PRIVACY POLICY

EXTENDED PRIVACY POLICY OF MIDOKURA

MIDOKURA IBÉRICA, S.L., wants to inform users of the website https://www.midokura.com (hereinafter, the “Website“), potential partners, clients, stakeholders and/or collaborators and job seekers (hereinafter, all of them jointly, the “Data subjects“), this additional information on data protection (hereinafter, “Privacy Policy“), in which the company provides in a transparent and simple manner all the information on the processing it carries out with the personal data of the Data subjects, the purposes for which it processes them, the legal bases, how long it keeps them and the rights that can be exercised. This Privacy Policy will always be available to Data subjects on the Website.

1. WHO ARE RESPONSIBLE FOR THE PROCESSING OF YOUR PERSONAL DATA AND HOW TO CONTACT US?

The company responsible for the processing of personal data for the purposes of customer service, CV management, sending newsletters and analysis of the use, use and improvement of the corporate website (further details on these processing can be found in clause 4 of this Privacy Policy) is MIDOKURA IBERICA, S.L. (hereinafter, “MIDOKURA” or the “Company”), company holder of Tax Identification Number B-67006965, with registered office in C/ Tanger 37, 08018 Barcelona (Barcelona) Spain and duly registered in the Mercantile Registry of Barcelona, in the Book 45970, Page 68, Section 8, Sheet 505488, inscription 1^st. Data subjects may contact MIDOKURA to exercise their personal data protection rights, resolve any doubts about the processing carried out by the Company on their personal data or request information on the privacy and protection of their personal data by sending an email to info@midokura.com in any case, clearly identifying their request or the right they are exercising.

The companies responsible for the processing of personal data for the purposes of contact database management and analysis, segmentation and profiling of contact database (further details on these processing can be found in clause 4) are the following companies as joint controllers:

MIDOKURA IBERICA, S.L., company holder of Tax Identification Number B-67006965, with registered office in C/ Tanger 37, 08018 Barcelona (Barcelona) Spain and duly registered in the Mercantile Registry of Barcelona, in the Book 45970, Page 68, Section 8, Sheet 505488, inscription 1^st; and
SONY CORPORATION (hereinafter, “SONY”), company holder of Tax Identification Number [****], with registered office in 7-1 Konan 1-chome, Minato-ku, Tokyo 108-0075 Japan and duly registered [*******].

MIDOKURA and SONY have signed a co-responsibility agreement defining their respective responsibilities in accordance with the provisions of the regulations in force on the protection of personal data. The information regarding the mains aspects of the co-responsibility agreement is available to Data subjects upon request at the following email address: info@midokura.com. You can contact MIDOKURA to exercise your rights regarding the protection of personal data, resolve any questions about the processing of your personal data by us or request information about any respect related to privacy and the protection of your personal data by sending an email to info@midokura.com, always and in any case clearly identifying your request.

2. WHAT IS PERSONAL DATA AND PROCESSING?

Personal data is any information relating to an identified or identifiable natural person. An identifiable natural person is any person whose identity can be determined, directly or indirectly, in particular by means of an identifier, such as a name, an identification number, location data, an online identifier or one or more elements of the physical, physiological, economic, cultural or social identity of that person. Processing of personal data is any operation or set of operations that MIDOKURA and, where applicable, MIDOKURA and SONY, carry out on personal data, such as the collection, recording, storage, use and disclosure.

3. THROUGH WHAT CHANNELS DOES MIDOKURA COLLECT PERSONAL DATA?

MIDOKURA collects Data subjects’ personal data through the following channels:

CV submission form on the Website.
Interaction with MIDOKURA contacting the company by the channels enabled for this purpose at all times.
Interaction with potential partners, clients, stakeholders and/or collaborators at congresses, trade fairs and other events.
The interaction and use that Data subjects make of the Website.
Opening, reading and use of the newsletters sent by MIDOKURA.

4. WHAT PERSONAL DATA PROCESSING DOES MIDOKURA CARRY OUT?

1. CV management:

Purposes	· Evaluate Data subjects’ application to join MIDOKURA. · Keep the CV of the applicant in case he/she does not join MIDOKURA to cover possible future vacancies.
Personal data processed	· Identification and contact details: name, surname, DNI or NIE, social security number, address, telephone number, email, photographs or voice audios, IP address. · Personal data: date and place of birth, age, marital status, family details. · Academic and training data: academic record, training and qualifications. · Professional and employment data: experience in the professional world, category or position to be developed or developed by the worker, professional file of the worker. · Social circumstances: property, hobbies and ways of life, membership in forums, clubs or associations. · Economic and financial data: bank details, income, withholdings, pension plan, retirement. · Social data: aid or subsidies, receipt of social assistance benefits, subsidies, pensions.
Legitimizing basis	· Execution of pre-contractual measures at the Data subjects’ request. · Data subjects’ consent in order to retain their CV.
Retention period	· MIDOKURA will process the personal data of Data Subjects for as long as the selection process for which their personal data are processed remains open and, with their consent, for a period of 1 year after the end of the selection process or receipt of their CV. · After the closure of the selection process or the subsequent storage period in the event of possible vacancies, MIDOKURA will keep the personal data of potential employees duly blocked for a period of 1 year to address potential liabilities derived from the processing and only for the prescription period of the same.

