Through this notice, “OPHTOS INSTITUT, S.L.” (hereinafter referred to as “OPHTOS”) informs users of the website www.inofinstitut.com, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR) and other applicable legislation, of its personal data protection policy, so that users may freely, expressly and voluntarily decide whether to provide “OPHTOS” with the personal data requested when seeking information or contracting the various services offered in the field of medical and ophthalmological care and related services.
Unless expressly stated otherwise, all information requested in the relevant form or equivalent document must be provided truthfully, accurately, completely and kept up to date. Otherwise, “OPHTOS” may, depending on the circumstances, refuse to register the user or deny the specific service requested. All data provided by the user/data subject will be processed in accordance with the conditions detailed below.
Information Regarding the Processing of Personal Data
Identification of the Data Controller: “OPHTOS INSTITUT, S.L.”, with its registered address at C/Vilana 12, Offices 156-157, 08022 Barcelona, Spain, Tax Identification Number (NIF): B63133227, registered in the Barcelona Commercial Registry, Volume 35399, Folio 187, Sheet B266408, Entry 1. Contact email address:
Identification of the Data Protection Officer: For any matters relating to personal data, including enquiries, requests, suggestions or other issues, you may contact the Data Protection Officer appointed by “OPHTOS” by email at
Purposes of Data Processing:
All data provided will be processed for the following purposes:
-
Responding to requests submitted by the data subject.
-
Maintaining any relationship that may be established.
-
Managing, administering, providing information about, delivering and improving the services contracted.
-
Sending commercial communications relating to our products and services.
The personal data provided will be retained for as long as the business relationship continues, until the data subject requests their erasure, or for as long as they are necessary for the purposes of processing. Data will not be deleted where a legal provision requires their retention. In such cases, the data will be blocked and retained solely for access by public authorities, judges and courts, for the purpose of addressing any potential liabilities arising from the processing, for the duration of the applicable limitation periods.
At present, no automated decision-making, including profiling, is carried out on the basis of your personal data. Should such automated decision-making be introduced in the future, your prior consent will be obtained.
Lawful Basis for Processing:
All processing of your personal data has been subject to your prior and express consent. Before giving your consent, you are informed of all matters required by law to ensure that your consent is informed.
You may withdraw this consent at any time, as detailed later in this document.
Recipients, Disclosures and Transfers of Data:
Your data will not be disclosed to third parties unless strictly necessary to fulfil the purposes described above or to comply with a legal obligation.
Likewise, your data will not be transferred to countries outside the European Union unless such a transfer is essential for fulfilling the stated purposes and you have given your prior and express authorisation.
Rights of Data Subjects:
You may exercise the rights detailed below at any time by sending a postal request to “OPHTOS”, C/Vilana 12, Offices 156-157, 08022 Barcelona, Spain, or by email to
The request must include the applicant's first name and surname, documentation proving the identity of the data subject or their legal representative, together with proof of representation where applicable, a clear description of the request, an address for notifications, the date and signature of the applicant, and any supporting documents relevant to the request.
If the request does not meet the specified requirements, the applicant will be asked to rectify any deficiencies.
Data subjects have the following rights: access, rectification, restriction of processing, data portability, objection and erasure. These rights are described below.
Right of Access
The data subject has the right to obtain confirmation from the data controller as to whether or not personal data concerning them are being processed and, where that is the case, access to the personal data and the following information:
-
The purposes of the processing.
-
The categories of personal data concerned.
-
The recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly recipients in third countries or international organisations.
-
Where possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period.
-
The existence of the right to request from the controller rectification or erasure of personal data, restriction of processing of personal data concerning the data subject, or to object to such processing.
-
The right to lodge a complaint with a supervisory authority.
-
Where the personal data have not been collected from the data subject, any available information regarding their source.
-
The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4), and, at least in such cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
Where personal data are transferred to a third country or an international organisation, the data subject has the right to be informed of the appropriate safeguards relating to the transfer pursuant to Article 46.
The data controller shall provide a copy of the personal data undergoing processing. For any additional copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs.
Where the data subject submits the request by electronic means, and unless otherwise requested, the information shall be provided in a commonly used electronic format.
Right to Rectification
The data subject has the right to obtain from the data controller, without undue delay, the rectification of inaccurate personal data concerning them.
Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement.
Right to Erasure
The data subject has the right to obtain from the data controller the erasure of personal data concerning them without undue delay, and the controller shall be obliged to erase such personal data without undue delay where one of the following grounds applies:
-
The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
-
The data subject withdraws the consent on which the processing is based, pursuant to Article 6(1)(a) or Article 9(2)(a), and there is no other legal ground for the processing.
-
The data subject objects to the processing pursuant to Article 21(1), and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2).
-
The personal data have been unlawfully processed.
-
The personal data must be erased to comply with a legal obligation under European Union or Member State law to which the controller is subject.
-
The personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
Where the controller has made personal data public and the data subject has exercised their right to erasure, the controller shall, taking account of available technology and the cost of implementation, take reasonable steps to inform third parties processing such data of the request for erasure, including any links to, copies of or replications of those personal data.
This right may be restricted by other rights, such as the right to freedom of expression and information, compliance with a legal obligation, or where there are reasons of public interest.
Right to Restriction of Processing
The data subject has the right to obtain from the data controller restriction of processing where one of the following conditions applies:
-
The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the data.
-
The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
-
The controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
-
The data subject has objected to processing pursuant to Article 21(1), pending verification of whether the legitimate grounds of the controller override those of the data subject.
Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject's consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.
Any data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction is lifted.
Right to Object
The data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them which is based on Article 6(1)(e) or (f), including profiling based on those provisions.
The data controller shall cease processing the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for such marketing, including profiling to the extent that it is related to such direct marketing.
Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for those purposes.
Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject has the right, on grounds relating to their particular situation, to object to the processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Right to Data Portability
The data subject has the right to receive the personal data concerning them, which they have provided to a data controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller without hindrance from the controller to which the personal data were provided, where:
-
The processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a), or on a contract pursuant to Article 6(1)(b); and
-
The processing is carried out by automated means.
In exercising the right to data portability pursuant to paragraph 1, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.
The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The data controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
The controller shall inform the data subject about those recipients if the data subject so requests.
Withdrawal of Consent: A data subject who has previously given consent to the processing of their personal data may withdraw that consent just as easily as it was given. Withdrawal of consent shall not affect the lawfulness of processing carried out before its withdrawal.
The data subject has the right to lodge a complaint with the competent Supervisory Authority.
Where personal data are to be subsequently processed for purposes other than those for which they were originally collected, the controller shall inform the data subject accordingly.
Security Measures: The Data Controller declares that it has implemented the necessary technical and organisational measures to ensure the security of personal data and to prevent their alteration, loss, unauthorised processing or access, taking into account the state of technology, the nature of the stored data and the risks to which they are exposed, whether arising from human action or from the physical or natural environment.
The website www.inofinstitut.com contains links to other websites that may be of interest to the data subject. “OPHTOS” accepts no responsibility for these links and cannot guarantee that the linked websites comply with appropriate privacy policies. Accordingly, the data subject accesses the content of such websites under the terms and conditions established by those websites and at their own risk.
If you have any questions, enquiries or recommendations regarding our Privacy Policy, please contact us by email at:
OPHTOS INSTITUT, S.L.
All rights reserved.