Data Protection Policy and Privacy Notice

When the processing of personal data by FREMAP is based on the data subject's consent, this must be given in a clear affirmative act that reflects the data subject's free, specific, informed and unambiguous will to accept the processing of personal data that concerns him/her, with a declaration in writing, including through digital means, or a verbal declaration. Consent must be given for all processing activities carried out with the data or with the same purposes. When there are multiple purposes to the consent, consent must be given for all of them. FREMAP will be responsible for demonstrating that the data subject provided his/her consent through any means of legally admissible evidence. The interested party will have the right to withdraw his/her consent at any time.

When the processing affects special data categories, particularly those relating to health, genetics or biometrics, and is based on the data subject's consent, this must be given explicitly, through a written declaration signed by the data subject.

Data transparency and communication to data subjects. The processing of personal data will be transparent in relation to the data subject, providing him/her with information on the processing of their data concisely, transparently, intelligibly and easily accessible, in clear, simple language. When personal data is acquired on a data subject, at the time of acquisition, FREMAP will provide him/her with the following information:

• The identity of FREMAP as the party responsible for processing the data, and its contact details.

• Contact details for the Data Protection Officer.

• Reasons for processing the data.

• Legal base of the treatment.

• Recipients of the data.

• The rights of the affected persons.

In the event that the data is not obtained from the data subject, but instead as a result of a lawful transfer, or from publicly accessible sources, FREMAP will inform the data subjects of said circumstances, and the source of the data.

Rights of access, rectification, erasure, objection, portability, limitation of processing, and no longer being subject to automated individual decisions. FREMAP will enable data subjects to be able to exercise their rights, establishing the internal procedures required to do so for this purpose.

Find out about your data protection rights and how to exercise them at FREMAP

The Data Protection regulations grant you certain rights, which you can exercise in relation to the processing of your personal data.

We inform you about them and the procedure you must follow to exercise them in FREMAP:

The Data Protection Officer is the person in charge of safeguarding your privacy at our company. If you wish to contact them, you can do so at dpd@fremap.es or by written letter sent to the aforementioned address, including the reference "Data Protection Officer".

Right of access: The right to obtain confirmation as to whether FREMAP, Mutual Society Partnering with Social Security No. 61, is processing personal data that concerns you and, if it is, to be able to access this data.

Right of rectification: The right to request that your data be amended or corrected if it is inaccurate.

Right of erasure: The right to request that your data be erased or deleted due to having been unlawfully processed, because the reason for collecting or processing it no longer exists, if you revoke your consent or object to it being processed or when it must be deleted to comply with a legal obligation.

Right of opposition: The right to object, at any time, for reasons related to your specific situation, to the processing of personal data that concerns you on the grounds of public interest or the legitimate interest of the data controller or a third party.

Right of limitation of the processing: The right to restrict the processing of your data, if you contest its accuracy, if it is being processed unlawfully, if your personal data is no longer needed for the purpose it was originally being processed for, or if you have exercised your right to object to the processing of your data.

Right of portability of the data: The right to receive the personal data that concerns you in a structured, commonly-used format that can be digitally read, and to transmit it to another data controller, provided it is technically possible.

The right not to be subject to individual automated decisions: The right to object to being the subject of decisions based on the automated processing of personal data, including setting up profiles, when this decision can affect you legally or significantly.

​The aforementioned rights may be exercised by sending a written communication to FREMAP, as follows:

• In person: At any of FREMAP's offices or hospitals, by showing the original ID card or equivalent identification document.

• By e-mail: Sending the application signed with a digital certificate to the mailbox at derechos_arco@fremap.es

Furthermore, you have the right to:

Revoke the consent you have provided: If you have given your consent for your data to be processed in this way, you have the right to revoke it. Revocation may be requested in the manner indicated above for the exercise of rights.

Lodge a claim: You can, in any case, contact the Data Protection Officer (dpd@fremap.es), you also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

Prior to contracting any service provider who accesses or can access personal data held by FREMAP, and during the term of the contractual relationship, measures must be adopted to ensure that the data processing by the processor is carried out in accordance with applicable regulations and the relationship is formalised through a contract. This contract will contain the obligations bestowed upon the processor by applicable regulations.

When FREMAP becomes aware of an incident that entails the accidental or unlawful destruction, loss or alteration of personal data, or the unauthorised communication or access to said data represents a high risk to the rights and freedoms of the data subjects, it must, without undue delay and, if possible, within 72 hours of becoming aware of it, report the security breach to the Spanish Data Protection Agency. Cases where it is unlikely that the security breach of personal data represents a risk to the rights and freedoms of individuals will be exempt. If such notification is not possible within 72 hours, the reasons for the delay will be indicated, and information may be provided in phases without any further undue delay.

Furthermore, if the security breach could entail a high risk to the rights and freedoms of data subjects, FREMAP will communicate said breach to personal data to each data subject, allowing them to take the necessary precautions.

Said incidents must be documented, and measures will be taken to rectify and alleviate the potential negative effects on data subjects, following the internal protocols established for this purpose.

• Principle of legality, loyalty and transparency. Personal data shall be processed lawfully and fairly in accordance with applicable legislation, whereby all data subjects must be informed of the circumstances relating to the processing of their information. In cases where it is mandatory due to applicable legislation, the consent of data subjects must be given before their information is processed.

• Principle of purpose limitation. Personal data will be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.

• Principle of data minimization. Only personal information that is strictly necessary and adequate for the purposes for which it was collected will be processed.

• Principle of accuracy. Personal data must be accurate and kept up to date. Otherwise, such information must be deleted or amended.

• Principle of limitation of data retention period. Personal data will not be kept beyond the period necessary for the purposes for which it was collected, unless legally required.

• Principle of integrity and confidentiality. Personal data will be processed in such a way that ensures its appropriate security, adopting technical and organisational measures that protect it against unauthorised or unlawful processing and against accidental loss, destruction or damage. Furthermore, the personal data collected and processed by FREMAP must be conserved with maximum confidentiality, and cannot be used for any other purposes than those that justified and allowed for its collection, without the possibility for such data to be communicated or transferred to third parties outside of the cases permitted by applicable legislation.

If you receive Social Security benefits and go to our administrative or healthcare centres:

• Identification and contact details (name, surname, ID/NIE/passport, postal and electronic address, Social Security number, telephone number of the interested party or of their relatives or representatives, signature and image).

• Personal characteristics (date of birth, age, family, sex and nationality).

• Professional data and employment details (profession, workplace, position and professional category).

• Economic and insurance data (banking data, salary data, subsidies, registration in Social Security and insurance data).

• Special category data: Information on your own health and that of family members.

• Data on whether the contingency is work-related or not, and on recognised benefits, their suspension, cancellation or termination.

• Data relating to legal complaints/convictions (in certain benefit files linked to these situations).

• Data relating to workshops and information and awareness sessions on preventive matters and the management of professional contingencies that you attend.

• Other data needed to check your entitlement to social security benefits, verify mutual insurance company competence and perform accident prevention actions.

- Information on the work accident that allows us to know how it occurred and its work-related nature (accident report, working hours, journey -in case of accidents on assignment-, functions performed, employment contract, RLC and RNT -Nominal List of Workers and Receipt of Settlement of Contribution- and time of health assistance).

- Information on the occupational disease that may affect you and that allows for a correct assessment of it (information on the presence of specific substances or agents -risk factor- in the workplace).

If you are not a social security beneficiary and we attend to you at one of our healthcare facilities:

• Identification and contact information (name, surname, ID/Tax ID/Passport, postal and email address, telephone, signature and image).

• Personal characteristics (age, sex and family).

• Insurance information and Social Security registration.

• Special category data (health data).

If you receive social security benefits and attend one of our administrative or healthcare facilities, your data will be processed:

A) For the management of Social Security benefits.

We will process your data to collaborate with the protective action of Social Security in the management of healthcare, in the management of economic benefits for professional contingencies, in preventive activity, in professional recovery when appropriate, and in economic benefits for temporary incapacity derived from common contingencies and non-work accident, for risk during pregnancy and risk during breastfeeding, for cessation of activity of self-employed workers and for care of minors affected by cancer or other serious illness.

The tasks described require processing your personal data in order to:​

• Determine the nature of the contingency (work-related or not).

• To assess and address your entitlement to Social Security benefits.

• ​To make the necessary communications regarding medical appointments or check-ups with the Mutual Insurance Society’s medical service, and notifications about the status of benefits, reviews and any procedure related to the management of the benefit, or to inform you of the possibility of online access to your information through the FREMAP CONTIGO App, ensuring digital communication in the management of your benefits.

• To notify both you and the employer – or the natural or legal person carrying out administrative tasks on their behalf – while the employment relationship remains in force, regarding:

- The work-related or common nature of the contingency.

- Administrative acts that recognize, suspend, annul or extinguish rights.

- Work accidents without sick leave.

- Any change in the classification of a disease initially considered occupational and subsequently reclassified as common.

- The information strictly necessary for the correct deductions of delegated payment in relation to sick leave due to common contingency.

All of this is to ensure that the parties involved understand their legal obligations regarding Social Security or Occupational Risk Prevention or, where applicable, that they are able to demonstrate the non-applicability of such obligations.​​

B) To expedite the recognition of the right to any benefits that may be due and to allow the employer to immediately comply with their obligations regarding Social Security and Occupational Risk Prevention:

Occupational accident: 

When you authorise it, the information relating to the accident suffered and the injury sustained will be communicated to your employer —or to the individual or legal entity that carries out administrative tasks on your behalf. The objective is for the company to have immediately the legally required data to report the accident in the Delt@ system and register the medical leave in the RED System.

Occupational disease:

Likewise, when you give your consent, information on the diagnosed work-related illness will be communicated to your employer – or to the natural or legal person carrying out administrative tasks on your behalf. This will allow the company to immediately investigate the working conditions that caused it and comply with the legal obligation to register the medical leave in the RED System.

