Privacy Policy - MiFisio Agenda

This document contains the privacy policy. We also recommend reading the cookies policy and the legal notice.

This Privacy Policy has been developed taking into account the provisions of the current Organic Law on the Protection of Personal Data, as well as Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and the free movement of such data, hereinafter the GDPR.

This Privacy Policy aims to inform the holders of personal data, regarding which information is being collected, the specific aspects related to the processing of their data, including the purposes of processing, contact details to exercise their rights, data retention periods and security measures, among other things.

Data Controller

In terms of data protection, Mfisio Schedula S.L. must be considered the Data Controller, in relation to the files/processing identified in this policy, specifically in the Data Processing section.

Below are the identifying details of the owner of this website:

Data Controller: Mfisio Schedula S.L.
Postal address: C/ Emilio Ferrari, 10. Ground floor left, 28017, Madrid, (Madrid).
Email address: info@mifisioagenda.com

Data Processing

The personal data requested, if any, will consist solely of those strictly essential to identify and attend to the request made by the data subject. Such information will be processed fairly, lawfully and transparently in relation to the data subject. On the other hand, personal data will be collected for specific, explicit and legitimate purposes, and will not be further processed in a manner incompatible with those purposes.

The data collected from each data subject will be adequate, relevant and not excessive in relation to the corresponding purposes for each case, and will be updated whenever necessary.

The data holder will be informed, prior to the collection of their data, of the general aspects regulated in this policy so that they can give express, precise and unequivocal consent for the processing of their data, in accordance with the following aspects:

Processing Purposes: The explicit purposes for which each of the processing operations are carried out are set out in the informative clauses incorporated in each of the data collection channels (web forms, paper forms, announcements or signs and informative notes). However, the personal data of the data subject will be processed for the sole purpose of providing them with an effective response and attending to requests made by the user, specified alongside the option, service, form or data collection system that the holder uses.
Legitimation: As a general rule, prior to the processing of personal data, Mfisio Schedula S.L. obtains express and unequivocal consent from the data holder, through the incorporation of informed consent clauses in the different information collection systems. However, in the event that consent is not required, the legal basis for processing relied upon by Mfisio Schedula S.L. is the existence of a specific law or regulation that authorizes or requires the processing of the data subject's data.
Recipients: As a general rule, Mfisio Schedula S.L. does not transfer or communicate data to third parties, except those legally required. However, if necessary, such transfers or communications of data are informed to the data subject through informed consent clauses contained in the different personal data collection channels.
Data Origin: As a general rule, personal data is always collected directly from the data subject. However, in certain exceptions, data may be collected through third parties, entities or services other than the data subject. In this regard, this will be communicated to the data subject through informed consent clauses contained in the different information collection channels and within a reasonable period, once the data has been obtained, and no later than within one month.

Retention Periods: The information collected from the data subject will be retained as long as necessary to fulfill the purpose for which the personal data was collected, so that once the purpose has been fulfilled, the data will be cancelled. Such cancellation will result in the blocking of the data, which will only be kept at the disposal of public authorities, judges and courts, to address possible liabilities arising from the processing, during the statute of limitations period. Once the said period has elapsed, the information will be destroyed. For informational purposes, the following legal retention periods for information in relation to different matters are listed below:

Document	Period	Legal Reference
Labor or social security related documentation	4 years	Art. 21 of Royal Legislative Decree 5/2000, of August 4, approving the consolidated text of the Law on Infractions and Sanctions in the Social Order
Accounting and tax documentation for commercial purposes	6 years	Art. 30 Commercial Code
Accounting and tax documentation for tax purposes	4 years	Articles 66 to 70 General Tax Law
Building access control	1 month	Guide on the use of video cameras for security and other purposes by the AEPD
Video surveillance	1 month	Guide on the use of video cameras for security and other purposes by the AEPD. Organic Law 4/1997, of August 4, regulating the use of video cameras by security forces in public places. Organic Law 4/2015, of March 30, on the protection of public safety

Navigation Data

Regarding navigation data that may be processed through the website, in the event that data subject to regulations is collected, it is recommended to consult the Cookies Policy published on our website.

If you subscribe to the newsletter through the blog or footer form, we will process your email address and the language you chose, for the sole purpose of sending you news about MiFisio Agenda, blog articles and management tips for physiotherapy clinics. Alongside your address we keep the subscription date, the page you subscribed from and the version of the consent text you accepted.

The legal basis is your consent (art. 6.1.a GDPR and art. 21 LSSI), which you confirm by clicking the link in the verification email (double opt-in) and can withdraw at any time through the unsubscribe link included in every email or by writing to info@mifisioagenda.com. The list and the mailings are managed in Acumbamail (Acumbamail S.L., Spain), which acts as a data processor with servers in the European Union; MiFisio Agenda keeps no copy of this data of its own. We will keep your address while you stay subscribed; after you unsubscribe, it is kept only on a suppression list so that we never contact you again.

Data Subject Rights

Data protection regulations grant a series of rights to data subjects or data holders, website users or users of Mfisio Schedula S.L.'s social media profiles.

These rights that assist data subjects are the following:

Right of Access: Right to obtain information about whether their own data is being processed, the purpose of the processing being carried out, the categories of data being processed, the recipients or categories of recipients, the retention period and the origin of such data.
Right of Rectification: Right to obtain the rectification of inaccurate or incomplete personal data.
Right of Erasure: Right to obtain the erasure of data in the following cases:
- When the data is no longer necessary for the purpose for which it was collected.
- When the data holder withdraws consent.
- When the data subject objects to the processing.
- When they must be erased in compliance with a legal obligation.
- When the data has been obtained by virtue of an information society service pursuant to Article 8(1) of the European Data Protection Regulation.
Right of Opposition: Right to oppose specific processing based on the data subject's consent.
Right of Restriction: Right to obtain the restriction of data processing when any of the following conditions apply:
- When the data subject contests the accuracy of the personal data, for a period that allows the company to verify the accuracy thereof.
- When the processing is unlawful and the data subject opposes the erasure of the data.
- When the company no longer needs the data for the purposes for which it was collected, but the data subject needs it for the establishment, exercise or defense of legal claims.
- When the data subject has objected to the processing while it is verified whether the company's legitimate grounds prevail over those of the data subject.
Right to Data Portability: Right to obtain the data in a structured, commonly used and machine-readable format, and to transmit it to another data controller when:
- The processing is based on consent.
- The processing is carried out by automated means.
Right to Lodge a Complaint: Right to lodge a complaint with the competent supervisory authority.

Data subjects may exercise the indicated rights by writing to Mfisio Schedula S.L. at the following address: C/ Emilio Ferrari, 10. Ground floor left, 28017 Madrid (Madrid), indicating in the subject line the right they wish to exercise.

Mfisio Schedula S.L. will attend to your request as soon as possible, taking into account the deadlines provided for in data protection regulations.

Security

The security measures adopted by Mfisio Schedula S.L. are those required in accordance with Article 32 of the GDPR. In this regard, Mfisio Schedula S.L., taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, has established the appropriate technical and organizational measures to ensure a level of security appropriate to the existing risk.

In any case, Mfisio Schedula S.L. has implemented sufficient mechanisms to: