1. Who is the controller of your data?

Company name: HYSSOGENIX SL
ID Number: B71422380
Registered place of business: Plaza CEIN Nº5. Laboratory R1.3. 31110 Noáin (Navarra)
Registered in the Mercantile Register of Navarre, Sheet NA 40114, Folio 68, Volume 2011, Section 8ª.
Telephone: 948150141
Email: administracion@hyssogenix.com

2. What is the purpose of processing your personal data?

In accordance with the provisions of EU Regulation 679/2026 and Organic Act 3/2018 of 5 December 2018 on the protection of personal data and assurance of digital rights, we hereby inform you that the personal data you provide and that which may be produced in the course of our relationship with you, are processed for the following purposes:

• to respond to your requests

• to provide information about the services of HYSSOGENIX SL, to which purposes you consent to being sent commercial communications by email or by any other equivalent means of electronic communication (such as text messages) that you have provided.

• if you have sent us your CV, to take your application into account in the recruitment process.

• to respond to queries, complaints and suggestions, and carry out all kinds of communication actions.

• to carry out accounting, tax and administrative tasks.

3. How long will you keep my data?

The personal data provided shall be stored for as long as their erasure is not requested by the data subject, or whoever legally acts as their legal representative, and for as long as necessary – including the need to keep the data during the applicable limitation periods – or relevant for the purpose for which they were collected or recorded.

The conservation of the data will be subject to the legal obligation that HYSSOGENIX SL may have to do so. After such time, the data shall be destroyed or erased, and the erasure, elimination or destruction shall be carried out in such a way that the information contained in the media is not recoverable.

4. Legitimation

The legal basis for the processing of your data is the consent given by the data subject. This is obtained expressly and unequivocally by completing and, where appropriate, sending the paper or electronic documents and forms in which your data are collected. In all of the entity’s documents, which are used to collect data for different uses, there are informative clauses in accordance with the provisions of the data protection regulations and consent is expressly given by the signature of the person concerned, or by sending the existing forms on the website.

Processing is also legitimate when it is necessary for the performance of a contract, or the provision of a service to the data subjects, to which they are party, or for the application of pre-contractual measures at their request (art. 6.1(a) and (b) GDPR).

HYSSOGENIX SL is also entitled to process your data in order to comply with the legal obligations to which it is subject and for the satisfaction of legitimate interests, provided that these do not override the interests or fundamental rights of the data subjects.

Whatever the legal basis, consent may be withdrawn at any time.

5. Who will be given your personal data?

Your data will not be transferred to any entity without your consent, except for the transfers provided for by law. In this respect, your express consent will be requested for the transfer of your data to any other entity.

As a consequence of the management of the authorised purposes, your data may be communicated to entities or persons directly related to HYSSOGENIX SL and the services provided by it. Likewise, your personal information will be at the disposal of public administrations, judges and courts, to comply with such responsibilities as may arise from the processing and provided that such availability is in accordance with the law.

Your data may also be disclosed to companies that provide us with consultancy, IT maintenance, marketing, training or auditing services. These companies only have access to personal information that is necessary to carry out these services, and are contractually bound to maintain confidentiality, refrain from using the information for other purposes, and take steps to ensure the integrity and availability of the information, all under a data processing agreement.

No international data transfers outside the European Union or to entities that do not comply with the data protection standards set out in EU Regulation 679/2016 are foreseen.

6. What is the provenance of your data?

The personal data processed by HYSSOGENIX SL are provided by the person concerned or obtained from sources accessible to the public.

7. What categories of data does HYSSOGENIX SL process?

HYSSOGENIX SL will process the data you provide, which may be of the following categories:

• Identification and contact data


• Academic and professional data


• Detailed employment data


• Economic, financial and insurance data


• Commercial information

8. What are your rights?

Anyone has the right to obtain confirmation about whether HYSSOGENIX SL is processing personal data concerning them.

Data subjects have the right to access their personal data and to obtain a copy of the personal data undergoing processing, to update them, as well as to request rectification of inaccurate data or, as the case may be, request their erasure when, among other reasons, the data is no longer necessary for the purposes they were collected.

In certain circumstances and for reasons related to their particular situation, data subjects may object to the processing of their data. HYSSOGENIX SL shall no longer process the data, except for compelling legitimate grounds, or the exercise or defence of legal claims.

Also, in certain circumstances provided for in Article 18 GDPR, data subjects may request the restriction of processing of their data, in which case HYSSOGENIX SL will process them, with the exception of storage, only with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If applicable, as a consequence of the application of the right to erasure or objection to personal data processing in the online environment, data subjects have the right to be forgotten according to the case law of the Court of Justice of the EU.

Under the right to data portability, data subjects have the right to obtain the personal data concerning them in a structured, commonly used and machine-readable format and to transmit it to another controller.

Every data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

The data subject has the right to the erasure of their data, due to the disappearance of the purpose for which the data were processed or collected, due to revocation of consent when this is the one that legitimises the processing, or for the other reasons contained in article 17, GDPR. Deletion shall be carried out by high-level erasure of data contained on automated media and physical destruction of non-automated media.

9. How can rights be exercised?

In writing, always accompanied by a copy of the ID card or other document accrediting the identity of the data subject, addressed to the addresses first shown above.

10. How can complaints be lodged?

If you consider that your rights have not been properly addressed, you have the right to file a complaint with the Spanish Data Protection Agency, whose contact details are:

Telephone numbers: 901 100 099, +34 912663517


Postal address: C/ Jorge Juan, 6 Madrid.