Medical discharge:

​Likewise, only with your authorisation will your employer – or the natural or legal person carrying out administrative tasks on its behalf – be informed of your medical discharge due to an accident at work or a work-related illness. This will enable the employer to adopt the necessary organisational and preventive measures for your return to work and to replace, as soon as possible, the temporary disability benefit with the corresponding salary. In the event of a medical fit-for-work notice issued due to the expiry of the statutory period or following a report/proposal, the employer will know instantly that you will not be returning to your post, as the temporary disability situation will continue.​

C) To verify the accuracy of the calculation of your benefits:

​This purpose applies, in those cases where you expressly authorise it, to obtaining from your employer the financial data required to recognise entitlement to the temporary disability benefit, as well as wage slips.

D) For the analysis and investigation of occupational contingencies and the development of a complete preventive action.

This purpose includes the processing of your data for:

• We will obtain information from your company or the medical facility that attended to you to help us ascertain how the accident happened and, where necessary, what assistance you received and the exact time of such assistance. This will help us provide you with the correct healthcare and determine the type of work-related incident that took place.

• If you have suffered a work-related illness, we will obitain from your company information about whether your job entails the presence of specific substances or agents and communicate to your employer the risk factors detected by the mutual insurance company's accident and illness prevention experts.

E) To transfer information about your care process to the insurance company responsible for the accident or to those medical services that you expressly authorize.

This purpose includes the processing of your data for: ​

• In those cases where you give your consent, we will communicate your data to the insurance company responsible legally or contractually for the costs arising from the accident suffered, specifically that information and medical documentation relating to the injuries resulting from the accident suffered, and in order to recover the expenses incurred during your outpatient or hospital healthcare.​

• Similarly, when you give your consent, your medical leave situation may be communicated to the medical department of your company so they can verify your health status, in accordance with article 20.4 of Royal Legislative Decree 2/2015 of 23 October, which approves the consolidated text of the Workers' Statute Act. Similarly, if you give your express consent, information on your latest medical procedure may be communicated to your company's medical department, so it can contribute to improving your health situation by expediting tests or treatments, if possible, or paying planned wage supplements. Likewise, if you expressly consent, your company's medical department can be informed about the mutual insurance company's proposal to issue you with a certificate of fitness to return to work so it can plan your return to work and reorganise the service.​

F) For research, teaching, statistical and analytical purposes.

Your personal data may be made anonymous or irreversibly unidentifiable and used for medical research, teaching, statistical and analytical purposes.

G) In relation to the purpose of collaboration with managing entities, public bodies and other entities collaborating with Social Security.

Your personal data may be processed to carry out the necessary communications to the National Social Security Institute as part of case management, as well as to other Public Bodies and collaborating entities for the recognition and monitoring of benefits, preventing duplications and ensuring the sustainability of the system, or whenever they are required, for the purpose of managing, handling, deciding on, investigating and supervising benefit case files falling within the Mutual Insurance Institution’s remit, relating to protected workers and their beneficiaries.

H) For the improvement of the management of the services provided.

• Your data may be processed to conduct satisfaction surveys, address any complaints or suggestions that you may submit to us and to manage your messages of acknowledgement and congratulations.
• They may also be processed using Artificial Intelligence (AI) systems in order to optimise and improve the efficiency of our internal processes.

​FREMAP uses AI systems as a support tool in diagnostic imaging. These systems are designed to analyse anonymised medical images and provide recommendations that are always reviewed and validated by a medical professional. AI is used solely to support the professionals handling your case, assisting with the interpretation of studies and diagnostic tests. All final decisions regarding your diagnosis will be taken solely by the responsible medical professional, who will consider the results generated by the AI as an additional element within their overall assessment. No automated decisions will ever be taken without human involvement.

I) For security purposes.

To maintain the safety of people, goods and facilities, your identifying data will be registered and your image may be recorded by the security cameras installed in our facilities and hospitals. The registration tag of the vehicle you use to attend the facilities may also be recorded.​

If you do not receive Social Security benefits and we see you in our healthcare facilities, we will process your data:

• To provide you with emergency medical assistance.

• For research, teaching, statistical and analytical purposes.

• Your personal data may be made anonymous or irreversibly unidentifiable and used for medical research, teaching, statistical and analytical purposes.

• For security purposes.

To preserve the safety of people, goods and facilities, your image may be recorded by the security cameras installed in our facilities and hospitals.​

The legal basis that allows us to process your personal data depends on the reason why we need to process it.

If you receive Social Security benefits and go to our administrative or healthcare centres:

A) In relation to the purpose of managing Social Security benefits:

The processing of your personal data is necessary to comply with legal obligations and to exercise public-interest functions related to the management and control of Social Security financial and healthcare benefits, recognised or to be recognised or reviewed, by virtue of your status as a protected worker or beneficiary within FREMAP. All in accordance with the applicable regulations governing Mutual Insurance Societies and, in particular:​

• Royal Legislative Decree 8/2015 (30/10/2015): Revised text of the General Act on Social Security (LGSS). General framework of the social protection system.

• Act 35/2014 (26/12/2014): Amendments to the legal framework of Mutual Insurance Societies collaborating with the Social Security System.

• Royal Decree 625/2014 (18/07/2014): Handling and oversight of temporary disability processes during the first 365 days.

• Royal Decree 1060/2022 of 27 December, amending Royal Decree 625/2014 of 18 July, regarding the online notification of medical reports.

• Order ESS/1187/2015 (15/06/2015): Implementation of RD 625/2014 on medical certificates and temporary disability procedures.

• Royal Decree 1430/2009 (11/09/2009): Regulatory development of Act 40/2007 in relation to temporary disability benefits.

• Royal Decree 1300/1995 (21/07/1995): Regulation of work-related disabilities within the Social Security system.

• Royal Decree 860/2018 (13/07/2018): Preventive activities of the Social Security protective action to be carried out by the Mutual Insurance Societies and annual Resolutions on the general planning of preventive activities of the Mutual Insurance Societies.

• Royal Decree 1993/1995 (07/12/1995): Regulations on the collaboration of the Mutual Insurance Societies with the Social Security System.

• Act 31/1995 (08/11/1995): Occupational Risk Prevention Act (applicable to preventive activities).

• Royal Decree 1299/2006 (10/11/2006): List of work-related illnesses within the Social Security System.

• Order of 13 February 1967 (13/02/1967): Rules for the application and development of death and survivors' benefits.

• Applicable healthcare regulations: Act 41/2002 of 14 November, on the autonomy of patients and rights and obligations with regard to clinical information and documentation.

This processing is lawful under Articles 6.1 c) and 6.1 e) of Regulation (EU) 2016/679 (GDPR), in relation to Article 9.2 b), f) and h), and includes the following actions:

• Determination of whether the contingency is occupational or not, as well as communications to the worker and the employer – or to the individuals or legal entities acting on their behalf – regarding the classification made.

• Management of Social Security benefits under the jurisdiction of the Mutual Insurance Companies, which includes:

- Issuance of administrative acts for the recognition, suspension, annulment or termination of rights, duly motivated and formalized in writing.

- Payment of benefits.

- Provision of healthcare and, where appropriate, rehabilitation.

- Control and monitoring of absences due to common contingencies.

• Communications to the employer – or to the natural or legal persons acting on its behalf – relating to:

- Nature of the contingency.

- Work accidents without sick leave.

- Changes in the classification of diseases (from occupational to common).

- Strictly necessary data on absences due to common contingency, in order to make the correct deductions regarding delegated payment.

• Communications to the worker regarding:

- Medical appointments.

- Notices and notifications regarding the status of benefits.

- Reviews and procedures related to its management.

B) In relation to the purpose of expediting the recognition of the right to benefits that may correspond to him/her and that the employer may proceed to a more immediate fulfillment of the obligations that correspond to him/her in matters of Social Security and Occupational Risk Prevention:

The lawful basis for processing your data for this purpose is your consent (Article 6.1 a) GDPR), meaning that the information will only be provided to your employer – or to the natural or legal persons acting on its behalf – if you expressly authorise it:

• Information relating to your sick leave (identification data, professional data, data related to the accident -date, time and manner of occurrence of the accident- and data relating to health (date of assistance and date of sick leave, injured body part, nature and degree of injury, whether it is a relapse or not and prognosis of severity, as well as the cancellation of the leave if applicable).

• Information related to the diagnosed occupational disease (identifying and health-related data - date of sick leave or assistance).

• Information relating to your medical discharge due to a work accident or occupational disease (identifying and health-related data - date of medical discharge and reason for it, as well as its cancellation if applicable).

C) In relation to the processing of your economic data for the purpose of verifying the accuracy of the calculation of your benefits.

The lawful basis for processing your data is your consent, meaning that only if you expressly authorise it will data be obtained from your payslips and contribution documents (Article 6.1 a) GDPR).

D) In ​​relation to the purpose of analyzing and investigating occupational contingencies and developing a comprehensive preventive action:

We process your personal data on the basis of our legitimate interest, in accordance with Article 6.1(f) of the GDPR, for legitimate and specific purposes relating to the analysis and investigation of contingencies and the development of comprehensive preventive measures, with the aim of ensuring an effective and efficient management of any benefits to which you may be entitled. This processing makes it possible to identify risks and adopt preventive measures, thereby fulfilling the duty to protect occupational health. It is considered to be to your benefit, since, where a professional contingency is recognised, you would acquire a series of rights in relation to Social Security benefits. We have assessed that this processing does not infringe your fundamental rights and freedoms and have implemented appropriate measures to protect your privacy. You can exercise your right to object to the treatment at any time by contacting us at derechos_arco@fremap.es.

E) In relation to the purpose of transferring information about your care process to the responsible insurance company or to those medical services that you expressly authorize:

The lawful basis for processing your data for this purpose is the consent you voluntarily provide (Article 6.1 a GDPR).

F) In relation to the purpose of research, teaching, statistics and analysis:

We process your personal data and information arising from procedures related to your occupational contingencies on the basis of our legitimate interest, in accordance with Article 6.1(f) of the GDPR, for legitimate and specific purposes of research, teaching, and statistical and analytical studies, once the data has undergone irreversible dissociation, as these purposes require real data to obtain valid conclusions and improve prevention and healthcare management. We have assessed that this processing does not infringe your fundamental rights and freedoms, as identification is not possible, and we have implemented appropriate measures to protect your privacy. You can exercise your right to object to the treatment at any time by contacting us at derechos_arco@fremap.es.

