Privacy Policy

In order to receive and process your complaint, you must confirm that you have read this Privacy Notice.

Dermofarm guarantees the confidentiality of the identity of the informant, of the affected persons and of any third party mentioned in the communication, as well as of the actions that take place during the investigation, without prejudice to the communications that must be made to the competent authorities in compliance with legal obligations.

Here's some basic information about how we process your personal data:

Privacy and data protection basics

1.Data Controller

DERMOFARM, S.A.U. (hereinafter, DERMOFARM) with registered office at Carrer Leonardo Da Vinci, 16-22, Parc de Can Sant Joan, 08191 Rubí (Barcelona) and with NIF A-08283624. It is registered in the Mercantile Registry of Barcelona.

2.Data processor

Dermofarm manages the channel through the Ithikios platform, owned by Digital Products Development, S.L. , which acts as a processor under a contract pursuant to Article 28 of the GDPR. The processor implements appropriate technical and organizational measures to ensure information security. The data is hosted on servers within the European Economic Area.

3.Data Protection Officer

You can contact us by email: [email protected]

4.Data subject to processing and origin

Communications may be made in an identified or anonymous form. In the event that the informant decides not to identify himself, Dermofarm will not process identifying data of the informant, unless these are voluntarily provided during the management of the communication.

The following will be subject to processing:

• your contact details (name and surname, e-mail, telephone number). Only in the event that the complaint is not anonymous.

• Name and position of the persons reported in the complaint

• information (regardless of their nature) of the facts denounced

5.Purpose of processing

In accordance with current data protection regulations, the Company informs you that your personal data will be collected and processed for the purpose of:

• To analyze, process, and investigate the facts reported confidentially.

• Manage the query you ask us.

• Exchange information in order to complement your application.

• Interview you to clarify the facts reported, if applicable.

6.Legal basis that legitimises the processing

1. Compliance with a legal obligation (art. 6.1.c GDPR), derived from Law 2/2023, of 20 February, regulating the protection of persons who report regulatory breaches and the fight against corruption.

2. Public interest (art. 6.1.e GDPR and art. 24 LOPDGDD) with respect to those communications admitted and managed through the system.

7.Data recipients or data transfers

The data will only be accessible by the System Manager and the authorised persons of the Compliance team. Likewise, they may be accessed by the external advisors that Dermofarm deems necessary for the correct development and management of an investigation. Where appropriate, these third parties will always act in the name and on behalf of Dermofarm, that is, they will act following our instructions and in accordance with the corresponding processing contract that we have signed with them. Under no circumstances will they use your data for their own purposes.

Likewise, the data may be communicated to judicial authorities, the Public Prosecutor's Office, the Security Forces and Corps or other competent administrative authorities when there is a legal obligation or it is necessary for the investigation of the facts.

No international data transfers are planned.

8.Retention period

Personal data will be kept only for the time necessary to decide on the appropriateness of initiating an investigation into the facts reported. In any case, if three (3) months have elapsed since receipt of the communication without any investigation actions having been initiated, the data may be deleted from the internal information system, unless its retention is necessary to provide evidence of the operation of the system or to attend to possible legal liabilities. When an investigation is initiated, the data may be kept for the time necessary for its processing and resolution.

9.Rights of data subjects

You can exercise your right of access, rectification, deletion or oblivion, limitation, portability, opposition by writing to [email protected] and to file complaints with the competent supervisory authorities (in Spain, to the Spanish Data Protection Agency (www.aepd.es)).

The exercise of these rights may be limited when necessary to protect the identity of the informant, guarantee the confidentiality of the system or safeguard the proper conduct of an investigation, in accordance with the applicable regulations.