1.- Right to information

The Privacy and Data Protection Policy of Centro Nacional de Investigaciones Cardiovasculares Carlos III (F.S.P.) responds to the need to comply with the legal obligation to inform data subjects, under the principle of transparency required by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter, GDPR), about the circumstances and conditions of the data processing to be carried out by Centro Nacional de Investigaciones Cardiovasculares Carlos III (Carlos III National Cardiovascular Research Centre), as well as the rights to which they are entitled.

2.- Who is responsible for the processing of your personal data?

The party responsible for the processing of your personal data is Centro Nacional de Investigaciones Cardiovasculares Carlos III (F.S.P.) (hereinafter, CNIC), with Fiscal Identification Code (C.I.F.) G-82316753 and domiciled at calle Melchor Fernández Almagro, 3, 28029 Madrid.

We inform that the ownership of the web domain https://resilience-h2020.com/ (hereinafter, the “Website”), belongs to CNIC.

The personal data that you provide, either through this Website, through any form/application in paper format or by any other means, will be duly registered and incorporated into CNIC’s data processing systems.

Email for information: resilience@cnic.es

Contact details of the Data Protection Officer: dpo@cnic.es

3.- For what purpose will your data be processed?

The purpose of the processing of the personal data that you have provided to CNIC through the Website and other communication channels will depend on the reason for which you have provided them:

• Processing of data of subjects joining RESILIENCE study, for the purpose of managing their participation in the study.
• Processing of the personal data of researchers participating in RESILIENCE study for the purpose of managing their relationship with CNIC within the framework of the study.
• Processing of personal data for the fulfilment of the tax and accounting obligations of CNIC in the framework of RESILIENCE study.
• Processing relating to the management of the data of suppliers and collaborators of CNIC, who provide professional services to the institution within the framework of RESILIENCE study.
• Processing relating to corporate contacts, the purpose of which is the management of the personal data of persons registered in CNIC information systems for the management of contacts for the purpose of calls for public and private events, communications and notifications related to RESILIENCE study.
• Processing of data to contact those requesting information, to respond to their application, request or query.

The personal information you provide to CNIC will be managed exclusively to process your relationship with CNIC in the context of RESILIENCE study, as well as to deal with any other type of request for information you may have made in relation to the same or to the operation of CNIC and the rest of the activities and services published on this Website.

CNIC will treat your personal information with complete confidentiality and will not use it for purposes other than or incompatible with those described in this notice without first requesting your consent.

The processing of your personal information will be carried out in a lawful, fair, transparent, adequate, relevant, limited, accurate and up-to-date manner. For this reason, CNIC undertakes to take all reasonable measures to ensure that this information is deleted or rectified when it is inaccurate.

4.- What is the legal basis for the processing of your data?

The legal basis for the processing of your personal data lies in the management of the request that you have sent to CNIC, the contractual relationship that you have with the institution, your consent to participate in the purposes of processing described in point 3, or those situations in which CNIC is legally entitled to process your personal data or in which there is a legitimate interest.

However, as will be explained below, you have the right to withdraw your consent at any time, as well as to exercise your right to object to the processing described above, by following the instructions provided by CNIC for this purpose.

5.- How long will your data be kept?

The personal data provided will be kept for the duration of your relationship with CNIC, and will be kept beyond this period in cases where it is relevant to the health of the interested parties, or for the time established by law in each case, as well as during the period of limitation of any liabilities that CNIC may incur.

6.- Security Measures

Taking into account the state of the art, the costs of application, and the nature, scope, context and purposes described in point 3 of this Privacy Policy, as well as the risks of varying likelihood and severity for the rights and freedoms of users, CNIC, in compliance with the provisions of Article 32.1. of GDPR, has implemented appropriate technical and organisational measures to ensure an adequate level of security, which where appropriate includes, among others: measures to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, measures to restore availability and access to personal data promptly in the event of a physical or technical incident, and the implementation of a process of regular verification, evaluation and assessment of the effectiveness of technical and organisational measures to ensure the security of the processing.

However, it should be borne in mind that the aforementioned measures are not impregnable and, for this reason, CNIC cannot be held responsible for the use of data due to theft, robbery or any use resulting from the illegality of third parties.

7.- To which recipients will your data be communicated?

CNIC does not intend to communicate or transfer personal information held in its processing systems to third parties, except in those cases where this is required or permitted by law or when you expressly authorize it. In the latter case, CNIC undertakes, where appropriate, to inform all users in advance of the identity of the transferee entity, as well as the purpose of the transfer, in order to obtain their consent.

Users are also informed that their personal data may be accessed by entities or persons outside CNIC, in those cases where this is necessary for the provision of a professional service to CNIC. In the latter case, such access to information will be subject to the signing of a contract regulating the processing of the data, in accordance with the terms and conditions set out in article 28 of GDPR.

8.- International data transfers

In those cases in which the development of RESILIENCE study could imply a transfer of data to destinations outside the European Economic Area, where the regulations on data protection are not as guaranteeing as the Community regulations, CNIC will adopt the appropriate guarantees foreseen in the RGPD or, where appropriate, will request and obtain your explicit consent for the said international transfer of data.

9.- What are your rights when you provide us with your data?

You have the right to access your personal data, as well as to request the rectification of inaccurate data or, where appropriate, request deletion when, among other reasons, the data are no longer necessary for the purposes for which they were collected. You may request the limitation of the processing of your data, in which case, CNIC will only keep them for the exercise or defence of claims or when required by law. You may also object to the processing of your data, in which case, CNIC will cease to process them, unless for legitimate reasons or for reasons of defence against possible claims, it cannot accede to your request for objection. Finally, you may request the portability of your data, as well as that the processing of your data not be based on exclusively automated decisions.

Likewise, in compliance with the provisions of GDPR, you are informed that, if you so wish, you may contact the Spanish Data Protection Agency (http://www.agpd.es) to obtain additional information on your rights and/or to file a complaint when these have not been duly attended to.

10.- User consent

The sending of personal data through the use of electronic or paper forms to CNIC or, where appropriate, e-mail messages or other similar means, implies the express consent of the sender to the processing of the data included in the means of communication related to CNIC. However, you may withdraw this consent at any time, without the need to justify your decision by exercising the rights described in point 9 of this Privacy Policy.

11.- Links

This Privacy Policy only applies to this Website. This Privacy Policy is not guaranteed for access through links to this site, nor for links from this site to other websites.

12.- Additional information

The user guarantees that the data provided is true, exact, complete and up to date, and is responsible for any direct or indirect damage or harm that may be caused as a result of non-compliance with this obligation. In the event that the user provides data of third parties, he/she declares that he/she has their consent and undertakes to pass on to them the information contained in this clause, exempting CNIC from any responsibility in this regard. However, CNIC may carry out checks to verify this fact, adopting the appropriate due diligence measures, in accordance with data protection regulations.

13.- Modification of this Privacy Policy

CNIC reserves the right to modify the present Privacy and Data Protection Policy in accordance with any changes in regulations that may occur, as well as with the doctrinal guidelines laid down by the Spanish Data Protection Agency. All of which will be duly reflected on the present Website in order to inform all users participating or interested in RESILIENCE study.