Careers Privacy Notice

Privacy notice available in other languages.

Grifols is a global healthcare group founded in Barcelona in 1909 committed to improving the health and wellbeing of people around the world. Its three main business units – Biopharma, Diagnostic and Bio Supplies – develop, produce and market innovative solutions and services that are sold in more than 100 countries.

Grifols respects the privacy rights of all data subjects who entrust Grifols with their personal data and is committed to complying with the data protection regulations applicable in each country.

This privacy notice has been prepared in accordance with the European Union General Data Protection Regulation (the "GDPR") and applicable privacy and data protection laws; see Section 7 for specific provisions. It outlines Grifols' data collection practices and data subjects’ rights in the context of Grifols' collection, use and sharing of their personal data.

This privacy notice applies to the processing of personal data of candidates or potential candidates that apply for and/or are offered a job position within a Grifols' group company.

1. Identification of the data controller(s)/owner(s) of the personal data

The data controller(s)/owner(s) is/are:

(a) Grifols, S.A.,

(b) The Grifols' group company or foundation with an open job position to which you have applied for or which has been offered to you (the "Employer"), or

Grifols, S.A. and the Employer will jointly be the data controllers/owners of the personal data. Grifols Viajes, S.A., if applicable, will act as independent data controller/owner of the personal data.

The identity and contact details of Grifols, S.A. and of the applicable Employer are available here. The Grifols' group company/ies or foundations acting as controller/s or joint controller/s will be referred to as "Grifols".

2. Identification of the data protection officer

The data protection officer acts as an interlocutor between Grifols and you in order to ensure Grifols' compliance with the data protection legislation and best protect your rights under such legislation. You may contact the data protection officer at dpo@grifols.com, unless the data controllers are Grifols Deutschland GmbH or Haema AG, in which case you may contact the data protection officer of each of these companies at dsb@grifols.com and dsb@haema.de, respectively.

The data subjects may ask, if they wish so, the data protection officer for more information on the essential aspects of the joint controllership agreement resulting from what is set out in Section 1.

3. Purposes, lawful basis for processing, categories and recipients of personal data

Purposes

To manage and assess your application or interest in a job position and, if applicable, the recruiting process. This processing includes without limitation:
- Manage your access and use of the recruitment platform
- Creation and edition of your profile, employment alerts and searches
- Application to job offers through the recruitment platform, social network functionalities or any other third-party feature embedded in the platform
- Communication with you in respect of the recruitment process
- Performance of questionnaires, interviews, language, personality and other tests as needed

Categories of personal data and recipients

To manage and assess your application or interest in a job position and, if applicable, the recruiting process. This processing includes without limitation:
- Manage your access and use of the recruitment platform
- Creation and edition of your profile, employment alerts and searches
- Application to job offers through the recruitment platform, social network functionalities or any other third-party feature embedded in the platform
- Communication with you in respect of the recruitment process

Performance of questionnaires, interviews, language, personality and other tests as needed

Lawful basis

Pre-contractual measures: when the processing is carried out by the Employer.

Legitimate interest: when the processing is carried out by Grifols, S.A.

To perform background screening and reference checks to assess your suitability for a specific job position. This screening may be legally mandatory for certain job positions and may include but is not limited to:
- Identity and academic verification
- Employment verification with current and past employers
- Media searches including social networks
- Criminal background checks

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics¹.
Contact details².
Professional data³.
Academic information⁶.
Convictions and criminal offences data.

Recipients:

Grifols' group of companies.
Providers of products and services.
Workers' legal representation.

Lawful basis

Legitimate interest

Legal obligation

To offer you a job position if you have been selected by sending you the job offer letter and other relevant documentation.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics¹.
Contact details².
Professional data³.
Financial data⁴.
Academic information⁶.

Recipients:

Grifols' group of companies.
Providers of products and services.
Workers' legal representation.

Lawful basis: Pre-contractual measures

To send surveys or similar

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics¹.
Contact details².
Professional data³.
Academic information⁶.
Interests and preferences.

