Privacy Policy

Last update date: 24th January, 2023.


1.               PURPOSE

This privacy policy regulates the processing of personal data performed by DIVASA-FARMAVIC, S.A. (hereinafter referred as “DIVASA” or “company”).


2.               CONTROLLER

The controller of the personal data is DIVASA, with registered office at Carretera Sant Hipòlit, km. 71, 08503 Gurb (Barcelona) and email regarding protection of personal data


3.               PERSONAL DATA

DIVASA will exclusively collect personal data that is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, as applicable in each case.

The holder of the personal data (hereinafter referred as “data subject”) guarantees the authenticity of the data disclosed and will be the sole responsible for any false or inaccurate indication.



The personal data will be processed for the following purposes and legal bases, as appropriate in each case:


Legal basis
-        Administrative management of the existing contractual relationship, which will include the budget monitoring and order control, as well as the management and control of the payment and the collection of the corresponding invoices.
-        Management of the compliance with legally stipulated obligations.
-        Management of communications made pursuant to the Spanish Law 2/2023, initiation, where appropriate, of the corresponding investigation procedure and adoption of corrective measures that, if applicable, are appropriate.
Compliance with a legal obligation.
-        Review and assessment of the information and/or documentation provided to DIVASA in order to participate in the company’s personnel selection processes, as well as to evaluate requests to carry out practices in it. If there is interest in the candidacy, the company will contact with the data subject in order to evaluate it. At any time, the data subject may withdraw his or her consent, without this affecting the lawfulness of the prior processing to its withdrawal.
Consent of the data subject.
-        Maintenance of professional contact regarding the relationship between DIVASA and its clients and suppliers.
Legitimate interest.
-        Management of communications made pursuant to the Spanish Law 2/2023, which contain special categories of personal data. These data will only be processed when it is strictly necessary for the adoption of corrective measures and/or the initiation of the corresponding investigation procedure, and/or the processing of the sanction or criminal procedures that, where appropriate, may apply.
Essential public interest.

5.               MEASURES TAKEN

DIVASA guarantees that it has taken all the necessary technical and organizational measures to maintain the required level of security, considering the nature of the personal data processed.


6.               RECIPIENTS

DIVASA will not sell the personal data subject to its processing. Furthermore, it will not make transfers to third parties, except in cases of legal obligation and contracted third parties.

The personal data obtained as a result of communications made under the Spanish Law 2/2023 may be communicated, where appropriate, in the framework of an investigation, to the judicial authority, to the public prosecutor's office or to the competent administrative authority.


7.               STORAGE PERIODS

DIVASA will store the personal data solely during the term that is necessary to perform the purposes upon which they were collected.

In case the legal basis of the processing is the consent of the data subject, the personal data will be stored until the data subject withdraws his or her consent or for a maximum period of two years from the receipt of the information and/or documentation mentioned above (whichever comes first).

Once the purpose for which the personal data were collected is terminated, the consent of the data subject has been withdrawn or once the two-year period mentioned above has ended, the data will be stored during the term upon which DIVASA could be held responsible as set forth in the applicable law, proceeding, if applicable, to the lock of the data until the corresponding limitation period has elapsed.

In the case of the personal data obtained as a result of the management of communications made under the Spanish Law 2/2023, these will be stored during the necessary time to decide on the appropriateness of initiating an investigation in relation to the reported facts. In case it was appropriate to adopt corrective measures, the data will be stored for the duration of the application of these measures. On the other hand, in the event that it is necessary to initiate the processing of sanction or criminal procedures, the data will be stored for the duration of the sanction or criminal procedure.

In any case, if the decision on the appropriateness of initiating an investigation into the reported facts is not adopted within three months, the personal data contained in the communication will be deleted, except for those data that are strictly necessary to be preserved locked in order to maintain evidence of the system performance in accordance with the Spanish Law 2/2023.

Those personal data that reveal behaviours that are not included in the scope of application of the Spanish Law 2/2023 will also be deleted, as well as those personal data not considered truthful, except that this lack of truthfulness may constitute a criminal offense. In the latter case, the information will be stored for the necessary time until the judicial procedure has been processed.


At any time, the data subject may request from DIVASA the access to his or her personal data, its rectification or erasure, the restriction or opposition to its processing, as well as exercise the right to data portability, sending a letter to the email address, or to the following postal address: Carretera San Hipòlit, km. 71, 08503 Gurb (Barcelona).

In particular, the data subject may exercise the following rights:

  • Access to his or her personal data.
  • Rectify inaccurate or incomplete data.
  • Request the deletion of the data when, among other reasons, the data is no longer necessary for the purposes for which they were collected.
  • Exercise the restriction of data processing when any of the conditions provided for in the regulations on data protection are met.
  • In certain circumstances and for reasons related to its particular situation, the data subject may object to the processing of their personal data. In these cases, DIVASA will stop processing the data, unless it proves compelling legitimate reasons, or for the exercise or defence of potential claims.
  • Obtain human intervention, express your point of view and contest the automated decision-making adopted by DIVASA, if applicable.
  • Request the portability of their data.

In case of disagreement in relation to the processing of personal data, the data subject may file a claim to the Spanish Data Protection Agency, the body that holds the control authority in the matter, located at Calle Jorge Juan, number 6, 28001 Madrid (







Group Divasa Farmavic © 2012