Platform Privacy Policy

1. Introduction

We appreciate the trust you place in us by sharing your personal data. We assure you that the security of your data is very important to Quirumed.

This Privacy Policy explains how we collect and use your personal information through this platform (hereinafter, the "Platform"), with whom we share it, what rights you have regarding your personal data, and how you can exercise those rights.

2. Who are we?

Quirumed is the data controller of your personal data. This means that Quirumed determines what data is collected, how it will be used, and how it is protected. Quirumed is part of the Bunzl Group. Bunzl is a global leader in the distribution of non-food consumables, present in 4 continents and represented in 32 countries with more than 250 distribution centers and over 22,000 employees. (For more information, visit: www.bunzl.com)

Our registered office address is:

Quirumed S.L.U.
Carrer del Corretger 117, Parque Empresarial Táctica, CP 46980 Paterna (Valencia – Spain)

If you have questions about how we process personal data or wish to exercise your rights, please email us at rgpd@quirumed.com, or write to us at the address above.

3. What personal data do we process?

In accordance with the General Data Protection Regulation (EU Regulation 2016/679, "GDPR") and Organic Law 3/2018 of December 5 on Data Protection ("LOPD"), Quirumed will process your personal data as a customer of the Platform as detailed below.

As not all your data will be used for every activity, throughout this document we will inform you of the specific types of personal data that will be processed in each case.

For the purposes of this Privacy Policy, any interested party who registers on the Platform in any of the following modalities will be considered a “CUSTOMER”: natural person (consumer) and legal entity or self-employed professional. Privacy conditions may vary depending on whether the customer is a consumer or a professional.

3.1 If you are a private customer (natural person)

In this case, Quirumed will process the following personal data:

• Identification data: Name and surname, ID (if necessary), IP address.
• Contact details: Phone number, contact email, contact address, and delivery address for purchased products.
• Banking data: Bank account number or credit/debit card number.
• Purchase data: Date and amount of transaction, identity of the parties, transaction details.
• Commercial information: Information about all completed orders.

3.2 If you are a professional customer (self-employed)

In this case, Quirumed will process the following personal data:

• Identification data: Name and surname, ID, IP address.
• Contact details: Phone number, contact email, contact address, and delivery address for purchased products.
• Banking data: Bank account number or credit/debit card number.
• Purchase data: Date and amount of transaction, identity of the parties, transaction details.
• Commercial information: Information about all completed orders.

3.3 If you are a professional customer (legal entity, company)

In this case, Quirumed will process the personal data of the contact person or representative acting on behalf of the professional customer on the Platform:

• Identification data: Name and surname, ID, IP address.
• Contact details: Company name represented by the contact/representative, phone number, contact email, contact address, and delivery address for purchased products.
• Banking data: Bank account number or credit/debit card number.
• Purchase data: Date and amount of transaction, identity of the parties, transaction details.
• Commercial information: Information about all completed orders.

3.4 Technical Information

Additionally, to ensure you can use and navigate the Platform effectively, we collect the following information:

• Technical information, including the IP (Internet Protocol) address used to connect your device to the Internet.
• Login data, browser type and version, time zone settings, browser plug-in types and versions.
• Operating system and platform.
• Information about your visit, including clickstream URL to, through and from our site.

For more information, see our Cookie Policy.

4. How do we obtain your personal data?

The personal data processed by Quirumed will be those you directly provide or those collected during the contracting process.

You guarantee that all the information and/or documentation you provide to Quirumed is truthful, belongs to you, or that you are authorized by third-party data owners to provide such data. In this case, you agree to inform those third parties about the terms of this Privacy Policy and to obtain their consent before providing their data to Quirumed.

5. For what purposes and on what legal grounds do we process your personal data?

The GDPR and the LOPD establish that personal data may only be processed if there is a legitimate basis expressly provided in the regulations. Specifically, Article 6 of the GDPR lists the legal bases that justify the processing of personal data.

The applicable legal basis depends mainly on the purpose of processing the data. Below, we explain the purposes and corresponding legal grounds under which Quirumed processes your data:

5.1 Processing necessary to fulfill the contractual relationship between you and Quirumed

The following processing activities are carried out because they are necessary for the formalization, development, maintenance, and fulfillment of the relationship between you and Quirumed:

• Managing your registration on the Platform, whether as a private or professional customer. This includes handling technical issues, notifications about changes to terms, and responding to any claims you may submit.
• Managing your purchases of products/services from Quirumed, including processing, shipping, invoicing, payment, and customer service.
• Managing and responding to queries, complaints, or suggestions via various contact methods depending on your needs.

