Privacy policy

The INSTITUTO DE INVESTIGACIÓN BIOMÉDICA DE LLEIDA, as the party responsible for the processing of personal data, guarantees an adequate and consistent level of protection for natural persons with regard to their personal data, which are processed for the development of its competences, in accordance with the requirements of the General Data Protection Regulation (2016/679) and Organic Law 3/2018, of 5 December, on data protection and guarantee of digital rights.

The INSTITUTO DE INVESTIGACIÓN BIOMÉDICA DE LLEIDA processes personal data in a fully responsible and loyal manner, and in accordance with the legal bases that allow the lawfulness of the processing, in compliance with the General Data Protection Regulation and Organic Law 3/2018, of 5 December, on data protection and guarantee of digital rights.

In order to comply with data protection legislation, the INSTITUTO DE INVESTIGACIÓN BIOMÉDICA DE LLEIDA has drawn up and published its Register of Processing Activities and has adopted the technical and organisational security measures appropriate to the risks assessed and objectively identified for the rights and freedoms of the persons concerned, to which the data processed and the processing carried out by the INSTITUTO DE INVESTIGACIÓN BIOMÉDICA DE LLEIDA could give rise. The INSTITUTO DE INVESTIGACIÓN BIOMÉDICA DE LLEIDA applies the principle of transparency in the processing of personal data, providing interested parties with the information on processing required by the RGPD and the LOPDGDD, in a concise, easily accessible, complete and easy to understand language; at the same time, it facilitates the exercise of rights by means of a contact e-mail address: protecciodedades@irblleida.cat.

Furthermore, the INSTITUTO DE INVESTIGACIÓN BIOMÉDICA DE LLEIDA has appointed a Data Protection Officer, in accordance with the provisions of article 37.1.a) of the General Data Protection Regulation (2016/679) and articles 34 and 36 of Organic Law 3/2018 on the protection of personal data and guarantee of digital rights. The contact email address of the Data Protection Officer is: dpd@ticsalutsocial.cat.

Further information is provided below on each processing activity under the responsibility of the BIOMEDICAL RESEARCH INSTITUTE OF LLEIDA, listed in the Register of Processing Activities, which completes the basic information provided in each data collection procedure.

1. Data Controller
INSTITUTO DE INVESTIGACIÓN BIOMÉDICA DE LLEIDA
CIF: G25314394;
Address: avda. alcalde rovira roble nº80 - 25198 - Lleida - Lleida
Telephone: 973702201
E-mail: info@irblleida.cat

2. Contact details of the Data Protection Delegate
DPD of the TIC Social Health Foundation
E-mail: dpd@ticsalutsocial.cat
Contact telephone: 935532642

3. Legal basis for processing
The processing of the personal data of the persons concerned, derived from the competences and functions of the BIOMEDICAL RESEARCH INSTITUTE OF LLEIDA is based, in general, on the following legal bases, which are detailed for each processing activity in the Register of Processing Activities.

General Data Protection Regulation 2016/679

  • Article 6.1.a. The data subject consented to the processing of his or her personal data for one or more specific purposes.
  • Article 6.1.b. The processing is necessary for the performance of a contract to which the data subject is party or for the implementation at his or her request of pre-contractual measures.
  • Article 6.1.c. Processing is necessary for compliance with a legal obligation applicable to the controller. Carrying out the activities of the administration.
  • Article 6.1.e. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  • Article 6.1.f. Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
  • Article 9(2)(a) the data subject gave his or her explicit consent to the processing of those personal data for one or more of the specified purposes, except where Union or Member State law provides that the prohibition referred to in paragraph 1 may not be lifted by the data subject.
  • Article 9(2)(j) the processing is necessary for archiving purposes in the public interest, including scientific or historical research or statistical purposes, in accordance with Article 89(1), on the basis of Union or Member State law, which must be proportionate to the aim pursued, respect in essence the right to data protection and provide for appropriate and specific measures to protect the interests and fundamental rights of the data subject.

Organic Law 3/2018 on the protection of personal data and guarantee of digital rights.

