Capture and use of images and other identifying features
Grifols is a global healthcare group committed to improving the health and well-being of people around the world. Its four divisions – Bioscience, Diagnostic, Hospital and Bio Supplies – develop, produce and market innovative solutions and services that are sold in more than 100 countries.
Grifols respects the privacy rights of any data subjects who entrust Grifols with their personal data and is committed to comply with applicable data protection regulations in each country.
This privacy notice has been prepared in accordance with the General Data Protection Regulation (the "GDPR"). It outlines Grifols' data collection practices and the choices data subjects can make about the way Grifols collects, uses and shares their personal data.
1. Identification of the data controller(s)/owner(s) of the personal data
The data controller/owner of the personal data is the Grifols' group company identified in the authorization document for the recording and use of images and other identifying features or in any communication of similar characteristics. The identity and contact details of the Grifols' group companies is available here.
The Grifols' group company acting as data controller/owner of the personal data shall be referred to as "Grifols".
2. Identification of the data protection officer
The data protection officer acts as an interlocutor between Grifols and you in order to ensure Grifols' compliance with the data protection legislation and guarantee your rights under such legislation. You may contact the data protection officer at dpo@grifols.com, unless the data controllers are Grifols Deutschland GmbH or Haema AG, in which case you may contact the data protection officer of each of these companies at dsb@grifols.com and dsb@haema.com, respectively.
3. Purposes and lawfulness of the processing
| Purpose | Lawful basis |
|---|---|
| The capture, recording and use of the images, voice and other identifying features including audio visual recordings of myself for the purposes described in the authorization document or in any communication of similar characteristics. As set out in Section 7, data subjects may exercise their right of objection and withdrawal of consent to the processing of their personal data for direct marketing. | Consent (article 6.1(a) of GDPR): Data subjects may provide consent by signing the respective authorization document or –if appropriate– by another explicit statement or clear affirmative clear action. Data subjects can withdraw their consent at any time, as detailed in Section 7. |
4. Recipients of personal data
Grifols may share the personal data with:
- Grifols' group companies. The list of Grifols' group companies is available here.
- The owners of the media where the images and, if applicable, the rest of the data subjects' personal data identified in this Privacy Notice, may be included.
- Grifols' service providers to process the personal data for the abovementioned purposes. These providers are photographers, camera operators or any other media agencies, among others.
Grifols will aim that the personal data is sent to countries that offer an adequate level of data protection. If the personal data is processed from countries that do not offer an adequate level of data protection, Grifols and/or the providers (as the case may be) will adopt, if required, the appropriate safeguards on such international data transfers in accordance with applicable data protection legislation. Information on the appropriate safeguards for international data transfers can be obtained from Grifols at privacy@grifols.com.
Grifols does not share the personal data with any other third party, unless required by applicable law.
5. Retention period
Grifols will stop using the personal data of the data subjects once the period set out in the authorization document for the recording and use of images and other identifying features or in any other communication of similar characteristics has elapsed. Thereafter, the personal data will be retained until the end of statutes of limitation of any liabilities that may arise and during the term required to comply with any applicable legal obligation.
6. Sources and categories of personal data
Grifols only processes the personal data that is relevant for the purposes mentioned in Section 3.
Grifols only processes the categories of personal data provided by the data subjects and that include identification details (for example, name, last name, identity/Passport number, image and voice).
7. Data protection rights
The following data protection rights are applicable according to GDPR. Grifols undertakes to respect other data protection rights that are applicable under the data protection legislation in each country.
| Right | Content |
|---|---|
| Access | You may request confirmation as to whether or not your personal data is being processed and, if so, you can obtain access to your personal data included in Grifols' files. |
| Rectification | You may request the rectification of your personal data if this is inaccurate. |
| Erasure | You may request that your personal data is erased. |
| Objection | You may request that your personal data is not processed in specific circumstances. |
| Portability | You may request receiving, in an electronic file, the personal data that you provided Grifols, as well as the right to transmit it to other parties. |
| Restriction of processing | You may request a restriction on how personal data is processed when:
|
| Withdrawal of consent | You may withdraw your consent without affecting the lawfulness of processing based on consent before its withdrawal. |
You may exercise, when appropriate, the data protection rights by sending a written communication to Grifols to privacy@grifols.com and indicating as subject matter of the communication "Authorization for the use of images, voice and other identifying features". For these purposes, Grifols may request a copy of your ID card/passport in force or any other valid document evidencing your identity.
In addition, you may lodge a complaint with a data protection authority, including the one at your residence, place of work or place of the alleged infringement.
Last update: June 2021