Legal Notice and Privacy Policy

Legal Notice

This Privacy Policy is general in nature and governs the processing of personal data carried out by the Banc de Sang i Teixits in the performance of its institutional functions. The processing of personal data arising solely from the use of the website is governed by the Website Privacy Policy.

The BST is a public entity within the public sector of the Generalitat de Catalunya, overseen by the Ministry of Health.

Accessing, browsing and using the website owned by BST, as well as all its subdomains, directories and own-domain portals under BST's ownership, including any services or content that may be obtained there, confers upon you the status of user. Consequently, browsing the BST website implies full and unreserved acceptance of all the terms of use set out in this document, without prejudice to the application of any mandatory legal provisions that may be applicable in each case.

Any person accessing this website assumes the role of user, undertaking to observe and strictly comply with the provisions set out herein, as well as with any other applicable legal provisions.

The BST reserves the right to modify any information that may appear on the website, without any obligation to pre-notify or inform users of these obligations, with publication on the website being considered sufficient.

The BST website makes available to the user a wide variety of information, products and services supplied or provided by the BST to those individuals or organisations interested in them. The user assumes responsibility for the correct use of the website, a responsibility that includes, by way of example but not limited to:

The truthfulness and lawfulness of the data and information provided through the registration and contact forms made available by BST to access certain content or services.
A use of the contents and services that complies with applicable legislation, these terms of use, morality, accepted standards of conduct and public order.

For this purpose, the user expressly undertakes to abstain from:

Using any of the website's content for illicit or prohibited purposes, or to infringe the rights and interests of third parties.
Carrying out actions that may damage, disable, overload, degrade or prevent the normal use of the content and services by other users or any Internet user, whether by affecting software or hardware.

Users shall be liable for any damages and losses of any nature that BST may suffer, directly or indirectly, as a result of failing to comply with the obligations arising from the use of the website or from the provisions of this policy.

In particular, and by way of example but in no way an exhaustive list, the user undertakes not to transmit, disseminate or make available to third parties, through this website, information, data, content, messages, graphics, drawings, sound and/or image files, photographs or any other type of material that infringes current legislation or the rights of third parties.

Privacy Policy

1. USER INFORMATION

Who is responsible for processing your personal data?

The BST is the data controller for the processing of the user's personal data and informs you that this data will be processed in accordance with the provisions of Regulation (EU) 2016/679, of 27 April (General Data Protection Regulation, GDPR), and Organic Law 3/2018, of 5 December, on the protection of personal data and the guarantee of digital rights (LOPDGDD).

For what purpose do we use your personal data?

Personal data are processed by the BST for the following purposes:

The management of activities related to the donation of blood, tissues, cells, human milk or other biological components.
The provision of the entity's own health, care and diagnostic services.
The fulfilment of legal obligations in the healthcare, assistance and administrative fields.
The carrying out of research, statistical and data analysis activities in accordance with current regulations.
The management of enquiries, requests or communications made by data subjects and other interested parties.
The sending of informative or institutional communications when so authorised.

What data do we process?

The BST may, depending on the case, process the following categories of personal data:

Identifying and contact details.
Administrative data.
Health data and other specially protected data, strictly necessary for healthcare and assistance purposes.
Professional details, if applicable.

Processing of minors' data

The BST will not process the personal data of minors under the age of 14 without first obtaining the express, free and verifiable consent of their parents or legal guardians.

In cases where minors' personal data is collected, the BST will take the necessary measures to verify the authenticity of the consent granted by the legal representative, in accordance with Regulation (EU) 2016/679 and Article 7 of Organic Law 3/2018.

On what basis can we process your personal data?

The processing of personal data is based on the following legal bases:

The fulfilment of a legal obligation applicable to the data controller (Article 6.1(c) of the GDPR).
The exercise of public authority or the performance of a task carried out in the public interest in the field of health (Article 6.1(e) of the GDPR).
The explicit consent of the data subject, where necessary (Article 6.1(a) of the GDPR).
The processing of health data is carried out in accordance with the exceptions provided for in Article 9.2 of the GDPR, in particular for reasons of public interest in the field of health, healthcare, medical diagnosis and scientific research.

