In accordance with current and applicable data protection regulations, you are hereby informed that your personal data will be incorporated into the data processing system owned by the Fundació Privada Institut d’Investigació Oncològica de Vall d’Hebron, hereinafter VHIO, with tax identification number G-64384969 and registered office at Centro CELLEX, C/Natzaret, 115–117, 08035 Barcelona.

At VHIO, we are deeply committed to guaranteeing the fundamental right to the protection of personal data of our users and individuals interested in our scientific and research work, ensuring compliance with applicable personal data protection legislation. VHIO also undertakes to maintain confidentiality with respect to any data to which it may have access, and to adopt the necessary security measures to prevent unauthorised access to, alteration of, or deletion of data.

Information on how personal data is processed through the VHIO websites is provided below:

Website management

Purpose: registration and management of the data needed for website functionality, as well as for cookie management and installation.

Legal basis: data subject’s consent.

Retention period: for as long as the data subject’s consent is provided.

Type of data: identification and browsing data only.

Contact form

Purpose: registering and handling contact requests.

Legal basis: data subject’s consent.

Retention period: for as long as the data subject’s consent is provided.

Type of data: name and email address.

Sending marketing communications

Purpose: sending marketing communications on activities organised by VHIO that may be of interest to users.

Legal basis: data subject’s consent.

Retention period: for as long as the data subject’s consent is provided.

Type of data: name and email address.

Login – Intranet

Purpose: management of user registration, authentication and access to the corporate intranet.

Legal basis: performance of a contractual relationship and, where applicable, compliance with legal obligations. 

Retention period: while the user maintains an active employment relationship with VHIO and for the legally established periods after its termination.

Type of data: email address and user name.

Access to Moodle

Purpose: management of registration, authentication and access to the online training platform.

Legal basis: performance of a contractual relationship and, where applicable, compliance with legal obligations. 

Retention period: while the user’s account is active and for the periods required to manage the training activity.

Type of data: user name.

Job offers

Purpose: collection, registration and processing of candidates’ data for recruitment purposes and the management, analysis and storage of candidates’ CVs.

Legal basis: when submitting an application for a specific VHIO recruitment process, the candidate’s data will be processed on the basis of their consent and for applying pre-contractual measures.

Retention period: for the time required for recruitment processes and, where applicable, up to 1 year, as long as the candidate’s CV is not part of an active recruitment process or has not been updated during that period.

Type of data: first name, surname(s), email address, telephone numbers, professional and academic data.

Training programmes

Purpose: answering requests for information on our training programmes.

Legal basis: data subject’s consent.                             

Retention period: for as long as consent is provided.

Type of data: email address

Event and seminar management

Purpose: registration and processing personal data to manage enrolments for events organised by VHIO.

Legal basis: data subject’s consent.                             

Retention period: for as long as consent is provided.

Type of data: first name, surname(s), email address, image and/or voice.

Course and workshop management

Purpose: registration and processing of personal data to manage enrolment for courses and workshops organised by VHIO.

Legal basis: data subject’s consent.                             

Retention period: for as long as consent is provided.

Type of data: first name, surname(s) and email address.

Internal information system and whistle-blower protection

Purpose: management of the procedure set out in article 9 of Law 2/2023, on the protection of whistle-blowers and the fight against corruption.

Legal basis: processing is required to comply with a legal obligation applicable to the data controller.

Retention period: personal data will be kept for as long as necessary for the purpose for which it is collected and to determine any possible responsibilities that may stem from that purpose and from the processing of the personal data.

Type of data: first name, surname(s), telephone number and email address.

Donation form

Purpose: collection of data via the donation and contribution management form.

Legal basis: data subject’s consent.

Retention period: as long as required to fulfil the stated purpose, except for legal obligations regarding retention.

Type of data: first name and surname(s), national identity document (DNI) number, postal address, telephone number, email address and bank details.

Additional information: Consult our Donations Policy.

You may also contact the data protection officer by writing to the email address dpd.cliente@conversia.es or phoning 872 987 665.

Rights of the data subjects

VHIO informs users that they may exercise their rights of access, rectification, restriction, erasure, data portability, objection to the processing of their personal data, and the right not to be subject to automated decision-making, including profiling, by contacting the data controller, and may also withdraw the consent given.

• Right to access: the user’s right to obtain confirmation as to whether their data is being processed, the specific personal data being processed, where applicable, and the legal information regarding the processing (purposes, legal basis, retention periods, transfers, data source, etc.).
• Right to rectification: the right of the data subject to have inaccurate or incomplete data corrected. In relation to the website, this right may only be exercised with regard to information under the control of the website, for example, by deleting comments posted on the website, images or website content containing the user’s personal data.
• Right to restriction of processing: the right to restrict the purposes of processing originally intended by the data controller.
• Right to erasure: the right of the user to have their personal data deleted, subject to the exceptions provided for in the GDPR itself (freedom of expression and information, legal obligations to retain data, the establishment, exercise or defence of legal claims, etc.).
• Right to data portability: the right of the user to receive the personal data they have provided in a structured, commonly used and machine-readable format, and to transmit those data to another controller when processing is based on consent or on a contract and is carried out by automated means.
• Right to objection: the right of the user not to have their personal data processed or require the processing to cease when it is based on legitimate interest or public interest or when it concerns direct marketing.
• Right not to be subject to automated decision-making, including profiling: when processing is not necessary for entering into or the performance of a contract, is not authorised by European Union or Member State law, and is not based on consent, the user has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or affects them in a similarly significant way.
• Right to withdraw consent: for any consent-based processing, the user has the right to withdraw their consent freely and at any time.

All the above data protection rights may be exercised in the following ways:

• by written request to the address Centro CELLEX, C/Natzaret, 115–117, 08035 Barcelona (for the attention of VHIO), or by email to info@vhio.net.
• The written request submitted by the data subject must take into account the following:
  • The data subject must reliably identify themselves. Where there is any doubt regarding the applicant’s identity, they will be asked to amend the request (e.g. by providing more information, such as the national identity document (DNI) number, the DNI document, the email address provided, etc.)
  • The request may be submitted by a legal or voluntary representative, provided they are properly identified and authorised by the data subject (through the data subject’s express authorisation to exercise the personal rights regulated by personal data protection laws).
  • The specific nature of the request (the right being exercised). If no specific processing is indicated, the response will include all processing involving the applicant’s personal data. If information is requested on specific processing, only information on this processing will be provided. If the request is made by phone, the applicant will be asked to submit the request in writing, informed of how to do so and given the relevant postal address. No information will be provided over the phone.
  • Postal or email address for notifications.
  • Supporting documents for the request, when required.
  • The applicant must use any means that allows proof of both sending and receipt of the request.

Finally, the user has the right to lodge a complaint with the Spanish Data Protection Agency if they become aware that, or consider that, an action may constitute a breach of applicable data protection regulations.

VHIO undertakes to adopt the necessary technical and organisational measures, appropriate to the risk level associated with the processing activities carried out, as set out in the terms and conditions of use, so at to guarantee their integrity, confidentiality and availability.

Last updated: May 2026.