Privacy notice

The Fundació Privada Víctor Grifols i Lucas was established in 1998 with the mission of promoting bioethics through dialogue between the sciences and the humanities, engaging specialists from different areas of knowledge. Driven by Víctor Grífols i Lucas, chairman of the Grifols Group until 2001, the foundation seeks to foster ethical attitudes and conducts among institutions, organizations, companies, and individuals whose activities are related to human health. For this reason, it serves as a platform for research, training, and debate, providing a meeting place for addressing issues related to the ethics of life from different perspectives and fields of knowledge.

The Fundació Privada Víctor Grifols i Lucas respects the privacy rights of all individuals who entrust their personal data to it and is committed to complying with the data protection regulations applicable in each country.

This privacy notice has been prepared in accordance with the European Union General Data Protection Regulation (the "GDPR") and applicable privacy and data protection laws; see Section 7 for specific provisions. It outlines The Fundació Privada Víctor Grifols i Lucas data collection practices for the development of its activity and the data subjects’ rights in the context of collection, use and sharing of their personal data.

1. Identification of the data controller(s)/owner(s) of the personal data

The data controller/owner is the Fundació Privada Víctor Grifols i Lucas, with contact address at Carrer Jesús i María, 6, 08022, Barcelona (Spain) (the "Fundació").

When the processing of personal data is for anti-corruption purposes, Grifols, S.A., with contact address at Avenida de la Generalitat, 152, 08174, Sant Cugat del Valles, Barcelona (Spain), and the Fundació will jointly be data controllers/owners of the personal data.

2. Identification of the data protection officer

The data protection officer acts as an interlocutor between the Fundació and the data subject in order to ensure its compliance with the data protection legislation and best protect their rights under such legislation. You may contact the data protection officer at dpo@grifols.com.
.
The data subjects may request more information from the data protection officer about the essential aspects of the joint controllership agreement outlined in Section 1.