G) In relation to the purpose of collaboration with managing entities, public services and other entities collaborating with Social Security:

The processing of your data is necessary to comply with legal obligations and to perform functions in the public interest relating to cooperation with the Public Social Security System, in accordance with Articles 71.1 and 82.2 of Royal Legislative Decree 8/2015 of 30 October, approving the revised text of the General Social Security Act, Royal Decree 625/2014 of 18 July regulating certain aspects of the handling and oversight of temporary disability processes during the first 365 days, Article 5 of Royal Decree 1630/2011 of 14 November, and Articles 1 and 18 of Act 23/2015 of 21 July governing the Labour and Social Security Inspectorate System. This processing of personal data is lawful under Articles 6.1 c and 6.1 e GDPR, in relation to Article 9.2 b), f) and h) of the Regulation.

H) In relation to the purpose of improving the management of the services provided:

• Your personal data are processed for the purpose of recording, handling and resolving any complaints you may submit regarding the actions of the Mutual Insurance Provider, within the framework of the functions of management, control and review of benefits and services legally entrusted to it. This processing is necessary for compliance with the legal obligations imposed on Mutual Insurance Providers Collaborating with the Social Security System, in accordance with the consolidated text of the General Social Security Law and its implementing regulations, the legal basis for the processing being Article 6(1)(c) and, where applicable, Article 9(2)(h) of Regulation (EU) 2016/679 (GDPR), where it involves the processing of health data.

• In addition, we process your personal data on the basis of the legitimate interests pursued by FREMAP, in accordance with Article 6(1)(f) of Regulation (EU) 2016/679 (GDPR), for the purpose of determining your level of satisfaction with the services provided, analysing their quality and making improvements in management and internal processes, including, where appropriate, the analysis of complaints, suggestions and expressions of appreciation. This processing is appropriate and proportionate, as it enables areas for improvement to be identified and the care provided to be optimised, thereby benefiting both users and the proper functioning of the service. The processing has been assessed, and it has been concluded that the rights and freedoms of the data subjects do not override it; it is carried out with the application of the necessary technical and organisational measures to ensure the protection of your personal data.

• Moreover, insofar as the processing is necessary for compliance with the legal obligations incumbent upon the Mutual Insurance Provider, in accordance with Article 6(1)(c) of Regulation (EU) 2016/679 (GDPR), your data may be processed using Artificial Intelligence systems for the purpose of optimising and improving the efficiency of internal processes and the services provided. In particular, such systems are used in the field of radiodiagnosis exclusively on previously anonymised medical images, so that the individuals concerned cannot be identified, and the confidentiality and security of the information processed are ensured at all times. This processing has been subject to prior assessment, concluding that it does not entail any infringement of the rights and freedoms of the data subjects, and appropriate technical and organisational measures have been implemented to ensure the protection of personal data.

I) In relation to the purpose of preserving security:

We process your personal data on the basis of our legitimate interest, in accordance with Article 6.1(f) of the GDPR, for the legitimate and specific purpose of guaranteeing the security of individuals, property and facilities through CCTV and access control. Recording of images and access control help to deter unlawful behaviour and assist in the investigation of incidents. Recording is limited to common areas and access points, and no more information than necessary is captured. Images and other data collected are retained only for as long as strictly necessary, and access to them is restricted to authorised personnel. We have assessed that this processing does not infringe your fundamental rights and freedoms and have implemented appropriate measures to protect your privacy. You can exercise your right to object to the treatment at any time by contacting us at rightchos_arco@fremap.es

If you do not receive social security benefits and go to any of our administrative or healthcare facilities:

a) To provide you with emergency healthcare:

The processing of your data is necessary to comply with legal obligations regarding the provision of emergency healthcare and its administrative handling (Art. 6.1 c GDPR in relation to Art. 9.2 c GDPR, and in relation to Article 196 of Organic Law 10/1995 of 23 November, the Criminal Code).

e) For research, teaching, statistical and analytical purposes.

We process your personal data and information on the basis of our legitimate interest, under Article 6.1 f) of the GDPR, for legitimate and specific purposes of research, teaching, statistical and analytical studies, after irreversible dissociation of the data, as these purposes require real data to obtain valid conclusions and to improve prevention and healthcare management. We have assessed that this processing does not infringe your fundamental rights and freedoms, as identification is not possible, and we have implemented appropriate measures to protect your privacy. You can exercise your right to object to the treatment at any time by contacting us at derechos_arco@fremap.es

c) To protect your safety.

We process your personal data on the basis of our legitimate interest, in accordance with Article 6.1(f) of the GDPR, for the legitimate and specific purpose of guaranteeing the security of individuals, property and facilities through CCTV and access control. Recording of images and access control help to deter unlawful behaviour and assist in the investigation of incidents. Recording is limited to common areas and access points, and no more information than necessary is captured. Images and other data collected are retained only for as long as strictly necessary, and access to them is restricted to authorised personnel. We have assessed that this processing does not infringe your fundamental rights and freedoms and have implemented appropriate measures to protect your privacy. You can exercise your right to object to the treatment at any time by contacting us at​ ​derechos_arco@fremap.es.

Data will be stored for the time required to meet the purpose for which it was collected and deal with any liabilities and claims that could be lodged against the company, in accordance with applicable regulations.

The erasure of the data could be detrimental to your future health, prevent the management of any Social Security financial benefits to which you may be entitled that do not expire, make it impossible to respond to any necessary legal actions or to requests from bodies with supervisory authority over Mutual Insurance Providers, such as the Labour and Social Security Inspectorate (Art. 5.2(d) of the General Social Security Law and Art. 12.1(c)(3) of Law 23/2015 of 21 July on the Organisation of the Labour and Social Security Inspectorate System), or the General Intervention of the Social Security System (145. 3 and 168(a) of Act 47/2003, of 26 November, the General Budgetary Act.​

If you receive Social Security benefits and go to our administrative or healthcare centres:

You are required to provide your data to enable us to provide you with healthcare and financial assistance. Refusal to provide such data impedes access to the financial and healthcare provisions that you have the right to access, on the basis of Social Security legislation.

If you do not receive Social Security benefits and we see you in our healthcare centres:

You are required to provide us with your data to enable us to provide you with any healthcare you need, and because your refusal to provide us with this information prevents us from providing you with such healthcare.

If you are a beneficiary of the Social Security System and visit FREMAP’s administrative or healthcare centres, it may be necessary to disclose certain personal data to third parties where this is essential to fulfil the purposes of processing previously indicated, in particular to manage Social Security benefits and cooperate with the protective functions of the system.

As a general rule, your data may be disclosed to the following recipients, under the terms and within the limits established by the applicable laws:

• Ministry of Labour and Social Economy and other competent authorities.

• Bodies and entities forming part of the Social Security system, and competent Public Administrations responsible for the processing, management, monitoring and audit of benefits, including, among others, the National Social Security Institute (INSS), Medical and Labour Inspectorates, the Directorate-General for the Organisation of the Social Security System (DGOSS), the General Intervention of the Social Security System, the State Public Employment Service (SEPE), as well as any other bodies that may need access to the necessary information in order to perform their functions in accordance with the applicable laws.
• Public Health Service.

• Other Mutual Insurance Providers Collaborating with the Social Security Institute.

• The employer, or natural or legal persons acting on its behalf in administrative management, under the terms provided by law or, where applicable, on the basis of the data subject’s consent.

• Medical services providing you with healthcare.

• Service provider companies that have a contractual relationship with FREMAP, acting as data processors.

• Financial institutions, including banks, savings banks and rural banks, for managing payments and benefits.

• Recipients by legal obligation, such as Courts, Tribunals, Public Prosecutor's Office and State Security Forces and Corps.

Disclosure of data to the employer and/or medical services that have provided healthcare in order to comply with legal obligations and functions carried out in the public interest.

For the purpose of managing Social Security benefits and cooperating with the protective functions of the system, your personal data may be disclosed to your employer or to those acting on its behalf in an administrative management capacity, pursuant to Articles 6(1)(c) and (e) and 9(2)(b) of the GDPR, where such disclosure is necessary for the proper management of a work-related accident or illness or a temporary disability process, as well as to comply with applicable labour and Social Security obligations, including the financial management of the process, delegated payment, and preventive obligations, including the analysis and investigation of work-related accidents, and any necessary organisational measures.

In this context, the following personal data may be disclosed, among others, strictly to the extent necessary for the purposes indicated:

• Identification data: full name; NIF or NIE.

• Necessary administrative and employment data, such as the type of contract and data relating to contributions, including the Nominal List of Workers (RNT) and the Contribution Settlement Receipt (RLC).

• Data necessary to confirm the occupational nature of the contingency—or, where applicable, its non-occupational nature—including the place and manner in which the accident occurred, working hours, the journey undertaken (in cases of accidents during work-related travel), the duties performed and the time of medical assistance.

• Administrative information of the process, such as the existence of a work-related accident or illness, the start, modification, cancellation or termination of a situation of temporary disability, cases of accident without sick leave, with sick leave, serious or resulting in death, as well as situations of sick leave and discharge due to a work-related illness.

• Data necessary for managing delegated payment, such as the origin of the deduction, the start date, the amount and the end date, where applicable.

• In cases of occupational illness, information relating to the presence of substances, agents or risk factors in the workplace relevant for preventive analysis, solely for the assessment of working conditions and the adoption of preventive measures, as well as, where applicable, information relating to any change in the classification of the contingency, where an illness initially classified as occupational comes to be considered common and this has an impact on the employer’s legal obligations.

Furthermore, the data may be disclosed to the medical services that have provided healthcare, solely in cases where the care is related to a work-related accident or illness, and only where such disclosure is necessary to ensure appropriate coordination of care and prevention.

