Privacy Notice – Private Contact Form

PRIVACY NOTICE – PRIVATE CONTACT FORM

Article 13 Regulation (EU) 2016/79 “General Data Protection regulation”

Please find herewith below a brief description of the processing of the personal data you will provide us with by filling in the present “Contact Form” in order to contribute to the project conect4children (hereinafter the” Project”). Activity will be coordinated by Fondazione Penta – for the treatment and care of children with HIV (and related diseases) – ONLUS, an organization incorporated in Italy (Fiscal Code 92166930286) whose registered office is in Padova, Corso Stati Uniti, 4, e-mail info@penta-id.org, in collaboration with Fundació Sant Joan de Déu, an organization incorporated in Spain (Fiscal Code G62978689) whose registered office is in Santa Rosa 39-57 – 08950 Esplugues de Llobregat (Spain), acting as Data controllers.

The data processing will be carried out in compliance with Regulation (EU) 2016/679 General Data Protection Regulation (hereinafter the “GDPR”) and other relevant Law and Regulation in force. Pursuant to art. 13 of the GDPR, the Data Controllers provide you the following information on the data processing.

a) Data Controller:

The Data Controller are the following organizations:

• Fondazione Penta – for the treatment and care of children with HIV (and related deseases) – ONLUS, an organization incorporated in Italy (Fiscal Code 92166930286) whose registered office is in Padova, Corso Stati Uniti, 4, e-mail info@penta-id.iorg (hereinafter “Penta”).
• Fundació Sant Joan de Déu, an organization incorporated in Spain (Fiscal Code G62978689) whose registered office is in Santa Rosa 39-57 – 08950 Esplugues de Llobregat (Spain) (hereinafter “FSJD”).

b) Data Protection Officer (DPO):

According to art. 37 of the GDPR:

• Penta has appointed a Data Protection Officer (art. 37 of the GDPR) whom may be contacted at the following e-mail address dpo@pentafoundation.org;
• FSJD, has appointed a Data Protection Officer (art. 37 of the GDPR) whom may be contacted at the following e-mail address dpo@sjdhospitalbarcelona.org

c) Purposes and legal basis of the processing

Your personal data are processed:

• by FSJD according to the GDPR, for the following purposes:

1. allow you to contribute to the scientific research related to the Project, and to be contacted by FSJD in order to provide your input to the protocol design and to the Project itself.
2. To assess the impact of patient and public involvement (PPI) initiatives on clinical trial performance from sites that are part of the c4c network and will participate in one of the Academic PoV trials.

The data requested by FSJD for purposes no. 1) are mandatory fields in the registration form of the data base and, should these data be omitted or only partially provided, you might not be able to send the present Contact Form. The legal basis applicable to such data processing is the execution of the contractual relationship between you and FSJD (having as object your request to be contacted by FSJD to contribute to the Project) (art. 6, par. 1, let. b) of the GDPR). The data provided for purpose no. 1), could belong to special categories of data; in case you need to provide FSJD with such data (e.g. data concerning health), the data processing will be based on the consent you may grant FSJD with (art.9, par. 2 let. a) of the GDPR). The Data Controllers remind you that your consent can be freely withdraw by sending an e-mail to dpo@sjdhospitalbarcelona.org Withdrawing your consent shall not affect the lawfulness of the processing based on consent before its withdrawal.

• by Penta, according to the GDPR, for the following purposes:

1. to update you, through newsletters or other communications regarding initiatives and activities related to the Project.

The data requested by Penta for the purpose no. 2) are optional and the legal basis of such data processing is the consent you may grant Penta with (art. 6, par. 1 let. a) of the GDPR). The Data Controllers remind you that your consent can be freely withdraw by sending an e-mail to info@penta-id.org. Withdrawing your consent shall not affect the lawfulness of the processing based on consent before its withdrawal.

d) Means of the processing

Your data will be processed and stored either by computerized means and by not computerized means, in compliance with the legislation in force and, in any case, in a way that ensures their safety, confidentiality and prevents unauthorized dissemination or use, falsification or destruction.

e) Data storage period

The data processed by FSJD for the purposes no. 1) will be stored for the time necessary to pursuit the objectives of the Project. At any rate, the processing of such data will be limited to the maximum period of 66 months, after which they will be destroyed or anonymized.

The data processed by Penta for the purposes no. 2), will be stored for the entire duration of your subscription to the Project’s newsletter and, in any case, for a maximum period of five years after which they will be destroyed or anonymized.

f) Processing recipients

Your data will not be disseminated. Within FSJD and Penta (for their respective data processing activities), the personal data provided by you, may come to knowledge of the persons expressly authorized to the processing by the Data Controllers. Moreover:

• Within FSJD, the personal data provided by you, may come to knowledge of the following third parties: (i) web agencies and other organizations which provide FSJD with services related to the web site (i.e. Penta Foundation) (iii)Where necessary, FSJD has appointed such processing recipients as Data processor pursuant to art. 28 of the GDPR. A list of all the Data processor designated by FSJD can be required by notice to be sent to the e-mail address dpo@sjdhospitalbarcelona.org
• Within Penta, the personal data provided by you, may come to knowledge of the following third parties: (i) companies which provide Penta with services related to the implementation and maintenance of the web site (i.e. web agencies, etc.); (ii) companies which provide Penta with services related to the processing, managing and sending of newsletters and other promotional material. Where necessary, Penta has appointed such processing recipients as Data processor pursuant to art. 28 of the GDPR. A list of all the Data processor designated by Penta can be required by notice to be sent to the e-mail address info@penta-id.org.

g) Data subject’s rights

You may at any time exercise the rights provided for by articles 15 to 22 of the GDPR, for the data processed by FSJD according to purposes no.1) let. c), by notice to be sent to the e-mail address dop@sjdhospitalbarcelona.org for the data processed by Penta according to purpose no. 2) let. c), by notice to be sent to the e-mail address dop@sjdhospitalbarcelona.org; the rights provided for by the abovementioned articles may be summarized as follows:

• obtaining confirmation as to whether or not personal data concerning you is being processed
• obtaining access to your personal data and to the information set out in Article 15 of the GDPR;
• obtaining the rectification of the inaccurate personal data that concern you without undue delay or the supplementing of incomplete personal data;
• obtaining the erasure of the personal data that concern you without undue delay;
• obtaining the restriction of processing the personal data that concern you;
• being informed of any rectifications or erasures or restrictions of processing in relation to the personal data that concern you;
• receiving in a structured, commonly used and machine-readable format the personal data that concern you;
• objecting at any time, on grounds associated with your specific situation, to the processing of the personal data that concern you.

Moreover, pursuant to Article 21 of the GDPR, you will be entitled to object at any time, on grounds associated with your specific situation, to the processing of the personal data that concern you carried out in pursuit of the legitimate interest of the data Controller (pursuant to Article 6(1)(f) of the GDPR).

You can find the full list of your rights on www.garanteprivacy.it or www.aepd.es.

h) Complaint to the Data Protection Authority

We remind you that, should you consider the processing of your data infringes the GDPR, you may in any event lodge a complaint before the Data Protection Supervisory Authority of the Member State of your habitual residence, place of work or place of the alleged infringement.

Fundació Sant Joan de Déu

Penta Foundation