3. Purposes, lawful basis for processing, categories and recipients of personal data

Purposes	Categories of personal data and recipients	Lawful basis
To analyse and, where appropriate, respond to any requests for information, suggestions and/or queries made through the means provided for this purpose.	Categories of personal data: - Identification data and personal characteristics¹. - Personal contact details². - Professional data³. Recipients: - Grifols, S.A. - Providers of products and services.	Legitimate interest
To contact data subjects by any means, including electronic ones, to evaluate potential business opportunities and collaborations, and to develop, control and manage current and future relationships. The reasons for contacting data subjects may include but are not limited to: - Scheduling appointments (online or in-person), - Sending surveys or similar, and - Any other activities that may contribute to evaluating potential business opportunities.	Categories of personal data: - Identification data and personal characteristics1. - Personal contact details 2. - Professional data 3. - Academic information6. Recipients: - Grifols, S.A. - Providers of products and services	Legitimate interest
To manage and control the registration, participation and attendance of data subjects to symposiums, conferences, webinars, training sessions, awards, contests or similar events, in person or online, organized by the Fundació or third parties.	Categories of personal data: - Identification data and personal characteristics¹. - Personal contact details². - Professional data³. - Financial data⁵. - Academic information⁶. - Interests and preferences Recipients: - Grifols, S.A. and Grifols Viajes, S.A: - Providers of products and services. - Financial entitites	Execution of a contract: when terms and conditions to participate exist Consent
To send scientific and educational information about the products and services of the Fundació by any means, including electronic ones.	Categories of personal data: - Identification data and personal characteristics¹. - Personal contact details². - Professional data³. - Interests and preferences. Recipients: - Providers of products and services.	Consent: when a contractual relationship does not exist. Legitimate interest: when a contractual relationship exists.
To create profiles of data subjects based on their preferences and personal interests which are obtained from information provided by their own data subjects, obtained from the third-party sources detailed in Section 5, and from analysing their behaviour (by reading cookies or similar technologies) when receiving or interacting with communications from the Fundació or when browsing the internet. The Fundació will use these profiles to send communications that are tailored to the preferences, interests and behaviour shown by the data subjects. Automated decisions will not be taken based on such profiles. As set out in Section 6, data subjects may exercise their right to object and withdraw their consent to the processing of their personal data for direct marketing purposes. In some cases, data subject profiling will be done in aggregate form so that the Fundació does not know the identity of data subjects in any way and, in such cases, will use the aggregated information for the purpose of analysing the behaviour of segments of data subjects.	Categories of personal data: - Browsing history data⁴. - Interests and preferences. Recipients: - Grifols, S.A. - Providers of products and services.	Consent
To manage and control the registration, access, and use of resources available on websites, landing pages and apps.	Categories of personal data: - Identification data and personal characteristics¹. - Personal contact details². - Professional data³. - Interests and preferences. Recipients: - Grifols, S.A. - Providers of products and services.	Consent: when a contractual relationship does not exist.
To capture, record and use images, voice and other identifying features, including audiovisual recordings of oneself, for the purposes described in the authorisation document or in another communication with similar characteristics, as well as to provide evidence of the consent of the data subjects.	Categories of personal data: - Identification data and personal characteristics¹. - Professional data³. Recipients: - Grifols, S.A. - Providers of products and services. - Public or private organizations.	Consent
To interact (i.e., respond to messages or comments, generate reactions, share content, etc.) with users of the Fundació’s profiles on social networks (in line with the privacy notices of each network)	Categories of personal data: - Identification data and personal characteristics¹. - Personal contact details². - Browsing history data⁴. Recipients: - Providers of products and services.	Legitimate interest
To customize certain functionalities of websites, landing pages, and apps based on the data subjects' browsing preferences and analyse their browsing behaviour with the aim of improving the services offered through these platforms. If any, the information about profiling activities and behavioural analysis is available in this privacy notice and/or in the Cookies Policy of the relevant website, landing page, or app.	Categories of personal data: - Browsing history data⁴. - Interests and preferences. Recipients: - Grifols, S.A. - Providers of products and services	Consent
To carry out maintenance tasks in websites, landing pages and apps to offer a secure environment to its users.	Categories of personal data: - Browsing history data⁴. Recipients: - Grifols, S.A - Providers of products and services.	Legitimate interest
To carry out anticorruption compliance checks, which include the assessment of the capacity of the organizations or other third parties to collaborate with the Fundació and initiate or maintain commercial relationships in accordance with The Fundació' anti-corruption programmes.	Categories of personal data: - Identification data and personal characteristics¹. - Professional data³. - Financial data⁵. - Academic information⁶. Recipients: - Grifols, S.A. - Providers of products and services. - Public or private organizations.	Legitimate interest
1. For example, name, last name, nationality, image, voice, ID/passport, username in social networks. 2. For example, email address and personal telephone number and address 3. For example, professional contact details, job position, place of work, membership to professional associations. 4. For example, IP address, device or user ID, browser type and version, visited sections, country of origin of the connection. 5. For example, financial interests and bank details. 6. For example, training data, degree, curriculum vitae.

3.1 Additional information about the lawful basis to process personal data

The table above shows the applicable lawful basis to process the personal data by purpose. In this section, you can find additional details of the lawfulness of the processing:

• Consent: Data subjects may provide their consent through the data collection forms, by clicking acceptance buttons or ticking boxes, replying to e-mails or making any other affirmative clear action.
Data subjects may withdraw their consent at any time, as set out in Section 6.

• Execution of a contract: Failure to provide the personal data requested by The Fundació could result in the impossibility of executing or maintaining such contract.

• Legitimate interest (of the Fundació and/or third parties): The Fundació is interested in fostering an ethical attitude among organizations, companies, and individuals whose activities are related to human health. For this reason, the Fundació pursues the following legitimate interests, which override the fundamental rights and freedoms of the data subjects, as these processing activities fall within the reasonable expectations they have, based on their relationship with the Fundació:

- Ordinary management of a foundation and its internal administration, which involves sharing information with Grifols, S.A. and Grifols Viajes, S.A.; and

- Creation of a secure information system infrastructure for preventing unlawful or malicious activities that may compromise the personal data

In any event, data subjects may request further information on the legitimate interest or exercise their right to object to the processing of their personal data based on legitimate interest by addressing their request to privacy@grifols.com.

3.2 Recipients of personal data

The table above shows categories of recipients with whom the Fundació may share personal data, by purpose. This section includes additional information regarding these recipients when applicable:

The following companies:
- Grifols, S.A.
- Grifols Viajes S.A.
Public or private organizations: for example, organizations with which the Fundació has signed collaboration agreements.
Financial entities
• Providers of products and services: for example, IT service providers, legal advisors, photographers, events’ organizers, travel agencies, media agencies etc.

