3.1. Additional information about the lawful basis to process personal data
The table above shows the applicable lawful basis to process the personal data by purpose. In this section, you can find additional details of the lawfulness of the processing:
- Consent: Data subjects may provide their consent, for example, by clicking acceptance buttons or ticking boxes in cookies’ banners of webs, landing pages and apps, or making any other affirmative clear action (for example by voluntarily posing in front of a camera). Data subjects may withdraw their consent at any time, as set out in Section 6.
- Legitimate interest (of Grifols and/or third parties): Grifols considers that the legitimate interests to facilitate the virtual attendance to the Shareholders’ Meeting by shareholders and its representatives by broadcasting it in real time, as well as the capture of images and audiovisual recording to document the event, override the fundamental rights and freedoms of the data subjects, given that these processings are within the data subjects' reasonable expectations based on their relationship with Grifols.
In any event, data subjects may request further information on the legitimate interest or exercise their right to object to the processing of their personal data based on legitimate interest by addressing their request to privacy@grifols.com.
- Execution of a contract: Failure to provide the personal data requested may result in Grifols being unable to manage or maintain the shareholding relationship with the data subject, or where applicable, the process any proxy granted for attendance at and the exercise of shareholders’ rights at the General Shareholders Meeting.
- Legal Obligation: applies when the processing of personal data is necessary to comply with legal obligations aplicable to Grifols. Failure to provide the personal data requested could result in the impossibility for Grifols to comply with such legal obligations. Section 7 includes details of the specific regulations applicable to Grifols that require the processing of personal data.
3.2. Recipients of personal data
The table above shows categories of recipients with whom Grifols may share personal data, by purpose. This section includes additional information regarding these recipients when applicable:
- Providers of products and services: for example, service providers related to the organization and management of the shareholders’ meeting; providers of the virtual meeting platform; event organizers; the public notary responsible for recording the minutes of the meeting; lawyers; auditors; photographers; camera crews; and media agencies or media owners.
The Company’s websites may include cookies or similar technologies from third parties other than the Company’s. This usually occurs when the Company’s website incorporates elements from other websites (such as images or social network plugins, for example, to access the Company’s profile on these platforms) or when the Company contracts third parties to provide measurement, analysis or marketing services for the website. By accepting the installation of these cookies, clicking on these plugins or performing similar actions, users' personal data (including, IP address and browsing data) may be transferred to the providers of these technologies, including social network providers. The Company will not be liable for any further processing of such personal data by these providers.
The purpose and scope of the data collection, as well as its subsequent processing and use by the providers of such technologies, together with the related rights and available options for configuring privacy settings, may be consulted in the privacy information provided by these companies.
Grifols will endeavour that the personal data is only transferred to countries that offer an adequate level of data protection. If the personal data is processed in countries that do not offer said level of protection, Grifols and/or the providers (as the case may be) will adopt, if necessary, the appropriate safeguards (e.g. the standard contractual clauses included in the Commission Implementing Decision (EU) 2021/914 of 4 June 2021, if GDPR is applicable) to carry out such international data transfers in accordance with the applicable data protection legislation. Specific information on the appropriate safeguards applicable to each international data transfer can be obtained from Grifols at privacy@grifols.com.
Grifols does not share personal data with any other third party unless it is authorised by the data subject or required by the applicable law.