Privacy policy

Fundació Institut de Recerca Biomèdica de Lleida, Fundació Dr. Pifarré (IRBLleida), as the controller of personal data processing, guarantees an adequate level of protection for natural persons with regard to the processing of their personal data, in accordance with Regulation (EU) 2016/679, General Data Protection Regulation, and Organic Law 3/2018, of 5 December, on the protection of personal data and the guarantee of digital rights.

IRBLleida processes personal data in a lawful, fair, transparent and responsible manner, in accordance with the legal bases that legitimise each processing activity and with the purposes inherent to its institutional, scientific, healthcare, training, administrative and management activities.

In order to comply with data protection regulations, IRBLleida has a Record of Processing Activities and has adopted appropriate technical and organisational measures to ensure the security of personal data and to protect the rights and freedoms of data subjects.

Likewise, IRBLleida applies the principle of transparency in the processing of personal data and provides data subjects with the information required by data protection regulations in a concise, accessible manner and in clear and understandable language.

1. Data controller

The controller of the personal data processing is:

Fundació Institut de Recerca Biomèdica de Lleida, Fundació Dr. Pifarré (IRBLleida)
Tax Identification Number: G25314394
Address: Avinguda Alcalde Rovira Roure, no. 80, 25198 Lleida
Telephone: 973 702 201
Email address: info@irblleida.cat

2. Data Protection Officer

IRBLleida has appointed a Data Protection Officer, who may be contacted for any matter related to the processing of personal data.

Data Protection Officer: Fundació TIC Salut Social
Email address: dpd@ticsalutsocial.cat
Contact telephone: 935 532 642

3. Purposes of processing

IRBLleida may process personal data for the following purposes, as applicable in each case:

• a) To manage enquiries, requests or communications received through the website or through other contact channels.
• b) To manage the relationship with users, participants, professionals, researchers, collaborators, suppliers, bidders, contractors, funding bodies, public administrations and other persons or entities related to IRBLleida's activity.
• c) To manage human resources, staff selection, internal and external training, employment relations, occupational risk prevention and other obligations linked to personnel management.
• d) To manage calls, selection processes, grants, aid, subsidies, projects, contracts, training activities, conferences, events and registrations.
• e) To develop and manage biomedical research activities, clinical trials, innovation, knowledge transfer, technical-scientific services, quality and scientific, institutional or business collaborations.
• f) To manage citizen participation activities, visits, educational workshops, dissemination activities and actions to promote scientific education.
• g) To manage committees, commissions, institutional relations and other bodies or participation spaces linked to IRBLleida's activity.
• h) To comply with legal, administrative, accounting, tax, employment, transparency, archiving, security, equality, institutional integrity, fraud prevention and other obligations applicable to IRBLleida.
• i) To manage the internal reporting system or whistleblowing channel, as well as any reports that may be submitted through it, in accordance with the applicable regulations.
• j) To ensure the security of persons, property and facilities through video surveillance systems, where applicable.
• k) To handle requests for access to public information and requests to exercise rights in relation to data protection.
• l) To send institutional or informative communications or communications related to IRBLleida's activities, where there is a legal basis that permits it.

The specific purposes of each processing activity are set out in IRBLleida's Record of Processing Activities and, where applicable, in the specific information clauses provided in each form, call, procedure or data collection channel.

4. Legal bases for processing

The processing of personal data of data subjects by IRBLleida is based, depending on the case, on one or more of the legal bases provided for in Regulation (EU) 2016/679, General Data Protection Regulation, and in Organic Law 3/2018, of 5 December, on the protection of personal data and the guarantee of digital rights.

The applicable legal bases are detailed for each processing activity in IRBLleida's Record of Processing Activities. In general terms, they may be the following:

Regulation (EU) 2016/679, General Data Protection Regulation

Article 6(1)(a) GDPR - Consent of the data subject
Processing is lawful where the data subject has given consent to the processing of his or her personal data for one or more specific purposes.

Article 6(1)(b) GDPR - Performance of a contract or application of pre-contractual measures
Processing is lawful where it is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.

Article 6(1)(c) GDPR - Compliance with a legal obligation
Processing is lawful where it is necessary for compliance with a legal obligation to which IRBLleida is subject.

Article 6(1)(e) GDPR - Task carried out in the public interest or exercise of official authority
Processing is lawful where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, provided that it derives from a function, competence or activity attributed by an applicable legal provision.

Article 6(1)(f) GDPR - Legitimate interest
Processing is lawful where it is necessary for the purposes of the legitimate interests pursued by IRBLleida or by a third party, except where such interests are overridden by the interests, rights or fundamental freedoms of the data subject that require the protection of personal data.

This legal basis will only apply where appropriate and where the prevalence of the rights and interests of the data subjects has been duly assessed.

Special categories of data

Where the processing concerns special categories of personal data, such as health data, trade union membership data or other specially protected data, IRBLleida will apply one of the exceptions provided for in Article 9(2) of the GDPR, as applicable in each case.