Recipients:

Grifols' group of companies.
Providers of products and services.

Lawful basis: Legitimate interest

To contact you for future job positions of the Employer and/or of other Grifols' group companies based on your preferred selection and send you general company and job-related information by any means, including electronic ones. As set out in Section 6 you can withdraw your consent to have your data processed for this purpose.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics¹.
Contact details².
Professional data³.
Browsing history data⁵.

Recipients:

Grifols' group of companies.
Providers of products and services.

Lawful basis: Consent

To manage and control your registration, participation and attendance to recruitment fairs, conferences, webinars, or similar events, in person or online, organized by Grifols or third parties.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics¹.
Contact details².
Professional data³.
Academic information⁶.

Recipients:

Grifols' group companies.
Providers of products and services.

Lawful basis: Consent

To analyse and, where appropriate, respond to any requests for information, suggestions and/or queries made through the means provided for this purpose.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics¹.
Contact details².
Professional data³.

Recipients:

Grifols' group companies.
Providers of products and services.

Lawful basis: Legitimate interest

To interact (i.e., respond to messages or comments related to recruitment processes, generate reactions, share content, etc.) with users of Grifols' profiles on social networks, which would involve the communication of certain data (i.e., IP address and browsing history data) to the providers of these social networks.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics¹.
Contact details².
Browsing history data⁵.

Recipients:

Grifols' group of companies.
Providers of products and services.

Lawful basis: Legitimate interest

To carry out maintenance tasks in the recruiting platform, websites, landing pages and apps to offer a secure environment to its users.

Categories of personal data and recipients

Categories of personal data:

Browsing history data⁵.

Recipients:

Grifols' group of companies.
Providers of products and services.

Lawful basis: Legitimate interest

To customize certain features of the recruiting platform, websites, landing pages, and apps based on your browsing preferences and analyse your browsing behaviour with the aim of improving the services offered through these platforms. If applicable, the information about behavioural analysis is available in the Cookies Policy of the relevant website, landing page, or app.

Categories of personal data and recipients

Categories of personal data:

Browsing history data⁵.
Interests and preferences.

Recipients:

Grifols' group companies.
Providers of products and services.

Lawful basis: Consent

To create profiles based on your attributes and characteristics identified through personality tests and on the information provided by you and other third-party sources. Grifols will use these profiles to assess your competencies and qualifications as a potential employee and evaluate whether your profile matches the specific position within the company. Automated decisions will not be taken based on such profile.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics¹.
Contact details².
Professional data³.
Academic information⁶.
Interests and preferences.

Recipients:

Grifols' group of companies.
Providers of products and services.

Lawful basis: Legitimate interest

To manage corporate reorganization activities.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics¹.
Contact details².
Professional data³.
Browsing history data⁵.
Academic information⁶.
Interests and preferences.
Special categories of data⁷.

Recipients:

Grifols' group of companies.
Providers of products and services.
Potential investors or purchasers.

Lawful basis: Legitimate interest

To manage travel arrangements in relation to the assessment of a candidacy.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics¹.
Contact details².
Health data.

Recipients:

Grifols' group of companies.
Providers of products and services.
Public bodies.

Lawful basis

Pre-contractual measures: when the processing is carried out by the Employer.

Legitimate interest: when the processing is carried out by Grifols Viajes, S.A.

Consent: for the processing of health data.

For example, name, last name, username.
For example, home address, personal e-mail address and telephone number.
For example, professional contact details, job position, place of work, member of professional associations.
For example, bank details.,
For example, IP address, device or user ID, browser type and version, visited sections, country from which the connection is made.
For example, training, degree, curriculum vitae.
For example, health data, racial or ethnic origin, trade union membership and religious or philosophical beliefs, as permitted by applicable laws.

For example, name, last name, username.

For example, home address, personal e-mail address and telephone number.

For example, professional contact details, job position, place of work, member of professional associations.

