25-04-2022
CYTES BIOTECHNOLOGIES S.L. (the “Company”) is an organization in which personal data processing activities occur, which gives it an important responsibility in the design and organization of procedures so that they are aligned with legal compliance in this area. In the exercise of these responsibilities and in order to establish the general principles that should govern the processing of personal data in the Company, it approves this Personal Data Protection Policy, which it notifies to its Employees and makes available to all its Stakeholders.
1. Purpose
The Personal Data Protection Policy is a measure of proactive responsibility that aims to ensure compliance with applicable legislation in this area and in relation to this, respect for the right to honor and privacy in the processing of personal data of all persons who are related to the Company. In development of the provisions of this Personal Data Protection Policy, the Principles governing the processing of data in the organization are established, and consequently, the procedures, and the organizational and security measures that the persons affected by this Policy undertake to implement in their area of responsibility. To this end, the Management shall assign responsibilities to the personnel involved in data processing operations.
2. Scope of application
This Personal Data Protection Policy shall apply to the Company, its directors, officers, and employees, as well as to all persons who deal with it, expressly including service providers with access to data (“Data Processors”).
3. Principles of personal data processing
As a general principle, The Company will scrupulously comply with the legislation on personal data protection and must be able to prove it (Principle of “proactive responsibility”), paying special attention to those processing operations that may entail a higher risk for the rights of the affected parties (Principle of “risk approach”). In relation to the above CYTES BIOTECHNOLOGIES S.L. will ensure compliance with the following Principles:
  •  Lawfulness, loyalty, transparency, and purpose limitation. The data processing must always be informed to the affected party, through clauses and other procedures; and will only be considered legitimate if there is consent for the processing of data (with special attention to that provided by minors), or has other valid legitimacy and the purpose of the same is in accordance with regulations.
  • Data minimization. The data processed must be adequate, relevant and limited to what is necessary in relation to the purposes of the processing.
  • Accuracy. The data shall be accurate and, if necessary, updated. In this regard, the necessary measures shall be taken to ensure that personal data that are inaccurate with respect to the purposes of the processing are deleted or rectified without delay.
  • Limitation of the retention period. The data will be kept in a form that allows the identification of the data subjects for no longer than is necessary for the purposes of the processing.
  • Integrity and Confidentiality. Data shall be processed in such a way as to ensure appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, by implementing appropriate technical or organizational measures.
  • Transfer of data. It is forbidden to purchase or obtain personal data from illegitimate sources or in those cases where such data have been collected or transferred in contravention of the law or where their legitimate origin is not sufficiently guaranteed.
  • Hiring of suppliers with access to data. Only suppliers that offer sufficient guarantees to apply appropriate technical and security measures in the processing of data will be chosen for contracting. With these third parties, the appropriate agreement in this regard shall be documented.
  • International data transfers. Any processing of personal data subject to European Union regulations that involve a transfer of data outside the European Economic Area must be carried out in strict compliance with the requirements established in the applicable law.
  • Rights of data subjects. The Company will facilitate the exercise of the rights of access, rectification, deletion, limitation of processing, opposition and portability to the affected parties, establishing for this purpose the internal procedures, and in particular the models for its exercise that are necessary and appropriate, which must satisfy, at least, the legal requirements applicable in each case.
The Company shall promote that the principles contained in this Personal Data Protection Policy are taken into account (i) in the design and implementation of all work procedures, (ii) in the products and services offered, (iii) in all contracts and obligations formalized or assumed and (iv) in the implementation of all systems and platforms that allow access by employees or third parties and/or the collection or processing of personal data.
4. Commitment of employees
Employees are informed of this Policy and declare that they are aware that personal information is an asset of the Company, and in this respect they adhere to it, committing themselves to the following:
  • Undertake the awareness training in Data Protection that the Company makes available to them.
  • Apply the security measures at user level that apply to their job, without prejudice to the responsibilities in their design and implementation that may be attributed to them depending on their role within CYTES BIOTECHNOLOGIES S.L..
  • Use the formats established for the exercise of Rights by the affected parties and inform the Company immediately so that the response can be effective.
  • To inform the Company, as soon as they become aware of deviations from the provisions of this Policy, in particular “Security breaches of personal data”, using the format established for this purpose.
5. Monitoring and evaluation
The effectiveness of the technical and organizational measures to ensure the security of the processing will be verified, evaluated, and assessed annually, or whenever there are significant changes in the data processing.
CYTES BIOTECHNOLOGIES S.L.