Conflicts of Interest Privacy Notice

Privacy notice available in other languages.

Grifols is a global healthcare group founded in Barcelona in 1909 committed to improving the health and well-being of people around the world. Its three main business units - Biopharma, Diagnostic and Bio Supplies develop, produce and market innovative solutions and services that are sold in more than 100 countries.

Grifols respects the privacy rights of all data subjects who entrust Grifols with their personal data and is committed to complying with the data protection regulations applicable in each country.

This privacy notice has been prepared in accordance with the European Union General Data Protection Regulation (the "GDPR") and applicable privacy and data protection laws, see Section 7 for specific provisions. It outlines Grifols' data collection practices and data subjects’ rights in the context of Grifols collection, use and sharing of their personal data.

This privacy notice applies to the processing of personal data of any individuals whose personal data is provided to Grifols in relation to any potential conflict of interest.

1. Identification of the data controller(s)/owner(s) of the personal data

The data controller/owner is Grifols, S.A. with address for contact purposes at Parque Empresarial Can San Joan, Avenida de la Generalitat, 152-158, 08174, Sant Cugat del Valles (Barcelona) ("Grifols").

2. Identification of the data protection officer

The data protection officer acts as an interlocutor between Grifols and you in order to ensure Grifols' compliance with the data protection legislation and best protect your rights under such legislation. You may contact the data protection officer at dpo@grifols.com.

3. Purposes, lawful basis for processing, categories and recipients of personal data
Purposes

To evaluate the nature of disclosed relationships and activities, and identify, manage and mitigate any actual, potential or perceived conflict(s) of interest involving Grifols' employees, contractors, executives and/or directors to ensure that all business decisions and actions are conducted in accordance with Grifols' commitment to ethical business practices and good governance.
Categories of personal data and recipients

Categories of personal data:

  • Identification data and personal characteristics1.
  • Professional data2.
  • Financial data3.
  • Family data4.

Recipients:

  • Grifols' group companies
  • Providers of products and services

 

Lawful basis

Legitimate interest

1 For example, name, last name and nationality.
2 For example, the condition of employee, consultant, independent contractor or board member, job position, place of work, working hours, participation on advisory councils, trade associations or vendor-related organizations.
3 For example, compensation, reimbursement, remuneration, personal loans, guarantees, stock or ownership interests, compensation received from outside activities, including payments for speeches, consultancy fees or other forms of remuneration.
4 For example, marital status.

1 For example, name, last name and nationality.
2 For example, the condition of employee, consultant, independent contractor or board member, job position, place of work, working hours, participation on advisory councils, trade associations or vendor-related organizations.
3 For example, compensation, reimbursement, remuneration, personal loans, guarantees, stock or ownership interests, compensation received from outside activities, including payments for speeches, consultancy fees or other forms of remuneration.
4 For example, marital status.
Purposes Categories of personal data and recipients Lawful basis

To evaluate the nature of disclosed relationships and activities, and identify, manage and mitigate any actual, potential or perceived conflict(s) of interest involving Grifols' employees, contractors, executives and/or directors to ensure that all business decisions and actions are conducted in accordance with Grifols' commitment to ethical business practices and good governance.

Categories of personal data:

  • Identification data and personal characteristics1.
  • Professional data2.
  • Financial data3.
  • Family data4.

Recipients:

  • Grifols' group companies
  • Providers of products and services

 

Legitimate interest

3.1. Additional information about the lawful basis to process personal data

The table above shows the applicable lawful basis to process the personal data by purpose. In this section, you can find additional details of the lawfulness of the processing:

  • Legitimate interest (of Grifols and/or any third party): Grifols is committed to conducting business with integrity and honesty, ensuring that personal interests do not compromise its legitimate business interests or influence the business judgment or decision-making of any Grifols' employee, contractor, executive and/or director. Therefore, Grifols pursues the following legitimate interests which override the fundamental rights and freedoms of the data subjects, given that the processing is within the data subjects' reasonable expectations based on their relationship with Grifols:
    • Maintain integrity, trust and compliance with ethical standards and legal obligations, and
    • Daily management of a multinational group of companies and internal administration, which means sharing information with the companies of the Grifols group.

In any event, data subjects may request further information on the legitimate interest or exercise their right to object to the processing of their personal data based on legitimate interest by addressing their request to privacy@grifols.com.

 

3.2 Recipients of personal data

The table above shows categories of recipients with whom Grifols may share personal data, by purpose. This section includes additional information regarding these recipients when applicable:

  • Grifols' group companies: The list is available here.
  • Providers of products and services: for example, information technology providers.