  • Article 8. Processing of data due to legal obligation, public interest or exercise of public powers. Carrying out the activities of the administration.
    • The processing of personal data may only be considered to be based on compliance with a legal obligation enforceable on the data controller, in the terms provided for in Article 6.1.c) of Regulation (EU) 2016/679, when so provided for by a rule of European Union law or a rule with the status of law.
    • The processing of personal data may only be considered to be based on the performance of a task carried out in the public interest or in the exercise of public authority vested in the controller, in the terms provided for in Article 6(1)(e) of Regulation (EU) 2016/679, where it derives from a competence conferred by a rule having the force of law.

4. Purposes of processing
The purposes of the processing of the personal data of data subjects, which the BIOMEDICAL RESEARCH INSTITUTE OF LLEIDA carries out in the exercise of its powers, in accordance with the legal bases that legitimise its processing, are recorded in the Register of Processing Activities.

5. Data retention period (deletion of data)
The personal data of the persons concerned will be kept for the time necessary to fulfil the purposes justifying the processing, in accordance with the exercise of the powers and functions of the INSTITUTO DE INVESTIGACIÓN BIOMÉDICA DE LLEIDA, and to determine the possible responsibilities arising from these purposes. The deletion of the data will also take into account specific cases such as the processing of data by the video-surveillance camera system, and sectorial regulations that require minimum periods of conservation; and subsequently in application of the legislation on public administration archives.

6. Data protection rights and how to exercise them
Data subjects, holders of the data processed by the INSTITUTO DE INVESTIGACIÓN BIOMÉDICA DE LLEIDA are entitled to exercise their data protection rights: access to their data, rectification of erroneous, inaccurate or incomplete data, and deletion when, among other reasons, the data is no longer necessary for the purposes for which it was processed.

In certain circumstances, data subjects may request the restriction of the processing of their data, in which case the data will only be kept for the exercise or defence of claims.

For reasons related to their particular situation, data subjects may object to the processing of their data. In this case, the INSTITUTO DE INVESTIGACIÓN BIOMÉDICA DE LLEIDA will cease processing this data except for legitimate reasons or for the exercise or defence of possible claims.

The portability of the personal data of the interested parties may also be carried out, provided that the purpose of the data collected is not based on compliance with a legal obligation, a public interest mission or the exercise of public powers conferred on the Data Controller (only the processing of which is based on the consent of the interested party and that this processing is carried out by automated means will be able to respond to the exercise of the right to portability).

To exercise these rights, the interested party may contact the INSTITUTO DE INVESTIGACIÓN BIOMÉDICA DE LLEIDA by sending an e-mail to the following address: protecciodedades@irblleida.cat.

Likewise, if you are not satisfied with the response to your request to exercise your rights, and in any case, whenever you consider it appropriate, you may file a complaint with the Catalan Data Protection Authority through its electronic site: apdcat.gencat.cat.

7. Data recipients
The identification of the recipients of the data is recorded in the Register of Processing Activities that the BIOMEDICAL RESEARCH INSTITUTE OF LLEIDA has made public. In any case, other public administrations competent in the matter may also be recipients of the personal data, where appropriate, the transfer having been based on a legitimate legal basis, in accordance with article 6 of the RGPD and article 8 of the LOPDGDD.

8. International data transfers
International data transfers are not foreseen

9. Automated decisions including profiling
The INSTITUTO DE INVESTIGACIÓN BIOMÉDICA DE LLEIDA does not carry out automated decision-making or profiling.

10. Origin of personal data
The personal data processed by the INSTITUT DE RECERCA BIOMÈDICA DE LLEIDA, in fulfilment of a mission carried out in the public interest, in the exercise of public powers conferred on the person responsible for the processing, in fulfilment of a legal obligation or in execution of a contract, comes directly from the interested parties or their representatives.
In the event that the data do not come directly from the data subjects, for example if they come from other public administrations, article 14 of the RGPD will be complied with, providing the data subject with the additional information required when the personal data have not been obtained from the data subject, which specifically includes the obligation to inform about the origin of the data and about the categories of personal data that are the object of processing.