In particular, the processing may be based on:

Article 9(2)(a) GDPR - Explicit consent
The data subject has given explicit consent to the processing of such personal data for one or more specific purposes, except where European Union law or Member State law provides that the prohibition on processing may not be lifted by the data subject.

Article 9(2)(j) GDPR - Scientific research, statistical purposes or archiving in the public interest
Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, in accordance with Article 89(1) of the GDPR, on the basis of European Union law or Member State law, and provided that it is proportionate to the aim pursued, respects the essence of the right to data protection and establishes appropriate and specific measures to safeguard the rights and freedoms of data subjects.

Organic Law 3/2018, on the protection of personal data and the guarantee of digital rights

Article 8 LOPDGDD - Processing of data on the basis of a legal obligation, public interest or exercise of official authority
The processing of personal data may only be considered to be based on compliance with a legal obligation imposed on the controller, under the terms provided for in Article 6(1)(c) of the GDPR, where this is provided for by European Union law or by a legal provision with the force of law.

Likewise, the processing of personal data may only be considered to be based on the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, under the terms provided for in Article 6(1)(e) of the GDPR, where it derives from a competence or function attributed by a legal provision with the force of law.

The specific legal basis applicable to each processing activity is set out in IRBLleida's Record of Processing Activities and, where applicable, in the specific information provided at the time the personal data are collected.

5. Data retention period

Personal data will be retained for the time necessary to fulfil the purposes for which they were collected and to determine any possible liabilities that may arise from those purposes.

The specific retention periods may vary depending on the processing activity and are set out in IRBLleida's Record of Processing Activities. In particular, certain processing activities, such as video surveillance, the whistleblowing channel or the handling of the exercise of data protection rights, may be subject to specific retention or deletion periods.

When the data are no longer necessary, they will be deleted or, where applicable, blocked for the legally required periods.

6. Recipients of the data

Personal data may be disclosed to third parties where there is a legal basis that permits it or a legal obligation that requires it.

In particular, where applicable, data may be disclosed to public administrations, supervisory bodies, funding bodies, auditors, judicial authorities, law enforcement authorities, collaborating entities, service providers or other recipients necessary for the development of the purposes of processing.

The specific identification of the recipients or categories of recipients is set out in the Record of Processing Activities and, where applicable, in the specific information clauses for each processing activity.

7. International data transfers

As a general rule, no international data transfers are envisaged.

If, in any specific processing activity, it becomes necessary to carry out international data transfers, IRBLleida will inform the data subjects and adopt the appropriate safeguards in accordance with the applicable regulations.

8. Automated decision-making and profiling

As a general rule, IRBLleida does not carry out decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them.

Nor does it create browsing profiles or automated profiles with such consequences, unless expressly stated otherwise in a specific processing activity.

9. Source of the data

The personal data processed by IRBLleida generally come from the data subjects themselves or from their representatives.

In certain cases, the data may also come from other entities, public administrations, funding bodies, collaborating institutions or legitimate sources, where there is a legal basis that permits it.

Where personal data have not been obtained directly from the data subject, IRBLleida will provide the additional information required by Article 14 of the GDPR, including information on the source of the data and the categories of personal data processed, unless any of the exceptions provided for by the regulations apply.

10. Rights of data subjects

Data subjects may exercise the following rights in relation to their personal data:

a) Right of access: this allows data subjects to obtain confirmation as to whether IRBLleida is processing their personal data and to access such data.

b) Right to rectification: this allows data subjects to request the correction of inaccurate or incomplete data.

c) Right to erasure: this allows data subjects to request the deletion of data where, among other reasons, they are no longer necessary for the purposes for which they were collected.

d) Right to object: this allows data subjects to object to the processing of their data in certain circumstances related to their particular situation.

e) Right to restriction of processing: this allows data subjects to request that the processing of their data be restricted in the cases provided for by the regulations.

f) Right to data portability: this allows data subjects to receive their personal data in a structured, commonly used and machine-readable format, and to transmit them to another controller, where the processing is based on consent or on a contract and is carried out by automated means.

g) Right to withdraw consent: where processing is based on consent, the data subject may withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal.

11. How to exercise rights

To exercise their rights, data subjects may contact IRBLleida by sending an email to: protecciodedades@irblleida.cat

The request must indicate which right is being exercised and must allow the applicant to be properly identified.

Data subjects may also contact the Data Protection Officer at: dpd@ticsalutsocial.cat

12. Complaint to the supervisory authority

If the data subject considers that the processing of their personal data does not comply with the applicable regulations, or if they are not satisfied with the response received when exercising their rights, they may lodge a complaint with the Catalan Data Protection Authority.

13. Record of Processing Activities

Detailed information on the processing activities carried out by IRBLleida is set out in the Record of Processing Activities, which supplements the general information contained in this Privacy Policy.

Likewise, in each procedure, form, call or data collection channel, IRBLleida may provide specific information on the particular processing activity that applies.