The data may be used to compile statistics necessary for the performance of tasks in the public interest, in accordance with Article 6.1(e) of the GDPR. If the processing affects special categories of data, it may be carried out on the basis of Article 9.2(j) of the GDPR, provided that the appropriate safeguards laid down in Article 89.1 of the GDPR are applied. In all cases, data used for statistical purposes will be anonymised, so that it will not be possible to identify the individuals concerned, and will be carried out by applying appropriate technical and organisational measures aimed at protecting individuals' rights and freedoms, including data minimisation and, where appropriate, encryption or pseudonymisation prior to their final anonymisation. This processing will not, under any circumstances, involve automated individual decisions or the creation of profiles with legal or significant effects on users.

How long will we keep your personal data?

They will be retained for no longer than is necessary to fulfil the purpose of the processing or to comply with any legal obligations for their retention, and once this purpose is no longer required, they will be deleted using appropriate security measures to ensure the anonymisation or complete destruction of the data.

In the case of health data, retention will be carried out in accordance with the deadlines established in the applicable health and archives regulations.

To whom do we provide your personal data?

Personal data may be disclosed to:

Government authorities and bodies in the healthcare system, when so required by applicable regulations.
Service providers acting as processors, with whom the BST has entered into the relevant agreements in accordance with Article 28 of the GDPR.

Under no circumstances will the data be shared for commercial purposes.

What are your rights as the data subject?

As website user and data subject, you have the following rights:

Right to withdraw consent at any time.
Right of access, rectification, portability and erasure of your data, and of restriction of or objection to its processing.
Right to lodge a complaint with the supervisory authority (https://apdcat.gencat.cat) if you consider that the processing does not comply with the applicable regulations.

Contact details for exercising your rights:

Users/data subjects may exercise their rights by any means that allow proof of sending and receipt to the following:Banc de Sang i Teixits, Passeig Taulat, 106-116, 08005 Barcelona. Email: cpd@bst.cat. Data protection officer: dpd@ticsalutsocial.cat

In accordance with Article 12.3 of the GDPR, the data controller shall provide a response within a maximum of one month of receiving the request, under the terms of Articles 15 to 21 of the this Regulation.

2. MANDATORY OR OPTIONAL NATURE OF INFORMATION PROVIDED BY THE USER

By ticking the corresponding boxes and entering data in the fields, marked with an asterisk (*) on the contact form or downloadable forms, users expressly, freely and unequivocally consent to their data being necessary for the provider to attend to their request, the inclusion of data in the remaining fields being voluntary. The user guarantees that the personal data provided to the data controller is accurate and undertakes to notify any changes to it.

The data controller informs the user that all data requested via the website are mandatory, as they are necessary to provide an optimal service to the user. If not all the information is provided, it cannot be guaranteed that the information and services provided will be entirely suited to the user's needs.

3. SECURITY MEASURES

In accordance with the provisions of the applicable personal data protection regulations, the data controller complies with all the provisions of GDPR and LOPDGDD regulations for the processing of personal data for which it is responsible, and manifestly, in regard to the principles described in Article 5 of the GDPR, whereby data are processed lawfully, fairly and transparently in relation to the data subject and are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. The BST does not make decisions based solely on automated processing of data, nor does it create profiles with legal or other significant effects on data subjects.

The data controller guarantees that it has implemented appropriate technical and organisational policies to apply the security measures established by the GDPR and the LOPDGDD in order to protect the rights and freedoms of users, and has provided them with the appropriate information so that they can exercise them.

Supervisory authority

If you consider that your rights in relation to the protection of personal data have been breached, the user may lodge a complaint with the Catalan Data Protection Authority: https://apdcat.gencat.cat.

Policy update

This Privacy Policy may be updated to adapt it to regulatory or operational changes. Any modifications will be published in this same space.