Privacy policy

BOCEMTIUM CONSULTING SL and Universitat Politècnica de Catalunya as controllers of the processing of data and this website, in accordance with the provisions of Regulation (EU) 2016/679, the General Data Protection Regulation, and Organic Law 3/2018, of December 5, on the Protection of Personal Data and the guarantee of digital rights, make this privacy policy available to you in order to inform you, in detail, about how we process your personal data and protect your privacy and the information you provide us.

In this privacy policy, we explain your rights regarding your personal information and how you can exercise them. Additionally, if you need to contact the competent data protection authority, we provide you with the necessary contact information.

We, the controllers of your data	Identity: BOCEMTIUM CONSULTING SL Tax Identification Number (NIF): B64418882 Registered Address: Calvet 55, Entresol 2a, 08021 Barcelona Telephone: 934161220 Email: gdpr[at]bocemtium.com
We, the controllers of your data	Identity: Universitat Politècnica de Catalunya Postal Address: Plaça Eusebi Güell, 6, Edifici Vèrtex Planta 2, Porta 206, 08034 Barcelona Phone: 93 405 46 99 (Monday to Friday, from 10 a.m. to 2 p.m.) Email: proteccio.dades[at]upc.edu

What type of information about you could we collect?

The personal data we collect from users can be grouped into the following categories:

- Basic and Contact Data: such as your name, surname, username, or similar identifier. This also includes your billing address, email, and telephone number.

- Financial and Economic Data: this group includes payment, refund, and reimbursement details, as well as business transactions conducted with us. It also includes identity verification data necessary to accept payments and the relevant financial checks to complete transactions.

- Professional and Employment Data:this category includes your professional interests and your professional identity published online, such as your LinkedIn profile.

- Technical Data: including IP address, log data, browser and version used, time zone and usage data, types of plugins installed on your browser, operating system, and other technology used during your access to our platform.

- User Account Data: such as your profile name and password, subscription history, suggestions submitted by you, or any surveys you have responded to.

- Browsing Data: includes information related to your browsing behavior when visiting our platform.

- Marketing and Communication Preferences: we collect your preferences regarding receiving commercial communications and news from us, the consents you have granted, and your preferred communication channels.

- Images Captured by Video Surveillance Cameras: includes images that could be captured through surveillance cameras in our offices, if any.

How do we collect your personal data?

CAs a general rule, most of your personal information is provided directly by you, whether personally, by telephone, email, web forms, or by responding to surveys. However, we may also obtain information from:

Publicly accessible sources.
Third parties associated with us, such as:
A company within our group (affiliated company),
Your employer,
A third party who has previously obtained your express consent.
Cookies enabled on our website – for more information about the use of cookies, you can consult our cookies policy
Our facility access systems, if applicable, such as entry and reception logs, employee clock-in systems, surveillance cameras, communication systems, instant messaging, email, or social networks.

In the case of congress registrations, communication submissions, or academic work submissions (including the addition of co-authors), the information may be provided by your employer, another co-author, or a third party, provided you have previously granted them your express consent.

In such cases, the person providing your data declares that they have your express authorization to register you for the congress and provide the necessary information, assuming full responsibility for the legality of such data transfer.

Likewise, that person exempts Bocemtium from any liability for claims, damages, or harm arising from the processing of personal data provided without the required consent.

What could happen if you do not provide your personal information?

When we are legally obliged to collect your personal data or when such data is essential to enter into a contract with you, if you refuse to provide your personal data, it may be impossible for us to serve you. If we eventually need to cancel the provision of our services for this reason, we will notify you in advance.

For what purpose do we process your personal information?

We attach a detailed table with the purpose for which we collect your data and the legal basis that legitimizes us to do so.

