Privacy Policy

Privacy Policy

The purpose of this policy is to inform data subjects about the various processing activities carried out by this organisation through the website that affect their personal data, in accordance with the provisions of Organic Law 3/2018, of 5 December, on Personal Data Protection and guarantee of digital rights (LOPDGDD), and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).

1. Identification and contact details of the controller and data protection officer

Data controller

You may use the address above both for general enquiries and to exercise your data protection rights. If a dedicated address for exercising rights is established, it will be published here.

Data protection officer

ETRYUM will appoint a Data Protection Officer where required by Article 37 of the GDPR and Article 34 of the LOPDGDD. Until the appointment is published on this page, all data protection requests should be addressed to info@etryum.com.

2. Purposes of processing your personal data

Website users and visitors

• Responding to information requests and early-access registrations received through the website contact channels.
• Sending information about the opening of the ETRYUM clinic, its services and early access, to those who have given their consent.
• Understanding visitor behaviour in order to detect potential cyber attacks and maintain the security of the website.
• Complying with the legal obligations applicable to our activity.
• Protecting and exercising our rights, or responding to claims.

3. Legal basis for processing

• Consent given for the purposes indicated above. Refusal to provide the data makes processing for these purposes impossible.
• Compliance with the legal obligations applicable to us. The data subject cannot object to this processing.
• Legitimate interest in protecting our image, business and reputation, and in preventing attacks on the website. The data subject cannot object to this processing, without prejudice to the rights set out in section 8.

4. Data retention periods or criteria

Personal data will be retained for the time necessary to fulfil the purposes for which it was collected. Once it is no longer necessary, it will remain blocked so that it can be made available to the competent Public Administrations or Bodies, Judges and Courts or the Public Prosecutor's Office, during the limitation periods for actions and/or the legally established retention periods.

Data collected through the early-access form will be retained until you withdraw your consent or object to the processing, and in any case for no longer than is necessary to inform you about the opening of the clinic.

5. Automated decisions and profiling

The website does not make automated decisions and does not create profiles.

6. Recipients

During the processing of your data, the organisation may communicate it to:

• Judges and Courts.
• Law enforcement agencies.
• Other competent authorities or public bodies where there is a legal obligation.

In addition, the following service providers act as data processors on our behalf, under contracts that comply with Article 28 of the GDPR:

• Vercel Inc. (United States) — website hosting and execution of the form endpoint.
• Resend (Plus Five Five, Inc.) (United States) — transactional email delivery of form submissions to our inbox.

7. International data transfers

The service providers listed in section 6 are located in the United States. These transfers are carried out on the basis of the safeguards provided for in Chapter V of the GDPR — the European Commission's Standard Contractual Clauses and/or the providers' certification under the EU–US Data Privacy Framework — together with the corresponding data processing agreements.

Beyond these providers, the organisation does not carry out international data transfers.

8. Your rights

You may exercise, at any time and free of charge, the rights of access, rectification, erasure, restriction of processing, objection and portability (where technically feasible), and you may withdraw the consent you have given. Where applicable, you may also request not to be subject to decisions based solely on automated processing, including profiling.

To exercise these rights, send a written request to the postal or email address indicated in section 1. You must attach a copy of your ID or an equivalent document so that we can verify your identity.

If you consider that your rights have been infringed, and especially if you do not obtain satisfaction in exercising them, you may file a complaint with the competent supervisory authority — the Spanish Data Protection Agency — at www.aepd.es.

In compliance with Article 21 of Law 34/2002 (LSSI), if you no longer wish to receive commercial communications you may unsubscribe by sending an email to info@etryum.com with the subject "UNSUBSCRIBE", or by using the unsubscribe link included in each communication.

9. Data accuracy

The data subject guarantees that the data provided is true, accurate, complete and up to date, and undertakes to communicate any changes through the channels provided. They shall be liable for any damages that may result from a breach of this obligation.

If the user provides third-party data, they declare that they have that third party's consent and undertake to convey the information in this policy to them, exempting the organisation from liability for non-compliance.

10. Social networks

ETRYUM maintains profiles on various social networks. Website users may join these networks or groups. Unless we request your data directly (for example, marketing actions, contests or promotions), the data will belong to the corresponding social network. We recommend reviewing their terms of use and privacy policies and configuring your data processing preferences.

11. Modifications and updates

This privacy policy may be modified or updated due to legal requirements, to adapt it to instructions from the Spanish Data Protection Agency, or as a result of changes to our website. We recommend reviewing it periodically.