Legal

Privacy policy

How Cucare Diagnostics collects and uses personal data, and the rights you have, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD) and Spanish Law 34/2002 (LSSI-CE).

Last updated: 23 September 2026

1. Controller

Registered in the Commercial Registry of Valencia (Registro Mercantil de Valencia), sheet V-224182, 1st entry (10 March 2025).

We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR and Article 34 LOPDGDD. For any question about your data, write to info@cucare.es.

2. Purposes, legal bases and retention

We only process the personal data needed for each purpose, and we do not use it for purposes other than those described here.

Purpose	Data	Legal basis	Retention
Answering your enquiry sent through the contact form or by email	Name, email, topic, message and any data you include in it; date, IP address and browser of the form submission	Processing needed to take steps at your request before a possible contract (Art. 6.1.b GDPR)	12 months from our last contact, unless the enquiry leads to a contract
Sending news about our services by email, only if you tick the optional box in the form	Name and email	Your consent (Art. 6.1.a GDPR and Art. 21 LSSI-CE), which you can withdraw at any time	Until you unsubscribe or withdraw consent
Information about similar services to existing clients	Name and professional email	Our legitimate interest in keeping clients informed (Art. 6.1.f GDPR and Art. 21.2 LSSI-CE). You can object at any time, free of charge, from every email	Until you object or the client relationship ends
Managing the relationship with clients and suppliers: quotations, projects, reports, invoicing	Identification and contact details, professional position, project and billing data	Performance of a contract (Art. 6.1.b GDPR) and compliance with legal obligations, such as tax and accounting law (Art. 6.1.c GDPR)	For the duration of the relationship and afterwards for the periods set by law (generally 6 years under the Spanish Commercial Code and 4 years under tax law)
Professional contact persons of client, supplier and partner organisations	Name, position and professional contact details	Our legitimate interest in maintaining the relationship with the organisation you work for (Art. 6.1.f GDPR and Art. 19 LOPDGDD)	While the relationship lasts and you hold that position
Website analytics, only if you accept analytics cookies	Pseudonymous browsing data: pages visited, device, browser and approximate location	Your consent (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE)	See our Cookie policy
Security of the website and prevention of abuse	Server logs: IP address, date and time, requested page	Our legitimate interest in protecting the website and its users against attacks and fraud (Art. 6.1.f GDPR)	No longer than 30 days, unless needed to investigate an incident

When the legal basis is our legitimate interest, we have weighed it against your interests and rights and consider that it does not override them. You can ask us for more information about this assessment and object to the processing at any time.

3. Mandatory data and consequences of not providing it

In the contact form, your name, email and message are required: without them we cannot answer your enquiry. Ticking the box to receive news is optional, and not ticking it has no effect on the answer to your enquiry. In a contract, the data we ask for are needed to perform it and to comply with our legal obligations.

4. Where your data come from

We obtain your data directly from you. If you are the contact person of a company or institution, we may receive your professional contact details (name, position, email and phone) from that organisation or from a colleague of yours, only to manage the relationship with it.

5. Recipients

We do not sell your data or disclose it to third parties, except where required by law (for example, to the tax authorities, courts or public bodies). To provide our services we use providers that access data on our behalf, as data processors, under a contract that complies with Article 28 GDPR:

• Website hosting and maintenance: a hosting provider with servers in the European Union, and the web agency that maintains the website.
• Email: IONOS SE (Germany).
• Email newsletters, only if you consent: the email marketing provider we use for that purpose.
• Website analytics, only if you accept analytics cookies: Google Ireland Limited (Google Analytics).

6. International transfers

Our hosting and email providers store data in the European Union. If you accept analytics cookies, data may be transferred to Google LLC in the United States. This transfer relies on the European Commission adequacy decision for the EU–U.S. Data Privacy Framework, under which Google LLC is certified (Art. 45 GDPR), and additionally on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR). You can request a copy of these safeguards by writing to info@cucare.es.

7. Your rights

You have the right to:

• Access your personal data and obtain a copy (Art. 15 GDPR).
• Rectify inaccurate or incomplete data (Art. 16).
• Obtain the erasure of your data when, among other reasons, it is no longer needed (Art. 17).
• Obtain the restriction of processing in the cases provided by law (Art. 18).
• Data portability of the data you provided, when processing is based on consent or contract and carried out by automated means (Art. 20).
• Object to processing based on our legitimate interest, and to direct marketing at any time (Art. 21).
• Not be subject to decisions based solely on automated processing, including profiling (Art. 22). We do not take this kind of decision.
• Withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7.3). To stop receiving news, use the unsubscribe link included in every email or write to us.

To exercise your rights, write to info@cucare.es or send a letter to our postal address, stating the right you wish to exercise. We may ask for additional information to confirm your identity only if we have reasonable doubts about it. Exercising your rights is free of charge. We will reply within one month; this period may be extended by two further months when necessary, taking into account the complexity and number of requests, in which case we will inform you within the first month.

If you consider that we have not handled your data correctly, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es), or with the supervisory authority of the EU country where you live or work.

8. Automated decisions and profiling

We do not take decisions based solely on automated processing, and we do not create profiles that produce legal effects on you or similarly affect you.

9. Children

Our website and services are aimed at companies, institutions and professionals. We do not knowingly collect data from children under 14 (Art. 7 LOPDGDD).

10. Our LinkedIn page

If you follow or interact with our LinkedIn page, LinkedIn Ireland Unlimited Company processes your data under its own privacy policy. For the aggregated statistics about visits to our page (Page Insights), Cucare Diagnostics and LinkedIn are joint controllers under Article 26 GDPR, according to the Page Insights Joint Controller Addendum; LinkedIn is responsible for handling requests to exercise rights over those data. We only use the messages you send us through LinkedIn to answer you.

11. Security and confidentiality

We apply technical and organisational measures appropriate to the risk — encrypted connections (HTTPS), access restricted to authorised personnel, up-to-date software, backups and confidentiality commitments — to protect your data against loss, misuse, alteration and unauthorised access (Art. 32 GDPR). Everyone who handles personal data at Cucare is bound by a duty of confidentiality (Art. 5 LOPDGDD).

12. Accuracy of your data

Please make sure that the data you give us are true and up to date, and tell us of any change. If you give us data about other people, you must have informed them beforehand of the content of this policy.

13. Changes to this policy

We may update this policy to reflect changes in the law or in how we process data. The date of the last update is shown at the top of this page, and we will inform you of any substantial change by appropriate means.