Since 2008, the Probitas Foundation (“Fundación Probitas”) has helped to improve the health, well-being and equal opportunities of vulnerable individuals both locally and globally. The Foundation develops local health and social initiatives to promote the holistic development of children and adolescents who are vulnerable and/or at risk of social exclusion and, internationally, it runs programmes to bolster the capabilities of public health systems in countries with limited health resources. The Probitas Foundation is funded by 0.7% of Grifols’ annual profits, donated by the company’s shareholders.
Probitas respects the privacy rights of all those who entrust it with their personal data and is committed to adhering to relevant data protection regulations.
In our Data Protection Notice, we explain which personal data we gather for our activity, how we use it, and what rights the data subjects have.
This Data Protection Notice was drafted in compliance with the General Data Protection Regulation (“GDPR”) of the European Union.
1. Identification of the data controller(s)/data subject(s)
The data controller is Fundación Privada Probitas, with contact address at calle Jesús y María, 6, 08022, Barcelona (Spain) (“Probitas”).
2. Identification of the data protection officer
The data protection officer acts as an interlocutor between Probitas and you, ensuring compliance with data protection legislation and safeguarding your rights under such legislation. You can contact the data protection officer at dpo@grifols.com.
3. For which purposes does Probitas process the personal data?
|
Purpose |
Categories of personal data and recipients |
Lawful basis |
|
Categories of personal data:
Recipients:
|
Consent
|
|
Categories of personal data:
Recipients:
|
Legitimate interest |
|
Categories of personal data:
Recipients:
|
Execution of a contract
Legal obligation
|
|
Categories of personal data:
Recipients:
|
Execution of a contract
Legitimate interest |
|
Categories of personal data:
Recipients:
|
Consent
Legitimate interest |
|
Categories of personal data:
Recipients:
|
Consent
Contract execution (if there are terms and conditions of participation in competitions or similar events) |
|
Categories of personal data:
Recipients:
|
Execution of a contract
Consent (if there is no contract) |
|
Categories of personal data:
Recipients:
|
Legitimate interest |
|
Categories of personal data:
Recipients:
|
Legitimate interest |
|
Categories of personal data:
Recipients:
|
Consent |
|
Categories of personal data:
Recipients:
|
Legitimate interest
Consent |
|
1For example, name, surname, image, nationality, number of national/foreigner's ID/passport document, username on social networks. 2For example, personal phone number, personal email address and home address. 3For example, professional contact details, job title, place of work, membership of professional associations or colleges. 4For example, IP address, device or user ID, browser type and version, sections visited and country from which the connection is made. 5 For example, health data. 6 For example, financial interests and bank details. |
||
3.1 Additional information about the lawful basis to process personal data
The table above shows the applicable lawful basis to process personal data by purpose. In this you can find additional details on the lawfulness of the processing:
• Consent (Article 6.1(a) of the GDPR): data subjects may provide their consent through the data collection forms, by clicking acceptance buttons or ticking boxes, replying to e-mails or making any other affirmative clear action. Data subjects may withdraw their consent at any time, as set out in Section 6.
• Execution of a contract (Article 6.1(b) of the GDPR): Refusal to provide the personal data requested by Probitas could result in the impossibility of entering into or maintaining such a contract.
• Legal obligation (Article 6.1(c) of the GDPR): Probitas needs to process the requested personal data to comply with legal obligations. Refusal to provide the personal data requested by Probitas could prevent Probitas from complying with such legal obligations. Section 7 provides details of the specific regulation applicable to Probitas that requires the processing of personal data.
• Legitimate interest (of Probitas and/or third parties) (Article 6.1(f) of the GDPR): Probitas is interested in helping to improve the health and well-being of very vulnerable people both locally and globally. In this regard, Probitas pursues the following legitimate interests, which take precedence over the fundamental rights and freedoms of data subjects because these processes are aligned with their reasonable expectations based on their relationship with Probitas:
- Direct marketing;
- Routine management of a foundation and internal administration, which involves sharing information with Grifols, S.A., and
- Establishment of secure information systems infrastructure to prevent illegal and malicious activities that could compromise stored personal data.