For example, bank details.,

For example, IP address, device or user ID, browser type and version, visited sections, country from which the connection is made.

For example, training, degree, curriculum vitae.

For example, health data, racial or ethnic origin, trade union membership and religious or philosophical beliefs, as permitted by applicable laws.
Purposes	Categories of personal data and recipients	Lawful basis
To manage and assess your application or interest in a job position and, if applicable, the recruiting process. This processing includes without limitation: Manage your access and use of the recruitment platform Creation and edition of your profile, employment alerts and searches Application to job offers through the recruitment platform, social network functionalities or any other third-party feature embedded in the platform Communication with you in respect of the recruitment process Performance of questionnaires, interviews, language, personality and other tests as needed	To manage and assess your application or interest in a job position and, if applicable, the recruiting process. This processing includes without limitation: Manage your access and use of the recruitment platform Creation and edition of your profile, employment alerts and searches Application to job offers through the recruitment platform, social network functionalities or any other third-party feature embedded in the platform Communication with you in respect of the recruitment process Performance of questionnaires, interviews, language, personality and other tests as needed	Pre-contractual measures: when the processing is carried out by the Employer. Legitimate interest: when the processing is carried out by Grifols, S.A.
To perform background screening and reference checks to assess your suitability for a specific job position. This screening may be legally mandatory for certain job positions and may include but is not limited to: Identity and academic verification Employment verification with current and past employers Media searches including social networks Criminal background checks	Categories of personal data: Identification data and personal characteristics¹. Contact details². Professional data³. Academic information⁶. Convictions and criminal offences data. Recipients: Grifols' group of companies. Providers of products and services. Workers' legal representation.	Legitimate interest Legal obligation
To offer you a job position if you have been selected by sending you the job offer letter and other relevant documentation.	Categories of personal data: Identification data and personal characteristics¹. Contact details². Professional data³. Financial data⁴. Academic information⁶. Recipients: Grifols' group of companies. Providers of products and services. Workers' legal representation.	Pre-contractual measures
To send surveys or similar	Categories of personal data: Identification data and personal characteristics¹. Contact details². Professional data³. Academic information⁶. Interests and preferences. Recipients: Grifols' group of companies. Providers of products and services.	Legitimate interest
To contact you for future job positions of the Employer and/or of other Grifols' group companies based on your preferred selection and send you general company and job-related information by any means, including electronic ones. As set out in Section 6 you can withdraw your consent to have your data processed for this purpose.	Categories of personal data: Identification data and personal characteristics¹. Contact details². Professional data³. Browsing history data⁵. Recipients: Grifols' group of companies. Providers of products and services.	Consent
To manage and control your registration, participation and attendance to recruitment fairs, conferences, webinars, or similar events, in person or online, organized by Grifols or third parties.	Categories of personal data: Identification data and personal characteristics¹. Contact details². Professional data³. Academic information⁶. Recipients: Grifols' group companies. Providers of products and services.	Consent
To analyse and, where appropriate, respond to any requests for information, suggestions and/or queries made through the means provided for this purpose.	Categories of personal data: Identification data and personal characteristics¹. Contact details². Professional data³. Recipients: Grifols' group companies. Providers of products and services.	Legitimate interest
To interact (i.e., respond to messages or comments related to recruitment processes, generate reactions, share content, etc.) with users of Grifols' profiles on social networks, which would involve the communication of certain data (i.e., IP address and browsing history data) to the providers of these social networks.	Categories of personal data: Identification data and personal characteristics¹. Contact details². Browsing history data⁵. Recipients: Grifols' group of companies. Providers of products and services.	Legitimate interest
To carry out maintenance tasks in the recruiting platform, websites, landing pages and apps to offer a secure environment to its users.	Categories of personal data: Browsing history data⁵. Recipients: Grifols' group of companies. Providers of products and services.	Legitimate interest
To customize certain features of the recruiting platform, websites, landing pages, and apps based on your browsing preferences and analyse your browsing behaviour with the aim of improving the services offered through these platforms. If applicable, the information about behavioural analysis is available in the Cookies Policy of the relevant website, landing page, or app.	Categories of personal data: Browsing history data⁵. Interests and preferences. Recipients: Grifols' group companies. Providers of products and services.	Consent
To create profiles based on your attributes and characteristics identified through personality tests and on the information provided by you and other third-party sources. Grifols will use these profiles to assess your competencies and qualifications as a potential employee and evaluate whether your profile matches the specific position within the company. Automated decisions will not be taken based on such profile.	Categories of personal data: Identification data and personal characteristics¹. Contact details². Professional data³. Academic information⁶. Interests and preferences. Recipients: Grifols' group of companies. Providers of products and services.	Legitimate interest
To manage corporate reorganization activities.	Categories of personal data: Identification data and personal characteristics¹. Contact details². Professional data³. Browsing history data⁵. Academic information⁶. Interests and preferences. Special categories of data⁷. Recipients: Grifols' group of companies. Providers of products and services. Potential investors or purchasers.	Legitimate interest
To manage travel arrangements in relation to the assessment of a candidacy.	Categories of personal data: Identification data and personal characteristics¹. Contact details². Health data. Recipients: Grifols' group of companies. Providers of products and services. Public bodies.	Pre-contractual measures: when the processing is carried out by the Employer. Legitimate interest: when the processing is carried out by Grifols Viajes, S.A. Consent: for the processing of health data.