2. Customer service

Purposes	· Attend to and resolve any request for information, incident or query that Data subjects may send MIDOKURA through the contact / customer service channels available.
Personal data processed	· Identification data: full name. · Contact details: email, telephone. · Any other information provided by Data subjects when contacting MIDOKURA.
Legitimizing basis	· Data subjects’ consent.
Retention period	· MIDOKURA will process the Data subjects’ personal data for as long as it is necessary to manage the request for information or query made by the User.

3. Contact database management

Purposes	· Create and manage a database with the contact details of potential partners, clients, stakeholders and/or collaborators and other people interested in receiving information about MIDOKURA’s activity
Personal data processed	· Identification data: full name. · Contact details: email, telephone. · Any other information provided by Data subjects when giving MIDOKURA and SONY their contact details.
Legitimizing basis	· Data Subjects’ consent.
Retention period	· MIDOKURA and SONY will process the personal data of Data Subjects as long as they do not revoke their consent to the processing of their data for this purpose.

4. Data subjects analysis, segmentation and profiling:

What is profiling?

Profiling is a form of automated processing of personal data which consisting of using personal data of a given group of individuals to analyse, evaluate or predict certain personal aspects of those individuals, such as their personal preferences, interests, behavior or interaction with other persons or entities, professional performance, financial situation, health, etc.

What personal data we do process?

To carry out the profiling we process all the information collected from the interaction between MIDOKURA and Data subjects, detailed in each of the processing specified in this Privacy Policy, such as, basic identification data (name and surname, email address, phone number) as well as the job position, preferences, areas and/or subjects of interest, etc.

How and for what do we use in MIDOKURA the profiling of our Data subjects?

To profile Data subjects use a CRM that records, stores and analyzes all information that can be obtained from our Data subjects during the development of the relationship between them and MIDOKURA. From their interaction in conferences, events, etc., where is MIDOKURA to their participation and response to commercial communications sent.

The profiling techniques and the profiles obtained allow us to extract value from personal data and to use the results of such analysis to:

Group Data subjects according to their profiles, areas and/or subjects of interest and preferences, as well as according to their response to commercial communications sent by MIDOKURA.
To send regular and parametrised commercial communications, in accordance with the preferences and interests of the Data subjects. In this way, MIDOKURA avoids sending information that does not meet their needs or interests.
Obtain metrics on Data subjects interactions, in order to adjust more and better to the patterns of use that are made.

In short, profiling allows us to get to know MIDOKURA Data subjects better and provide them with a much more personalized information, avoiding spam.

How does profiling of personal data affect Data subjects?

The profiling of personal data does not produce in the latter any legal effects or effects that would significantly affect them in a similar way. Consequently, Data subjects will not be affected in any case their rights or their legal position with respect to MIDOKURA, or suffer effects that could be considered similar. We use the data obtained from profiling only for the purposes specified above and which, again, are specified in the following table.

Purposes	· Analyse and segment Data subjects characteristics, personal data and participation, areas of interest and preferences, in order to obtain common profiles. · Create Data subjects profiles based on the information and data obtained from this analysis. · Enrich Data subjects profiles with data obtained from other sources. · Design commercial communications by electronic means to maintain regular communication with Data subjects about services, events or recommendations in a personalized manner based on the characteristics, interests, preferences and history of the Data subjects.
Personal data processed	· Identification data: full name. · Contact details: email. · Data derived from the profiling carried out.
Legitimizing basis	· Data subject’s consent.
Retention period	· MIDOKURA shall process the personal data of Data subjects unless the User exercises their right of opposition or deletion or until Data subjects withdraw their consent.

5. Sending of newsletters:

Purposes	· Send commercial communications by electronic means with advertising and promotional purposes regarding MIDOKURA’s corporate information, services, events and, in general, information about its activity.
Personal data processed	· Identification data: full name. · Contact details: email.
Legitimizing basis	· Data Subjects’ consent. · MIDOKURA’s legitimate interest of keeping Data subjects duly informed on a regular basis about the Company’s activity, services, events and/or news.
Retention period	· MIDOKURA will process the personal data of Data subjects as long as they do not revoke their consent to the processing of their data for this purpose.

