Introduction

At I+MED, S.COOP., we are committed to protecting privacy and ensuring the proper use of the personal data we process and that you provide to us, both online through this website and, where applicable, any of its subdomains and microsites, and offline.

Please read this policy carefully and make sure that you understand and agree with it before providing us with your personal data. If you do not agree with it, please do not use this website or its services and do not provide us with your data.

By accessing this website, using any of its services or providing us with your data, whether online or offline, we will understand this as a clear affirmative action by which you give us your consent, where such consent is required, to process your data for the purposes described below.

Who is responsible for processing your data?

I+MED, S.COOP.

Postal address: C/Albert Einstein, 15 Nave 15 01510 Miñano Mayor (Álava / Araba)

Email: imasmed@imasmed.com

Telephone: 945 56 11 34

How have we obtained your data?

1. Obtained directly from the data subject.
2. If you are a customer, whether current or prospective, or a user of our website, you have provided the data yourself, either offline or online, when requesting our products or services or contacting us to request information. You may also have provided it to us in person if you have visited our facilities.
3. By providing us with your data, you guarantee that you are authorised to do so, that the information is accurate and up to date, and that it does not infringe any contractual restriction or third-party rights. You are responsible for keeping your data and profile accurate and up to date, and I+MED, S.COOP. accepts no liability if you fail to do so. You undertake not to impersonate other users by using their registration details to access the different services and/or content of the Website.
4. Automatically obtained when you visit our website:
5. When you visit our website or any of our other platforms, such as social networks or mobile applications, we collect information through cookies and other tracking and web analytics technologies. This means that data is sent from your browser to our servers in order to optimise our services and improve your user experience. Such data may be collected and stored automatically by us or by third parties acting on our behalf. You can consult our Cookie Policy.
6. Location services: we use location services to help you find the nearest I+MED, S.COOP. location through mobile applications such as Google Maps and Bing Maps. To facilitate this process, we load an image into the application and store the map image and route data on our server. If you use these mobile applications, they may receive information about your actual location, such as GPS signals sent by a mobile device, or information that can be used to approximate your location. You can generally enable or disable location services in your device or browser settings. For more information about Google Maps and Bing Maps, please consult their respective privacy policies.
7. Data relating to the data subject communicated by a third party.
8. Your data may not have been provided directly by you, but rather by a third party we work with to whom you previously provided such data. For example:
9. Publicly owned registers, such as the Civil Registry, Commercial Registry, Property Registry and other public administration registers.
10. Our sales or distributor network, where you have previously provided your data to one of our sales representatives.
11. Public or private referring entities with which we enter into collaboration agreements.
12. Companies directly related to I+MED, S.COOP.
13. In addition, by accepting this Privacy Policy and, where applicable, by providing your express consent, you authorise I+MED, S.COOP. to request from third parties any data required for the fulfilment of the relevant service or provision.

Communication of third-party data

With regard to the data of other persons, you must respect their privacy and take particular care when communicating or publishing their personal data. Only the data subject may authorise the processing of their personal data. Publishing third-party data without their consent may infringe not only data protection legislation but also their rights to honour, privacy and personal image.

If you provide us with third-party data, it is your responsibility to obtain their prior and express consent to use such data, and you are responsible for informing them about the processing we will carry out. By accepting this Privacy Policy, you expressly guarantee that you have authorisation to provide such data and release us from any liability in the event of a claim by the data subject.

What types of data do we process?

The categories of data we may process include:

1. Data obtained directly from the data subject: identification data, such as first name, surname and tax identification number; contact details, such as telephone number, postal address, email address, billing or delivery address; commercial and financial information, such as information about products requested, customer history and payment information including bank details and credit card details; and online profile data, such as information, preferences and interests.
2. Data obtained automatically when you visit our website: the user's IP address, the date and time of the visit, the URL of the website from which the user arrived, the pages visited on our website, and information about the browser used, including browser type and version, operating system, etc.
3. Data communicated by a third party: identification data; personal characteristics; social, academic and professional circumstances; economic, financial and insurance data; data relating to transactions involving goods and services; and employment details.
4. Special-category data: we may process special categories of personal data if you report adverse effects relating to a product through the form provided for this purpose.

What do we process your data for?

The data you provide to us, as well as any data generated during the relationship we maintain with you, may be processed for different purposes:

1. If you are a current or prospective customer: to maintain contact and communication with you and to manage the contractual and/or commercial relationship.
2. If you are a user of our website, or the sender or recipient of an email: to manage requests submitted online and to contact you.
3. If you access our facilities as a visitor: to manage access and visitor control.
4. If you provide us with your CV: to contact you and manage any recruitment processes we carry out. In this case, you must accept the Privacy Policy by ticking the field provided for this purpose. If you do not give your consent, we will not be able to consider your CV.
5. To send you, by electronic means, information about our activities, products and/or services similar to those requested, including advertising and/or commercial communications for the purposes of Article 21 of Spanish Law 34/2002 on Information Society Services and Electronic Commerce. If we already have a prior contractual relationship with you, these communications will be sent on the basis of our legitimate interest. If there is no prior contractual relationship, we will only send you this type of communication if you authorise us by selecting the option expressly included for this purpose in the relevant forms. Any electronic communications we send will include an option allowing you to unsubscribe. If you choose to do so, we will stop sending you such communications.
6. To disclose your data to other companies or entities directly related to I+MED, S.COOP., in order to provide the service or product you have requested and to carry out the administrative and accounting management required for that provision. In particular, we may disclose your data to the recipients listed in the relevant section further below in this policy.