In all cases, such disclosures are made solely for the purposes described, without transferring clinical data or health information that is not strictly necessary, and in accordance with the principles of purpose limitation, data minimisation and confidentiality, as set out in the applicable data protection laws.

Data communications to the employer to streamline the management and recognition of benefits.

Where necessary to streamline the management and recognition of any benefits to which you may be entitled, as well as to ensure compliance with certain employer obligations, and provided that you give your consent, FREMAP may process your personal data in accordance with Article 6(1)(a) of Regulation (EU) 2016/679 (GDPR). In such cases, the data may be disclosed to your employer or to the natural or legal person acting on its behalf in an administrative management capacity.

In particular, with your consent, FREMAP may disclose to your employer information relating to the workplace accident suffered and the injury caused, so that it can immediately have the information legally required to report the accident in the Delt@ system and to record the medical leave data in the RED System. This disclosure may include identification data, professional data, data relating to the accident (date, time and manner in which it occurred) and health-related data, such as the date of treatment and of medical leave, the part of the body injured, the nature and severity of the injury, an indication of whether it is a relapse, the prognosis of severity and, where applicable, the cancellation of the medical leave.

Similarly, FREMAP may disclose to your employer, if you give your consent, information relating to a diagnosed work-related illness, so that it can immediately investigate the working conditions that gave rise to it and comply with its obligations to record the medical leave in the RED System. In such cases, the data disclosed will be limited to identification data and certain health-related data, specifically the date of medical leave or of the healthcare provided.

In addition, where the worker authorises it, FREMAP may request and obtain from the employer the financial data necessary to determine the temporary incapacity benefit, in order to verify immediately the accuracy of the calculation of any financial benefits to which the worker may be entitled. In this context, identification and financial data may be processed, such as payslips and contribution documents.

Lastly, where explicit consent has been given, FREMAP may disclose to the company information relating to medical discharge following a work-related accident or illness, so that it can take the appropriate organisational and preventive measures upon the employee’s return to work and, where applicable, replace the temporary incapacity benefit with the employee’s ordinary salary. In such cases, identification data and health-related data may be disclosed, such as the date of medical discharge, the reason for it and, where applicable, its cancellation. In cases of medical discharge due to the expiry of the maximum period or following a proposal report, the disclosure will enable the employer to know that the employee will not immediately return to work, as the temporary disability status remains in force.

The consents granted for these disclosures are free and voluntary and may be withdrawn at any time by the worker through the channels made available by FREMAP. Refusal to give consent or its subsequent withdrawal will not entail adverse consequences, without prejudice to the fact that the processing or recognition of certain benefits may be delayed for reasons beyond FREMAP’s control.

Data communications to insurance companies and the company's medical services.

In this context, your data may be disclosed to the insurance company responsible for the claim, solely to the extent necessary to ensure the proper handling of actions arising from the damage suffered and the coverage of the claim, including the checks and procedures essential for the proper conduct of the insurance process.

Furthermore, and only where you have given your express authorisation, your data may be disclosed to your company’s medical services where such disclosure is necessary to support the improvement of your health and to ensure appropriate coordination of care, within the framework of your treatment or medical follow-up.

To comply with these purposes, essential identification data may be disclosed, such as your name and surname and NIF or NIE, as well as certain health-related data, strictly limited to the information necessary regarding the most recent care process, such as diagnosis, treatment received and the progress of the medical condition, all within the limits established by the applicable legislation and in accordance with the principle of data minimisation.

In relation to these disclosures, no international transfers of data to third countries or international organisations are envisaged.

If you do not receive Social Security benefits and we attend to you in one of our centres:

• Your data may be communicated to the relevant Public Health Department or your relatives.

We will not make any international transfers of data to third countries or international organisations.

For the purpose of providing information relating to your care process to the insurance company responsible for the damage suffered or, where applicable, to your company’s medical services, and always subject to your prior express authorisation, FREMAP may disclose certain personal data under the terms set out below.

In the case of business or administrative relations with us, in your capacity as a representative of a company or individual businessperson, to maintain our administrative or contractual relationship.

In the case of contact persons for a supplier company, associated company or associated individual businessperson, or someone with RED authorisation, your data will be processed to maintain the relationship with the individual businessperson on behalf of the person acting, and to comply with legal and contractual obligations.

In either case, your data may be used to conduct satisfaction surveys to improve the management of the services provided by the Mutual Society, and to obtain the opinions of those surveyed on FREMAP's main services (absenteeism, Delta Aid, in-center care, single point of contact).​

The data will be stored for the time required to meet the purpose for which it was collected, to determine the possible liabilities and to attend to the claim against the company, which could occur at a future date.

In any case, the data will need to be stored for the time needed for FREMAP to carry out any legal or administrative actions derived from the account audits and compliance stipulated in article 98.2 of Royal Legislative Decree 8/2015, of 30 October, which approves the Amended Text on the General Social Security Act.

The provisions of Royal Decree 1993/1995, of 7 December, which approves the Regulation on the Collaboration of Mutual Companies, will be applicable, along with those of Article 1964 of the Civil Coe.

If you have a business or administrative relationship with us, in your quality as a representative of a company or individual businessperson, we are legally authorised by virtue of article 6.1 b) and c) of Regulation (EU) 2016/679 on General Data Protection, whereby this is needed to comply with legal and contractual obligations, and article 6.1 f), whereby the processing is needed to satisfy the legitimate interests of FREMAP.

In the case of contact persons for a supplier company, an associated company or an individual associated businessperson, we are legally authorised by virtue of article 6.1 b), c) and f) of Regulation (EU) 2016/679 on General Data Protection, whereby this is necessary for the execution of a contract, application of pre-contractual measures at the request of the data subject, or to comply with legal obligations and legitimate interests.

You are obliged to provide your data or consent to the processing of your data as this is required to formalise and maintain the relationship with you or with the company you represent, or through which you are acting, as it would not be possible to attend to you correctly otherwise.

You are not required to provide your data if you are sent satisfaction surveys for the purpose of improving the management of the services provided. The surveys are voluntary for the recipients.

Your personal data are processed at our company. To the extent stipulated by Law, we can transfer your data to recipients external to the mutual company. These recipients may include service providers (who, pursuant to contracts awarded, provide services including the processing of personal data) and public authorities, inasmuch as we are required to disclose it by virtue of a legal obligation.

We will not make any international transfers of data to third countries or international organisations.

Right of access: The right to obtain confirmation as to whether FREMAP, MUTUAL INSURANCE COMPANY NO. 61 PARTNERING WITH THE SOCIAL SECURITY INSTITUTE is processing personal data that concerns you and, if it is, the right to access it.

Right to rectification: The right to request that your data be amended or corrected if it is inaccurate.

Right of erasure: The right to request that your data be erased or deleted due to having been unlawfully processed, because the reason for collecting or processing it no longer exists, if you revoke your consent or object to it being processed or when it must be deleted to comply with a legal obligation.

Right of opposition: The right to object, at any time, for reasons related to your specific situation, to the processing of personal data that concerns you on the grounds of public interest or the legitimate interest of the data controller or a third party.

Right of limitation of the processing: The right to restrict the processing of your data, if you contest its accuracy, if it is being processed unlawfully, if your personal data is no longer needed for the purpose it was originally being processed for, or if you have exercised your right to object to the processing of your data.

Right of portability of the data: The right to receive the personal data that concerns you in a structured, commonly-used format that can be digitally read, and to transmit it to another data controller, provided it is technically possible.

Right not to be subject to automated individual decisions: The right to object to being the subject of decisions solely based on the automated processing of personal data, including creating profiles, when this decision may legally or significantly affect you.

​The aforementioned rights may be exercised by sending a written communication to FREMAP, as follows:

• In person: At any of FREMAP's offices or hospitals, showing an original National Identity Card or equivalent identification document.

• By e-mail: Sending the application signed with a digital certificate to the mailbox at derechos_arco@fremap.es​.

​​If the request is submitted by a representative:

• If the application is submitted in person by the voluntary representative, it will be necessary to include authorization from the represented person and to show the original ID card or equivalent document of the representative and of the represented person, and to include the specific authorization or power of representation (which authorizes access to health data in case of a request for medical information), a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.

• If the application is submitted in person by the legal representative, it will be necessary to include the document that proves the legal representation (judgment or notarized power of attorney) and to show the original of the ID card or equivalent document of the representative.

• If the request is sent by email by the voluntary representative, it will be necessary that it be signed with a digital certificate and accompanied by the authorization or specific power of representation (which empowers access to health data in case of a request for medical information), also signed with a digital certificate, a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.

• If the application is submitted by email by the legal representative, it must be signed with a digital certificate and accompanied by the document that proves the legal representation (judgment or notarized power of attorney).

Data protection rights will be handled immediately and at the latest within 1 month from when the request is submitted by the data subject. If your request has not been resolved within this period and you submitted it by email, please notify the Contact Office or any of our offices or hospitals whose details are posted on this website.

Furthermore, you have the right to:

Revoke the consent given: If you have given your consent for your data to be processed in this way, you have the right to revoke it. Revocation may be requested in the manner indicated above for the exercise of rights.

File a claim: You can, in any case, contact the Data Protection Officer (dpd@fremap.es), you also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

From you, when you register, or participate in our events, seminars, courses, seminars, Teams-webinars, interviews and videos.

The main purpose is to manage personnel selection processes, evaluate personal aspects (profile development), and provide jobs in which you participate. We inform you that FREMAP will automatically process the information obtained from the psychometric test (profiling) if you consent to this. This information is needed to determine the best fit and integration of the individual with the job they will perform. This psychometric test assesses professional competencies and personality factors related to professional and/or professional training aspects (aptitude test).

Under no circumstances will the results of the psychometric test be used alone to exclude you from the selection process in which you have been included; it is merely one of several factors to be considered. When selecting or rejecting you as a candidate, FREMAP will take into account other factors, such as personal interviews, prior experience, evaluation of the probationary period, and the results of any exams you take. Factors based on which FREMAP will reach its decision to select or reject you for the vacancy offered (decision criteria or applied logic).