In any event, data subjects may request further information on the legitimate interest or exercise their right to object to the processing of their personal data based on the legitimate interest by addressing this request to privacy@grifols.com.
3.2 Recipients of personal data
The earlier table lists the different categories of recipients with which Probitas shares personal data by their purpose. This section includes additional information about these, where applicable.
• Grifols, S.A. and Grifols Viajes, S.A.
• Public or private organisations, such as organisations with which Probitas has signed collaboration agreements.
• Financial institutions.
• Providers of products and services, such as providers of information technology services, legal advice, photographers, travel agencies, communication agencies, etc.
Probitas’ websites may include social network plugins, which can be recognised by the social network’s logo or name, so that users to access Probitas’ profile on these platforms. By clicking on these buttons, the users' personal data (including IP address and browsing data) will be transferred to the providers of these social networks. Probitas will not be liable for any further processing of this personal data by said social network providers. The purpose and scope of the data collection, its subsequent processing and use by the providers of these social networks, as well as related rights and privacy setting options, can be found in the data protection information of these companies.
Probitas will ensure that personal data is only transferred to countries that offer an adequate level of data protection. If personal data is processed in countries that do not offer such a level of protection, Probitas and/or the providers (as applicable) will adopt, if necessary, appropriate safeguards (e.g. the standard contractual clauses included in Commission Implementing Decision (EU) 2021/914 of 4 June 2021, if the GDPR applies) to carry out such international data transfers according to the applicable data protection legislation. You can request specific information from Probitas on the safeguards applied for each international transfer of personal data at privacy@grifols.com.
Probitas does not share personal data with any other third party, unless required by the applicable law or authorised by the data subject.
4. Retention period
Once the purposes for which the personal data are processed have been fulfilled, Probitas will retain such data until the limitation periods for any liabilities as may arise have elapsed and during the term required to comply with any applicable legal obligations.
5. Sources of personal data
In addition to the personal data provided directly by data subjects to Probitas, Probitas may also obtain data from databases of event organisers and other sources, such as websites and publications related to Probitas’ mission, from donors and collaborators, organisations that request and/or receive donations from Probitas and professional social networks.
6. Data protection rights
The following data protection rights are applicable under the GDPR. Probitas undertakes to respect any other data protection rights that may be applicable in accordance with the data protection legislation of each country.
|
Rights |
Contents |
|
Access |
You may request confirmation as to whether or not your personal data is being processed and, if so, you can obtain access to your data included in Probitas’ files. |
|
Rectification |
You may request the rectification of your personal data if inaccurate. |
|
Erasure |
You can request the erasure of your personal data. |
|
Objection |
You may request that your personal data is not processed under specific circumstances. |
|
Portability |
You may request to receive the personal data you provided to Probitas in an electronic file and you have the right to transmit it to other third parties. |
|
Restriction of processing |
You may request a restriction on how your personal data is processed when:
|
|
Withdrawal of consent |
You may withdraw your consent without this affecting the lawfulness of the processing based on your consent before its withdrawal. |
You may exercise your data protection rights, where applicable, by sending a written communication to Probitas at privacy@grifols.com, indicating in the subject of the communication “Probitas Fundación Privada – Protección de datos”. To that end, Probitas may request the necessary information and documentation to identify you.
In addition, you may lodge a complaint with a data protection authority, including the one at your residence, place of business, or place of the alleged infringement.
7. Specific provisions
Spain
With regard to donations, Probitas is subject to compliance with legal obligations derived from tax regulations (Act 49/2002 of 23 December 2002 and any regulations implementing or replacing it) and, if applicable, obligations arising from money laundering and terrorist financing prevention regulations (Act 10/2010 of 28 April 2010 and any regulations implementing or replacing it).
Date of last update: February 2024