Privacy policy

Confidentiality and security are core values of Fundación Jaime Planas (hereinafter, the FOUNDATION), owner of this website of Fundación Clínica Planas and the DECODED congress, and we therefore undertake to ensure the User's privacy at all times and to not gather any unnecessary information. Below is all the necessary information on our Privacy Policy regarding the personal data we collect, explaining:

• Who the data controller for processing your information is.
• The purpose for collecting the data we request.
• The legal basis for its processing.
• The length of time we retain the data.
• With whom we share your information.
• Whether your data is transferred outside the European Economic Area.
• Your rights.

1. Data controller

Fundación Jaime Planas, Fundación Privada (G59509133)

Pere II de Montcada, 16, 08034 Barcelona, Spain

fundacion@clinicaplanas.com

Data Protection Officer: jmmartin@clinicaplanas.com

2. Purposes, legal basis and retention of the data sent via this website

Early Bird notification form

Data: first name, surnames, email address, mobile phone number with country code, and language.

Purpose: To notify you when ticket sales for the DECODED congress open, to send you a welcome email and, in due course, the invitation to complete your registration for the congress, as well as to send you communications related to the congress, including via electronic means. This form does not create a user account.

Legal basis: User consent when signing up via our form and checking the box to accept.

Retention: For the period indicated in the section ‘How long we keep your data’ at the end of this policy, or until you withdraw your consent, if earlier.

Rising Stars application form

Data: first name, surnames, email address, mobile phone number with country code, a link to a video, area of interest, and language.

Purpose: To manage your application to the DECODED congress Rising Stars programme and to keep you informed of its status. Submitting the application creates an account in the private area so that you can complete your documentation.

Legal basis: User consent when submitting the application via our form and checking the box to accept.

Retention: For as long as you keep your account in the private area or until you ask us to delete it and, after that, during the legally required retention periods to meet any liabilities.

Application documents (private area)

Data: CV in PDF, scientific panel in PDF, links to a video and to a questions document, and a free-text summary.

Purpose: To enable the Rising Stars programme committee to assess the application.

Legal basis: User consent when providing the documents for their application.

Retention: The same as the application they belong to.

Access to the private area

Data: email address and password, which is stored with irreversible encryption. The single-use links sent by email to confirm your address or reset your password are stored encrypted, together with the IP address from which they were requested.

Purpose: To identify you in the private area, to confirm that the email address belongs to you and to allow you to reset your password.

Legal basis: The same as that of the processing for which the account is opened: user consent, in the case of Rising Stars applications, and performance of the contract, in the case of congress delegates.

Retention: For as long as you keep your account or until you ask us to delete it and, after that, during the legally required retention periods to meet any liabilities. Sessions expire after seven days, and unused single-use links are deleted thirty days after they expire.

Congress delegate registration form (when ticket sales open)

Data: password and speciality, which are added to the data provided in the Early Bird notification.

Purpose: To complete your registration for the DECODED congress from the invitation received and to give you access to the private area.

Legal basis: Taking pre-contractual steps at the user's request and performance of the congress registration contract.

Retention: For the duration of the contractual relationship and, once it has concluded, during the legally required retention periods, in particular for accounting and tax purposes.

Ticket purchase form (when ticket sales open)

Data: type and number of tickets; first name, surnames and email address of each attendee; amount, order number, result and authorisation code of each payment. Card details are entered directly in the Redsys payment gateway: the FOUNDATION neither receives nor stores them.

Purpose: To manage the purchase of tickets and their payment, and to identify congress attendees. Where the purchaser provides the data of other attendees, they must have informed them of this policy beforehand.

Legal basis: Performance of the ticket sales contract and compliance with the legal accounting and tax obligations arising from the sale.

Retention: For the duration of the contractual relationship and, once it has concluded, during the legally required retention periods to meet any liabilities.

Commercial communications and newsletter

Data: first name, surnames, email address and language, and the form on which you accepted: the Early Bird notification, the Rising Stars application, the delegate registration or the contact form.

Purpose: To send you, by email, commercial communications from the FOUNDATION and The Other 95% newsletter, only if you have accepted them by ticking the specific box on the form. Ticking it is optional: not doing so does not prevent you from signing up, applying or writing to us.

Legal basis: User consent when ticking that box, which you may withdraw at any time without affecting any other processing. Each communication will tell you how to unsubscribe, and you can also ask us by writing to fundacion@clinicaplanas.com.

Retention: Until you unsubscribe or ask us to delete your data. The proof of your acceptance is kept as indicated under ‘Record of consent’.

