Data protection policy

The Fundación Privada Hospital de la Santa Cruz y San Pablo (hereinafter referred to as “the Foundation”), as the person responsible for the processing of personal data, guarantees an adequate and coherent level of protection for natural persons with respect to their personal data. , object of treatment for the development of its powers, in accordance with the requirements of the General Data Protection Regulation (2016/679) and Organic Law 3/2018, of December 5, on data protection and guarantee of data. digital rights.

The Foundation carries out personal data processing with full responsibility and fairness, and in accordance with the legal bases that allow the legality of the processing, in compliance with the General Data Protection Regulation and Organic Law 3/2018, of December 5 , data protection and guarantee of digital rights. In order to comply with data protection legislation, the Foundation has prepared and published its Record of Treatment Activities and has adopted technical and organizational security measures, appropriate to the objectively assessed and identified risks for rights and freedoms. of the interested persons, to whom the data processed and the treatments carried out by the Foundation could give rise. The Foundation applies the principle of transparency in the processing of personal data, providing interested parties with the information on the processing, required by the GDPR and the LOPDGDD, in a concise, easily accessible, complete and easy-to-understand language; at the same time, it provides the email address [email protected], where interested persons can exercise their rights in relation to their personal data.

On the other hand, the Foundation has appointed a Data Protection Delegate, in accordance with the provisions of article 37.1.a) of the General Data Protection Regulation (2016/679) and articles 34 and 36 of the Organic Law 3 /2018 of protection of personal data and guarantee of digital rights. The electronic contact address of the Data Protection Officer is [email protected].

Below is extended information regarding each treatment activity under the Foundation’s scope of responsibility, inventoried in the Treatment Activities Register, which completes the basic information provided in each data collection procedure.

1. Responsible for the treatment

Fundació Privada Hospital de la Santa Creu i Sant Pau – CIF G08197774
C/ Sant Antoni Maria Claret 167, 08025 Barcelona
Phone: 935 537 145
Email: [email protected]

2. Contact details of the Data Protection Officer

[email protected]

3. Legal bases of the treatment

The treatment of the personal data of the interested persons derived from the powers and functions of the Foundation are based, for all purposes, on the following legal bases, which are detailed for each treatment activity in the Register of Treatment Activities.

General Data Protection Regulation 2016/679

• Article 6.1.a: The interested party gave his consent for the processing of his personal data, for one or different specific purposes. Unequivocal consent of the interested parties who sign up for our Newsletter or write a comment on the Modernist Site blog.
• Article 6.1.b: The treatment is necessary for the execution of a contract in which the interested party is a party, or for its application at the request of the same of pre-contractual measures. Execution of contract for the purchase of tickets to visit the venue in any modality (free visit, guided, in groups…), space rental, etc.
• Article 6.1.c: The treatment is necessary for the fulfillment of a legal obligation applicable to the person in charge of the treatment (Law 50/2002 of December 26 of foundations).

Organic Law 3/2018 on the protection of personal data and guarantee of digital rights.

• Article 6: Treatment based on the consent of the affected party.
• Article 8: Data processing due to legal obligation, public interest or exercise of public powers.
• The processing of personal data can only be considered based on compliance with a legal obligation enforceable by the person in charge, in the terms provided in article 6.1.c of Regulation (EU) 2016/679, when so provided by a regulation of Union Law. European or standard with force of law.

4. Purposes of the treatment

The purposes of the treatment of the personal data of the interested parties, which the Foundation carries out in the exercise of its powers, in accordance with the legal bases that legitimize its treatment, are recorded in the Register of Treatment Activities.

5.Data retention period (data deletion)

The personal data of the interested persons will be kept for the time necessary for the fulfillment of the purposes that justify the treatment, in accordance with the exercise of the powers and functions of the Foundation, and to determine the possible responsibilities derived from these purposes. The deletion of the data will also address specific cases such as data processing by the video surveillance camera system, and sectoral regulations that require minimum retention periods; and subsequently in application of the legislation on archives if necessary.

6. Data protection rights and how to exercise them

The interested persons, holders of the data subject to treatment by the Foundation, have recognized the exercise of data protection rights: access to their data, rectification of erroneous, inaccurate or incomplete data, and deletion when, among other reasons , the data is no longer necessary for the purposes that justified the treatment.

In certain circumstances, the interested parties may request the limitation of the processing of their data, in which case they will only be kept for the exercise or defense of possible claims.

Also for reasons related to their particular situation, the interested parties may oppose the processing of their data. In this case, the ‘Foundation’ will stop processing this data except for legitimate reasons or for the exercise or defense of possible claims.

To exercise these rights, the interested party may contact the Foundation, through the email address [email protected].

Likewise, if you are not satisfied with the response to the request to exercise your rights and whenever you deem it appropriate, you may file a claim with the Catalan Data Protection Authority through its email address.

7. Data recipients

The identification of recipients of the data is recorded in the Register of Treatment Activities that the Foundation has made public. In any case, public administrations competent in the matter may also be recipients of personal data, when appropriate, the assignment having been based on a legitimate legal basis, in accordance with article 6 of the GDPR and article 8 of the LOPDGDD.

8. International data transfers

There are no international data transfers planned, except in the following cases in which they will be carried out in third countries with an adequate level of protection, declared by the European Commission and with the provision of adequate guarantees such as Standard Contractual Clauses (Articles 28.8 and 46.2. d GDPR) and Binding Corporate Regulations (Articles 46.2.b and 47 GDPR):

• When the data that you have provided us to subscribe to our “San Pablo Recinto Modernista Newsletter” (newsletter) is sent, through the Mailchimp company, which carries out its activity of processing your personal data in third countries outside the European Union . Consult the full version of its Privacy Policy.
• The Foundation, as data controller, hires its virtual infrastructure according to a “cloud” computing model through Google/Microsoft, under the Binding Corporate Rules. Consult the privacy policy of Google and Microsoft.
• The cases in which there may be international data transfers will be through cookies from third parties (Youtube, Google, Google Analytics and Javascript). You can find out about data transfers to third countries in their corresponding policies on the treatment of the data collected.

9. Origin of personal data

The personal data processed by the Foundation, in compliance with a legal obligation or in execution of a contract, come directly from the interested persons or their representatives.

In the event that the data does not come directly from the interested persons, article 14 of the GDPR will be complied with, providing the interested party with the additional information required, which specifically includes the obligation to inform about the origin of the data and about the categories of personal data object. of treatment.