Purpose of Processing Why do we collect your information?	Legal Basis for Processing Your Personal Information
Provide our services, accept payments and receive due amounts	(1) Contractual performance (2) Our legitimate interest
Register as a web user or new client	(1) Data subject’s express consent (2) Contractual performance
Manage our relationship with our clients, including: (1) Notifying you of changes to our terms and policies (2) Requesting that you respond to a survey or rate our services	(1) Contractual performance (2) Compliance with a legal obligation (3) Our legitimate interest (to update our records and understand clients’ opinions about our services)
Send commercial communications, newsletters, and advertising through any communication channel	(1) Data subject’s express consent (2) Our legitimate interest (provided you have not opted out of receiving communications
Respond to inquiries and/or provide requested information, including sending quotes	(1) Our legitimate interest (2) Contractual performance (3) Data subject’s consent (4) Compliance with a legal obligation
Manage user interactions on our social media networks	(1) Compliance with a legal obligation (e.g., to remove offensive, racist, obscene, or defamatory comments; to maintain a respectful and inclusive environment; to protect minors’ privacy) (2) Our legitimate interest (e.g., to remove third-party advertising from our networks)
Use analytical data to improve web browsing experience, implement marketing strategies, and optimize recruitment processes through the use of cookies	(1) Our legitimate interest (2) Data subject’s consent (e.g., upon accepting the use of analytical cookies)
Administer and protect our business and website, including troubleshooting, data analysis, web testing, etc.	(1) Compliance with a legal obligation (2) Our legitimate interest (to operate our business, ensure network security, prevent fraud, etc.)
Suggest and recommend products and services that may be of interest to you	(1) Our legitimate interest (to grow our business)
Provide personal information to authorities or in response to judicial request	Compliance with a legal obligation
Enhance security at our physical premises (installation of CCTV/video surveillance, access control)	Our legitimate interest and the interest of third parties (e.g., to detect harmful acts against our employees or clients
Update and improve our client records	(1) Compliance with a legal obligation (2) Contractual performance (3) Our legitimate interest (to verify we can continue contacting clients regarding subscriptions, orders, or purchased products)
Register as a congress attendee for various medical societies	(1) Data subject’s express consent (2) Contractual performance
Submit academic papers or presentations (abstracts)	(1) Data subject’s express consent (2) Contractual performance

Who might we share your personal data with?

We may need to share your personal information with:

Third-party companies we subcontract or service providers we use to provide our services, such as payment gateway providers.
Third parties necessary for managing our business, such as advertising agencies, lawyers, IT service providers, etc.
Insurance companies and brokers.
Banking entities with which we operate.

All providers we work with are contractually bound to us. We ensure they comply with all necessary security measures to safeguard your personal information and use your data solely and exclusively for the specified purposes according to our instructions

When registering for the event, the user accepts the Terms and Conditions (T&C), which include the transfer of data to certain third parties based on the execution of the contract (Article 6.1.b of the GDPR). Within this framework, your personal data may be shared with:

Exhibitors and event sponsor, exclusively for the following purposes:

Manage your participation in activities organized by the exhibitor or sponsor (workshops, round tables, symposia, etc.)
Send you information about products or services related to the activity you have registered for.
Contact you to provide technical or commercial information about products presented at the event.

The shared data may include your name, email address, and medical specialty, without disclosing sensitive or unnecessary data.

If you do not wish your data to be shared with an exhibitor or sponsor, you can exercise your right to object by writing to us at gdpr[at]bocemtium.com or managing it directly with the sponsor through the contact information they provide.

We will also share personal information with law enforcement authorities when required by law.

Where do we store your personal information?

All the information you provide us, either through this website or through other means or channels, will be stored on Amazon Web Services cloud servers. These servers are located within the European Economic Area.

How long will we retain your personal data?

Your data will be retained for as long as the commercial relationship with us continues or until you exercise your right of cancellation, objection, or restriction of processing. However, certain identifying personal data and traffic data will be retained for a maximum period of 2 years in case they are required by courts and tribunals or to initiate internal actions resulting from the misuse of the website.

Additionally, we inform you that our data retention policies comply with the periods set by various legal responsibilities for prescription purposes:

As a general rule:
In accordance with Article 30 of the Commercial Code, and unless other criteria apply, all company documents and/or information will be retained for 6 years.
This affects all accounting, tax, labor, or commercial documentation, including correspondence.

Specific periods:
Our company must also establish minimum retention periods depending on the type of data involved and in accordance with the various statutory limitation periods, which each department must be aware of.
The following table lists the limitation periods that affect or may affect our organization:

Subject	Limitation Period	Regulation
Labor, for infractions	3 years	Art. 4.1 RD 5/2000
Social Security, for infractions	4 years	Art. 4.2 RD 5/2000
Occupational Risk Prevention, for infraction/td>	5 years	Art. 4.3 RD 5/2000
Tax, for tax debt	4 years	Art. 4.3 RD 5/20003
Tax, for verification of compensated quotas or applied deductions	10 years	Art. 66 bis Law 58/2003
Accounting and Commercial	6 years	Art. 30 of the Commercial Code
Crimes against the Public Treasury and Social Security	10 years	Art. 131 LO 10/1995

You will not be subject to decisions based solely on automated processing that produce effects on your data.

