PRIVACY POLICY

We would like you to know, by means of this notice, what are the criteria we follow regarding the use of the data you provide us with through the Application to which you have accessed as a user (hereinafter, the “Application“) and of which THE EUROPEAN BOARD OF RADIOLOGY, S.L. (hereinafter “EBR”) is the owner.

EBR takes the protection of your privacy and personal data very seriously and, therefore, in compliance with the provisions of Organic Law 15/1999, of 13 December, on the Protection of Personal Data (hereinafter “LOPD”), Royal Decree 1720/2007, of 21 December, approving the Regulations implementing the Organic Law, in Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”) and other legislation in force, and ensures the correct use and processing of the user’s personal data.

Application users are informed that the completion of the data collection forms contained in the Application is voluntary, although the refusal to provide the data requested will result in the impossibility of being assisted by our services. In EUROPEAN BOARD OF RADIOLOGY, S.L. (hereinafter, EBR) we collect and process your personal data in order to process your requests for our services and our contractual relationship with you, or to send you commercial communications about our products and services.

The data provided will be kept for the duration of the contractual/ pre-contractual relationship with you, or for the period during which the commercial relationship between the user and EBR is in force, as well as for the years necessary to fulfil the purposes, legitimate relationships and legal obligations. The data will not be passed on to third parties unless there is a legal obligation or we have obtained your express consent.

Our Privacy Policy may change over time, so we recommend that you read this page each time you visit our Application. If there are any changes of great relevance, we will keep you informed through this page and through individual communications sent to the address provided by you. You may, at any time, revoke the consent given.

The completion of all data requested through the Application is necessary to achieve an optimal provision of the services made available. The lack of completion of these fields or their defective completion makes it difficult or even impossible for us to manage them according to your needs.

1. Information on the Data Controller

The data controller responsible for the processing of the data provided to us through the Application will be included in a file owned by EUROPEAN BOARD OF RADIOLOGY, S.L., whose contact details are:

Head of Processing: EUROPEAN BOARD OF RADIOLOGY, S.L.
NIF: B65668006
Address: Avenida Diagonal 383 sobreático 1a, 08008 Barcelona, SPAIN
E-mail: administration@myebr.org

2. Purpose, legitimacy of processing and retention period

2.1. Purpose of processing

The processing of the data collected through this Application has the following purposes:

• I. Treatments for the management of the contractual relationship with the user: managing the contractual and/or pre-contractual relationship between EBR and the user.
• II. Treatments to attend to the user’s requests and to send commercial communications about our products and services: to attend to the user’s requests for information as well as to send advertising messages about EBR’s products and services.

With the data collected, EBR will be able to create a “commercial profile” of the users of the Application. No automated decisions will be made based on this profile.

2.2 Basis of legitimation of processing

The processing by EBR of the data provided via the Application finds its legitimacy, depending on the type of processing, in:

• I. Treatments for the management of the contractual relationship with the user: execution of the contract and/or to attend the request for pre-contractual information.
• II. Treatments to meet user requests and sending commercial communications about our products and services: your express and informed consent. The user declares that he has read and expressly accepted this Privacy Policy when registering on the Application, giving his unequivocal and express consent to EBR for the processing of the data in accordance with the purposes reflected herein.

2.3. Retention of data

Depending on the type of processing, the data will be stored in accordance with the following:

• I. Treatment for the management of the contractual relationship with the user: during the duration of the contractual relationship and as long as there are legal obligations in relation to it.
• II. Processing to meet user requests and sending commercial communications about our products and services: The data of the interested parties will be as long as no cancellation is requested in relation to data relating to professionals. Once the data retention period has expired, the data, as well as any support or documents in which they were integrated, will be destroyed or returned to their holder. All this without prejudice to the existence of a legal provision that requires the retention of certain data or that these may be useful in the event of a claim arising from the provision of agreed services.

3. Addressees

EBR will not transfer user data to third parties, except in the event of a legal obligation to do so, in which case the user expressly authorises the transfer. 3 Users’ personal data may be communicated to EBR’s data processors who assist them in processing for the purposes described in this Privacy Policy.

4. Exercise of rights

We inform you that you, as a user of the Application, may exercise the rights granted to you by RGPD in relation to the processing of your personal data:

• Right to request access to personal data concerning the data subject.
• Right to request correction or deletion.
• Right to request a restriction on your treatment.
• Right to object to treatment.
• Right to data portability.
• The right not to be subject to automated individualized decisions.

In this sense, you may at any time exercise your rights of access and information on the processing of the data communicated, rectification and suppression of the data, opposition or cancellation of the consent granted for processing, right of portability or transmission of the data to third parties or to the data subject himself, as well as knowing the limitations that apply to the processing, oppose the drawing up of profiles (automated data processing), before EBR by sending us your request and identification through a letter to EUROPEAN BOARD OF RADIOLOGY, S.L.,Avenida Diagonal 383 sobreático 1a, 08008 Barcelona, SPAIN or by e-mail to administration@myebr.org. The user must enclose within the application a copy of his/her national identity card, passport or other valid document identifying him/her. EBR will respond to your request, without undue delay, within a period not exceeding ONE (1) month from the date of its receipt, although EBR will do its best to respond to your request for cancellation of service within a maximum period of 72 hours. Likewise, users who have authorized the collection of their data and their subsequent processing have the right, in the event of their rights being infringed by EBR, to lodge a complaint with the Spanish Data Protection Agency, located at calle Jorge Juan, nº6, 28001 Madrid (www.agpd.es).

5. Security measures and levels

EBR has adopted the necessary measures to maintain the required level of security, according to the nature of the personal data processed and the circumstances of the processing, in order to prevent, as far as possible and always in accordance with the state of the art, their alteration, loss, processing or unauthorized access. Likewise, EBR guarantees that it has implemented mechanisms in all its files (temporary or permanent), equipment and information systems containing personal data and of which it is the owner in order to comply with the current legislation on data protection, with the following functionalities:

1. Ensure the continued confidentiality, integrity, availability and resilience of treatment systems and services.
2. Restore availability and access to personal data quickly in the event of a physical or technical incident.
3. Verify, evaluate and evaluate, on a regular basis, the effectiveness of the technical and organizational measures implemented to guarantee the security of the treatment. 4
4. Pseudonymize and encrypt personal data, if applicable.

In addition to the confidential information exchanged between the parties, EBR will treat the data collected in all private communications between EBR and its customers or Users in the strictest confidence, and EBR undertakes to keep the personal data confidential, to keep it safe and to take all necessary measures to prevent its alteration, loss and unauthorised processing or access.

6. Third party data communications and menus

The User who communicates data from third parties through the Application is solely responsible for having obtained the prior express consent and for having informed them of the terms contained in this privacy policy.

Please note that this Application is not intended for minors. If a minor nevertheless provides his or her personal data, he or she must have the authorization of his or her parent or legal custodian.