Privacy policy of Made of Genes

In compliance with the legislation on personal data protection, namely the General Data Protection Regulation (EU) 2016/679 and the Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights, Made of Genes, S.L.U (hereinafter, ‘Made of Genes’) hereby informs that the personal data of individuals (hereinafter, ‘Users‘) who access and visit the website https://shop.madeofgenes.com/, as well as its subdomains and related mobile applications (hereinafter, the ‘Service’) will be processed in accordance with the stipulations of this Privacy Policy.

The legal basis for processing personal data will depend on the specific purpose of each data processing operation. In this sense, Users’ personal data will be processed for the following purposes:

Information Request

The processing of personal data is based on Made of Genes’ legitimate interest in responding to Users’ questions or queries regarding the Service, and being able to offer commercial information about the Service via electronic communications. In the latter case, the legal basis of the processing will be the Users’ consent. Additionally, Users may specify that Made of Genes can occasionally contact them through a phone call or videoconference. The data processed for this purpose will be kept until the request for information and/or inquiry has been answered and, after that, until Users hire the Service or revoke their consent via the appropriate link enabled for this purpose, which is at the bottom of each email.

Subscription to Newsletters

The legal basis for the processing of personal data is the Users’ consent to receiving news in the personalised health sector or updates on Made of Genes’ products. The form of communication will be via email to the address provided by the User. The data processed for this purpose will be kept indefinitely until the User indicates that they wish to cancel their subscription, that is, revoke their consent through the link at the bottom of each electronic communication.

Hiring of the Service

In the event that Users purchase Made of Genes’ Service, they must read and accept the Terms and Conditions of the Service, and sign the consent form for the purposes of data protection regulations, which includes detailed information about the use and protection of personal data. The legal basis for such processing is the execution of a contract in which the User is a party and the User's explicit consent regarding their genetic and/or health data. The data processed for this purpose will be stored for as long as the business relationship is maintained and, once it has ended, during the legal data retention and statutory limitation periods.

Job Application

In the event that the User wishes to apply to some of the offers advertised by Made of Genes on its website or through the email address jobs@madeofgenes.com, the User’s personal data as well as possible attachments (curriculum vitae) will be added to a database of candidates in order to attend and evaluate your application for employment. The data processed for this purpose will be kept for up to 24 months after receipt, after which they will be deleted.

The legal basis for the processing of your personal data is the performance of pre-contractual measures requested by the applicant, in order to evaluate their application, and the legitimate interest of Made of Genes in managing its recruitment processes and considering candidates future vacancies.

Data Sharing and International Transfers

In general, Made of Genes informs its Users that their data may be communicated to third-party recipients such as Public Bodies and Administrations in order to comply with legal obligations.

Additionally, for the execution of the Service, Made of Genes uses certain operational support services outsourced to third-party companies that may eventually act as Data Processors for certain data, such as: electronic communications providers, cloud software providers, hosted web services (hosting), administrative agencies, legal services, auditors, lawyers, human resources platforms, or logistics companies.

Made of Genes informs its Users that the Made of Genes Service operates on the operational infrastructure and servers of the Genomcore platform (owned by the company Genomcore, S.L.), whose terms and conditions are available on the website https://genomcore.com and also include the terms relating to Data Protection and a list of the platform's sub-processors. Genomcore's servers are located in data centers within the European Union.

Made of Genes designs its operations and selects its suppliers to avoid international transfers of personal data outside the European Economic Area (EEA). However, in the event that, for operational reasons or due to the nature of the service requested, it is essential to transfer personal data to countries outside the EEA, Made of Genes will adopt the safeguards provided for in the applicable regulations (General Data Protection Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPD DGG)) to ensure an adequate level of protection of personal data. These safeguards may include, among others, the existence of an adequacy decision by the European Commission or the signing of Standard Contractual Clauses approved by the European Commission.

Likewise, Made of Genes works with suppliers who act as data processors and who may transfer personal data outside the European Economic Area as part of the services provided or for reasons related to their operations. In such cases, adequate safeguards for the protection of personal data will also be adopted, including, among others, the existence of an adequacy decision, the signing of Standard Contractual Clauses, or the application of Binding Corporate Rules.

Depending on the service provided, Made of Genes may act as the Data Controller or Data Processor. In cases where services are provided jointly and in collaboration with other companies, Made of Genes may maintain its status as Data Processor vis-à-vis the Data Controller, while the collaborating companies act as sub-processors vis-à-vis the Data Controller.

The providers we use to process data in our personalized health intelligence services, and who may eventually act as sub-processors, are listed below:

Likewise, please be informed that these sub-processors may in turn use services provided by third-party subcontractors for the provision of certain services or for reasons related to their operations, who will act as second-level sub-processors, based on the corresponding sub-processor contract. In these cases, Made of Genes will require first-level sub-processors to guarantee compliance with the obligations set out in Article 28 of the GDPR, ensuring that second-level sub-processors offer the same adequate data protection guarantees and sign the corresponding processing agreements.

Users’ Rights

Users may at any time exercise their rights to request access, rectification, cancellation of data, restriction or opposition of its processing, and right to data portability. Similarly, in the data processing whose legitimacy is based on the consent given by the User, the User has the right to withdraw said consent at any time, without affecting the legality of the data processing based on consent prior to its withdrawal.

To exercise such rights, the User can send their request via email to dpo@madeofgenes.com or by post to Genomcore S.L., Carrer de la Riba, 36 Edifici Baronda, Espai A, 08950 Esplugues de Llobregat, Barcelona. In any case, Users have the right to lodge a complaint with a supervisory authority Spanish Data Protection Agency (www.aepd.es), should they deem it appropriate.