Privacy Policy
Last updated: 9 November 2026
Data Controller
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation — GDPR) and Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD), users are informed about the processing of their personal data through this website.
Data Controller:
- Name: María Ximena Rojas Reyes
- Tax Identification Number (NIE): Y0109205S
- Address: Carrer dels Cirerers, 164, 08358 Arenys de Munt, Barcelona, Spain
- Email: mxrojas@livingevidenceihd.com
- Website: https://livingevidenceihd.com
The Data Controller is responsible for ensuring that personal data collected through the website is processed lawfully, fairly and transparently, in accordance with applicable data protection legislation.
Purpose of Personal Data Processing
Personal data may be processed for the following purposes:
Responding to enquiries and requests
To respond to enquiries, requests for information and communications submitted by users through email or any contact mechanisms provided on the website.
Scientific and research-related communications
To manage communications concerning the Living Evidence to Inform Health Decisions (LE-IHD) programme, including requests for information about research activities, scientific publications, evidence synthesis projects, methodological tools and collaboration opportunities.
Training activities and webinars
Where registration is offered, to manage participation in training activities, webinars, workshops and other educational initiatives, including sending relevant organisational information to registered participants.
Newsletters and informational communications
Where users have expressly subscribed or otherwise provided valid consent, to send updates about research activities, scientific developments, publications, training opportunities and other initiatives associated with the LE-IHD programme.
Users may withdraw their consent to receive these communications at any time.
Website administration and security
To maintain the functionality and security of the website, prevent unauthorised access, investigate technical incidents and ensure the proper operation of its services.
Compliance with legal obligations
To comply with legal or regulatory obligations applicable to the Data Controller.
Personal data will not be used for purposes incompatible with those described above.
Categories of Personal Data Collected
Depending on how users interact with the website, the following categories of personal data may be processed:
- Identification data: Name and surname.
- Contact information: Email address and any other contact details voluntarily provided.
- Professional information: Institutional affiliation, organisation, professional position or research interests, where voluntarily submitted.
- Communication data: Information included in enquiries, messages or correspondence.
- Event registration data: Information necessary to organise participation in webinars, workshops or training activities, where applicable.
- Technical information: IP address, browser type, device information, access logs and other technical data necessary for website operation or security.
- Cookie-related information: Data collected through cookies and similar technologies, subject to the conditions described in the Cookie Policy.
The website is not intended to collect personal health information or other special categories of personal data through ordinary contact communications.
Users are requested not to submit sensitive personal information unless specifically requested through an appropriate and secure procedure.
Legal Basis for Processing
Personal data will be processed on the basis of one or more of the following legal grounds under Article 6 of the GDPR:
Consent — Article 6(1)(a)
Where users provide consent for specific activities, such as subscribing to newsletters, receiving optional communications or enabling non-essential cookies.
Performance of a contract or pre-contractual measures — Article 6(1)(b)
Where processing is necessary to manage a service, registration or contractual relationship requested by the data subject.
Compliance with legal obligations — Article 6(1)(c)
Where processing is necessary to comply with obligations established by applicable legislation.
Legitimate interests — Article 6(1)(f)
Where processing is necessary to respond to general enquiries, maintain website security, prevent misuse or manage legitimate administrative activities, provided that such interests are not overridden by the rights and freedoms of the individuals concerned.
Where processing is based on consent, users may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Data Retention
Personal data will be retained only for as long as necessary to fulfil the purposes for which it was collected, in accordance with the principles of data minimisation and storage limitation established by the GDPR.
In particular:
- Contact enquiries: Data will be retained for the period necessary to respond to the request and manage any related follow-up, and subsequently where necessary to comply with legal obligations or address potential claims.
- Training and webinar registrations: Data will be retained for the duration of the relevant activity and for any additional period necessary to fulfil associated administrative or legal obligations.
- Newsletter subscriptions: Personal data will be retained until the user withdraws consent or requests removal from the relevant mailing list, unless further retention is legally required.
- Technical and security information: Data will be retained only for the period reasonably necessary for security, maintenance and incident management, subject to applicable legal requirements.
Once personal data is no longer required, it will be securely deleted or anonymised, unless further retention is required or permitted by law.
Data Recipients and Third-Party Service Providers
Personal data will not be sold to third parties.
Access to personal data may be granted to service providers where necessary for the operation of the website or the provision of its services.
These may include:
- Website hosting and technical maintenance providers.
- Email and communications service providers.
- Providers of webinar, video hosting or online training services.
- Website security and technical support providers.
- Other service providers necessary for the activities described in this Privacy Policy.
Where these service providers process personal data on behalf of the Data Controller, appropriate data processing agreements and safeguards will be established in accordance with Article 28 of the GDPR.