How long will we retain your data?

We will retain the personal data you provide to us for as long as the contractual, pre-contractual or commercial relationship remains in force and, once it has ended, for as long as the data subject does not request its deletion. Even after deletion has been requested, we may retain the data for as long as necessary, limiting its processing solely to:

1. Compliance with any legal and/or contractual obligations to which we are subject,
2. and/or for the statutory limitation periods applicable to any liability on our part,
3. and/or for the establishment, exercise or defence of claims arising from the relationship maintained with the data subject.

In accordance with the above criteria, the deletion of personal data, whether from digital records or paper files, may be carried out at the organisation's discretion depending on logistical and/or storage-space requirements that make it advisable to delete information or documentation.

What is the legal basis for processing your data?

The legal basis that allows us to process your data may vary:

1. Performance of the legal relationship, whether contractual or commercial, where you are already a customer, supplier or participant in our activities. If you are a prospective customer or supplier, the legal basis is the pre-contractual relationship between us. Providing the requested data is mandatory because it is necessary to enter into and/or maintain the contractual or pre-contractual relationship and to comply with the legal obligations arising from it. If you do not provide such data, we will not be able to provide the service deriving from that relationship.
2. Consent: your consent may also constitute the legal basis where you have submitted a request or enquiry yourself or have granted consent for a specific purpose, for example if you have accessed our website, sent us your CV or consented to receive commercial communications.
3. You provide such consent unequivocally when you provide us with your data online or offline, as the provision of such data constitutes a clear affirmative action demonstrating your consent.
4. Providing the requested data is mandatory because it is necessary to deal with your request. If you do not provide it, we will not be able to fulfil your request.
5. You may withdraw your consent at any time by sending us an email to imasmed@imasmed.com. Such withdrawal will not affect the processing of your data for the other purposes described, although it may mean that we are unable to respond to your request.
6. Compliance with applicable regulations or a legal obligation: such as obligations established under tax, social security, occupational risk prevention, consumer protection and anti-money laundering legislation, as well as the Spanish Criminal Code, including Article 31 bis concerning the establishment of whistleblowing channels, among others.
7. Our legitimate interest as an organisation also constitutes a legal basis for processing your data. In accordance with Recital 47 of the GDPR, we have an interest in informing you about our activities, products and/or services, including through electronic communications.
8. If we already have a prior contractual relationship with you, these communications will be sent on the basis of our legitimate interest. Otherwise, we will only send such communications if you give us your consent by selecting the option expressly provided for this purpose in the relevant forms.
9. In all cases, we consider the processing of your data described above to be proportionate and to have a minimal impact on your privacy. However, your interests, rights and freedoms will always prevail over our legitimate interest. Therefore, if you do not wish us to process your data for these purposes, please send us an email to imasmed@imasmed.com and we will cease doing so.

To which recipients may we disclose your data?

We inform you that the data you provide may be disclosed to third-party entities for purposes directly related to the legitimate functions of the disclosing and receiving parties, including:

1. Banking institutions: for the management of collections and payments.
2. Our employment, accounting and tax advisers: for the management of our accounting and invoicing, personnel administration and the organisation's other legal obligations.
3. Our legal advisers: for the provision of legal advice and consultancy services.
4. Entities or public bodies to which we are legally required to disclose data: for example, the Tax Authority.
5. Insurance companies: for the management and insurance of commercial risks.
6. Transport companies: responsible for the logistics, shipment and delivery of our services and products.
7. Any company directly related to I+MED, where necessary for the performance of the contractual or commercial relationship, such as Unikare Bioscience S.L.

International Data Transfers

At I+MED, S.COOP., we may use service providers located outside the European Union that may have access to personal data in order to provide services ancillary to our activities, such as hosting, housing, SaaS, remote backups, IT support or maintenance services, email management, email delivery and email marketing, file transfer services, etc.

In all cases, the legal basis for such transfers will be one of those provided for under applicable legislation, either because the transfer is necessary for the performance of the contractual relationship or through the use of Standard Contractual Clauses. In any event, by accepting this Data Protection Policy, you expressly and unequivocally authorise the communication of data to such companies, acknowledging that this may involve an international transfer of data to a country outside the European Economic Area and giving your unequivocal consent to such transfer.

What rights do you have when you provide us with your data?

Where applicable, you may exercise your rights of access, rectification, erasure, restriction of processing and objection to processing, as well as any other applicable rights, using the postal or email address indicated at the beginning of this Privacy Policy. In both cases, the request must be made in writing and signed, accompanied by a copy of your national identity document, passport or other valid identification document. If your data changes, you must notify us using the same address. This entity accepts no liability if you fail to do so.

1. Right of access: You may ask us what personal data we are processing and request a copy of it.
2. Right to rectification: You may ask us to correct inaccurate personal data or complete incomplete data, including by providing an additional statement.
3. Right to erasure, or right to be forgotten: You may ask us to delete your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw your consent, where it has been processed unlawfully, or where deletion is required in order to comply with a legal obligation.
4. Right to restriction of processing: You may ask us to restrict the processing of your data, in which case we will retain it only for the establishment, exercise or defence of legal claims.
5. Right to object: You may object to the processing of your data where such processing is based on the legitimate interest of the data controller or is carried out for advertising purposes.

Once we receive any of the above requests, we will respond within the legally established time limits. You may lodge a complaint with the Spanish Data Protection Agency. If you would like further information about the rights you may exercise or wish to obtain template forms for exercising those rights, you may visit the website of the Spanish Data Protection Agency, www.aepd.es.