Our Communications

All personal information you provide will be incorporated into our information systems. By accepting this privacy policy, you expressly consent to BOCEMTIUM CONSULTING SL and Universitat Politècnica de Catalunya carrying out the following activities and/or actions, unless you indicate otherwise:

Sending you commercial, promotional, and direct marketing communications through any enabled communication channel, to inform you about activities, services, promotions, advertising, news, offers, and other information related to our services and products, and those of our group.
Sending you communications electronically, provided you have subscribed to our NEWSLETTER and have not unsubscribed.
Retaining your data for the periods provided for in the applicable regulations.

How to stop receiving marketing communications (opt-out)?

You may revoke any express consent you have given us to send you commercial information at any time. To do so, you can unsubscribe using the opt-out option available on our website (if enabled), or by writing an email with the subject “unsubscribe” to gdpr[at]bocemtium.com.

In accordance with the LSSICE, we never send SPAM; therefore, we will not send you commercial emails unless they have been requested or authorized by you. Nevertheless, in all our communications, you will have the opportunity to revoke your consent.

We will not process your personal data for any purpose other than those described, except when required by law or a judicial request.

User Responsibility – Declaration of Truthfulness

By providing us with your personal information through electronic channels, the user declares that they are over 18 years of age and that all the data provided to BOCEMTIUM CONSULTING SL and Universitat Politècnica de Catalunya is true, accurate, complete, and up to date. In this regard, the user confirms that they are responsible for the accuracy of the data provided and will keep such information properly updated to reflect their real situation, being liable for any false or inaccurate information they may provide, as well as for any direct or indirect damages that may arise.

How do we keep your information secure?

We take the protection of your data very seriously. Therefore, we guarantee the implementation of appropriate physical, organizational, and technological security measures, controls, and procedures to prevent your information from being accidentally lost, misused, or accessed maliciously.

We limit access to your data to authorized persons and entities and ensure that all our personnel are properly trained. Everyone involved in the processing of your personal data is subject to a duty of confidentiality.

Additionally, we apply technical procedures to respond to any suspected data breach. If necessary, we will notify you and the supervisory authority (the AEPD in Spain) in accordance with the applicable regulations.

How to exercise your ARCOLP rights?

Both the GDPR and the Spanish transposition law (the LOPDGDD) guarantee you the right to exercise the following rights. You can exercise them at any time and always free of charge:

Right	Description
Right of Access	The right to receive a copy of your personal information
Right of Rectification	The right to request the correction of errors in your personal information.
Right of Cancellation/Deletion (Right to be Forgotten	The right to request that we delete your personal information – in certain situations.
Right of Restriction	The right to request the restriction of the processing of your data.
Right of Objection	The right to object to: – The processing of your data for direct marketing purposes (including profiling). – In certain circumstances, the continued processing of your data, such as processing based on our legitimate interest.
Right to Data Portability	The right to receive your personal information in a structured, readable format and/or to transmit this data to a third party – in specific situations.
Automated Individual Decision-Making	The right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects you.

To exercise any of the aforementioned rights, you can send us your request via the specifically designated email addresses:

For Bocemtium Consulting SL: gdpr[at]bocemtium.com

For Universitat Politècnica de Catalunya: proteccio.dades[at]upc.edu

You must attach to your request precise information about what you need and, in any case, valid proof of your identity according to the law.

Supervisory Authority for Data Protection

We hope to be able to resolve any questions or concerns you may have regarding your personal information. However, if you wish to file a complaint with the competent authority, you have the right to do so.

In Spain, the highest authority on data protection matters is the Spanish Data Protection Agency (AEPD). https://www.aepd.es/es – Tel: +34 91 266 35 17.

Changes to this Privacy Policy

BOCEMTIUM CONSULTING SL and Universitat Politècnica de Catalunya reserve the right to modify this policy to adapt it to new legislative or jurisprudential developments.