Record of consent

Data: the exact text shown to you when you accepted, its version, the date and time of acceptance, and the IP address from which it was given.

Purpose: To be able to demonstrate that you gave your consent and to which text you gave it.

Legal basis: Compliance with a legal obligation: the General Data Protection Regulation requires the controller to be able to demonstrate that the data subject has consented to the processing of their data.

Retention: For the period indicated in the section ‘How long we keep your data’ at the end of this policy.

Sending of emails

Data: the recipient's email address, and the subject and content of each automatic email sent by the website (email confirmation, welcome, changes to the application, password recovery, among others), except for access links, which are masked; and the delivery status reported by the email provider (delivered, bounced or marked as spam).

Purpose: To send you the emails relating to each of the processing activities above and to be able to prove what was sent to you and when.

Legal basis: The same as that of the processing to which each email relates.

Retention: For the period indicated in the section ‘How long we keep your data’ at the end of this policy.

Obligation to provide your personal data and consequences of not doing so

Providing personal data requires being at least 16 years old and, where appropriate, having sufficient legal capacity to enter into a contract.

The personal data requested is necessary to manage your requests and/or provide you with the services you may contract. Therefore, if you do not provide it to us, we will not be able to assist you correctly or provide you with the requested service.

3. Recipients of your personal data

Your data is confidential and will not be transferred to a third party unless under a legal obligation or it is necessary for the provision of services, with you previously being informed and, where appropriate, your consent given.

To provide the services of this website, the FOUNDATION relies on the following providers, who access the data as data processors, on behalf of the FOUNDATION and following its instructions:

Provider	Service	Data received
Resend, Inc. (United States)	Sending the website's automatic emails.	The recipient's email address and the content of each email.
Cloudflare (R2 storage service)	Safekeeping of the application documents, in private storage under European Union jurisdiction.	The PDF files of the CV and the scientific panel.
Redsys (payment gateway)	Collecting payment for tickets, when sales open.	The amount and the order number. It does not receive the purchaser's name or email address; card details are collected directly by Redsys.
myfocus	Development, hosting and maintenance of the website.	All the data described in this policy.
Google Ireland Limited (Google Analytics), only if traffic measurement is switched on	Statistical measurement of visits to the website.	Technical browsing data, such as the IP address, the type of browser and the pages visited, and, if you accept analytics cookies, the identifiers of those cookies. It is explained in the Cookie Policy.

4. International data transfers

Resend, Inc., the provider that sends the website's emails, is established in the United States. Consequently, sending each email involves an international transfer of the recipient's address and the content of the email to a country outside the European Economic Area.

This transfer is carried out with the safeguards provided for in the General Data Protection Regulation for international data transfers. You may request further information about them by writing to the data controller at the addresses indicated in section 1.

5. Rights in relation to your personal data

Consent granted for the processing of personal data can be withdrawn at any time. In no circumstance does this withdrawal affect the performance of the signed contract or the previously established relationships.

Likewise, you may exercise the following rights:

• Request access to your personal data or its rectification when inaccurate.
• Request its erasure when, among other reasons, it is no longer necessary for the purpose for which it was collected.
• Request the restriction of processing in certain circumstances.
• Object to the processing of your data for reasons related to your particular situation.
• Request the portability of the data when so provided for in law.
• Other rights recognised in applicable laws.

Where and how to exercise your rights: By writing to the data controller at their postal address (Pere II de Montcada, 16, 08034 Barcelona, Spain) or email address (fundacion@clinicaplanas.com), quoting the reference ‘Personal Data’ and specifying the right to be exercised and the personal data concerned.

In the event of any dispute with the FOUNDATION regarding the processing of your data, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

6. Cookies

This website uses its own technical cookies that are strictly necessary for it to function, such as the one that keeps your session open in the private area. It may also use Google Analytics analysis cookies, which are only installed with your prior consent, in compliance with Article 22 of the Spanish Information Society Services Law. You will find all the information, including the browsing data sent to Google when you do not accept them, in our Cookie Policy.

7. Security of your personal data

To safeguard the security of your personal data, we have adopted all the technical and organisational measures necessary to protect the personal data provided against alteration, loss or unauthorised access or processing.

8. Updating your personal data

So that we can keep your personal data up to date, it is important that you tell us whenever it changes; otherwise, we cannot be held liable for its accuracy.

We are not responsible for the privacy policies regarding the personal data supplied by you to third parties via the links on our website.