The Fundació’s websites may include cookies or similar technologies from third parties. This usually occurs when the Fundació’s website incorporates elements from other websites (such as images or social network plugins, for example, to access the Fundació’s profile on these platforms) or when the Fundació contracts third parties to provide measurement, analysis or marketing services for the website. By accepting the installation of these cookies, clicking on these plugins or performing similar actions, users' personal data (including, IP address and browsing data) may be transferred to the providers of these technologies, including social network providers. The Fundació will not be liable for any further processing of such personal data by these providers.

The purpose and scope of the data collection, as well as its subsequent processing and use by the providers of such technologies, together with the related rights and available options for configuring privacy settings, may be consulted in the privacy information provided by these companies.

The Fundació will endeavour that the personal data is only transferred to countries that offer an adequate level of data protection. If the personal data is processed in countries that do not offer said level of protection, the Fundació and/or the providers (as the case may be) will adopt, if necessary, the appropriate safeguards (e.g. the standard contractual clauses included in the Commission Implementing Decision (EU) 2021/914 of 4 June 2021, if GDPR is applicable) to carry out such international data transfers in accordance with the applicable data protection legislation. Specific information on the appropriate safeguards applicable to each international data transfer can be obtained from the Fundació at privacy@grifols.com .

The Fundació does not share personal data with any other third party unless it is authorised by the data subject or required by the applicable law.

4. Retention period

The Fundació will retain the personal data for the time strictly necessary for the fulfilment of the purposes for which it has been collected or, if applicable, until the end of the statutes of limitation of any liabilities that may arise, and during the term required to comply with any applicable legal obligation.The Fundació will retain the personal data for the time strictly necessary for the fulfilment of the purposes for which it has been collected or, if applicable, until the end of the statutes of limitation of any liabilities that may arise, and during the term required to comply with any applicable legal obligation.

5. Sources of personal data

If data subjects do not directly provide the Fundació with their personal data, the Fundació may obtain the personal data from event organizers databases and public sources, such as websites, social networks and publications from the entity to which the data subject belongs or from the scholarships’ requesters.

6. Data protection rights

Los siguientes derechos de protección de datos son aplicables de conformidad con el RGPD. La Fundació se compromete a respetar otros derechos de protección de datos que resulten de aplicación de conformidad con las normativas de protección de datos de cada país.

Rights	Content
Access	You may request confirmation as to whether or not your personal data is being processed and, if so, you can obtain access to your personal data included in The Fundació' files.
Rectification	You may request the rectification of your personal data if inaccurate.
Erasure	You may request the erasure of your personal data.
Objection	You may request that your personal data is not processed under specific circumstances.
Portability	You may request receiving, in an electronic file, the personal data that you provided The Fundació with, as well as the right to transmit it to other parties.
Restriction of processing	You may request a restriction on how your personal data is processed when: - the accuracy of the personal data is being verified after being contested. - processing of your personal data is unlawful and you object to its erasure. - The Fundació no longer needs the personal data for the purposes of processing it, but you need it in order to prepare, exercise or defend a legal claim. - you have objected to the processing of the personal data for the performance of a task carried out in the public interest or necessary for the purposes of a legitimate interest, while verifying if The Fundació' legitimate grounds override yours.
Withdrawal of consent	You may withdraw your consent without affecting the lawfulness of the processing based on consent before its withdrawal.

Data subjects may exercise, when appropriate, their data protection rights by sending a written communication to The Fundació at privacy@grifols.com with the subject line " Fundació Privada Víctor Grifols i Lucas – Privacy". To that end, the Fundació may request further information or documents if necessary or appropriate to identify you.

In addition, you may lodge a complaint with a data protection authority, including the one at your residence, place of work or place of the alleged infringement.

7. Specific Provisions

Unión Europea

•   European Union
The legal bases for processing the personal data identified in Section 3 are regulated in the following provisions of the GDPR:
o   Consent: Article 6(1)(a) of the GDPR
o   Execution of a Contract: Article 6.1(b) of the GDPR
o   Legitimate interest (of The Fundació and/or any third party): Article 6.1(f) of the GDPR

Last update: March 2026