Without prejudice of the categories of personal data shown in the table above, please be informed that the categories of personal data that are processed for compliance with legal obligations may differ depending on the jurisdiction of the potential Employer.

3.1. Additional information about the lawful basis to process personal data

The table above shows the applicable lawful basis to process the personal data by purpose. In this section, you can find additional details of the lawfulness of the processing:

Application of pre-contractual measures at data subjects' request: applies when the processing of your personal data is necessary for managing your job application with the intention of offering you an employment agreement at Grifols. If you refuse to provide the personal data requested by the Employer, from time to time, the Employer may find it impossible to initiate the employment relationship with you.
Legal obligation: applies when processing your personal data is necessary to comply with the legal obligations that apply to Grifols. Section 7 includes details of the specific regulations applicable to Grifols that require the processing of your personal data. Failure to provide the personal data requested could result in Grifols being unable to comply with such legal obligations.
Consent: applies when you decide to give your consent –it must be obtained through a clear affirmative action, for example, by clicking acceptance buttons or similar and for a particular purpose. You may withdraw your consent at any time, as detailed in Section 6. Your refusal to grant the consent requested will not negatively affect the recruiting process.
Legitimate interest (of Grifols and/or any third party): Grifols seeks to ensure the robust and effective selection of qualified personnel to enhance the expansion of its business operations in line with its corporate values. Therefore, Grifols pursues the following legitimate interests which override the fundamental rights and freedoms of candidates, given that the processing is within the individual reasonable expectations:
- Prevention of fraud;
- Daily management of a multinational group of companies and internal administration, which means sharing information with the companies of the Grifols group;
- Creation of a secure information system infrastructure for preventing unlawful or malicious activities that may compromise the personal data stored in the information systems.

In any event, you may request further information on the legitimate interest or exercise your right to object to the processing of your personal data based on legitimate interest by addressing your request to privacy@grifols.com.

The processing of special categories of personal data and data related to criminal convictions and offences is permitted only according to the regulations in each country. See Section 7 for details.

3.2. Recipients of personal data

The table above shows categories of recipients with whom Grifols may share your personal data by purpose. This section includes additional information regarding these recipients when applicable:

Grifols' group of companies: The list is available here.
Providers of products and services: for example, information technology providers, event organizers, human resources service providers, lawyers, auditors.

Grifols' website may include social network plugins, which can be recognised by the social network's logo or name, so that you can access Grifols' profile on these platforms. By clicking these buttons, your personal data (including, IP address and browsing data) will be transferred to the providers of said social networks. Grifols will not be liable for any further processing that the providers of the social networks may carry out with your personal data. The purpose and scope of the collection of data and its subsequent processing and use by the providers of these social networks, as well as the related rights and the possibilities of configuring privacy settings can be consulted in the data protection information of each of these companies.

