Privacy Policy
General information
In compliance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, known as the General Data Protection Regulation (hereinafter, the “GDPR”), and Organic Law 3/2018 of 5 December 2018 on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, the “LOPDGDD”), users are hereby informed about the processing of personal data provided through this website.
This Privacy Policy aims to explain clearly and transparently what personal data Deflastrat collects, the purposes for which it uses them, how long it retains them and how users may exercise their rights.
Data controller
The controller responsible for processing personal data is Deflastrat S.L.U. (hereinafter, “Deflastrat”), with tax identification number (CIF) B75060343 and registered office at Calle Aienas 3, local 23, Polígono 27, 20014 Donostia-San Sebastián (Gipuzkoa, Spain).
You may contact Deflastrat regarding any matter related to the protection of your personal data at the following email address: deflastrat@deflastrat.com
Categories of Data
For the creation and management of the user account, Deflastrat will process the following categories of personal data: identification data, such as the user’s first name, surname and username; contact data, such as their email address; professional data, such as the hospital to which the user belongs and their role or position; and authentication data, such as the credentials required to access the account.
Purpose
The personal data provided by the user will be processed for the purposes of creating and activating their account, identifying and authenticating them when they access the website, managing and maintaining their account, verifying their professional affiliation with the stated hospital and managing access by authorised professionals, enabling the recovery or modification of their access credentials, handling account-related issues and ensuring the security of the website.
The data provided to create the account will not be used to send marketing communications.
Legitimacy
The legal basis that allows Deflastrat to process personal data is the performance of the relationship requested by the user when creating and using an account, in accordance with Article 6(1)(b) of the GDPR.
Providing the data requested in the registration form is necessary to create and manage the account. If the user does not provide these data, it will not be possible to complete the registration process or allow access to features reserved for registered users.
Where processing is necessary to ensure the security of the website, prevent fraudulent access or protect Deflastrat’s systems, the legal basis will be Deflastrat’s legitimate interests, in accordance with Article 6(1)(f) of the GDPR.
Data retention
Personal data will be retained while the user account remains active and until the user requests its deletion.
When deletion of the account is requested, the data will no longer be used for the purposes described above. However, they may be retained in a duly restricted form for the periods necessary to address potential legal, administrative or judicial liabilities.
Once those periods have expired, the data will be securely deleted.
Release and transfers
The website and user accounts are managed directly by Deflastrat. Therefore, the personal data provided by users will not be disclosed to third parties, nor will external service providers be permitted to access such information, except where disclosure is required by law or requested by a competent public, administrative or judicial authority.
Furthermore, Deflastrat will not transfer personal data internationally outside the European Economic Area.
Users’ rights
Users may exercise the following rights at any time:
- Right of access: to find out what personal data Deflastrat processes.
- Right to rectification: to request the correction of data that are inaccurate or out of date.
- Right to erasure: to request the deletion of their data when they are no longer necessary.
- Right to restriction: to request that the processing of their data be temporarily restricted in certain circumstances.
- Right to object: to object to processing where it is based on Deflastrat’s legitimate interests.
- Right to data portability: to receive the personal data provided in a structured, commonly used and machine-readable format, where applicable.
To exercise these rights, users must send a request to deflastrat@deflastrat.com, specifying the right they wish to exercise and providing, where necessary, the information required to verify their identity.
The exercise of these rights will be free of charge, unless the request is manifestly unfounded, excessive or repetitive.
Users also have the right to lodge a complaint with the Spanish Data Protection Agency if they consider that the processing of their personal data does not comply with the applicable legislation.
Security and confidentiality
Deflastrat will adopt the necessary technical and organisational measures to protect personal data against loss, alteration, misuse, unauthorised access or disclosure.
Any personnel who may have access to personal data will be subject to the corresponding duty of confidentiality.
Nevertheless, users must keep their access credentials secure and confidential and must not disclose them to third parties. Users will be responsible for activities carried out through their account where their access credentials have been correctly used.
Last modified: 6 July 2026.