6. Analysis of the use, use and improvement of the Website:

Purposes	• Purposes • Recognize Data subjects when they return to the Website. • To allow the User to browse the Website and make correct use of its functionalities. • Maintain security and protect the Website from malicious use. • Adapt the Website to the type of devices used. • Adapt the Website to the personalization criteria chosen by the Data subjects and remember them. • Correctly display the content of the Website and that requested by the Data subjects at all times. • Store and retrieve information about the browsing habits and preferences of Data subjects or their devices. • Analyze the use and navigation made by Data subjects on the Website, detect the dates/times of greatest influx and detect browsing patterns. • Study possible improvements to the Website to optimize the usability experience and implement them.
Personal data processed	· Identification data: IP address; · Information on the use and browsing of the Website by the User: login data, page of origin of the visit to the Website, pages after the visit of the Website, layers of the Website visited, duration of browsing, recommended products, data of the browser used and data of the device used.
Legitimizing basis	· The User’s consent; and · MIDOKURA’s legitimate interest in maintaining the security, accessibility and usability of the Website.
Retention period	· MIDOKURA will process the Data subjects’ personal data for the duration of the storage period of each cookie used at any given time or until they withdraw their consent to the use of cookies and in any case for a maximum period of 24 months.

7. Blocking of personal data and maintenance of suppression lists:

Purposes	· Maintain a duly updated list of all those Data subjects who have requested the rectification or deletion of their data and/or who at any time have opposed some of the data processing MIDOKURA carries out. · Prevent the processing of personal data, including its visualization, except for its availability to judges and courts and/or any other competent Public Administrations, in particular data protection authorities, for the enforcement of possible liabilities arising from the processing and only for the limitation period of the same.
Personal data processed	· Identification data: full name. · Contact details: e-mail, telephone. · Effective date of deletion or opposition. · Identification data: IP address; · Data derived from the profiling carried out; and · Information on the use and browsing of the Website by the User: login data, page of origin of the visit to the Website, pages after the visit of the Website, layers of the Website visited, duration of browsing, recommended products, data of the browser used and data of the device used.
Legitimizing basis	· The processing of personal data is necessary for MIDOKURA to comply with its legally enforceable obligations, in particular the obligations to comply with the principle of proactive responsibility and the blocking of personal data stipulated in the current regulations on the protection of personal data.
Retention period	· When MIDOKURA proceeds to the rectification or deletion of the personal data of the Data subjects, it will proceed to block them, adopting appropriate technical and organizational measures to prevent their processing, except for the provision of data to the judges and courts, the Public Prosecutor or the competent public authorities, for the requirement of possible liabilities arising from treatment and only for the prescription period of the responsibilities arising from the processing, specifically, 3 years in terms of personal data protection, 2 years in terms of information society services and 1 year in terms of labor regulation. · Upon reaching the maximum limitation periods for the responsibilities arising from the processing, MIDOKURA will anonymize or definitively delete the personal data of the Data subjects.

5. WHAT RIGHTS CAN DATA SUBJECTS EXERCISE IN TERMS OF PERSONAL DATA PROTECTION?

Right of access

Data subjects have the right to know whether or not MIDOKURA is processing their personal data and, if so, the right to know what personal data is being processed and to obtain a copy of it.

Right to rectification

Data subjects have the right to modify any data that is inaccurate and to complete any data that is incomplete. Whenever they request to rectify any personal data, they must indicate which data they want to modify in particular and provide adequate accreditation.

Right to opposition

In the cases set forth by applicable regulation, Data subjects may object at any time, for reasons related to their particular situation, to the processing of their personal data by MIDOKURA when the legitimate basis for such processing is a legitimate interest of MIDOKURA. In any case, Data subjects must remember that opposition to the performance of processing based on consent or the execution of a contract will make it impossible for MIDOKURA to carry out such processing or execute the said contract.

Right of deletion

Under certain circumstances set forth in applicable regulation, Data subjects have the right to obtain the deletion of their personal data from MIDOKURA without undue delay. This does not mean that the Data subjects’ data will be definitely deleted, but that they will be kept duly blocked, i.e. kept in such a way as to prevent their processing except for their disposal of public administrations, judges and courts for the attention of possible liabilities that may have arisen as a result of the processing during the prescription periods of the latter. Once these periods have passed, MIDOKURA will duly anonymized or permanently delete Data subjects’ personal data.

Right to data portability

Data subjects have the right to receive and/or request that the personal data concerning them are transferred to another data controller other than MIDOKURA. MIDOKURA reminds Data subjects that it is only possible to exercise this right when the legitimizing basis for the processing of their personal data is the execution of a contract or the consent of Data Subjects and the processing is carried out by automated means.