The decision regarding your selection or rejection as a candidate will be made by the personnel responsible for the selection process and will never be based solely on the automated processing of your data.

Furthermore, for video surveillance and access control in facilities for security purposes.

The data will be kept during the time necessary to comply with the purpose for which it was collected and to determine the possible responsibilities that could result from this purpose and from the processing of the data and while the interested party does not exercise his/her right of erasure.

The processing of your personal data for the management of personnel selection processes and the provision of jobs in which you participate is necessary for the implementation of pre-contractual measures (Article 6.1.b) of Regulation (EU) 2016/679, General Data Protection Regulation).

In relation to special categories of data (health), such as those obtained from the psychometric test carried out for the evaluation of personal aspects, the processing of your data is subject to your consent, so these data will only be processed if you expressly give your consent to do so (Article 9.1 a) of Regulation (EU) 2016/679 General Data Protection, in relation to Article 22.4 of the aforementioned Regulation).

The personal data collected for video surveillance and access control to the facilities are based on FREMAP's legitimate interests, such as ensuring the security of people, property and facilities (Article 6.1. f) Regulation (EU) 2016/679 General Data Protection): Royal Legislative Decree 2/2015, of 23 October, which approves the amended text of the Law on the Statute of Workers' Rights.

You are required to provide us with your information if you wish to participate in the selection process for a vacant position at the entity, as it is necessary for the management of your application and the development of the selection process in which you participate. If you do not provide your data, we will not be able to manage your participation in the selection processes.

Your data will not be transferred to third parties, other than transportation companies, travel agencies and hotel establishments, for trips made during the selection processes in which you participate and which are necessary.

We will not make any international data transfers to third countries or international organisations

Right of access: The right to obtain confirmation as to whether FREMAP, MUTUAL INSURANCE COMPANY NO. 61 PARTNERING WITH THE SOCIAL SECURITY INSTITUTE is processing personal data that concerns you and, if it is, the right to access it.

Right of rectification: The right to request that your data be amended or corrected if it is inaccurate.

Right of erasure: The right to request that your data be erased or deleted due to having been unlawfully processed, because the reason for collecting or processing it no longer exists, if you revoke your consent or object to it being processed or when it must be deleted to comply with a legal obligation.

Right of opposition: The right to object, at any time, for reasons related to your specific situation, to the processing of personal data that concerns you on the grounds of public interest or the legitimate interest of the data controller or a third party.

Right of limitation of the processing: The right to restrict the processing of your data, if you contest its accuracy, if it is being processed unlawfully, if your personal data is no longer needed for the purpose it was originally being processed for, or if you have exercised your right to object to the processing of your data.

Right of portability of the data: The right to receive the personal data that concerns you in a structured, commonly-used format that can be digitally read, and to transmit it to another data controller, provided it is technically possible.

The right not to be subject to individual automated decisions: The right to object to being the subject of decisions based on the automated processing of personal data, including setting up profiles, when this decision can affect you legally or significantly. You have the opportunity to express your opinion, challenge the decision, and request the intervention of a person in the process to review the decision.

​The aforementioned rights may be exercised by sending a written communication to FREMAP, as follows:

• In person: At any of FREMAP's offices or hospitals, showing an original National Identity Card or equivalent identification document.

• By e-mail: Sending the application signed with a digital certificate to the mailbox at derechos_arco@fremap.es.

If the request is submitted by a representative:

• If the application is submitted in person by the voluntary representative, it will be necessary to include authorization from the represented person and to show the original ID card or equivalent document of the representative and of the represented person, and to include the specific authorization or power of representation (which authorizes access to health data in case of a request for medical information), a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.

• If the application is submitted in person by the legal representative, it will be necessary to include the document that proves the legal representation (judgment or notarized power of attorney) and to show the original of the ID card or equivalent document of the representative.

• If the request is sent by email by the voluntary representative, it will be necessary that it be signed with a digital certificate and accompanied by the authorization or specific power of representation (which empowers access to health data in case of a request for medical information), also signed with a digital certificate, a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.

• If the application is submitted by email by the legal representative, it must be signed with a digital certificate and accompanied by the document that proves the legal representation (judgment or notarized power of attorney).

Data protection rights will be handled immediately and at the latest within 1 month from when the request is submitted by the data subject. If your request has not been resolved within this period and you submitted it by email, please notify the Contact Office or any of our offices or hospitals whose details are posted on this website.

Furthermore, you have the right to:

Revoke the consent given: If you have given your consent for your data to be processed in this way, you have the right to revoke it. Revocation may be requested in the manner indicated above for the exercise of rights.

File a claim: You can, in any case, contact the Data Protection Officer (dpd@fremap.es), you also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

Directly from you when you send your CV to FREMAP, when you offer your candidacy through the website, or subsequently when you provide your data in the selection interview, psycho-technical tests, group dynamics or exams carried out, and from employment companies or job boards you may be subscribed to.

Your details will be stored for the time needed to comply with the purpose for which they were collected, and, where relevant, to attend to the liabilities that may be derived from this purpose and data processing.

We are authorized to process your data as it is necessary for the performance of a contract and compliance with legal obligations [Article 6.1 b) and c) Regulation 2016/679 General Data Protection Regulation].

You are obliged to provide your data in order to manage the internship or service provisions and to comply with the contractual or collaborative relationship.

Your personal data will be disclosed to the educational centre you belong to, or to the company with which you have a labour or trade relationship.

Furthermore, your data may be communicated to the occupational authority when this is requested in compliance with the obligations of the Mutual Company.

We will not make any international transfers of data to third countries or international organisations.

Right of access: The right to obtain confirmation as to whether FREMAP, MUTUAL INSURANCE COMPANY NO. 61 PARTNERING WITH THE SOCIAL SECURITY INSTITUTE is processing personal data that concerns you and, if it is, the right to access it.

Right of rectification: The right to request that your data be amended or corrected if it is inaccurate.

Right of erasure: The right to request that your data be erased or deleted due to having been unlawfully processed, because the reason for collecting or processing it no longer exists, if you revoke your consent or object to it being processed or when it must be deleted to comply with a legal obligation.

Right of opposition: The right to object, at any time, for reasons related to your specific situation, to the processing of personal data that concerns you on the grounds of public interest or the legitimate interest of the data controller or a third party.

Right of limitation of the processing: The right to restrict the processing of your data, if you contest its accuracy, if it is being processed unlawfully, if your personal data is no longer needed for the purpose it was originally being processed for, or if you have exercised your right to object to the processing of your data.

Right of portability of the data: The right to receive the personal data that concerns you in a structured, commonly-used format that can be digitally read, and to transmit it to another data controller, provided it is technically possible.

The right not to be subject to individual automated decisions: The right to object to being the subject of decisions solely based on the automated processing of personal data, including creating profiles, when this decision may legally or significantly affect you.

​The aforementioned rights may be exercised by sending a written communication to FREMAP, as follows:

• In person: At any of FREMAP's offices or hospitals, showing an original National Identity Card or equivalent identification document.
  
  
• By e-mail: Submit the application signed with a digital certificate to the mailbox of derechos_arco@fremap.es​.

If the request is submitted by a representative:

• If the application is submitted in person by the voluntary representative, it will be necessary to include authorization from the represented person and to show the original ID card or equivalent document of the representative and of the represented person, and to include the specific authorization or power of representation (which authorizes access to health data in case of a request for medical information), a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted in person by the legal representative, it will be necessary to include the document that proves the legal representation (judgment or notarized power of attorney) and to show the original of the ID card or equivalent document of the representative.
  
  
• If the request is sent by email by the voluntary representative, it will be necessary that it be signed with a digital certificate and accompanied by the authorization or specific power of representation (which empowers access to health data in case of a request for medical information), also signed with a digital certificate, a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted by email by the legal representative, it must be signed with a digital certificate and accompanied by the document that proves the legal representation (judgment or notarized power of attorney).

Data protection rights will be handled immediately and at the latest within 1 month from when the request is submitted by the data subject. If your request has not been resolved within this period and you submitted it by email, please notify the Contact Office or any of our offices or hospitals whose details are posted on this website.

Furthermore, you have the right to:

Revoke the consent given: If you have given your consent for your data to be processed in this way, you have the right to revoke it. Revocation may be requested in the manner indicated above for the exercise of rights.

File a claim: You can, in any case, contact the Data Protection Officer (dpd@fremap.es), you also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

If you are a student taking an internship, your details are provided to us by the educational centre you are part of.

If you are an external worker providing services to FREMAP, your data is provided to us by the company with which you have a labour or trade relationship, a service provider to FREMAP.

Your details will be processed for the administrative management of governing and administration bodies of the Mutual Company.

The data will be stored for the time required to meet the purpose for which it was collected, to determine the possible liabilities and to attend to the claim against the company, which could occur at a future date.

In any case, the data will need to be stored for the time needed for FREMAP to carry out any legal or administrative actions derived from the account audits and compliance stipulated in article 98.2 of Royal Legislative Decree 8/2015, of 30 October, which approves the Amended Text on the General Social Security Act.

The provisions of Royal Decree 1993/1995, of 7 December, which approves the Regulation on the Collaboration of Mutual Companies, will be applicable, along with those of Article 1964 of the Civil Coe.

Our legal ground for processing your data is based on compliance with legal obligations attributed to the Mutual Company, stipulated in article 6.1 c) of Regulation (EU) 2016/679 on General Data Protection.

You are obliged to provide your data as it is required for the administrative management of governing and administration bodies of the Mutual Company. Otherwise, your participation in governing and participation bodies of the Mutual Company would not be possible.

Personal data processing also takes place in our company. To the extent stipulated by Law, we can transfer your data to recipients external to the mutual company. These recipients can include service providers (which, in accordance with contracts in place, provide services including the processing of personal data) and public bodies, insofar that we are obliged to communicate such data by virtue of a legal obligation.

We will not make any international transfers of data to third countries or international organisations.

Right of access: The right to obtain confirmation as to whether FREMAP, MUTUAL INSURANCE COMPANY NO. 61 PARTNERING WITH THE SOCIAL SECURITY INSTITUTE is processing personal data that concerns you and, if it is, the right to access it.

