FUNDACIÓ INSTITUT D’INVESTIGACIÓ SANITÀRIA ILLES BALEARS (hereinafter IDISBA) reserves the right to modify or adapt this Privacy Policy at any time. Therefore, we recommend that you review it every time you access the Website. In the event that the user has registered on the website and accesses their account or profile, they will be informed if there have been any significant changes regarding the processing of their personal data.

Who is responsible for processing your data?
The data that is collected or provided voluntarily by you through the Website, either by navigating the site, as well as any information you provide through contact forms, email, or phone, will be collected and processed by the Data Controller, whose details are provided below:

Fundació Institut d’Investigació Sanitària Illes Balears (IdISBa). CIF: G-57326324
Address: Crta. Valldemossa, 79 (Hospital Universitari Son Espases), Building S, 1st floor. 07010 Palma de Mallorca
Phone number: 871 20 52 34
Data Protection Officer: idisba.protecciondatos@ssib.es
Registration details (Registry Number of Foundations of the Balearic Islands): 100000000220

If, for any reason, you wish to contact us regarding any issue related to the processing of your personal data or privacy (with our Data Protection Officer), you can do so through any of the methods provided above.

What data do we collect through the website?

IDISBA does not store data simply by browsing the website; however, the website provides the utility of Google Maps, which may access your location if you allow it, to provide more specific information about the distance and/or routes to our offices. In this regard, we refer to the Privacy Policy used by Google Maps to understand the usage and processing of such data: http://www.google.com/intl/en/policies/privacy/

User registration on the website
The website does not store user data.

CONTACTS FROM THE WEBSITE OR EMAIL

For what purposes will we process your personal data?

• To respond to your inquiries, requests, or petitions.
• To manage the requested service, respond to your request, or process your petition.
• Information through electronic means regarding your request.
• Commercial or event information through electronic means, provided that express authorization has been given.

What is the legal basis for the processing of your data?
The acceptance and consent of the interested party: In cases where it is necessary to complete a form to make a request and click the submit button, doing so will necessarily imply that the individual has been informed and has expressly given their consent to the content of the clause attached to the form or acceptance of the privacy policy.

All our forms include a checkbox with the following statement to submit the information: “□ I have read and accept the Privacy Policy.”

Do we include personal data of third parties?
No, as a general rule, we only process the data provided by the data subjects. If you provide us with data about third parties, you must, beforehand, inform and obtain their consent. Otherwise, you relieve us from any responsibility for non-compliance with this requirement.

And data concerning minors?
We do not process data of minors under the age of 14; therefore, refrain from providing such data if you are not of that age.

Will we communicate through electronic means?
They will only be made to manage your request if it is one of the contact methods you have provided to us. If we send commercial communications, they will have been previously and expressly authorized by you.

What security measures do we apply?
You can rest assured: We have adopted an optimal level of protection for the Personal Data we handle and have implemented all the technical means and measures available to us, according to the state of the art, to prevent the loss, misuse, alteration, unauthorized access, and theft of Personal Data.

To what extent will decision-making be automated?
IDISBA does not use fully automated decision-making processes to establish, develop, or terminate a contractual relationship with the user. If we use such processes in a particular case, we will keep you informed and communicate your rights in this regard as required by law.

Will profiling take place?
In order to offer you products and/or services according to your interests and improve your user experience, we may create a “commercial profile” based on the information provided. However, no automated decisions will be made based on this profile.

To whom will your data be disclosed?
To the participating entities necessary to achieve the purposes of IDISBA. Your data will not be shared with other entities unless legally required. Specifically, it will be disclosed to the State Tax Administration Agency and banks or financial institutions for the collection of the service provided or product purchased, as well as to data processors required for the execution of the agreement. If you have given us your consent to process your name, images, and other information related to IDISBA’s activity, it will be published on IDISBA’s various social media platforms and website.

International Transfers.
If IDISBA needs to carry out international data transfers, it will ensure that such transfers comply with the General Data Protection Regulation or any other requirements established by applicable regulations. To this end, the organization will enter into agreements as necessary to guarantee a level of data protection equivalent to that established under European regulations. If shared folder systems are used in applications such as Dropbox, Google Drive, Microsoft OneDrive, Amazon, Apple, HubSpot, etc., an international transfer to the United States will be made under the authorization of Article 49(c) of the General Data Protection Regulation or any other mechanism that ensures a level of data protection equivalent to that provided by European regulations.

What Rights Do You Have?

• To know whether we are processing your data or not.
• To access your personal data.
• To request the rectification of your data if it is inaccurate.
• To request the deletion of your data if it is no longer necessary for the purposes for which it was collected or if you withdraw the consent you had given us.
• To request the limitation of the processing of your data in certain circumstances, in which case we will only retain it in accordance with current regulations.
• To request the portability of your data, which will be provided to you in a structured, commonly used, and machine-readable format. If you prefer, we can send it to the new data controller you designate. This is only valid in certain circumstances.
• To file a complaint with the Spanish Data Protection Agency if you believe we have not handled your request correctly.
• To withdraw consent for any processing to which you have consented, at any time.

If you modify any data, we kindly ask that you inform us so we can keep it updated.

Would you like a form to exercise your rights?
We have forms available for the exercise of your rights. You can request them by email, or if you prefer, you can use those provided by the Spanish Data Protection Agency or third parties. These forms must be signed electronically or accompanied by a copy of your ID. If someone represents you, they must provide a copy of their ID or sign the form with their electronic signature. The forms can be submitted in person, sent by mail, or by email to the address of the Responsible party at the beginning of this text. You have the right to file a complaint with the Spanish Data Protection Agency if you believe your request for rights has not been properly addressed. The maximum period for IDISBA to resolve this is one month from the effective receipt of your request. You have the right to withdraw your consent for any treatment at any time.

Does this website use cookies?
No, this website does not use cookies.

How long will we keep your personal data?
Personal data will be kept as long as you are linked to us. Once you disengage, the personal data processed for each purpose will be retained for the legally required periods, including the time during which a judge or court may request them, according to the statute of limitations for legal actions. The data will be kept until the expiration of the aforementioned legal periods, if there is a legal obligation to retain them, or, if there is no such legal period, until the interested party requests their deletion or revokes the consent granted. We will keep all information and communications related to your purchase or the provision of our service for the duration of product or service guarantees, to address possible claims.