This Privacy Policy explains how Katalog Software, S.L. (hereinafter, "Katalog" or "Katalog Health") processes personal data in connection with its website www.katalog.health, contact forms, platform login, authorised user accounts and lead capture functionalities made available through the Platform.
Depending on the relevant processing activity, Katalog may act either as controller or as processor.
- Katalog acts as controller when it determines the purposes and means of the processing, including in relation to its website, contact forms, commercial communications, cookies and certain account, access, security and service administration data.
- Katalog acts as processor where it processes personal data on behalf of a customer, including where leads are collected through the Platform for the customer’s CRM or commercial activities.
For the purposes of this Privacy Policy, “Website Users” means individuals who access or interact with the website; “Authorised Users” means individuals authorised by a customer to access and use the Platform; and “Leads” means individuals who provide their contact details through lead capture functionalities linked to product lists, product teasers, QR codes or similar materials made available through the Platform.
PROCESSED DATA, LEGAL BASIS, PURPOSES AND RETENTION PERIOD
Legal basis: Katalog Health’s legitimate interest in enabling, administering, securing and evidencing access to the Platform, and the legitimate interest of the Customer in allowing its authorised personnel to use the Platform. Where Katalog Health processes such data on behalf of the Customer, the processing will be carried out in accordance with the Customer’s instructions and the applicable agreement.
Purpose: to create and manage Authorised User accounts, authenticate access, provide the Platform, manage permissions, provide support, protect the security of the Platform, prevent misuse and maintain access and activity records.
Retention: for the duration of the Customer’s contractual relationship with Katalog Health or until the relevant Authorised User account is disabled, and thereafter for the period necessary to comply with legal obligations, resolve disputes and enforce contractual rights.
Purpose
To operate the Website and ensure its technical security
- Data processed
- IP address, device/browser data, technical logs, strictly necessary cookies
- Data subjects
- Website Users
- Katalog Role
- Controller
- Legal basis
- Legitimate interest to serve the website, prevent anomalous access and maintain its security
- Retention
- For the time necessary to ensure Website operation and security, as set out in the Cookie Policy
Purpose
To analyse Website usage through non-essential cookies or similar technologies
- Data processed
- Cookie identifiers, browsing data, analytics events
- Data subjects
- Website Users
- Katalog Role
- Controller
- Legal basis
- Consent
- Retention
- As set out in the Cookie Policy. 24 months maximum before requesting the update of consent.
Purpose
To respond to contact requests submitted through the Website
- Data processed
- Name, email, company, position where provided, message content
- Data subjects
- Website Users / prospects
- Katalog Role
- Controller
- Legal basis
- Legitimate interest consisting of responding to a request voluntarily initiated by the data subject
- Retention
- Until the request is resolved and thereafter during 5 years for possible personal actions linked to the pre-contractual or professional interaction
Purpose
To handle pre-contractual enquiries or commercial requests
- Data processed
- Name, email, company, position, message content and related communications
- Data subjects
- Prospects / Customer contacts
- Katalog Role
- Controller
- Legal basis
- Pre-contractual measures
- Retention
- Until the enquiry is handled and thereafter during 5 years for possible personal actions linked to the pre-contractual or professional interaction
Purpose
To create and manage Authorised User accounts
- Data processed
- Full name, business email, job title, phone number where provided, customer organisation, account status
- Data subjects
- Authorised Users
- Katalog Role
- Controller
- Legal basis
- Legitimate interest in identifying the user, enabling the account and managing the access
- Retention
- During the Customer’s contractual relationship or until the account is disabled, and thereafter during 5 years from the deactivation of the account, for liabilities arising from the SaaS relationship
Purpose
To authenticate Authorised Users and manage access security
- Data processed
- Business email, password or authentication credentials, one-time email codes, session data, login records
- Data subjects
- Authorised Users
- Katalog Role
- Controller
- Legal basis
- Legitimate interest for account security, fraud prevention and traceability of access
- Retention
- During the account lifecycle and thereafter for the period necessary for security and audit purposes
Purpose
To provide technical support requested by Authorised Users
- Data processed
- Contact details, account details, support request content, technical information relating to the issue
- Data subjects
- Authorised Users
- Katalog Role
- Controller
- Legal basis
- Legitimate interest to resolve incidents reported by the user and document the assistance provided
- Retention
- Until the support request is resolved and thereafter during 5 years from closing
Purpose
To send service-related communications about the Platform
- Data processed
- Name, business email, customer organisation, account/service information
- Data subjects
- Authorised Users / Customer contacts
- Katalog Role
- Controller
- Legal basis
- Legitimate interest for security notices, maintenance, relevant functional changes and account management
- Retention
- During the Customer’s contractual relationship and for 5 years when necessary to credit notices or communications relevant to the service relationship
Purpose
