Capture and use of images and other identifying features

Privacy notice available in other languages.

Grifols is a global healthcare group committed to improving the health and well-being of people around the world. Its four divisions – Bioscience, Diagnostic, Hospital and Bio Supplies – develop, produce and market innovative solutions and services that are sold in more than 100 countries.

Grifols respects the privacy rights of any data subjects who entrust Grifols with their personal data and is committed to comply with applicable data protection regulations in each country.

This privacy notice has been prepared in accordance with the General Data Protection Regulation (the "GDPR"), applicable privacy and data protection laws, and specific provisions referenced in Section 8, below.)It outlines Grifols' data collection practices and the choices data subjects can make about the way Grifols collects, uses and shares their personal data.

1. Identification of the data controller(s)/owner(s) of the personal data

The data controller/owner of the personal data is the Grifols' group company identified in the authorization document for the recording and use of images and other identifying features or in any communication of similar characteristics. The identity and contact details of the Grifols' group companies is available here.

The Grifols' group company acting as data controller/owner of the personal data shall be referred to as "Grifols".

2. Identification of the data protection officer

The data protection officer acts as an interlocutor between Grifols and you in order to ensure Grifols' compliance with the data protection legislation and guarantee your rights under such legislation. You may contact the data protection officer at dpo@grifols.com, unless the data controllers are Grifols Deutschland GmbH or Haema AG, in which case you may contact the data protection officer of each of these companies at dsb@grifols.com and dsb@haema.de, respectively. For residents in the United States, please contact the Privacy Office at US-PrivacyRights@Grifols.com.

3. Purposes and lawfulness of the processing
Purpose

The capture, recording and use of the images, voice and other identifying features including audio visual recordings of myself for the purposes described in the authorization document or in any communication of similar characteristics. When the data subjects are patients these recordings may include data relating to their health. As set out in Section 7, data subjects may exercise their right of objection and withdrawal of consent to the processing of their personal data for direct marketing.
Legal basis

Explicit Consent (article 6.1(a) and 9.2(a) of GDPR):
Data subjects may provide consent by signing the respective authorization document or –if appropriate– by another explicit statement or clear affirmative clear action.

Data subjects can withdraw their consent at any time, as detailed in Section 7.

Purpose Legal basis

The capture, recording and use of the images, voice and other identifying features including audio visual recordings of myself for the purposes described in the authorization document or in any communication of similar characteristics. When the data subjects are patients these recordings may include data relating to their health. As set out in Section 7, data subjects may exercise their right of objection and withdrawal of consent to the processing of their personal data for direct marketing.

Explicit Consent (article 6.1(a) and 9.2(a) of GDPR):
Data subjects may provide consent by signing the respective authorization document or –if appropriate– by another explicit statement or clear affirmative clear action.

Data subjects can withdraw their consent at any time, as detailed in Section 7.

4. Recipients of personal data

If needed, Grifols may share the personal data with:

  • Grifols' group companies. The list of Grifols' group companies is available here.
  • The owners of the media where the images and, if applicable, the rest of the data subjects' personal data identified in this Privacy Notice, may be included.
  • Grifols' service providers to process the personal data for the abovementioned purposes. These providers are photographers, camera operators or any other media agencies, among others.

Grifols will aim that the personal data is sent to countries that offer an adequate level of data protection. If the personal data is processed from countries that do not offer an adequate level of data protection, Grifols and/or the providers (as the case may be) will adopt, if required, the appropriate safeguards on such international data transfers in accordance with applicable data protection legislation. Information on the appropriate safeguards for international data transfers can be obtained from Grifols at privacy@grifols.com.

Grifols does not share the personal data with any other third party, unless required by applicable law. 

5. Retention period

Grifols will stop using the personal data of the data subjects once the period set out in the authorization document for the recording and use of images and other identifying features or in any other communication of similar characteristics has elapsed. Thereafter, the personal data will be retained until the end of statutes of limitation of any liabilities that may arise and during the term required to comply with any applicable legal obligation.

6. Sources and categories of personal data

Grifols only processes the personal data that is relevant for the purposes mentioned in Section 3.

Grifols only processes the categories of personal data provided by the data subjects and that include identification details (for example, name, last name, identity/Passport number, image and voice) and if applicable, information about your health.

7. Data protection rights

The following data protection rights are applicable according to GDPR. Grifols undertakes to respect other data protection rights that are applicable under the data protection legislation in each country.  See Section 8 for specific provisions

Right

Access
Content

You may request confirmation as to whether or not your personal data is being processed and, if so, you can obtain access to your personal data included in Grifols' files.

Rectification
Content

You may request the rectification of your personal data if this is inaccurate.

Erasure
Content

You may request that your personal data is erased.

Objection
Content

You may request that your personal data is not processed in specific circumstances.

Portability
Content

You may request receiving, in an electronic file, the personal data that you provided Grifols, as well as the right to transmit it to other parties.

Restriction of processing
Content

You may request a restriction on how personal data is processed when:

  • the accuracy of your personal data is being verified after you have contested its accuracy.
  • processing of your personal data is unlawful, and you oppose to its erasure.
  • Grifols no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims.
  • you have objected to the processing for the performance of a task carried out in the public interest or that is necessary for the purposes of a legitimate interest, whilst it is being verified whether the legitimate grounds of Grifols override yours. 

Withdrawal of consent
Content

You may withdraw your consent without affecting the lawfulness of processing based on consent before its withdrawal.

Right Content

Access

You may request confirmation as to whether or not your personal data is being processed and, if so, you can obtain access to your personal data included in Grifols' files.

Rectification

You may request the rectification of your personal data if this is inaccurate.

Erasure

You may request that your personal data is erased.

Objection

You may request that your personal data is not processed in specific circumstances.

Portability

You may request receiving, in an electronic file, the personal data that you provided Grifols, as well as the right to transmit it to other parties.

Restriction of processing

You may request a restriction on how personal data is processed when:

  • the accuracy of your personal data is being verified after you have contested its accuracy.
  • processing of your personal data is unlawful, and you oppose to its erasure.
  • Grifols no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims.
  • you have objected to the processing for the performance of a task carried out in the public interest or that is necessary for the purposes of a legitimate interest, whilst it is being verified whether the legitimate grounds of Grifols override yours. 

Withdrawal of consent

You may withdraw your consent without affecting the lawfulness of processing based on consent before its withdrawal.

You may exercise, when appropriate, the data protection rights by sending a written communication to Grifols to privacy@grifols.com and indicating as subject matter of the communication "Authorization for the use of images, voice and other identifying features". For these purposes, Grifols may request a copy of your ID card/passport in force or any other valid document evidencing your identity.

In addition, you may lodge a complaint with a data protection authority, including the one at your residence, place of work or place of the alleged infringement.

8. Specific Provisions

United States

You can check the privacy notice here

Last update: January 2023

Privacy notice available in other languages

AR – Privacy policy – Capture and use of images and other identifying features ES – Privacy policy - Capture and use of images and other identifying features