Information on client data protection

RESPONSIBLE

Identity: CLECE VITAM, S.A.
Company tax code: A-87045456
Registered address: Avda de Manoteras 46, bis (28050-Madrid)
Data Protection Delegate (DPD): rgpd-clecevitam@clecevitam.com

PURPOSE

We process the information you provide for the purpose of:

• Managing the care of users of care homes (managing social welfare, managing and monitoring health, and medical records).
• Internal dissemination of social and leisure activities carried out by users (prior consent required for images).
• Video surveillance (if installed): Safety at facilities, and security and monitoring of access to buildings. Ensuring the security of assets and people. Monitoring visits that enter the facilities and checking regular visits to users of care homes for the older persons.
• Financial, economic, accounting and service provision administration management.
• Satisfaction surveys.
• Ensuring legal proceedings are properly managed and maintained.
• Managing and developing activities relating to fraud prevention and control.
• Ethics channel: Dealing with communications received through the various media or channels made available, such as the email address on the company’s website, telephone (24/7) and the web platform managed by the contracted data processor, with the guarantee of maintaining the sender’s absolute confidentiality and that no reprisals of any kind will be taken for acting in good faith.
• Allocation of photographic and audiovisual material that will form part of a bank of images, once express consent has been obtained.
• Sending commercial information relating to products and services.

LEGAL BASIS

• Performance of a contract: The legal basis for processing your data is the performance of the contract according to the terms and conditions as set out in the document signed between CLECEVITAM and the client.
• Legitimate interest.
• Prior consent.
• Public interest (Ethics channel): The communications channel (Ethics channel) is based on the existence of a public interest, in the terms established in article 6.1.e) of the General Data Protection Regulation, on detecting and preventing complaints and the corresponding prevention of damages and risks of liability to CLECEVITAM and as defined in article 24 of Organic Law 3/2018.

RETENTION PERIODS:

• Basic law regulating the autonomy of patients and the rights and obligations on matters of clinical information and documentation (Law 41/2002 of 14 November).
• Clinical documentation will also be held on file for legal purposes in accordance with legislation.
• Accounting and tax documentation: 6 years – Art. 30 Commercial Code.
• For tax purposes: 4 years – articles 66 to 70 General Taxation Law.
• Commercial management: 1 year.
• Image use and retention: 5 years
• Ethics channel: Will be held in the complaints reception system solely for the length of time needed to ascertain the facts reported. In any event, the information must be removed from the system three months after it was entered. However, it may be processed outside of the system to investigate the facts reported for as long as is necessary until such time as the matter is concluded. Once the investigation of the communication has concluded and any appropriate actions have been taken, the data pertaining to said complaints that have been processed will be held and duly blocked in compliance with any applicable legal obligations. If the decision is made not to take the complaint filed any further, the information may be held in said system in anonymised form..

RECIPIENTS

Their data may be legally notified to:

Organisation	Data	Location
Public administrations with competence in the matter.	Name/surname(s), identity document, signature, economic.	Spain
Healthcare companies	Health management	Spain
Insurance companies	Name/surname(s), identity document, details relating to insurance cover.	Spain
Pharmacies and technical assistance companies (prior consent required)	Economic	Spain
State tax administration	Name/surname(s), identity document, signature, economic.	Spain
Banks, savings banks and credit banks	Name/surname(s), economic.	Spain

EXERCISE OF RIGHTS

The persons concerned have the right to obtain confirmation regarding whether the company is processing their personal data.
They have the right to request:

• Access to their personal data.
• Amendment of inexact data.
• The elimination when, among other reasons, the data are no longer needed for the purposes for which they were obtained.
• The limitation of the processing of their data, in which case we will only preserve them in order to exercise or defend claim.
• To object to the processing of their data, in certain circumstances and for reasons relating to their personal situation. The company will cease to process the data, except for imperative legal reasons, or the exercise or defence of possible claims.

The rights recognised in the EU Regulation 2016/679, may be exercised directly or by means of legal or voluntary representative.
You may request to exercise your rights by emailing the Data Protection Officer or by sending or delivering your request to the centre in question.
To obtain information regarding your rights, you may visit:  https://www.aepd.es/reglamento/derechos/index.html
If you have not obtained satisfaction in exercising your rights, you may submit a claim at the Spanish Data Protection Agency.