Legal representation of workers: work councils, staff representatives, trade union sections and representatives.
Public bodies: such as health, labour, social, tax or judicial authorities, among others.
Financial entities for the reimbursement of travel expenses when applicable.

Grifols will endeavour that your personal data is only transferred to countries that offer an adequate level of data protection. If your personal data is processed in countries that do not offer said level of protection, Grifols and/or the providers (as the case may be) will adopt, if necessary, the appropriate safeguards (e.g. the standard contractual clauses included in the Commission Implementing Decision (EU) 2021/914 of 4 June 2021, if GDPR is applicable) to carry out such international data transfers in accordance with the applicable data protection legislation. Specific information on the appropriate safeguards applicable to each international data transfer can be obtained from Grifols at privacy@grifols.com.

Grifols does not share your personal data with any other third party unless it is authorized by you or required by the applicable law.

4. Retention period

Grifols will retain your personal data for the time strictly necessary for the fulfilment of the purposes for which it has been collected or, if applicable, until the end of the statutes of limitation of any liabilities that may arise, and during the term required to comply with any applicable legal obligation.

Data stored in the recruitment platform will be retained for 3 years since your last access to the platform or the end of the recruitment process where you participate.

5. Sources of personal data

If you do not directly provide Grifols with your personal data, Grifols may obtain your personal data from recruitment agencies, present or former employers, other Grifols' employees, event organizers, databases and public sources, such as websites, social networks and publications, among others.

6. Data protection rights

The following data protection rights are applicable under the GDPR. Grifols undertakes to respect other data protection rights that may be applicable in accordance with the data protection legislation of each country.

Rights

Access

Content: You may request confirmation as to whether or not your personal data is being processed and, if so, you can obtain access to your personal data included in Grifols' files.

Rectification

Content: You may request the rectification of your personal data if inaccurate.

Erasure

Content: You may request the erasure of your personal data.

Objection

Content: You may request that your personal data is not processed under specific circumstances.

Portability

Content: You may request receiving, in an electronic file, the personal data that you provided Grifols with, as well as the right to transmit it to other parties.

Restriction of processing

Content

You may request a restriction on how your personal data is processed when:

the accuracy of the personal data is being verified after you have contested its accuracy.
processing of your personal data is unlawful and you object to its erasure.
Grifols no longer needs the personal data for the purposes of processing it, but you need it in order to prepare, exercise or defend a legal claim.
you have objected to the processing of the personal data for the performance of a task carried out in the public interest or necessary for the purposes of a legitimate interest, while verifying if Grifols' legitimate grounds override yours.

Withdrawal of consent

Content: You may withdraw your consent without affecting the lawfulness of the processing based on consent before its withdrawal.

Rights	Content
Access	You may request confirmation as to whether or not your personal data is being processed and, if so, you can obtain access to your personal data included in Grifols' files.
Rectification	You may request the rectification of your personal data if inaccurate.
Erasure	You may request the erasure of your personal data.
Objection	You may request that your personal data is not processed under specific circumstances.
Portability	You may request receiving, in an electronic file, the personal data that you provided Grifols with, as well as the right to transmit it to other parties.
Restriction of processing	You may request a restriction on how your personal data is processed when: the accuracy of the personal data is being verified after you have contested its accuracy. processing of your personal data is unlawful and you object to its erasure. Grifols no longer needs the personal data for the purposes of processing it, but you need it in order to prepare, exercise or defend a legal claim. you have objected to the processing of the personal data for the performance of a task carried out in the public interest or necessary for the purposes of a legitimate interest, while verifying if Grifols' legitimate grounds override yours.
Withdrawal of consent	You may withdraw your consent without affecting the lawfulness of the processing based on consent before its withdrawal.

