NAGEN-DATA PRIVACY POLICY

The Data Protection Officer (DPO) is the natural or legal person who independently supervises compliance with the regulations, advises the controller on the protection of personal data and ensures that this fundamental right is respected. The DPO does not receive instructions regarding the performance of their duties and is bound to secrecy or confidentiality.

NAVARRABIOMED has appointed a Data Protection Officer (DPO). Anyone can contact them to resolve queries about data processing, to exercise their rights, or to make any suggestions or complaints in this regard. This complaint may be made by the Data Subject prior to submitting it to the Spanish Data Protection Agency. In this case, the DPO shall inform the Data Subject of the decision taken on their complaint within two months of receiving it.

The Data Protection Officer can be contacted by email at dpd-navarrabiomd@navarra.es or by post at the NAVARRABIOMED address indicated at the beginning of this policy (for the attention of the Data Protection Officer).

NAVARRABIOMED processes personal data for different purposes related to each of the processing activities it carries out, listed in the processing activities record available on the transparency portal. The purpose of the processing is identified for each activity.

The processing of personal data collected through the web forms on NAGEN-data is for the following purposes:

• To respond to requests from interested parties and to be able to contact them to offer them more detailed information related to those requests.
• To process service requests.
• To process user registration and platform access procedures.

The processing of personal data carried out through the genome-phenome data discovery functions included in NAGEN-data is intended to:

• Provide a genome-phenome data discovery service that promotes genomic medicine research.
• Provide authorised researchers access to a service for the review of pseudonymised genetic and phenotypic data for research purposes.
• Control researcher access to available service features.
• Guarantee patient rights and freedoms in research projects.

Data processing is carried out for the fulfilment of legal obligations, for the fulfilment of mandates carried out in the public interest or in the exercise of public authority, for the execution of a contract or on the basis of consent, in which case it must be given by means of a clearly affirmative action.

You can refer to the legal basis for each of the processing activities carried out by NAVARRABIOMED in the record of processing activities available on the transparency portal.

In general, the personal data provided will be kept for the time necessary to fulfil the purpose for which it was collected and to determine any possible liabilities that may arise from that purpose and from the processing of the data. However, NAVARRABIOMED will comply with regional, national and European regulations governing the conditions for archiving and documentation depending on the type of data being processed.

The data retention criteria affecting each type of processing are available in the processing activities record on the transparency portal.

In general, data are only shared if there is a legal obligation to do so, but data sharing may occur based on other legitimate processing scenarios. Review the recipients for each of the processing activities carried out by NAVARRABIOMED in the processing activities record available on the transparency portal.

Entities or individuals contracted by NAVARRABIOMED to provide services involving data processing will also have access to personal data. In these cases, access will be based on a contract that will include all the guarantees provided for in Article 28 of the General Data Protection Regulation. In this regard, you should be aware that we use the Webex and Zoom® video call platforms to organise online talks and other events, involving the international transfer of data to the United States. Please refer to the Data Protection Policy of Webex and Zoom.

In general, the data processed by NAVARRABIOMED are obtained from the Data Subjects themselves. However, you can review the record of processing activities available on the transparency portal, which specifies the processing of data from sources other than the Data Subject.

Data Subjects may exercise the following rights:

Interested parties may exercise the above rights via the following means:

At the offices of NAVARRABIOMED, Management Unit, in person or by post, at c/ Irunlarrea, 3, 31008 Pamplona (Navarra).

By contacting the Data Protection Officer at dpd-navarrabiomed@navarra.es.

You may use the template available in the DATA PROTECTION section of the Transparency Portal.

NAVARRABIOMED may make changes to its Privacy Policy without prior notice. Before providing personal data in any of the web forms, users are advised to carefully read the Privacy Conditions summarised below, as well as this Privacy Policy.

In accordance with Article 30 of Regulation (EU) 2016/679 of 27 April 2016 (GDPR), NAVARRABIOMED shall keep and maintain an up-to-date RECORD OF PROCESSING ACTIVITIES carried out under its responsibility, in electronic format, containing:

• Name and contact details of the Data Controller and DPO.
• Purposes of the processing.
• Description of the categories of Data Subjects.
• Description of the categories of data.
• Categories of recipients
• Data transfers to third countries, with identification of the third countries and documentation of adequate safeguards

Where possible:

• Expected timeframes for the deletion of different categories of data.
• General description of technical and organisational security measures.

This record, in accordance with Article 6 bis of Law 19/2013 on Transparency, Access to Information and Good Governance, must be published and is therefore available to interested parties in the ‘DATA PROTECTION’ section of the transparency portal.