Right of rectification: The right to request that your data be amended or corrected if it is inaccurate.

Right of erasure: The right to request that your data be erased or deleted due to having been unlawfully processed, because the reason for collecting or processing it no longer exists, if you revoke your consent or object to it being processed or when it must be deleted to comply with a legal obligation.

Right of opposition: The right to object, at any time, for reasons related to your specific situation, to the processing of personal data that concerns you on the grounds of public interest or the legitimate interest of the data controller or a third party.

Right of limitation of the processing: The right to restrict the processing of your data, if you contest its accuracy, if it is being processed unlawfully, if your personal data is no longer needed for the purpose it was originally being processed for, or if you have exercised your right to object to the processing of your data.

Right of portability of the data: The right to receive the personal data that concerns you in a structured, commonly-used format that can be digitally read, and to transmit it to another data controller, provided it is technically possible.

The right not to be subject to individual automated decisions: The right to object to being the subject of decisions solely based on the automated processing of personal data, including creating profiles, when this decision may legally or significantly affect you.

​The aforementioned rights may be exercised by sending a written communication to FREMAP, as follows:

• In person: At any of FREMAP's offices or hospitals, showing an original National Identity Card or equivalent identification document.
  
  
• By e-mail: Submit the application signed with a digital certificate to the mailbox of derechos_arco@fremap.es​.

If the request is submitted by a representative:

• If the application is submitted in person by the voluntary representative, it will be necessary to include authorization from the represented person and to show the original ID card or equivalent document of the representative and of the represented person, and to include the specific authorization or power of representation (which authorizes access to health data in case of a request for medical information), a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted in person by the legal representative, it will be necessary to include the document that proves the legal representation (judgment or notarized power of attorney) and to show the original of the ID card or equivalent document of the representative.
  
  
• If the request is sent by email by the voluntary representative, it will be necessary that it be signed with a digital certificate and accompanied by the authorization or specific power of representation (which empowers access to health data in case of a request for medical information), also signed with a digital certificate, a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted by email by the legal representative, it must be signed with a digital certificate and accompanied by the document that proves the legal representation (judgment or notarized power of attorney).

Data protection rights will be handled immediately and at the latest within 1 month from when the request is submitted by the data subject. If your request has not been resolved within this period and you submitted it by email, please notify the Contact Office or any of our offices or hospitals whose details are posted on this website.

Furthermore, you have the right to:

Revoke the consent given: If you have given your consent for your data to be processed in this way, you have the right to revoke it. Revocation may be requested in the manner indicated above for the exercise of rights.

File a claim: You can, in any case, contact the Data Protection Officer (dpd@fremap.es), you also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

You provide your details yourself when you apply to form part of a governing and participation body of the Mutual Company.

The data collected from participants in events, workshops, courses, seminars, webinars, and interviews organized by FREMAP will be used to monitor participants and to publicize FREMAP's activities through institutional documentation, web applications, and social media. This information will also be used, where applicable, to justify the implementation of these activities to official bodies or third parties that must receive them by virtue of a legal obligation.

The personal data of participants in events, conferences, courses, seminars, webinars, and interviews held by the Mutual Society in the course of its activities will be retained for the time necessary for their dissemination in institutional documentation, web applications, and social media, and for a period of five years from the date of their completion or as long as any actions that may be taken to hold the Mutual Society liable do not expire.

The legal basis for the processing of your data is your consent, in accordance with the provisions in Article 6.1 a) of the General Data Protection Regulation (EU) 2016/679, which is why your data will be processed only if you have expressly stated that you consent to this taking place.

You do not have any obligation to provide your data. Participation in events, workshops, courses, seminars, webinars, and interviews organized by FREMAP to publicize its activities is voluntary.

If you do not provide your data and expressly consent to its processing, you will not be able to participate in events, conferences, courses, seminars, webinars, and interviews to prevent your image or voice from being recorded.

The data will be disclosed via institutional documentation, web applications and social networks, which is why it will be passed on to third parties interested in FREMAP's activities, as well as those recipients legally required to receive them.

We will not make any international transfers of data to third countries or international organisations.

Right of access: The right to obtain confirmation as to whether FREMAP, MUTUAL INSURANCE COMPANY NO. 61 PARTNERING WITH THE SOCIAL SECURITY INSTITUTE is processing personal data that concerns you and, if it is, the right to access it.

Right of rectification: The right to request that your data be amended or corrected if it is inaccurate.

Right of erasure: The right to request that your data be erased or deleted due to having been unlawfully processed, because the reason for collecting or processing it no longer exists, if you revoke your consent or object to it being processed or when it must be deleted to comply with a legal obligation.

Right of opposition: The right to object, at any time, for reasons related to your specific situation, to the processing of personal data that concerns you on the grounds of public interest or the legitimate interest of the data controller or a third party.

Right of limitation of the processing: The right to restrict the processing of your data, if you contest its accuracy, if it is being processed unlawfully, if your personal data is no longer needed for the purpose it was originally being processed for, or if you have exercised your right to object to the processing of your data.

Right of portability of the data: The right to receive the personal data that concerns you in a structured, commonly-used format that can be digitally read, and to transmit it to another data controller, provided it is technically possible.

The right not to be subject to individual automated decisions: The right to object to being the subject of decisions solely based on the automated processing of personal data, including creating profiles, when this decision may legally or significantly affect you.

​The aforementioned rights may be exercised by sending a written communication to FREMAP, as follows:

• In person: At any of FREMAP's offices or hospitals, showing an original National Identity Card or equivalent identification document.
  
  
• By e-mail: Submit the application signed with a digital certificate to the mailbox of derechos_arco@fremap.es​.

If the request is submitted by a representative:

• If the application is submitted in person by the voluntary representative, it will be necessary to include authorization from the represented person and to show the original ID card or equivalent document of the representative and of the represented person, and to include the specific authorization or power of representation (which authorizes access to health data in case of a request for medical information), a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted in person by the legal representative, it will be necessary to include the document that proves the legal representation (judgment or notarized power of attorney) and to show the original of the ID card or equivalent document of the representative.
  
  
• If the request is sent by email by the voluntary representative, it will be necessary that it be signed with a digital certificate and accompanied by the authorization or specific power of representation (which empowers access to health data in case of a request for medical information), also signed with a digital certificate, a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted by email by the legal representative, it must be signed with a digital certificate and accompanied by the document that proves the legal representation (judgment or notarized power of attorney).

Data protection rights will be handled immediately and at the latest within 1 month from when the request is submitted by the data subject. If your request has not been resolved within this period and you submitted it by email, please notify the Contact Office or any of our offices or hospitals whose details are posted on this website.

Furthermore, you have the right to:

Revoke the consent given: If you have given your consent for your data to be processed in this way, you have the right to revoke it. Revocation may be requested in the manner indicated above for the exercise of rights.

File a claim: You can, in any case, contact the Data Protection Officer (dpd@fremap.es), you also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

From you, when you register, or participate in our events, seminars, courses, seminars, Teams-webinars, interviews and videos.

Your personal data will be used to attend to and properly manage your complaint or claim.

If your claim or complaint is related with our collaboration with the protective action of Social Security, we will store the data for as long as we provide the healthcare and manage the provisions derived from your condition as a recipient of Social Security protective action, and, in any case, for the statutes of limitation of actions that may be incurred against the Mutual Company.

If you receive Social Security benefits and we attend to you in our healthcare or administrative centres, we are legally authorised by virtue of article 9.2.b) and f) of Regulation (EU) 2016/679 on General Data Protection, given that it is necessary for compliance with obligations and exercising specific rights in the area of social security and protection, and we are authorised to process the rest of your data by virtue of article 6.1.c) of said Regulation, as we are obliged to comply with Royal Decree 8/2015, of 30 October, which approves the amended text of the General Social Security Act and Royal Decree 1993/1995, of 7 December, on the Collaboration of Mutual Companies with Social Security.

You are obliged to provide your data when filing your claim or complaint, as failure to do so prevents us from being able to process it.

The Ministry of Employment and Social Security and Authorities and Entities that comprise Social Security to correctly control the performance of our collaboration with said Authorities, in compliance with Social Security regulations, Royal Decree 8/2015, of 30 October, which approves the amended text of the General Social Security Act, and Royal Decree 1993/1995, of 7 December, on the Collaboration of Mutual Companies with Social Security, and the data will be transferred or disclosed to any recipients that must receive them by virtue of a legal obligation.

We will not make any international transfers of data to third countries or international organisations.

Right of access: The right to obtain confirmation as to whether FREMAP, MUTUAL INSURANCE COMPANY NO. 61 PARTNERING WITH THE SOCIAL SECURITY INSTITUTE is processing personal data that concerns you and, if it is, the right to access it.

Right of rectification: The right to request that your data be amended or corrected if it is inaccurate.

Right of erasure: The right to request that your data be erased or deleted due to having been unlawfully processed, because the reason for collecting or processing it no longer exists, if you revoke your consent or object to it being processed or when it must be deleted to comply with a legal obligation.

Right of opposition: The right to object, at any time, for reasons related to your specific situation, to the processing of personal data that concerns you on the grounds of public interest or the legitimate interest of the data controller or a third party.

Right of limitation of the processing: The right to restrict the processing of your data, if you contest its accuracy, if it is being processed unlawfully, if your personal data is no longer needed for the purpose it was originally being processed for, or if you have exercised your right to object to the processing of your data.

Right of portability of the data: The right to receive the personal data that concerns you in a structured, commonly-used format that can be digitally read, and to transmit it to another data controller, provided it is technically possible.

The right not to be subject to individual automated decisions: The right to object to being the subject of decisions solely based on the automated processing of personal data, including creating profiles, when this decision may legally or significantly affect you.

​The aforementioned rights may be exercised by sending a written communication to FREMAP, as follows:

• In person: At any of FREMAP's offices or hospitals, showing an original National Identity Card or equivalent identification document.
  