You may exercise, when appropriate, your data protection rights by, for example, sending a written communication to Grifols at privacy@grifols.com with the subject line "Recruiting". To that end, Grifols may request further information or documents if necessary and appropriate to identify you.

For residents in the United States, please contact the Privacy Office at US-PrivacyRights@Grifols.com.

In addition, you may lodge a complaint with a data protection authority, including the one at your residence, place of work or place of the alleged infringement.

7. Specific provisions

European Union

The lawful basis to process personal data identified in Section 3 are regulated in the following provisions of the GDPR:

Application of pre-contractual measures at data subjects' request: article 6.1(b) of GDPR
Legal obligation: article 6.1(c) of GDPR
Consent: article 6.1(a) of GDPR
Legitimate interest (of Grifols and/or any third party): article 6.1(f) of GDPR

The processing of special categories of personal data is covered by your explicit consent (article 9.2(a) of the GDPR), the fulfilment of obligations and the exercise of specific rights in the field of employment, social security and social protection law (article 9.2(b) of the GDPR) or the processing is necessary for the assessment of the working capacity of the employee (article 9.2 (h) of the GDPR).

The processing of personal data related to criminal convictions and offences is permitted only under the control of official authority or covered by the fulfilment of legal obligations (article 10 of the GDPR).

The legal obligation referred to in Section 3 with respect to the performance of criminal background checks by Grifols is regulated in the following laws and in any other laws that develop, complement and/or replace them:

Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002.
Regulation (EU) 2015/1998 of 5 November 2015 laying down detailed measures for the implementation of the common basic standards on aviation security.

France

When Grifols France S.A.R.L. is the data controller, the data subjects have the right to provide guidance on the management of their data after their death.

Germany

In Germany, any processing of a candidate’s personal data necessary for the decision about establishing an employment relationship with that respective candidate may be based on Sec. 26 Par. 1 S. 1 of the Federal Data Protection Act in addition to Art. 6.1(b) of the GDPR.

According to Sec. 26 Par. 3 S. 1 of the Federal Data Protection Act, this legal basis also covers the processing of sensitive data normally prohibited under Art. 9.1 GDPR.

Furthermore, there are additional German provisions on data subject rights (cf. Secs. 32 to 37 of the Federal Data Protection Act).

Portugal

When Grifols Portugal – Produtos Farmacêuticos e Hospitalares, Lda. Is the data controller, the data subjects have the right to provide guidance on the management of their data after their death. When guidance on the management of their data has not been provided by the deceased data subjects, the exercise of their data protection rights defined in Section 6 may be carried out by their heirs. The data subjects may also determine the impossibility of exercising these rights after their death.

When there is a legal obligation of secrecy, the rights of the data subjects cannot be exercised.

Spain

The legal obligation referred to in Section 3 with respect to the performance of criminal background checks by Grifols is regulated in Law 21/2003 of 7 July 2003 on Aviation Safety and in any other laws that develop, complement and/or replace it.

Thailand

When Grifols (Thailand) Ltd. is the data controller, see full privacy notice here.

United Kingdom

All references throughout the document to the GDPR also refer to, as applicable, the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland.

Grifols UK Ltd. will usually undertake DBS checks on personnel involved in the supply of services to UK hospitals in order to meet its contractual obligations to hospitals in the UK to comply with NHS and regulatory requirements in relation to background checks on staff. Where we undertake DBS checks: (a) we consider that we have a legitimate interest in doing so in accordance with Article 6.1(f) of the UK GDPR, and (b) we may share the results of the DBS check with the UK hospitals to which our services are being provided and with which we have a contract, and to Grifols, S.A.

United States

When Grifols Shared Services North America, Inc. on behalf of itself and its affiliated companies under common ownership and control, is the data controller, see the California Personnel Privacy Policy here.

Privacy notice available in other languages

DE – DATENSCHUTZHINWEIS – KARRIERE ES – AVISO DE PROTECCION DE DATOS - VACANTES DE EMPLEO

Last update: March 2024