To capture leads for the Customer through product lists, product teasers, QR codes or similar Platform functionalities
- Data processed
- Name, email, company, accessed publication, access date/time, email status, marketing consent status
- Data subjects
- Leads
- Katalog Role
- Processor
- Legal basis
- Customer’s legal basis as controller
- Retention
- As instructed by the Customer or set out in the applicable agreement
Purpose
To make lead data available to the Customer for its CRM or commercial follow-up activities
- Data processed
- Name, email, company, accessed publication, access date/time, email status, marketing consent status
- Data subjects
- Leads
- Katalog Role
- Processor
- Legal basis
- Customer’s legal basis as controller
- Retention
- As instructed by the Customer or set out in the applicable agreement
Purpose
To send Katalog’s own commercial communications where separately authorised
- Data processed
- Name, email, company, consent record, preferences
- Data subjects
- Leads / Website Users / Customer contacts
- Katalog Role
- Controller
- Legal basis
- Consent
- Retention
- Until consent is withdrawn and thereafter for an additional 3 years from its withdrawal or from the last sending
Purpose
To maintain suppression lists for individuals who withdraw consent or object to marketing
- Data processed
- Email address, suppression status, date of withdrawal or objection
- Data subjects
- Leads / Website Users / Customer contacts
- Katalog Role
- Controller
- Legal basis
- Legal obligation
- Retention
- For 3 years from unsubscribe to ensure no further commercial communications are sent
Purpose
To prevent misuse, investigate incidents and protect the Platform
- Data processed
- Login records, access logs, session data, IP address, technical identifiers, security events
- Data subjects
- Authorised Users
- Katalog Role
- Controller
- Legal basis
- Legitimate interest to protect the Platform, the Customers and the data processed
- Retention
- For the period necessary for security, audit and incident-management purposes and for 5 years from the closure of the incident or the end of the relevant relationship
Purpose
To comply with legal obligations applicable to Katalog
- Data processed
- Identification, contact, account, technical or contractual records strictly necessary for compliance
- Data subjects
- Website Users / Authorised Users / Customer contacts / Leads, where applicable
- Katalog Role
- Controller
- Legal basis
- Legal obligation
- Retention
- For 6 years from the last accounting entry or relevant commercial document
Purpose
To manage and defend legal claims
- Data processed
- Identification, contact, account, lead, technical or contractual records relevant to the claim
- Data subjects
- Website Users / Authorised Users / Customer contacts / Leads, where applicable
- Katalog Role
- Controller
- Legal basis
- Legitimate interest limited to data strictly necessary for a specific complaint
- Retention
- From the time the dispute arises until its final resolution
DATA TRANSFERS
Katalog Health informs User’s that, for purposes described above, it will not disclose the User’s personal data to third parties. Notwithstanding the foregoing, Katalog Health may grant access to such personal data to:
- Technology service providers with which it has entered into a data processing agreement, in particular:
- Providers of database maintenance services
- Analytics service providers
- Hosting service providers
- Email service providers
- Consent management providers
- Payment gateway providers
The aforementioned providers may be located in jurisdictions that generally do not provide adequate safeguards in relation to the processing of personal data. For all entities that are not located within the European Economic Area (EEA), Katalog Health has entered into agreements with such entities incorporating appropriate safeguards, including the European Commission’s standard contractual clauses.
Users may obtain further information about the technology service providers by requesting it from Katalog Health through the contact details provided in this Privacy Policy.
Likewise, Katalog Health may disclose your data to:
- Companies interested in purchasing or acquiring the company or part of its business and, consequently, any national or international auditor given access to carry out due diligence.
- Authorities for the purpose of investigating suspected fraud, harassment or other violations of any law, rule or regulation, or of the Website’s policies.
SECURITY AND CONFIDENTIALITY
Katalog Health undertakes to adopt the necessary physical, technical and organisational measures, in accordance with applicable law, to ensure the security of personal data and to prevent the accidental or unlawful destruction, loss or alteration of personal data transmitted, stored or otherwise processed, or the unauthorized disclosure or access to such data.
Personal data will be processed confidentially by Katalog Health, which undertakes to inform its employees, partners and any person who must have access to the User’s personal data of these confidentiality obligations and to ensure compliance with it, whether by legal or contractual obligation.
USER’S RIGHTS
The User may exercise the rights of access, rectification, erasure, objection and, where applicable, restriction of processing and data portability by sending an email to privacy@katalog.health.
Likewise, the User may lodge a complaint with a supervisory authority and, in particular, with the Data Protection Agency (www.aepd.es) if the User considers that the rights set out in this Privacy Policy had been infringed or that the processing of personal data concerning the User breaches applicable law.
MODIFICATIONS
Katalog Health reserves the right to amend this Privacy Policy at any time. Changes or updates to the Privacy Policy will be expressly notified to the User by means of a notice on the Website, together with the updated version of the Privacy Policy.