  
• By e-mail: Submit the application signed with a digital certificate to the mailbox of derechos_arco@fremap.es​.

If the request is submitted by a representative:

• If the application is submitted in person by the voluntary representative, it will be necessary to include authorization from the represented person and to show the original ID card or equivalent document of the representative and of the represented person, and to include the specific authorization or power of representation (which authorizes access to health data in case of a request for medical information), a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted in person by the legal representative, it will be necessary to include the document that proves the legal representation (judgment or notarized power of attorney) and to show the original of the ID card or equivalent document of the representative.
  
  
• If the request is sent by email by the voluntary representative, it will be necessary that it be signed with a digital certificate and accompanied by the authorization or specific power of representation (which empowers access to health data in case of a request for medical information), also signed with a digital certificate, a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted by email by the legal representative, it must be signed with a digital certificate and accompanied by the document that proves the legal representation (judgment or notarized power of attorney).

Data protection rights will be handled immediately and at the latest within 1 month from when the request is submitted by the data subject. If your request has not been resolved within this period and you submitted it by email, please notify the Contact Office or any of our offices or hospitals whose details are posted on this website.

Furthermore, you have the right to:

Revoke the consent given: If you have given your consent for your data to be processed in this way, you have the right to revoke it. Revocation may be requested in the manner indicated above for the exercise of rights.

File a claim: You can, in any case, contact the Data Protection Officer (dpd@fremap.es), you also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

From you, when you register, or participate in our events, seminars, courses, seminars, Teams-webinars, interviews and videos.

For the management and control of communications received, requests for access and use of web applications owned by FREMAP that are carried out and for the resolution of any technical incidents that may occur.

The data will be kept for the time necessary to deal with your communication or request, or resolve the reported incident and, in all cases, for the period necessary to deal with the claim processes that may be presented against the company.

We are entitled to process your personal data because we are permitted by Article 6.1 c) and f) and Article 9.2 a) of Regulation (EU) 2016/679, on the General Protection of Personal Data, as it is necessary to process this information in order to comply with data protection obligations, specifically relating to attention to the rights of the interested parties, in accordance with Articles 12 to 22 of the aforementioned Regulations and Articles 12 to 18 of Organic Law 3/2018, of 5 December, on Personal Data Protection and guaranteeing digital rights. Furthermore, its processing is necessary to serve the mutual legitimate interests of the parties, including FREMAP's interest in providing a fast and simple remote service for interested users and the User's interest in making fast and secure communications or accessing voluntary and free services provided by FREMAP.

You are obliged to provide your data, as otherwise the communication you send us or the request for access to the applications owned by FREMAP that you make may not be attended to, and any technical incidents that have occurred may not be resolved.

No data will be reported to third parties except in cases where it is necessary to comply with a legal obligation. International transfers of personal data will not be carried out, unless legally required.

Right of access: The right to obtain confirmation as to whether FREMAP, MUTUAL INSURANCE COMPANY NO. 61 PARTNERING WITH THE SOCIAL SECURITY INSTITUTE is processing personal data that concerns you and, if it is, the right to access it.

Right of rectification: The right to request that your data be amended or corrected if it is inaccurate.

Right of erasure: The right to request that your data be erased or deleted due to having been unlawfully processed, because the reason for collecting or processing it no longer exists, if you revoke your consent or object to it being processed or when it must be deleted to comply with a legal obligation.

Right of opposition: The right to object, at any time, for reasons related to your specific situation, to the processing of personal data that concerns you on the grounds of public interest or the legitimate interest of the data controller or a third party.

Right of limitation of the processing: The right to restrict the processing of your data, if you contest its accuracy, if it is being processed unlawfully, if your personal data is no longer needed for the purpose it was originally being processed for, or if you have exercised your right to object to the processing of your data.

Right of portability of the data: The right to receive the personal data that concerns you in a structured, commonly-used format that can be digitally read, and to transmit it to another data controller, provided it is technically possible.

The right not to be subject to individual automated decisions: The right to object to being the subject of decisions solely based on the automated processing of personal data, including creating profiles, when this decision may legally or significantly affect you.

​The aforementioned rights may be exercised by sending a written communication to FREMAP, as follows:

• In person: At any of FREMAP's offices or hospitals, showing an original National Identity Card or equivalent identification document.
  
  
• By e-mail: Submit the application signed with a digital certificate to the mailbox of derechos_arco@fremap.es​.

If the request is submitted by a representative:

• If the application is submitted in person by the voluntary representative, it will be necessary to include authorization from the represented person and to show the original ID card or equivalent document of the representative and of the represented person, and to include the specific authorization or power of representation (which authorizes access to health data in case of a request for medical information), a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted in person by the legal representative, it will be necessary to include the document that proves the legal representation (judgment or notarized power of attorney) and to show the original of the ID card or equivalent document of the representative.
  
  
• If the request is sent by email by the voluntary representative, it will be necessary that it be signed with a digital certificate and accompanied by the authorization or specific power of representation (which empowers access to health data in case of a request for medical information), also signed with a digital certificate, a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted by email by the legal representative, it must be signed with a digital certificate and accompanied by the document that proves the legal representation (judgment or notarized power of attorney).

Data protection rights will be handled immediately and at the latest within 1 month from when the request is submitted by the data subject. If your request has not been resolved within this period and you submitted it by email, please notify the Contact Office or any of our offices or hospitals whose details are posted on this website.

Furthermore, you have the right to:

Revoke the consent given: If you have given your consent for your data to be processed in this way, you have the right to revoke it. Revocation may be requested in the manner indicated above for the exercise of rights.

File a claim: You can, in any case, contact the Data Protection Officer (dpd@fremap.es), you also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

Only the data that you yourself have provided to us in the communications sent or in the completed forms will be processed.

To ensure the safety of people, goods and facilities through video surveillance and visit controls.

To identify access to the WiFi network, if it is known to have been fraudulently used.

In the case of capturing and recording your images through video cameras, the data will be eliminated one month later by deleting the images, except for recordings related to criminal or administrative infractions regarding public safety, an ongoing police investigation or an open legal or administrative procedure. If your data is collected at reception or at the access control point to our facilities, the data will be deleted one month following the collection.

In the case of WiFi network access data, the data will be deleted 90 days after it is collected, which is the period deemed necessary to detect possible irregularities.

Our legal basis for processing your identification details is based on our legitimate interest stipulated in article 6.1.f) of Regulation (EU) 2016/679 on General Data Protection, to carry out image processing through cameras or video cameras or to control physical access with a view to preserve the safety of people, goods and facilities, given that said interest does not prevail over interests or rights and fundamental freedoms.

Our legal capacity to process identification data is based on the consent freely given by the data subject who wishes to use the wifi network provided to him/her (article 6.1.a) of General Data Protection Regulation (EU) 2016/679).

You are obliged to provide your data because we must protect people, goods and facilities. If you do not provide this data, you may not be able to access our facilities for security reasons.

Similarly, if you wish to use the WiFi network provided, you must identify yourself in order to register your access for security reasons.

To Security Forces and Agencies and the Law Courts if criminal or administrative offences have been committed.

We will not make any international transfers of data to third countries or international organisations.

Right of access: The right to obtain confirmation as to whether FREMAP, MUTUAL INSURANCE COMPANY NO. 61 PARTNERING WITH THE SOCIAL SECURITY INSTITUTE is processing personal data that concerns you and, if it is, the right to access it.

Right of rectification: The right to request that your data be amended or corrected if it is inaccurate.

Right of erasure: The right to request that your data be erased or deleted due to having been unlawfully processed, because the reason for collecting or processing it no longer exists, if you revoke your consent or object to it being processed or when it must be deleted to comply with a legal obligation.

Right of opposition: The right to object, at any time, for reasons related to your specific situation, to the processing of personal data that concerns you on the grounds of public interest or the legitimate interest of the data controller or a third party.

Right of limitation of the processing: The right to restrict the processing of your data, if you contest its accuracy, if it is being processed unlawfully, if your personal data is no longer needed for the purpose it was originally being processed for, or if you have exercised your right to object to the processing of your data.

Right of portability of the data: The right to receive the personal data that concerns you in a structured, commonly-used format that can be digitally read, and to transmit it to another data controller, provided it is technically possible.

The right not to be subject to individual automated decisions: The right to object to being the subject of decisions solely based on the automated processing of personal data, including creating profiles, when this decision may legally or significantly affect you.

​The aforementioned rights may be exercised by sending a written communication to FREMAP, as follows:

• In person: At any of FREMAP's offices or hospitals, showing an original National Identity Card or equivalent identification document.
  
  
• By e-mail: Submit the application signed with a digital certificate to the mailbox of derechos_arco@fremap.es​.

If the request is submitted by a representative:

• If the application is submitted in person by the voluntary representative, it will be necessary to include authorization from the represented person and to show the original ID card or equivalent document of the representative and of the represented person, and to include the specific authorization or power of representation (which authorizes access to health data in case of a request for medical information), a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted in person by the legal representative, it will be necessary to include the document that proves the legal representation (judgment or notarized power of attorney) and to show the original of the ID card or equivalent document of the representative.
  
  
• If the request is sent by email by the voluntary representative, it will be necessary that it be signed with a digital certificate and accompanied by the authorization or specific power of representation (which empowers access to health data in case of a request for medical information), also signed with a digital certificate, a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted by email by the legal representative, it must be signed with a digital certificate and accompanied by the document that proves the legal representation (judgment or notarized power of attorney).

Data protection rights will be handled immediately and at the latest within 1 month from when the request is submitted by the data subject. If your request has not been resolved within this period and you submitted it by email, please notify the Contact Office or any of our offices or hospitals whose details are posted on this website.

Furthermore, you have the right to:

Revoke the consent given: If you have given your consent for your data to be processed in this way, you have the right to revoke it. Revocation may be requested in the manner indicated above for the exercise of rights.

File a claim: You can, in any case, contact the Data Protection Officer (dpd@fremap.es), you also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

Directly from you when you come to our administrative or healthcare centres and your image is recorded or your data is collected at reception or at an access control point.

