Privacy policy and data protection

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE) and other applicable regulations, the user is informed in a clear and transparent manner about the processing of their personal data.

1. Identification of the data controller

Controller: Gold Standard Diagnostics Madrid PTS SL
Address: Calle Caridad, 32 – 28007 Madrid (Spain)
Email: ptgsc@gscsal.com

The controller guarantees that data processing is carried out in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality.

2. Processing purposes and legal bases

2.1 Website navigation

When the user accesses the website, certain technical data are automatically collected such as: IP address, date and time of access, browser type and version, operating system, pages visited, HTTP status code and internet service provider.

Purpose: to ensure network security, prevent unauthorized access, detect possible security incidents, maintain service availability and improve browsing experience.

Legal basis: Art. 6.1.f) GDPR (legitimate interest of the controller). The corresponding balancing has been carried out between the legitimate interest and the rights of the user.

2.2 Contractual management and service provision

Identifying, contact and billing data necessary for the management of customers, suppliers and collaborators are processed.

Purposes: administrative management, invoicing, compliance with tax obligations, payment and collection management, incident management, customer service and contractual compliance.

Legal bases: Art. 6.1.b) GDPR (performance of contract) and Art. 6.1.c) GDPR (compliance with legal obligations).

2.3 Contact form

Data provided voluntarily through the contact form will be used exclusively to respond to queries, requests for information or communications made by the user.

Legal basis: Art. 6.1.a) GDPR (consent of the data subject).

2.4 Sending commercial communications (Newsletter)

In case of subscription, the necessary data will be processed for sending commercial communications related to the services offered. A double verification system (double opt-in) is used to guarantee the authenticity of consent.

Legal basis: Art. 6.1.a) GDPR (consent). The user may withdraw consent at any time.

2.5 Selection processes

In case of submitting an application, the data will be processed for the purpose of managing personnel selection processes. Data will be kept for a maximum of 1 year, unless consent is given for longer retention.

Legal basis: Art. 6.1.b) GDPR.

3. Data retention

Personal data will be kept for the time strictly necessary to fulfill the purpose for which they were collected and during the legally established periods in tax, commercial or contractual liability matters. Once these periods have expired, the data will be blocked and subsequently deleted.

4. Recipients and data processors

Data will not be transferred to third parties except for legal obligation or when necessary for the provision of the service. Certain technology providers may have access to the data as data processors, with contracts in accordance with Art. 28 GDPR.

5. International data transfers

The use of certain technological services may involve international data transfers to the United States. Such transfers are made under appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission and adherence to the EU-US Data Privacy Framework where applicable.

6. Rights of the data subject

The data subject may exercise the rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent, by sending a request to the controller's email address.

Likewise, they may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Security measures

The controller applies appropriate technical and organizational measures to guarantee the confidentiality, integrity and availability of personal data. The website uses SSL protocol with secure encryption.