Personal data may also be disclosed to public authorities or competent bodies where required by applicable legislation.
International Data Transfers
Some third-party service providers used in connection with the website may operate outside the European Economic Area (EEA).
Where personal data is transferred to countries outside the EEA, such transfers will be carried out in accordance with the requirements of Chapter V of the GDPR.
Depending on the service provider and destination country, appropriate safeguards may include:
- Adequacy decisions adopted by the European Commission.
- Standard Contractual Clauses approved by the European Commission.
- Other safeguards or lawful transfer mechanisms recognised under the GDPR.
Users may request additional information about applicable international data transfers and related safeguards by contacting the Data Controller.
Cookies and Similar Technologies
This website may use cookies and similar technologies for technical functionality, security, user experience and, where applicable, statistical analysis.
Certain third-party services, including embedded multimedia content, may also use cookies or similar technologies.
Where required by applicable legislation, non-essential cookies and technologies will only be activated after obtaining the user’s valid consent.
Users can find further information about the types of cookies used, their purposes, retention periods and available consent management options in the website’s Cookie Policy.
Embedded Content and External Services
The website may provide access to scientific videos, webinars, educational materials and other content hosted on external platforms, including YouTube.
When users access or activate embedded content, the relevant third-party provider may process technical information, such as the user’s IP address, browser information or interaction data, in accordance with its own privacy policy.
Where legally required, third-party content involving non-essential tracking technologies will not be activated before obtaining the user’s consent.
The Data Controller encourages users to review the privacy policies of external platforms before interacting with their services.
Rights of Data Subjects
Under the GDPR, users have the following rights, subject to the conditions and limitations established by law:
- Right of access: To obtain confirmation as to whether their personal data is being processed and to access that information.
- Right to rectification: To request the correction of inaccurate or incomplete personal data.
- Right to erasure: To request the deletion of personal data where the legal conditions are met.
- Right to restriction of processing: To request that the processing of their personal data be restricted in certain circumstances.
- Right to data portability: To receive personal data in a structured, commonly used and machine-readable format, where applicable.
- Right to object: To object to processing based on legitimate interests or other applicable legal grounds.
- Right to withdraw consent: To withdraw previously granted consent at any time.
- Rights relating to automated individual decision-making: To exercise the applicable rights concerning decisions based solely on automated processing, including profiling, where such processing takes place.
Users may exercise their rights by submitting a request to:
Email: mxrojas@livingevidenceihd.com
Postal address: Carrer dels Cirerers, 164, 08358 Arenys de Munt, Barcelona, Spain.
Requests should clearly identify the right being exercised and provide sufficient information to enable the Data Controller to process the request.
Additional information may be requested where reasonably necessary to verify the identity of the applicant.
Requests will be handled within the time limits established by the GDPR, generally within one month of receipt, subject to any legally permitted extension.
Right to Lodge a Complaint
If users believe that the processing of their personal data infringes applicable data protection legislation, they have the right to lodge a complaint with the competent supervisory authority.
In Spain, the relevant authority is generally:
Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD)
Website: https://www.aepd.es
Users may also contact the Data Controller directly to raise concerns regarding personal data processing.
Data Security
The Data Controller will implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction.
Such measures will be selected according to the nature of the personal data processed and the risks associated with the processing activities, in accordance with Article 32 of the GDPR.
Although reasonable security measures will be maintained, no internet-based system can guarantee absolute security.
Data Accuracy and User Responsibilities
Users are responsible for ensuring that the personal information they voluntarily provide is accurate, complete and up to date.
Where users provide personal information relating to third parties, they must ensure that they have a valid legal basis for doing so and that any required information has been provided to the individuals concerned.
The Data Controller may request clarification or corrections where necessary to maintain accurate information.
Links to Third-Party Websites
This website may contain links to external websites, academic institutions, scientific repositories, research organisations and other third-party platforms.
The Data Controller does not control the privacy practices or data processing activities of those external websites.
Users are encouraged to review the privacy policies of third-party websites before providing personal information.
Changes to This Privacy Policy
The Data Controller reserves the right to update this Privacy Policy to reflect changes in applicable legislation, data processing activities, website functionality or organisational requirements.
Any modifications will be published on this page, together with the corresponding date of revision.
Where legally required, users will be informed of significant changes or asked to provide renewed consent.
Contact Information
For any questions concerning this Privacy Policy, the processing of personal data or the exercise of data protection rights, users may contact:
María Ximena Rojas Reyes
Living Evidence to Inform Health Decisions (LE-IHD)
Email: mxrojas@livingevidenceihd.com
Address: Carrer dels Cirerers, 164, 08358 Arenys de Munt, Barcelona, Spain
Website: https://livingevidenceihd.com