PRIVACY POLICY

VETNOVA SALUD SL must ensure that the data subject’s personal data collected on the website is processed according to the following processing principles:

  • Processed lawfully, fairly, and transparently with respect to the data subject (“lawfulness, fairness, and transparency”).
  • Collected for specific, explicit, and legitimate purposes and may not be processed in a manner incompatible with those purposes (“purpose limitation”).
  • Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”).
  • Accurate and, if necessary, updated, with reasonable technical and organizational measures adopted to ensure that they are deleted or rectified when they are inaccurate with respect to the purposes for which they are processed (“accuracy”).
  • Maintained in a manner that permits identification for no longer than necessary for the purposes of the processing (“retention period limitation”).
  • Processed in such a way as to ensure adequate security through the application of appropriate technical or organizational measures (“integrity and confidentiality”).
  • Thus, VETNOVA SALUD SL will be responsible for compliance with the above provisions and must be able to subsequently prove this (“proactive accountability”).

Similarly, the processing carried out by the entity will only be lawful if it meets at least one of the following conditions (“lawfulness of processing”):

  • The data subject has given their consent to the processing of their personal data for one or more specific purposes;
  • The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation, at the request of the data subject, of pre-contractual measures;
  • The processing is necessary for compliance with a legal obligation applicable to the data controller;
  • The processing is necessary to protect the vital interests of the data subject or of another natural person;
  • The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This legitimate basis shall not apply to processing carried out by public authorities in the exercise of their duties. Where processing is based on the data subject’s consent, the controller must be able to demonstrate that the data subject has consented to the processing of his or her personal data.

If the data subject’s consent is given in the context of a written declaration that also concerns other matters, the request for consent shall be presented in a form that is clearly distinguishable from other matters, in an intelligible and easily accessible manner, and using clear and plain language.

The data subject shall have the right to withdraw their consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal. Before giving consent, the data subject shall be informed thereof. Withdrawing consent shall be as easy as giving it.

VETNOVA SALUD SL must include in the forms used to collect personal data the information required to comply with the obligation to provide information contained in Articles 13 and 14 of the General Data Protection Regulation (hereinafter GDPR).

In this regard, and in order to comply with the applicable and current data protection regulations, when VETNOVA SALUD SL obtains personal data directly from a data subject, it must:

  1. Provide the identity and contact information of the Data Controller and, where applicable, their representative, the contact information of the Data Protection Officer, where applicable, and the purposes for which the personal data are processed, as well as the legal basis for the processing.
  2. Specify the legitimate interests of the controller or a third party when processing is necessary for the purposes of those interests, provided that the interests or fundamental rights and freedoms of the data subject do not prevail.
  3. Provide the recipients or categories of recipients of the personal data and, where applicable, the controller’s intention to transfer personal data to a third country or international organization, and the existence or absence of an adequacy decision by the Commission.
  4. Indicate the period for which the personal data will be retained or the criteria used to determine the retention period.
    Inform the controller of the right to request access to the personal data relating to the data.
  5. Inform the data subject of the existence of the right to request from the Data Controller access to personal data relating to the data subject, its rectification or erasure (“right to be forgotten”), restriction of processing, or the right to object to processing, as well as data portability.
  6. Inform the data subject of the possibility of withdrawing consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal. Also, inform the data subject of the possibility of filing a complaint with a Supervisory Authority.
  7. Specify whether the provision of personal data is a legal or contractual requirement, or a necessary requirement to enter into a contract, and whether the data subject is obliged to provide the personal data, and inform the data subject of the possible consequences of not providing such data.
  8. Inform the data subject of the existence of automated decision-making, including profiling, and, at least in such cases, inform the data subject of the logic involved, as well as the significance and expected consequences of such processing for the data subject.

When VETNOVA SALUD SL does not obtain the personal data from the data subject, it must provide the data subject with the information described in the previous section. This information must also include the categories of personal data being processed, their source, and, where applicable, whether they are from publicly accessible sources.

VETNOVA SALUD SL must include in the forms or documents used to collect personal data, including those established on the website owned by VETNOVA SALUD SL, the information required to comply with the obligation to provide information contained in Articles 13 and 14 of the General Data Protection Regulation (hereinafter GDPR), and, where necessary, record the consent granted by the data subject.

To accommodate the increased demand for information that must be provided to the data subject whose personal data is to be processed, the possibility of presenting the information using a layered or leveled information model is established. This must be consistent with the information being provided in clear, simple language and in a concise, transparent, intelligible, and easily accessible manner.

Article 11 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), regulates the basic information required in a first layer. Layered information consists of:

  • Presentation of Basic Information (1st layer): This consists of presenting basic information in a first level, in a summarized form, at the same time and in the same medium in which the data is collected.
  • Reference to Additional Information (2nd layer): This consists of presenting the information in detail and completely, in an appropriate, structured, concise, and precise medium. The way this additional information is presented depends on the characteristics of the medium used to provide the information; it can be presented in paper or electronic format.