their published information and content.

By accepting this privacy policy, you declare that all the data you provide in the forms is accurate and up to date. If you wish to modify any personal data, you must contact VHIO or make the changes in the relevant section of the website. In any case, you will be solely responsible for any false or inaccurate statements or information you provide to VHIO and for any damage or harm this may cause the organisation.

VHIO also reiterates its commitment to carefully comply with all provisions of the current regulations on personal data protection. Specifically, VHIO undertakes to observe the duty of confidentiality with regard to the data it accesses and to adopt the necessary security measures to prevent unauthorised access, modification or erasure of data.

Who is the data controller?

VHIO is the data controller of your data. Its registered office is C/ NATZARET 115-117 (08035) BARCELONA, and its CIF [Tax ID No.] is G64384969.

Furthermore, we inform you that you can contact VHIO’s Data Protection Officer by writing to dpd.cliente@conversia.es or calling 872 987 665.

What data do we hold about you, and how have we obtained it?

The categories of personal data that VHIO may obtain about you and process are as follows:

• Identification data
• Contact details
• Postal or email addresses
• Financial and transaction data
• Professional data
• Academic data
• Commercial information
• Personal circumstances
• Special categories of data (genetic, health and biometric data)
• Data relating to vulnerable individuals (data on minors)
• Image and voice recordings during job interviews
• Content of communications (e.g. emails exchanged with VHIO during recruitment processes).

The aforementioned personal data has been obtained directly from you or, in some instances, through third parties, always in compliance with a specific lawful basis, such as your informed consent, a pre-contractual or contractual relationship, or a duly justified legitimate interest.

If you are a candidate for a VHIO job offer, we may have obtained your data through the submission of your Curriculum Vitae, cover letter, recommendation letters, etc., or VHIO employees or collaborators (such as recruitment service providers) when they consider your profile may be of interest for current or future vacancies at VHIO, provided you have authorised the transfer of your data to VHIO. VHIO may also obtain your data from public sources, such as LinkedIn or the website of the company or institution where you are currently employed, or from referees you have provided as part of your application. Additionally, VHIO may collect your personal information by taking notes or making image and voice recordings during interviews with you and through assessments and tests carried out during the selection process.

How long will we retain your data?

Your data will be retained unless and until you request its erasure.

In any case, VHIO will retain your data for the reasonably necessary period, considering our need to address any issues or resolve problems, make improvements, initiate new research, and/or comply with the requirements of current legislation. This means we may retain your data for a reasonable period even after you have ceased participating in our activities or using this website. After this period, your data will be erased from all VHIO systems. If you are a candidate for VHIO job offers, your data will be retained for the period reasonably necessary to manage your application to VHIO job offers. This period may be extended if you have consented to VHIO retaining your personal data for future applications.

For what purposes and on what legal basis do we process your data?

At VHIO, we process the data provided by data subjects to manage various activities related to the foundation’s purpose, such as research, enquiries and other actions. In this way, we will use your data to carry out some of the following activities based on the respective legal basis:

We will not create profiles based on the information provided. Consequently, we will not make automated decisions about you based on a created profile.

To whom will your data be disclosed?

We inform you that your data may be disclosed to Public Administration bodies and competent authorities in cases where VHIO receives a legal request from the authorities above or in cases where, acting in good faith, we consider such action reasonably necessary to comply with a judicial process, respond to any claim or legal demand, or protect the rights of VHIO, its clients and the general public.

Your data may be disclosed to third parties within the scope of VHIO’s activities, including, but not limited to, internet service providers who assist us in managing our website or carrying out our foundational activities, IT support and maintenance companies, payroll and advisory firms providing labour, legal, tax and accounting services, partner organisations in scientific research projects, providers of scientific and technical services, and banking institutions. At all times, these third parties must maintain the same levels of security as VHIO regarding your data and, where necessary, will be subject to legal commitments to ensure your data is kept private and secure and used only in accordance with VHIO’s specific instructions.

Are international transfers of my data carried out?

We want to inform you that, as part of VHIO’s activities, we collaborate with third parties outside the European Economic Area (EEA), and your data may be subject to an international transfer. At VHIO, we ensure that the guarantees established under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC (“GDPR”), are applied at all times. Specifically, we ensure that international transfers of your data are only made to countries offering a level of protection equivalent to that established by the GDPR, as determined by an adequacy decision of the European Commission, or to third parties with whom the EU Standard Contractual Clauses in their most up-to-date version have been agreed.

What are your rights as a data subject or interested party?

Any individual has the right to obtain confirmation as to whether VHIO is processing personal data concerning them. Specifically, data subjects can request access to their personal data and receive it in a common and machine-readable format if the processing is carried out by electronic means (right to data portability).

Additionally, data subjects have the right to rectify inaccurate data or, where applicable, request its erasure when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

Furthermore, in certain circumstances, data subjects may request the restriction of the processing of their data. In other specific cases and for reasons related to their particular situation, data subjects may exercise their right to object to processing their data. VHIO will cease processing the data unless there are compelling legitimate grounds for the exercise or defence of potential claims or in cases where applicable regulations establish exceptions.

You are also informed that you can withdraw your consent at any time without affecting the lawfulness of processing based on that consent before its withdrawal.

Users are informed that they may exercise the aforementioned rights at any time by contacting us in writing using the contact details provided above regarding the Data Controller. You must verify your identity by providing your full name and national ID number.  In cases of reasonable doubt regarding your identity, we may request additional information or a partial copy of your identification document, showing only the necessary data to verify your identity. Similarly, you may email us at the following address: lopdvhio@vhio.net. You also have the right to file a complaint with the competent Supervisory Authority, in this case, the Catalan Data Protection Authority, if you become aware of or believe that an incident may constitute a breach of the current data protection regulations.