Legal
Privacy Policy
Last updated: October 21, 2026
1. Data Controller
Controller: Oncology Consultants, S.L., NIF B-25978180.
Address: C/ José Ortega y Gasset, 22-24, 3rd floor, 28006 Madrid.
Privacy contact: privacidad@oncologyconsultantsespana.com.
Data Protection Officer: David Jiménez Mouriz (external legal advisor), privacidad@oncologyconsultantsespana.com.
2. Data We Process
Browsing: IP address, browser and device type, pages visited, and data collected through cookies, as described in the Cookie Policy.
Contact form and email: first and last name, email address, telephone (optional), organization and job title (optional), sender profile and message content.
Professional contacts: contact details and roles of people who work at sponsors, CROs, hospitals, suppliers and other organizations we work with.
Job applicants: CV and any other data the applicant provides to us.
We do not request health data through the website or by email. Please do not send us medical reports, diagnoses, treatment details or medical records through these channels. If we receive them, we will delete them without adding them to our systems and will direct you to the appropriate channel. Assessment for a possible trial always takes place in a clinical care setting, with its own information and safeguards.
3. Purposes, Legal Bases and Retention Periods
| Processing | Purpose | Legal basis | Retention |
|---|---|---|---|
| Enquiries by form or email | To handle and respond to your request | Consent (Art. 6.1.a GDPR) or precontractual steps taken at the data subject's request (Art. 6.1.b) | Until the enquiry is resolved and for 12 months afterwards |
| Professional contacts | To maintain relationships with collaborating organizations | Legitimate interest (Art. 6.1.f GDPR and Art. 19 LOPDGDD) | For the duration of the relationship or until you object |
| Contractual relationships | To manage contracts with sponsors, suppliers and collaborators | Performance of a contract and legal obligations (Art. 6.1.b and c) | For the term of the contract and then the statutory periods (6 years commercial, 4 years tax) |
| Job applicants | To assess your application in recruitment processes | Consent (Art. 6.1.a GDPR) | 12 months from receipt |
| Website security | To prevent fraud and attacks | Legitimate interest (Art. 6.1.f GDPR) | 90 days |
| Cookies | Depends on cookie type | As set out in the Cookie Policy | As set out in the Cookie Policy |
At the end of each period, the data is blocked for the limitation period of any potential liability and then deleted (Art. 32 LOPDGDD). We do not make automated decisions or carry out profiling that produces legal effects.
4. Recipients
We do not disclose your data to third parties unless required by law (for example, to health, judicial or tax authorities). Our web hosting, email, IT services and advisory providers may access your data as data processors under contract (Art. 28 GDPR). Where necessary to handle a request from a sponsor or collaborator, and always with appropriate safeguards, we may share professional contact details with organizations that work with us in conducting trials (for example, contract research organizations).
5. International Transfers
Our website and its contact form are hosted on servers located in the United States, on IONOS infrastructure managed by nexodigital.mx, which acts as a data processor. As a result, data you provide through the website is transferred to the United States. This transfer is based on the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914), together with any supplementary measures required. You may request a copy of these safeguards at privacidad@oncologyconsultantsespana.com.
6. Your Rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time. You may also withdraw your consent, without affecting the lawfulness of processing carried out before withdrawal. To do so, write to privacidad@oncologyconsultantsespana.com or to our registered address, stating which right you are exercising. We may ask for additional information to verify your identity.
If you believe we have not handled your request properly, you may contact our Data Protection Officer or file a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Security
We apply technical and organizational measures appropriate to the risk to protect your data against loss, alteration or unauthorized access. These include an encrypted (HTTPS) connection to the website and restricted access to information.
8. Children
Our forms are not intended for children under 14 years of age. If you are under that age, your parents or guardians must contact us on your behalf.
9. Social Media
We are present on LinkedIn, Instagram and X. If you interact with our profiles, we will process your data in accordance with this Policy and the terms of each social network. Each platform is responsible for its own privacy policy.
10. Changes to This Policy
We may update this Policy to reflect changes in the law or in our activities. The current version will always be the one published on the website, together with its update date.
This English version is provided for information purposes only. In the event of any discrepancy, the Spanish version shall prevail.