Right to restriction of processing

Data subjects have the right to request MIDOKURA to suspend the processing of their data (i) when they have disputed the accuracy of their data, while MIDOKURA verifies such accuracy; or (ii) when they have exercised their right to object to the processing of their data, while verifying whether the legitimate interests of MIDOKURA prevail over those of the Data subjects. Likewise, this right allows Data Subjects to request MIDOKURA to keep their personal data when (i) the data processing is unlawful and the User opposes the deletion of their data, requesting instead a limitation of their use; or (ii) MIDOKURA no longer needs your personal data for the purposes of processing, but needs it for the establishment, exercise, or defense of claims.

Also, whenever MIDOKURA carries out a personal data processing based on Data Subjects’ consent, the latter have the right to withdraw said consent at any time without affecting the lawfulness of the processing previously carried out based on the consent prior to its withdrawal.

MIDOKURA does not currently carry out any profiling of Data subjects, nor does it carry out any automated processing of their personal data on the basis of which decisions are made that may legally affect or in a significantly similar way the Data subjects.

Data subjects may exercise their rights free of charge, freely and at any time by communicating it to MIDOKURA by sending an email to info@midokura.com and specifying which specific right is being exercised. Regarding those persona data processing carried out by MIDOKURA and SONY as joint controllers, the management of the rights of Data subjects shall be the sole responsibility of MIDOKURA. If the Company has difficulties in identifying the Data subject, MIDOKURA shall request the latter to send an identification document in order to duly confirm his/her identity and correctly manage the request. In the event that Data Subjects consider that MIDOKURA has not correctly satisfied their exercise of rights under the GDPR, Data subjects may file a complaint with the Spanish Data Protection Agency – https://www.aepd.es/es.

6. TO WHOM DOES MIDOKURA DISCLOSE PERSONAL DATA?

For some data processing, such as the contact database management and the CV management, MIDOKURA may share data subjects’ personal data with its parent company for the purposes of the said processing, previously explained. Except from these processing, MIDOKURA does not communicate data subjects’ personal data to third parties.

On the other hand, MIDOKURA may communicate data subjects’ personal information to third parties in the event of legal compliance, administrative or judicial request and/or when there is a legitimate interest pursued by MIDOKURA, such as, for example, the exercise of legal actions that MIDOKURA considers appropriate. In these cases, the Company may communicate personal data to:

Legal advisors;
Courts and Tribunals;
Tax Administration;
Spanish Data Protection Agency;
Government Agencies and Public Administrations; and
State Security Forces and Corps.

Likewise, MIDOKURA may communicate to third parties the personal data of Data subjects Processing in the context of the performance of certain commercial operations, including their prior communication, when such communication and any other processing derives from the development of any operation of structural modification of companies or the contribution or transfer of business or branch of business activity. Is necessary for the successful completion of the operation and ensures, where appropriate, continuity in the provision of services.

7. WHO CAN ACCESS THE PERSONAL DATA OF DATA SUBJECTS?

MIDOKURA works with providers whose services are necessary for the correct presentation and usability of the Website and our information systems and who, by reason of the exercise of their activity, may have access to the Data subjects’ data as Data Processors. This is the case, for example, with providers who help MDOKURA improve and optimize our Website, technology service providers or those who provide MIDOKURA with maintenance services for our databases and information systems. In any case, these providers are considered to be Data Processors and MIDOKURA has previously signed the corresponding processing contracts with all of them that include the due guarantees regarding the processing of the Data subjects’ personal data and their confidentiality, integrity, availability and accessibility.

8. ARE YOUR PERSONAL DATA SECURE?

MIDOKURA adopts the appropriate procedures and implements the necessary and adequate technical and organizational security measures to ensure a level of security appropriate to the risks that the processing may involve. All information provided will be stored on secure servers. Thus, once the Company has received all the information, it will use strict security procedures to prevent any unauthorized access. MIDOKURA also ensures that its service providers also have adequate security standards for the protection of the personal data to which they have or may have access, in accordance with the applicable data protection legislation in force at any given time.

For some data processing, such as the contact database and CV management, MIDOKURA may transfer personal data outside the EU for the purposes of those processing, previously explained. For such purposes MIDOKURA may transfer personal data to its parent company located outside the European Economic Area, in Japan, which ensures an adequate level of protection based on an adequacy decision of the EU Commission “Commission implementing decision (EU) 2019/419 of 23th of January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, concerning the adequacy of the protection of the personal data by Japan under the Law on the protection of personal information on the Protection of Personal Information”.

9. CHANGES TO THIS PRIVACY POLICY

This Privacy Policy for Data subjects may vary over time due to possible changes in the personal data protection regulation and/or the criteria followed at any time by the Spanish Data Protection Agency or other relevant data protection control authorities. MIDOKURA therefore reserves the right to modify this Privacy Policy to adapt it to these criteria, as well as to new case law or legislation. MIDOKURA may also change this Privacy Policy in the event of any change in the characteristics of the processing of personal data carried out. In any case, MIDOKURA will always inform data subjects about any changes to this Privacy Policy and their effective date of validity.

Latest version: 7 of march of 2024.