Privacy policy
This Privacy Policy explains how personal data is processed through the website [https://gametia.com/](https://gametia.com/), in particular when an individual uses the contact forms to request information about Gametia Biobank services, egg banks or sperm banks.
The website is intended for informational purposes and to provide an initial point of contact. The forms allow interested individuals to provide their contact details and information relating to their clinic, professional role, country or enquiry so that the request can be handled and, where appropriate, referred to the relevant group entity based on geographical location or the type of service requested.
The contact forms are not intended to collect medical records, genetic data or other health-related information. If an individual subsequently continues the process with a clinic or gamete bank, they will be provided with the specific privacy information applicable to the relevant treatments, samples and services.
1. Website operator and entities involved
| Details | Information |
|---|---|
| Website operator | Nextclinics Spain, S.L.U. |
| Trading name | Gametia Biobank |
| Tax Identification Number (NIF) | B98959232 |
| Registered office | Avenida Burjassot 3, 46009 Valencia |
| Email address | rgpd@gametia.com |
| Website | [https://gametia.com/](https://gametia.com/) |
This Privacy Policy explains that Nextclinics Spain, S.L.U. and certain entities within its group participate in the management of requests received through the contact forms, each within its respective area of responsibility:
| Entity | Scope of involvement |
|---|---|
| Nextclinics Spain, S.L.U. | To connect individuals requesting information with the relevant entity and refer their contact details based on geographical location or the type of service requested. |
| Centro de Estudio e Investigación de la Fertilidad, S.L. | To handle enquiries from individuals interested in sperm bank services. |
| Ceifer Biobanco Sevilla, S.L.U. | To handle enquiries from individuals located in Spain who are interested in oocyte bank services. |
| Instituto de Medicina Reproductiva, S.A.U. | To handle enquiries from international contacts interested in oocyte bank services. |
The entities involved in handling a request will process personal data within their respective areas of responsibility. Where two or more entities jointly determine the purposes and means of the initial processing of a contact request, they will act as joint controllers in accordance with Article 26 of the GDPR. Any subsequent provision of clinical services, processing of health data or management of biological samples will be governed by the specific privacy information provided by the relevant entity.
2. Personal data we process
Depending on the form used and the content of the enquiry, we may process the following categories of personal data:
- Identification and contact data, such as first name, surname and email address.
- Professional or employment-related data, such as the position or job title of the individual making the enquiry.
- Location and service-related information, such as country, geographical area, referring clinic and the type of bank or service in respect of which information is requested.
- Personal data included in the comments field and in any subsequent communications required to respond to the enquiry.
- Technical and browsing data required to ensure the security and proper functioning of the website, including information generated by reCAPTCHA where this service is used.
It is not necessary to provide health data, genetic data, biometric data, medical reports or identifying information relating to donors or patients in order to use the contact forms. Users are therefore requested not to include such information in the comments field or in subsequent communications sent through the general contact channel.
3. Purposes of processing and legal bases
Personal data is processed for the purposes and on the legal bases set out below:
| Processing activity | Purpose | Legal basis |
|---|---|---|
| Management of contact forms | To receive, record, manage and respond to enquiries or requests for information submitted by the data subject. | The data subject’s consent and/or our legitimate interests in responding to an enquiry initiated by that individual. Articles 6(1)(a) and 6(1)(f) GDPR. |
| Referral within the group | To disclose contact details to the relevant group entity based on geographical location, the type of bank or the service requested, so that the requested initial information can be provided. | The data subject’s consent and, where applicable, our legitimate interests in appropriately organising and managing the request. Articles 6(1)(a) and 6(1)(f) GDPR. |
| Handling the requested service | To provide information about gamete bank services and manage the communications required to assess or progress the initial request. | The data subject’s consent or the taking of steps at the request of the data subject prior to entering into a contract, where the individual expressly requests to proceed with a service relationship. Articles 6(1)(a) and 6(1)(b) GDPR. |
| Technical operation and security | To maintain the availability, integrity and security of the website, prevent spam, fraudulent activity and cyber-attacks, and manage technical incidents. | Our legitimate interests in ensuring the proper functioning and security of the website. Article 6(1)(f) GDPR. |
| Legal obligations and claims | To comply with applicable legal obligations and to establish, exercise or defend legal or administrative claims. | Compliance with a legal obligation and/or our legitimate interests. Articles 6(1)(c) and 6(1)(f) GDPR. |
Where processing is based on consent, the data subject may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.
4. Data retention
| Processing activity | Retention period or criteria |
|---|---|
| Forms and enquiries | Personal data will be retained for as long as necessary to manage and respond to the request and, thereafter, for as long as required to comply with applicable legal obligations or deal with any potential liabilities arising from the processing. |
| Referral to another group entity | Personal data will be retained for as long as necessary to coordinate the initial handling of the request. The receiving entity will apply its own retention periods to any subsequent processing activities it carries out. |
| Security data and technical logs | Data will be retained for as long as necessary to maintain system security, investigate incidents and comply with applicable legal or regulatory obligations, depending on the nature of the relevant log or technology. |
Once personal data is no longer required for the purposes for which it was collected, it will be erased or, where required by applicable law, securely restricted or blocked, while ensuring its confidentiality and compliance with applicable limitation periods.
