GENERAL PRIVACY POLICY

1. Introduction

The right to privacy, particularly the right to personal data protection, is one of the core values of FUNDACIÓN URIACH 1838 (hereinafter, the FOUNDATION). 

The objective of this policy is to explain how the FOUNDATION processes personal data collected through different online forms on its website. Your personal data will be processed in a confidential manner and only for those purposes for which you have provided consent, as explained below in the General Privacy Policy and in each of the Privacy Policies of the different online forms.

2. Commitment to Privacy

The FOUNDATION is fully committed to complying with the European Union's General Rules and Regulations on Data Protection and the regulations concerning the protection of personal data in force at any time; this being a priority objective of the FOUNDATION.

The FOUNDATION has therefore implemented the following principles, with privacy forming the very basis of data procedures:

• Transparency in data processing is one of our priorities, so whenever we collect personal data about you, we will duly inform you of its purposes in the corresponding privacy policy.
• We will only process data that is strictly necessary for carrying out a procedure about which you are informed.
• We will never require you to provide personal data unless it is necessary for a service you have requested.
• Whenever possible, we will provide you with simple means for controlling your personal data.
• We will not share your personal data with any third party except those suppliers providing a service on our behalf, or those you have previously consented and been informed about.

3. Purposes of Data Processing

The FOUNDATION collects personal information from you so that it can manage your requests and offer you services and products that you may be interested in. We handle personal data for the following purposes:

1. To be able to contact you and respond to any inquiries, questions or requests you have made through customer service communication channels identified on each web page.
2. To improve our web pages, services, and products, and thereby offer better service and content.
3. To provide you with access to restricted areas of our website (registration may require acceptance of a specific privacy policy).
4. Manage sales of the online store.

At times, it may be necessary to process your personal data to enforce legal obligations, or in relation to any contractual relationship we may have with you.

In other cases, and whenever appropriate, we will request your consent to process your personal data.

4. Duration of Data Processing and Storage

At the FOUNDATION we are committed to processing personal data only while it is useful to us in offering you service of quality. Therefore, we will make all the opportune and reasonable efforts to minimise personal data processing and storage time.

In this sense, we will inform you of the expected duration of the processing and storage of your personal data.

In any case, even if you request that we remove your data, we will be able to keep and maintain it, under due protection, during the time period necessary for us to comply with our legal obligations and submit it to any authorities that may legally request it.

5. Exercise of Rights and Claims Before the AEPD

As a result of the FOUNDATION's processing of your personal data, current legislation provides you with rights. Below, we offer you a summary explanation of each of these rights so that you may exercise them:

1. Right to Access: You have the right to know the personal information of yours that we are processing in our dealings with you and the ends toward which it is being used.
   
2. Right to Rectification: Your data will always be yours, and as such, you can request that it be rectified in case that which we have in our records is incorrect.
   
3. Right to suppression: You may request that your personal data be deleted from our files at any time. However, and as indicated in the previous Data Processing and Storage section, please note that in certain circumstances, compliance with existing legislation may impede the effective exercise of this right.
   
4. Right to Opposition: You may object to the processing of your data in relation to any of the purposes toward which we process your data in accordance with the privacy policies applicable in each case. 
   
5. Right to Limitation: You may request limitations on the processing of your personal data in the following cases:
1. If you believe that the personal data we are storing is incorrect or inaccurate;
2. In case you believe that we are not processing your data legitimately, but prefer to impose limitations on your data rather than have it eliminated;
3. If the data we are storing is no longer necessary to us according to the purpose for which we collected it, but you wish it maintained in case of legal claims;
4. If, having exercised the right to oppose any processing of your data, it is pending response on our part.
5. Right to data portability: You are entitled, as far as technically possible and reasonable, to request that any personal information you have directly provided us with be transferred to another entity for processing. If possible, we will transfer your data directly to the other entity, but if not, we will issue it to you in a standard format.

The consent you provide us with to process your data may be revoked at any time without incurring any consequences except for the cancellation of certain services, depending on the right exercised.

You may exercise your rights by contacting the FOUNDATION through one of the following means (please include a copy of your DNI or equivalent identification document in your correspondence):

(i). E-mail: dpo@uriach.com

(ii). Regular mail: DPO, Camí Avda Royal 51-57, 08184 Palau-Solità i Plegamans, Barcelona, Spain.

Additionally, if you consider it necessary, you can also contact our Data Protection Delegate through e-mail address dpo@uriach.com

If you do not want to exercise a particular right but wish to consult or make a suggestion about the processing of your personal data, you may nevertheless contact the addresses provided above for exercising rights.

Please note that, in any event, you may always file a complaint with the competent authority on data protection if you believe that we have not treated your data lawfully or that we have not responded adequately to your requests or rights.

In Spain, the competent authority is the Spanish Data Protection Agency.

6. Confidentiality and Security in the Processing of Data

Your personal data is very important to us, and we are committed to processing it with the utmost confidentiality and discretion, as well as to implement all the security measures that we consider timely and reasonable.

In this regard, the FOUNDATION declares and guarantees that it implements all the technical means at its disposal to avoid the loss, misuse, alteration, unauthorized access and theft of data provided by users.

7. Social Networks

Social networks are part of the everyday life of many internet users, and so the FOUNDATION has created different profiles.

All users have the opportunity to join the pages or groups that the FOUNDATION has created on different social networks.

However, you should keep in mind that unless we request your data directly (for example, through marketing campaigns, contests, promotions, or any other valid form), your data will belong to the respective social network, so we recommend carefully reading your terms and conditions of use and privacy policies, as well as make sure you set your personal preferences with regard to data handling.

8. International Transfers

As a general rule, we store your data within the European Union (EU) or the European Economic Area (EEA).

In these situations, the FOUNDATION guarantees that it will apply all measures and controls to guarantee and protect the treatment of your personal data, such as:

1. Communication to countries which, despite not being part of the EU or the EEA, have been considered by the European Commission as countries with data protection standards that guarantee a level of security similar to that applicable in Europe.
2. European Commission Contractual Clause Type: the European regulator has envisaged that some countries may not have a data protection standard similar to that applicable in Europe, so it has developed contract models designed to ensure that companies from countries that are not part of the EU or EEA comply with a similar level of protection. the FOUNDATION will sign these contracts provided there is no equivalent alternative that guarantees the protection of your personal data.
3. Binding corporate norms: these are company-approved standards reviewed and approved by controlling authorities to ensure that a company we provide your data with complies, in whatever country, with an adequate level of protection.
4. Certifications: in certain cases, the company we facilitate data with may have data protection certifications that guarantee the correct use of your data according to current regulations.

9. Contact THE FOUNDATION

If you have any questions or concerns about your personal data, please contact us via:

(i).  E-mail dpo@uriach.com

(ii). Regular mail: DPO, Camí Avda Royal 51-57, 08184 Palau-Solità i Plegamans, Barcelona, Spain.