Grifols will endeavour that the personal data is only transferred to countries that offer an adequate level of data protection. If the personal data is processed in countries that do not offer said level of protection, Grifols and/or the providers (as the case may be) will adopt, if necessary, the appropriate safeguards (e.g. the standard contractual clauses included in the Commission Implementing Decision (EU) 2021/914 of 4 June 2021, if the GDPR applies) to carry out such international data transfers in accordance with the applicable data protection legislation. Specific information on the appropriate safeguards applicable to each international data transfer can be obtained from Grifols at privacy@grifols.com.

Grifols does not share personal data with any other third party unless it is authorised by the data subject or required by the applicable law.

4. Retention period

Grifols will retain the personal data for the time strictly necessary for the fulfilment of the purposes for which it has been collected or, if applicable, until the end of the statutes of limitation of any liabilities that may arise, and during the term required to comply with any applicable legal obligation.

5. Sources of personal data

If data subjects do not directly provide Grifols with their personal data, Grifols may obtain the personal data from other data subjects informing on potential conflicts of interest or from public sources, such as Internet or other public directories.

If the data subjects provide Grifols with personal data of any third parties, they undertake to previously inform said third parties of the transfer of their personal data to Grifols and to provide them with this privacy notice.

6. Data protection rights

The following data protection rights are applicable under the GDPR. Grifols undertakes to respect other data protection rights that may be applicable in accordance with the data protection legislation of each country.

Rights

Access
Content

You may request confirmation as to whether or not your personal data is being processed and, if so, you can obtain access to your personal data included in Grifols' files.

Rectification
Content

You may request the rectification of your personal data if inaccurate.

Erasure
Content

You may request the erasure of your personal data.

Objection
Content

You may request that your personal data is not processed under specific circumstances.

Portability
Content

You may request receiving, in an electronic file, the personal data that you provided Grifols with, as well as the right to transmit it to other parties.

Restriction of processing
Content

You may request a restriction on how your personal data is processed when:

  • the accuracy of the personal data is being verified after you have contested its accuracy.
  • processing of your personal data is unlawful and you object to its erasure.
  • Grifols no longer needs the personal data for the purposes of processing it, but you need it in order to prepare, exercise or defend a legal claim.
  • you have objected to the processing of the personal data for the performance of a task carried out in the public interest or necessary for the purposes of a legitimate interest, while verifying if Grifols' legitimate grounds override yours.
Rights Content

Access

You may request confirmation as to whether or not your personal data is being processed and, if so, you can obtain access to your personal data included in Grifols' files.

Rectification

You may request the rectification of your personal data if inaccurate.

Erasure

You may request the erasure of your personal data.

Objection

You may request that your personal data is not processed under specific circumstances.

Portability

You may request receiving, in an electronic file, the personal data that you provided Grifols with, as well as the right to transmit it to other parties.

Restriction of processing

You may request a restriction on how your personal data is processed when:

  • the accuracy of the personal data is being verified after you have contested its accuracy.
  • processing of your personal data is unlawful and you object to its erasure.
  • Grifols no longer needs the personal data for the purposes of processing it, but you need it in order to prepare, exercise or defend a legal claim.
  • you have objected to the processing of the personal data for the performance of a task carried out in the public interest or necessary for the purposes of a legitimate interest, while verifying if Grifols' legitimate grounds override yours.

You may exercise, when appropriate, your data protection rights by, for example, sending a written communication to Grifols at privacy@grifols.com with the subject line "Conflicts of Interest". To that end, Grifols may request further information or documents if necessary and appropriate to identify you.

For residents in the United States please contact the Privacy Office at US-PrivacyRights@Grifols.com.

In addition, you may lodge a complaint with a data protection authority, including the one at your residence, place of work or place of the alleged infringement.

7. Specific provisions

European Union 

The lawful basis to process personal data identified in Section 3 are regulated in the following provisions of the GDPR:

  • Legitimate interest: article 6.1(f) of GDPR

France

When Grifols France S.A.R.L. is the data controller, the data subjects have the right to provide guidance on the management of their data after their death.

 

Portugal

When Grifols Portugal – Produtos Farmacêuticos e Hospitalares, Lda. is the data controller, the data subjects have the right to provide guidance on the management of their data after their death. When guidance on the management of their data has not been provided by the deceased data subjects, the
exercise of their data protection rights defined in Section 6 may be carried out by their heirs. The data subjects may also determine the impossibility of exercising these rights after their death.

When there is a legal obligation of secrecy, the rights of the data subjects cannot be exercised.

 

United Kingdom

All references throughout the document to the GDPR also refer to, as applicable, the GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland.

Privacy notice available in other languages

DE - Interessenkonflikte - Datenschutzhinweis
ES – Conflictos de Interés – Aviso de Protección de datos

Date of creation: December 2024