1. DATA CONTROLLER (RESPONSIBLE FOR THE TREATMENT)
Company Name: PANGAEA ONCOLOGY, S.A.
Tax Identification Number (NIF): A64353584
Registered Corporate Office: Calle Coso 42, 4ª planta, 50001 Zaragoza
Commercial Registry Information: Registered in the Commercial Registry of Zaragoza, Volume 4301, Folio 221, Sheet Z-63113, 11th Registration.
Contact E-mail: dpo@panoncology.com
2. PURPOSES OF THE PROCESSING
PANGAEA ONCOLOGY, S.A. processes the personal data provided by users through this Website for the following specific purposes:
Contact and Requests: To manage, process, and respond to information requests, queries, and doubts submitted by users through the contact forms or corporate email addresses provided on the website.
Investor Relations: To manage communication, events, newsletters, or mandatory corporate presentations specifically requested by shareholders, investors, or financial analysts.
Whistleblowing Channel: To process, investigate, and manage complaints and communications received through the corporate Whistleblowing Channel in full compliance with applicable whistleblowing regulations.
Website Improvement: To carry out statistical analysis and technical improvements on the website’s functionality, optimized through our cookie settings.
3. LEGAL BASIS FOR PROCESSING
The legal basis that justifies the processing of your data depends on the interaction:
Consent: When you explicitly fill out a contact form, register for an investor event, or accept non-functional cookies, you grant your unambiguous consent for your data to be processed for that specific purpose.
Legal Obligation: When processing data through our Whistleblowing Channel or delivering financial/corporate communications required by the BME Growth market regulations.
Legitimate Interest: To maintain operational security, prevent fraud, and optimize the overall performance of the Website.
4. DATA RETENTION PERIOD
Personal data will be kept only for the time strictly necessary to fulfill the purposes for which it was collected, or as long as the user does not revoke their consent. Subsequently, the data will be securely blocked and preserved exclusively to comply with statutory legal limitations or potential corporate liabilities.
5. RECIPIENTS OF THE DATA
Personal data processed through this website will not be sold, rented, or shared with unauthorized third parties. Data may only be disclosed to:
Companies within the PANGAEA ONCOLOGY Group (such as specialized clinical or laboratory subsidiaries) if necessary to resolve a query or fulfill a service requested by the user.
Competent Public Authorities, Regulatory Bodies (such as the CNMV or BME Growth authorities), or Judges/Courts, strictly when mandated by Spanish or European law.
Trusted technical third-party processors (e.g., hosting providers or IT infrastructure consultants) under strict data protection service agreements.
6. USER RIGHTS (DATA SUBJECT RIGHTS)
Under the General Data Protection Regulation (GDPR), you can exercise the following rights at any time and free of charge:
Access: To know what personal data of yours is being processed by the company.
Rectification: To request the correction of inaccurate or incomplete data.
Erasure (Right to be forgotten): To request the deletion of your data when it is no longer necessary for the purposes it was collected.
Restriction of processing: To temporarily restrict the processing of your data under specific legal scenarios.
Data Portability: To receive your personal data in a structured, commonly used, and machine-readable format.
Objection: To object to the processing of your data based on legitimate interest or direct marketing.
How to exercise your rights: You must send a written communication to the Data Controller via email at dpo@panoncology.com or by physical post to Av. Gran Via Carles III, 86, 5ª-3ª, 08028 Barcelona, stating your full name and the specific right you wish to exercise. If necessary to verify your identity, a copy of an official identification document (ID/Passport) may be requested.
Furthermore, if you believe your data protection rights have been violated, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) at www.aepd.es.
7. CORPORATE DATA PROTECTION GUIDELINES AND PRINCIPLES
The Management of PANGAEA ONCOLOGY, S.A. is deeply committed to maintaining a robust data protection framework. The company implements and respects the following core principles across all corporate processes:
Proactive Responsibility (Accountability): The Management establishes, implements, and monitors a comprehensive management system to ensure that all personal data processing complies strictly with the GDPR and national regulations.
Lawfulness, Fairness, and Transparency: All data processing is strictly grounded on lawful bases, ensuring clear and honest communications with data subjects.
Purpose Limitation: Personal data is collected only for specified, explicit, and legitimate corporate, scientific, or research purposes, and is never processed in an incompatible manner.
Data Minimization: PANGAEA ensures that only the data strictly necessary, adequate, and relevant for the intended purpose is processed.
Accuracy: Appropriate technical and organizational measures are deployed to ensure that personal data remains accurate and completely up to date.
Storage Limitation: Data is kept in a form which permits identification of data subjects for no longer than necessary for the purposes for which the personal data is processed.
Integrity and Confidentiality: Security controls are designed and embedded directly into our clinical, laboratory, and corporate platforms to prevent unauthorized access, accidental loss, alteration, or destruction of sensitive health and corporate data.
Data Protection by Design and by Default: Privacy-enhancing controls are natively integrated into the life cycle of every new technological project, application, or business tool from the earliest stages of its conception.