Identity and Contact Information of the Data Controller:

• IDENTIFYING DETAILS:
  • Company: IDEA STEMCELL SL
  • Registered Address: C/ Abeto, 3, 28670 Villaviciosa de Odón (Madrid)
  • Tax ID (NIF): B56263973
  • Contact Email: legal@ideastemcell.com
  • Contact Phone: +34 667690899
  • Registered in the Commercial Registry of Madrid, Volume 45,904, Book 0,Page 190, Section 8, Sheet M-806698

In compliance with the provisions of the General Data Protection Regulation (GDPR), EU
Regulation 2016/679 of April 27, 2016, and in compliance with the duty of information
outlined in Article 10 of Law 34/2002, of July 11, on Information Society Services and
Electronic Commerce, we inform you as a user that the personal and informational data you
provide will be incorporated into a personal data file owned by IDEA STEMCELL S.L.

Purposes of Data Processing:

Your personal data will be processed for the following purposes:

• To respond to and process your contact request.
• To allow you to sign up to receive information.
• To process and manage orders for products purchased through this website and to
  manage the resulting contractual relationship.
• To send commercial and promotional communications, if you have expressly
  authorized us to do so.

Unless you notify us otherwise, we will assume that the personal data you provided has not
changed and that you commit to informing us of any changes, and that you consent to its use
for the purposes mentioned above.

Legal Basis:

The legal basis that authorizes us to process your data is your consent, given when you
contact us electronically, or public interest in the area of public health in the case of
pharmacovigilance reporting.

Your Rights:

You may exercise the rights of access, rectification, deletion, restriction, objection,
portability, and the right not to be subject to automated individual decisions. These rights
may be exercised by sending a request by post to the registered address of IDEA
STEMCELL S.L. and/or by email to: legal@ideastemcell.com

According to the GDPR, users have the following rights:

• Right of Access: To obtain information about your specific personal data and how it
  is processed.
• Right of Rectification: To have your personal data modified.
• Right of Deletion («Right to be Forgotten»): To have your data deleted when no
  longer necessary for the purposes it was collected, or when you withdraw consent
  (unless legal obligations require otherwise).
• Right to Restriction of Processing: To limit how your data is processed under
  certain conditions.
• Right to Data Portability: If data processing is automated, you have the right to
  receive your data in a structured, commonly used, machine-readable format, and to
  transmit it to another data controller, when technically feasible.
• Right to Object: To object to the processing of your personal data.
• Right Not to Be Subject to Automated Individual Decision-Making, Including
  Profiling: To not be subject to decisions based solely on automated processing,
  including profiling.

To exercise these rights, you must provide a copy of your ID or equivalent identification
document.

Data Retention Period:

Your personal data will be kept for as long as necessary to fulfill the purpose for which it was
collected or until you withdraw your consent. After that, the data will be deleted in
accordance with data protection regulations, which may involve blocking the data—keeping
it accessible only to Judges, Courts, the Public Prosecutor’s Office, or relevant Public
Authorities for the determination of potential legal liabilities—during the applicable statute of
limitations. After that period, the data will be permanently deleted.

You are reminded of your right to file a complaint with the National Supervisory Authority
if you believe there has been a violation of applicable data protection laws. In Spain, this
authority is the Spanish Data Protection Agency (AEPD), located at Calle Jorge Juan 6,
28001 Madrid, or via their website: www.aepd.es

Disclosure of Data to Third Parties:

To fulfill your request, your data may be shared with third-party service providers such as
postal services, after-sales services, digital and e-commerce service providers, and payment
service providers.

Data processing takes place within the territory of the European Union. If, at any point, data
is processed outside the EU, it will only occur in countries that are declared to have an
adequate level of data protection.

Security and Confidentiality Measures:

IDEA STEMCELL S.L. is committed to implementing the technical and organizational
security measures necessary to ensure the security of collected personal data and to prevent
accidental or unlawful destruction, loss, alteration, unauthorized access, or disclosure. We
also commit to informing users without undue delay in the event of a personal data breach.
All personal data will be treated as confidential by the Data Controller, its employees,
partners, and anyone with access to the information.