5. Recipients of personal data
Personal data will not be sold or disclosed to third parties for their own commercial purposes. It may, however, be made available to the following categories of recipients where necessary:
- Nextclinics Spain, S.L.U. and the relevant group entities based on country, location, clinic or type of bank requested, to the extent necessary to respond to the enquiry and provide the requested initial information.
- Technology providers and other service providers that support hosting, maintenance, email services, form management, security, technical support and the general operation of the website, acting as processors where applicable.
- Google and providers involved in the operation of reCAPTCHA, where this tool is used to protect forms against automated or fraudulent use, in accordance with their own applicable privacy terms and policies.
- Public authorities, courts, tribunals, law enforcement bodies and other third parties where disclosure is required by law or is necessary for the establishment, exercise or defence of legal claims.
Where a service provider acts as a processor, it may process personal data only on the basis of documented instructions and subject to the safeguards required under Article 28 of the GDPR.
6. International transfers of personal data
The use of certain technology providers, including Google and other providers of hosting, communications, security or support services, may involve the processing of personal data outside the European Economic Area.
Where personal data is transferred internationally, the safeguards required under Articles 44 et seq. of the GDPR will be implemented. Depending on the circumstances, these may include an adequacy decision, valid participation in the EU-U.S. Data Privacy Framework where applicable, the use of Standard Contractual Clauses and, where necessary, supplementary technical, contractual or organisational measures.
The list of providers and the configuration of the website should be kept under review so that this information accurately reflects the services and tools actually in use at any given time.
7. Data subject rights
Subject to the conditions provided under applicable data protection law, you may exercise your rights of access, rectification, erasure, restriction of processing, objection and data portability. Where processing is based on consent, you may also withdraw your consent at any time.
You may exercise these rights by contacting:
| Contact channel | Information |
|---|---|
| Data controller | Nextclinics Spain, S.L.U. |
| Postal address | Avenida Burjassot 3, 46009 Valencia |
| Email address | rgpd@gametia.com |
Your request must contain sufficient information to identify you and must specify the right you wish to exercise. Additional information will only be requested where there are reasonable doubts as to the identity of the person making the request. As a general rule, requests will be answered within one month of receipt, unless an extension of that period is permitted under applicable law.
If you consider that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) through www.aepd.es, without prejudice to any other administrative or judicial remedy available to you.
8. Contact our Data Protection Officer (DPO)
We have appointed a Data Protection Officer whom you may contact with any complaints, questions or suggestions concerning the processing of your personal data.
The contact details of our Data Protection Officer are as follows:
Email address: delegadodeprotecciondedatos@dataevalua.com. Please include “Gametia Biobank” in the subject line of your email.
9. Profiling and automated decision-making
We do not carry out automated individual decision-making that produces legal effects concerning individuals who use the contact forms or similarly significantly affects them. We also do not carry out profiling for such purposes.
10. How we protect personal data
The entities acting as controllers and, where applicable, joint controllers implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, taking into account the nature of the data, the purposes of the processing and the risks involved.
However, no system connected to the Internet can be guaranteed to be completely secure. Where a personal data breach occurs and is likely to result in a risk to the rights and freedoms of individuals, the relevant incident management and notification procedures will be followed in accordance with applicable data protection law.
11. Mandatory and optional data fields
Fields identified as mandatory on each form are those required to process the enquiry and contact the interested individual. If the required data is not provided, it may not be possible to process the request or provide the requested information. Optional fields may be left blank.
Any individual providing personal data through the website confirms that such data is accurate, current and truthful, and undertakes to notify us of any changes affecting the information provided.
Where an individual provides personal data relating to another person, they confirm that they have previously informed that person of the matters set out in this Privacy Policy and that they have a valid legal basis for disclosing the relevant data.
12. Cookies and third-party links
The website may use cookies and similar technologies that are strictly necessary for its operation and, where applicable, technologies used for analytics, service improvement or protection of online forms. Non-essential cookies will only be placed where valid consent has been obtained through the relevant cookie banner or consent management platform.
Further information about the cookies used, their purposes, providers, duration and how consent can be managed or withdrawn is available in the Cookie Policy. The website may also contain links to Google, reCAPTCHA, clinics and other third-party websites. Gametia Biobank is not responsible for the privacy notices, policies or practices of those third parties.
13. Changes to this Privacy Policy
This Privacy Policy may be updated from time to time to reflect changes in applicable law, organisational arrangements, technology or the processing activities carried out through the website and its contact channels. The version in force will be the version published on this page together with the date on which it was last updated.