Privacy Policy

1. Data controller identification.

Company name: IMMFLY S.L. (“Immfly” or “us”)

Address: Carrer Albert Einstein, 1-3, 08940, de Cornellà de Llobregat (Barcelona), Spain.

Tax or registration No.: B66155979

E-mail: dpo@immfly.com

Data Protection Officer: Carrer Albert Einstein, 1-3, 08940, de Cornellà de Llobregat (Barcelona), Spain, dpo@immfly.com

2. What personal data do we collect and how?

2.1. Personal data shall mean any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to physical, physiological, genetic, mental, economic, cultural or social identity.

2.2. We currently collect and process the following personal data of our website’s (the “Website”) users:

contact details (e.g., name, last name, email, or phone number), corporate information (e.g., company name, job tittle, or solutions of interest) and other personal data you may voluntarily disclose to us when using the contact form or is generated in the course of our communications; and

information collected through cookies – please review our Cookie Policy here.

2.3. Please note that, by providing us with your data, you guarantee the truthfulness and/or accuracy of this data. Consequently, you will be liable for any false or inaccurate statements you make, as well as for any damages caused to Immfly or third parties as a result.

2.4. This Privacy Policy does not apply to Immfly's solutions such us our entertainment platform offered to our clients.

3. What do we use your data for? Which are our legal grounds for that?

3.1. Regulations references:

“Spanish Personal Data Act”: Spanish Act 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights.

“Spanish eCommerce Act”: Spanish Act 34/2002, of July 11, on Information Society Services and Electronic Commerce.

“GDPR”: General Data Protection Regulation 2016/679 of April 27th 2016.

4. Who will your data be shared with?

4.1. We share this information with:

Immfly Group: we may share your data with affiliated companies for operational purposes and, where the intragroup data communication is controller to controller, we will rely on legitimate interest for such communication to carry out internal administrative tasks within the Immfly Group.

Providers: We will grant access to your personal data to those providers who require such access to deliver their services to us, such as cloud hosting, IT services, CRM providers, consultants or collaborators and legal advisors, and any other third party helping us in organizing and/or managing the Website. Before sharing any of your personal data with our external providers when acting as our (sub)processors, we require them to sign a data processing agreement pursuant to art. 28 GDPR, confirming that your data will be kept secure. This means that in such cases we determine the purpose for which and the manner in which your data is to be processed, and the data (sub)processor is only allowed to handle your data according to the instructions and security standards that we follow.

Other: We will share your personal data with third parties if we are required to do so by law, by an administrative or judicial authority, or in the public interest or for public order, such as, for example, to comply with anti-money laundering and counter-terrorism regulations, tax or social security obligations.

4.2. Finally, in the event of a business restructuring, merger, split, or sale, we may transfer all of your personal information to the third party arising from such transaction based on legitimate interest in accordance with article 21 of Spanish Personal Data Act.

5. How do we protect your personal data?

We take all reasonable and appropriate technical and organizational measures to protect the security of your personal data throughout the course of our business, taking into consideration the risks associated to the processing activities being carried out. Technical safeguards are for example restrictive access, encryption, antivirus software, regular testing and evaluation.

6. Do we carry out international transfers outside the European Economic Area (EEA)?

We do not carry out international transfers of data to third parties except to this IT providers that, as commonplace, have their servers outside of the EEA. Therefore, some of our current providers (such as, for example, Google) are located, or provide services from, outside the EEA. In these cases, we will execute all necessary contractual agreements or other measures with any recipients of your personal information to ensure your personal data will be equally protected.

7. How long will we keep your personal data for?

7.1. We keep the information we collect only for as long as necessary for the purpose we collected it. We may also store your data for dealing with any complaints regarding our products and services.

7.2. For instance, reporting channel data will be deleted within 3 months according to the Spanish Act 2/2023, of 20 February, on the protection of persons who report breaches of law and on the fight against corruption.

7.3. When applicable, we will retain personal data dully blocked, in order to comply with the legal obligation envisaged under Article 32 of the Spanish Personal Data Act.

8. What are your rights?

8.1. What are your rights?

Under data protection law, you can exercise the following rights:

Your right of access: You have the right to ask us for copies of your personal data.

Your right to rectification: Under certain circumstances, you have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure: Under certain circumstances, you have the right to ask us to erase your personal data in certain circumstances i.e., if your personal data are no longer necessary for the purpose they were collected for or if you withdraw your consent.

Your right to restriction of processing: Under certain circumstances, you have the right to ask us to restrict the processing of your personal data in certain circumstances i.e., if you think that the information we process is inaccurate or unlawful.

Your right to object to processing: Under certain circumstances, you have the right to object to the processing of your personal data only if we process the relevant information on legitimate or public interest grounds.

Your right to data portability: Under certain circumstances, you have the right to ask that we transfer the personal data you directly gave us to another organisation, or to you, if we process the relevant information on consent or contract grounds

8.2. How can you exercise your rights?

You may exercise your rights at any time by contacting us as indicated in Section 1, stating "Privacy" in the subject line and sending your request to dpo@immfly.com.

The exercise of these rights is free of charge. However, please note that a reasonable fee may be charged where requests are manifestly unfounded, excessive or repetitive.

8.3. Do you have the right to withdraw your consent?

Yes. You may withdraw your consent at any time in relation to one, several or all of the processing purposes described above that are based on your consent.

8.4. Do you have the right to lodge a complaint?

Yes. You have the right to lodge a complaint at any time with the competent supervisory authority in accordance with your place of residence. In Spain, the competent supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD). You may contact us to obtain information about the supervisory authority applicable to your circumstances.

In any event, before lodging a complaint with a supervisory authority, we kindly ask you to contact us by email at dpo@immfly.com so that we may try to resolve any issue or dispute amicably.

8.5. How long will it take us to respond?

We will respond to your request as soon as possible and, in any event, within one month. If you do not receive a response within that period, please accept our apologies and contact us again so that we can address your request and remedy any possible technical issue that may have prevented us from responding on time.

9. How to contact us.

Please contact us at dpo@immfly.com if you wish to make a request or complaint or have any questions on how we use your personal data.

10. How do we keep this Privacy Policy up to date

We may update this Privacy Policy periodically and will revise the date at the bottom of this Privacy Policy to reflect the date when such update occurred.

Version July 2026