5.2 Processing based on Quirumed’s legitimate interest

Quirumed may also process your data based on legitimate interest under Article 6.1(f) of the GDPR, provided it does not override your rights and freedoms. You may:

• Request more information on our “legitimate interest” assessments.
• Object to these activities via the contact methods outlined in section 11 “What are your rights?”.

These include:

• Managing the registration of a professional customer (legal entity) via their representative.
• Managing purchases by a professional customer via their contact person.
• Handling queries or complaints submitted by a professional customer (legal entity).
• Conducting satisfaction surveys to improve our services and customer experience.
• Sending commercial communications about similar products/services based on previous purchases.
• Preventing, detecting, and controlling fraud, including the use of IP and transaction data.
• Data anonymization for internal statistical analysis.

5.3 Processing based on your consent

Some processing activities require your prior authorization, which you may withdraw at any time without affecting your status as a customer. These include:

• Sending personalized marketing communications about products/services different from those initially contracted, via email, SMS, or similar channels.

5.4 Processing necessary for legal obligations

Quirumed must process your data to comply with various legal obligations, which may continue even after the contractual relationship ends. These include:

• Managing judicial or administrative procedures related to service provision.
• Compliance with accounting, legal, fiscal, and administrative regulations, including data protection obligations.

6. How can you object to the processing of your personal data?

Data processing activities based on Quirumed's legitimate interest are considered common industry practices and do not restrict your rights and freedoms. However, you may object to such processing by contacting Quirumed at its registered office or via email at rgpd@quirumed.com, specifying the specific processing and the reasons for your objection.

7. How does Quirumed obtain your consent?

Where required, Quirumed obtains your consent via specific checkboxes in online forms. You may withdraw your consent at any time by contacting us at the email address indicated in this Privacy Policy.

8. Who do we share your personal information with?

Quirumed may share your personal data in the following cases:

• With public institutions and authorities when legally required, including judicial bodies.
• With payment service providers (Klarna Bank AB, Sequra, PayPal, credit card, bank transfer) when purchases are made.
• With service providers operating under data processing agreements, such as:
  • Accountants, legal advisors, consultants
  • Payment providers and insurers
  • IT and communication service providers
  • Logistics and transport services
  • Retail Rocket (for anonymized analytics): Privacy Policy
  • Hotjar (user experience analysis): Privacy Policy
• Via WhatsApp messages, if you have consented. You can revoke this at any time. See WhatsApp's Privacy Policy.

9. Will your data be transferred internationally?

As a global organization, we may use third-party providers located outside the EU. In such cases, appropriate safeguards will be implemented to ensure that your data is protected according to EU standards.

10. How long do we keep your personal information?

Your data will be retained only as long as necessary to fulfill the intended purpose and comply with legal or regulatory obligations. Once the retention periods have expired, Quirumed will securely delete your personal data.

11. What are your rights?

You may exercise the following rights:

• Right to be informed: About how we process your data.
• Right of access: To receive a copy of your data and processing details.
• Right to rectification: To correct incomplete or inaccurate data.
• Right to erasure (“right to be forgotten”): When no legal basis exists to retain the data.
• Right to restrict processing: In specific cases such as contesting accuracy or pending objections.
• Right to data portability: To receive or transfer your data in a readable format.
• Right to object: To processing based on legitimate interest, direct marketing, or profiling.

To exercise these rights, send an email to rgpd@quirumed.com. We may request proof of identity before processing your request.

12. Which authority can you contact with complaints?

You may file a complaint with the Spanish Data Protection Agency (www.aepd.es) or initially contact Quirumed directly at rgpd@quirumed.com for resolution.

13. Cookies

For more information, see our Cookie Policy.

14. Contact us

For questions, suggestions or comments about this policy, contact us by email at rgpd@quirumed.com, or write to:

Quirumed S.L.U.
Carrer del Corretger 117, Parque Empresarial Táctica,
CP 46980 Paterna (Valencia – Spain)

15. Changes to the Privacy Policy

This policy was last updated on 20/03/2023.

We recommend reviewing this document each time you access the Platform to stay informed about how your personal data is processed and any changes that may occur.