Privacy Policy

In compliance with the provisions of the General Data Protection Regulation (EU) 2016/679 (hereinafter "GDPR"), this Privacy Policy applies to the website of IMMFLY, S.L. (hereinafter "Website") and, therefore, does not apply to Immfly's entertainment platforms.

In this Privacy Policy, we inform you about the collection, processing, and use of your personal data through the use of this Website, as well as those treatments that may arise from the interaction between Immfly and users.

For the purposes hereof, we may refer to Immfly as "we", we may also refer to users as "you".

1. Who is the Data Controller?

Identity of the responsible: IMMFLY, S.L.

Address: Carrer Albert Einstein, 1-3, 08940, de Cornellà de Llobregat (Barcelona).

Contact details of the Data Protection Officer: dpo@immfly.com

E-mail: dataprotection@immfly.com

2. Which personal data do we collect?

Our data processing as Data Controller derived from the services offered on the Website, are focused on the form available in the upper section of the Website "Contact", as well as from the section "Careers", on the other hand, the data processing through the Website, may also arise from any communication made through the section "Reporting Channel". In addition, you may be asked for personal information each time you contact Immfly, but in no case will it be used for purposes other than those mentioned above.

Also, on our Website we may collect aggregated/anonymous information about your activity on our website.

2.1 What categories of personal data do we collect?

Identification data: First name, surname, gender, image, country and city of residence.

Contact details: e-mail address, telephone number.

Academic and professional data: Curriculum Vitae (professional and academic experience).

3. What are the purposes of the processing that we carry out and what is the basis of legitimacy for such processing?

a) Contact

Immfly through this processing aims to manage all those contact requests received through the "Contact" form provided on the website, as well as all those that may be received by any other means. From this processing is carried out, the reception, management, resolution and archiving of all those contact requests received.

The basis of legitimacy that supports the processing of personal data in the contact forms is the consent provided by the data subject, in accordance with the article 6.1 a) of the RGPD. The data subject has the right to withdraw consent at any time, however, the revocation of consent will not affect the lawfulness of the processing previously carried out.

b) Career

The purpose of this processing is the management of those job applications made by users of this website in vacancies that we have published. This processing is carried out by means of a log-in in which the user can provide identification data that allow us to generate a profile and, subsequently, to apply for a published vacancy.

The basis of legitimacy that covers the processing of personal data is that provided for in Article 6.1 b) of the GDPR, i.e. the processing is necessary for the performance of a contract to which the data subject is a party or for the implementation at the request of the data subject of pre-contractual measures.

Those candidates who do not pass the selection process may choose to remain registered in Immfly's job board, subject to the data subject's express consent, in accordance with Article 6.1 a) of the GDPR. The data subject has the right to withdraw consent at any time, however, the revocation of consent will not affect the lawfulness of the processing previously carried out.

c) Reporting Channel

The purpose of this processing is to manage all those communications made by users of the website through the Reporting Channel whose purpose is to ensure the obligations provided through the Spanish Law 2/2023 of 20 February, regulating the protection of persons who report regulatory infringements and anti-corruption.

The basis of legitimacy for the guarantee of the processing of personal data is the fulfilment of a legal obligation, in accordance with the provisions of Article 6.1 c) of the GDPR. This legal obligation is determined by the provisions of Article 30.2 of Law 2/2023 of 20 February, regulating the protection of persons who report regulatory violations and the fight against corruption, which stands from the Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law.

The processing is not intended for the primary collection of special categories of data provided for in Article 9.1 of the GDPR, such as, for example, health data, data concerning sexual orientation, data concerning trade union membership or religious data. However, in the event that such processing occurs incidentally, the exception for such processing shall be the one provided for in Article 9.2 g) of the GDPR, i.e. the processing is necessary for reasons of essential public interest.

4. How long will we keep your personal data?

a) With regard to the processing of Contact, we will process your personal data for as long as they are necessary to achieve the purpose proposed and previously defined in the Section 3. In any case, we will stop processing your personal data when you ask us to withdraw the consent given. In case there is a legal obligation or action exercised or as long as the time limit for its exercise has not expired, the processing will be carried out to the extent necessary to respond to such legal responsibilities.

b) With respect to the processing of Careers, the term of conservation of your personal data is while the existing pre-contractual relationship is carried out, that is, for the duration of the selection process. In the event that the interested party does not pass the selection process, your personal data will be deleted, unless you have given your express consent to remain in the Immfly job board for subsequent job opportunities with us.

c) The term of retention of the Reporting Channel processing complies with the terms set forth in Article 30.4 of Spanish Law 2/2023, of February 20th, regulating the protection of persons who report regulatory violations and the fight against corruption, i.e., that after three months from the receipt of the communication without any investigation action having been initiated, the deletion will be carried out.

The processing may follow, by the appropriate body, in accordance with the provisions of the article 24.2 of the Spanish Organic Law 3/2018, of December 5th, regarding protection of personal data and guarantee of digital rights, the investigation of the facts reported, not being kept in the internal complaints information system itself.

In order to leave evidence of the operation of the system when necessary, they will be kept anonymized.

5. To whom may personal data be disclosed?

Immfly will only communicate your personal data when legally required to do so.

Also, in order to provide you with services, we have service providers who may have access to your personal data and who will only act in accordance with the instructions given by Immfly, which means that they may not, under any circumstances, use your personal data for purposes other than those we have previously indicated.

6. Are there any international transfers of data outside the European Economic Area?

There will not be any international transfer of data.

7. Are automated decision-making or profiling carried out?

In no case is automated decision-making without human intervention or profiling carried out.

8. What rights are granted to me under the General Data Protection Regulation (EU) 2016/679?

The rights that you can exercise, as the owner of your personal data, are those indicated below:

a) Access: You can obtain confirmation if Immfly processes personal data, as well as consult the personal data included in Immfly's processing.

b) Rectification: You will be able to correct any inaccurate personal data and complete any incomplete data.
Erasure: You may request the erasure of personal data when, among other reasons, the data are no longer necessary for the purposes for which they were collected.

c) Restriction: You may request that your personal data not be processed. Immfly will stop processing the data, except for compelling legitimate reasons, or for the exercise or defence of possible claims.

d) Limitation: You may request the limitation of the processing of personal data in the following applicable cases:

i) While the accuracy of the data is being challenged; when the processing is unlawful and you object to the erasure of the data, and request the restriction of its use; When the processing is unlawful and you object to the deletion of the data, and request the restriction of its use.

ii) When Immfly does not need to process the data, but you need it for the exercise, formulation, or defence of claims.

iii) When you have objected to the processing of the data for the performance of a task carried out in the public interest or for the satisfaction of a legitimate interest, while it is being verified whether the legitimate reasons of the data controller prevail over those of the data subject.

f) Portability: You may receive, in electronic format, the personal data you have provided to us and those obtained through the relationship with Immfly, as well as transmit them to another entity, if you consider it appropriate.

You may exercise your rights by sending a written communication to IMMFLY, S.L.: C/ Albert Einstein, 1-3, Cornellà de Llobregat (Barcelona), or by sending an e-mail to the following address: dpo@immfly.com.

To exercise your rights, you must attach a copy of your ID card or other document proving your identity and the right you wish to exercise.

If you consider that Immfly has not processed your personal data in accordance with the applicable regulations, you may file a complaint with the Spanish Data Protection Agency, through the following website: https://www.aepd.es/. We remind you that the exercise of rights is free of charge.