From you when you access FREMAP's WiFi network via your device.

To comply with your right to the protection of personal data. In accordance with this, your application will be recorded and processed, making any communications that may be required according to the form of contact provided.

Additionally, if necessary, your data will be processed in order to be able to accredit the exercised right to the Control Authority.

The data will be kept for the time necessary to process your request and in any case for the period necessary to address any claims that may be filed against the entity.

We are entitled to process your personal data because we are permitted by Article 6.1 c) of Regulation (EU) 2016/679, General Protection of Personal Data, as it is necessary to process this information in order to comply with data protection obligations, specifically in relation to the attention to the rights of the interested parties, in accordance with Articles 12 to 22 of the aforementioned Regulations and Articles 12 to 18 of Organic Law 3/2018, of 5 December, on Personal Data Protection and guaranteeing digital rights.

You are obliged to provide your details, otherwise the exercised right may not be respected.

No data will be reported to third parties except in cases where it is necessary to comply with a legal obligation. In this regard, your data may be transferred to the Control Authority (Spanish Data Protection Agency), the Management and Guardianship Body of the Mutual Society, the Ministry of Employment and Social Security, its subsidiary bodies, courts and tribunals upon request or in defence of legal or administrative proceedings, and security forces and bodies in the event of civil, criminal or administrative offences (Article 6.1.c) and f) of Regulation (EU) 2016/679 on General Data Protection).

International transfers of personal data will not be carried out, unless legally required.

Right of access: The right to obtain confirmation as to whether FREMAP, MUTUAL INSURANCE COMPANY NO. 61 PARTNERING WITH THE SOCIAL SECURITY INSTITUTE is processing personal data that concerns you and, if it is, the right to access it.

Right of rectification: The right to request that your data be amended or corrected if it is inaccurate.

Right of erasure: The right to request that your data be erased or deleted due to having been unlawfully processed, because the reason for collecting or processing it no longer exists, if you revoke your consent or object to it being processed or when it must be deleted to comply with a legal obligation.

Right of opposition: The right to object, at any time, for reasons related to your specific situation, to the processing of personal data that concerns you on the grounds of public interest or the legitimate interest of the data controller or a third party.

Right of limitation of the processing: The right to restrict the processing of your data, if you contest its accuracy, if it is being processed unlawfully, if your personal data is no longer needed for the purpose it was originally being processed for, or if you have exercised your right to object to the processing of your data.

Right of portability of the data: The right to receive the personal data that concerns you in a structured, commonly-used format that can be digitally read, and to transmit it to another data controller, provided it is technically possible.

The right not to be subject to individual automated decisions: The right to object to being the subject of decisions solely based on the automated processing of personal data, including creating profiles, when this decision may legally or significantly affect you.

​The aforementioned rights may be exercised by sending a written communication to FREMAP, as follows:

• In person: At any of FREMAP's offices or hospitals, showing an original National Identity Card or equivalent identification document.
  
  
• By e-mail: Submit the application signed with a digital certificate to the mailbox of derechos_arco@fremap.es​.

If the request is submitted by a representative:

• If the application is submitted in person by the voluntary representative, it will be necessary to include authorization from the represented person and to show the original ID card or equivalent document of the representative and of the represented person, and to include the specific authorization or power of representation (which authorizes access to health data in case of a request for medical information), a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted in person by the legal representative, it will be necessary to include the document that proves the legal representation (judgment or notarized power of attorney) and to show the original of the ID card or equivalent document of the representative.
  
  
• If the request is sent by email by the voluntary representative, it will be necessary that it be signed with a digital certificate and accompanied by the authorization or specific power of representation (which empowers access to health data in case of a request for medical information), also signed with a digital certificate, a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted by email by the legal representative, it must be signed with a digital certificate and accompanied by the document that proves the legal representation (judgment or notarized power of attorney).

Data protection rights will be handled immediately and at the latest within 1 month from when the request is submitted by the data subject. If your request has not been resolved within this period and you submitted it by email, please notify the Contact Office or any of our offices or hospitals whose details are posted on this website.

Furthermore, you have the right to:

Revoke the consent given: If you have given your consent for your data to be processed in this way, you have the right to revoke it. Revocation may be requested in the manner indicated above for the exercise of rights.

File a claim: You can, in any case, contact the Data Protection Officer (dpd@fremap.es), you also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

From yourself when you request in writing the exercise of a personal data protection right (access, rectification, erasure, opposition, limitation of processing, portability and the right not to be subject to automated individual decisions).

To manage security breaches that may occur in the company.

Your details will be stored for as long as needed to manage the detected incident and, in any case, for the statutes of limitation of actions that may be incurred against the Mutual Company.

Because the data processing is needed to meet the Mutual Company's legal obligations (article 6.1.c) of Regulation (EU) 2016/679 on General Data Protection).

You are obliged to provide the information required for the resolution of the incident, as otherwise it would not be possible to resolve it properly or comply with legal obligations attributed to the Mutual Company.

Your data may be communicated to the Spanish Data Protection Agency in compliance with obligations legally attributed by Data Protection regulations, and, if the security incident could represent a high risk to the rights and freedoms of third parties, the implications and the information related thereto will be notified to the data subjects.

To security forces and bodies. Courts and Tribunals in the case of criminal or administrative infractions.

We will not make any international transfers of data to third countries or international organisations.

Right of access: The right to obtain confirmation as to whether FREMAP, MUTUAL INSURANCE COMPANY NO. 61 PARTNERING WITH THE SOCIAL SECURITY INSTITUTE is processing personal data that concerns you and, if it is, the right to access it.

Right of rectification: The right to request that your data be amended or corrected if it is inaccurate.

Right of erasure: The right to request that your data be erased or deleted due to having been unlawfully processed, because the reason for collecting or processing it no longer exists, if you revoke your consent or object to it being processed or when it must be deleted to comply with a legal obligation.

Right of opposition: The right to object, at any time, for reasons related to your specific situation, to the processing of personal data that concerns you on the grounds of public interest or the legitimate interest of the data controller or a third party.

Right of limitation of the processing: The right to restrict the processing of your data, if you contest its accuracy, if it is being processed unlawfully, if your personal data is no longer needed for the purpose it was originally being processed for, or if you have exercised your right to object to the processing of your data.

Right of portability of the data: The right to receive the personal data that concerns you in a structured, commonly-used format that can be digitally read, and to transmit it to another data controller, provided it is technically possible.

The right not to be subject to individual automated decisions: The right to object to being the subject of decisions solely based on the automated processing of personal data, including creating profiles, when this decision may legally or significantly affect you.

​The aforementioned rights may be exercised by sending a written communication to FREMAP, as follows:

• In person: At any of FREMAP's offices or hospitals, showing an original National Identity Card or equivalent identification document.
  
  
• By e-mail: Submit the application signed with a digital certificate to the mailbox of derechos_arco@fremap.es​.

If the request is submitted by a representative:

• If the application is submitted in person by the voluntary representative, it will be necessary to include authorization from the represented person and to show the original ID card or equivalent document of the representative and of the represented person, and to include the specific authorization or power of representation (which authorizes access to health data in case of a request for medical information), a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted in person by the legal representative, it will be necessary to include the document that proves the legal representation (judgment or notarized power of attorney) and to show the original of the ID card or equivalent document of the representative.
  
  
• If the request is sent by email by the voluntary representative, it will be necessary that it be signed with a digital certificate and accompanied by the authorization or specific power of representation (which empowers access to health data in case of a request for medical information), also signed with a digital certificate, a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted by email by the legal representative, it must be signed with a digital certificate and accompanied by the document that proves the legal representation (judgment or notarized power of attorney).

Data protection rights will be handled immediately and at the latest within 1 month from when the request is submitted by the data subject. If your request has not been resolved within this period and you submitted it by email, please notify the Contact Office or any of our offices or hospitals whose details are posted on this website.

Furthermore, you have the right to:

Revoke the consent given: If you have given your consent for your data to be processed in this way, you have the right to revoke it. Revocation may be requested in the manner indicated above for the exercise of rights.

File a claim: You can, in any case, contact the Data Protection Officer (dpd@fremap.es), you also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

Directly by you, your company or the entity you work for or collaborate with, and from the Social Security Fund.

To manage the communications received through the FREMAP Compliance Channel, in accordance with the established procedure and the provisions of current legislation, within the framework of the Crime Prevention Plan implemented by FREMAP. Accordingly, your data will be processed in order to act on the communications received in the Compliance Channel, to open and process the corresponding investigation file, and to initiate or attend to the necessary complaint processes.

Your personal data will be kept for the time necessary to decide on the appropriateness of initiating an investigation into the reported events, and will be destroyed within a maximum period of three months if it is not agreed to initiate an investigation file.  If an investigation file needs to be initiated, the records will be retained for the time necessary to determine potential responsibilities and address any claims that may arise or need to be addressed. Under no circumstances may the retention of the data exceed a period of ten years, in accordance with the provisions of art. 26 of Law 2/2023 of 20 February on the protection of persons who report breaches of the law and the fight against corruption (Register of information).

We are entitled to process your personal data under Article 6(1)(c) of the General Personal Data Protection Regulation (EU) 2016/679, as processing is necessary for the fulfilment of obligations under Law 2/2023 of 20 February on the protection of persons who report breaches of the law and the fight against corruption.

Knowledge of your personal data facilitates the investigation of the reported facts, however, you are under no obligation to provide your data. 

Data will not be communicated to third parties except in those cases where it is necessary to comply with a legal obligation or to make it available to competent Public Administrations, Courts and Tribunals upon request or in defense of judicial or administrative proceedings, and to Law Enforcement Agencies in the event of civil, criminal or administrative offenses. 

International transfers of personal data will not be carried out, unless legally required.

Right of access: The right to obtain confirmation as to whether FREMAP, MUTUAL INSURANCE COMPANY NO. 61 PARTNERING WITH THE SOCIAL SECURITY INSTITUTE is processing personal data that concerns you and, if it is, the right to access it.

Right of rectification: The right to request that your data be amended or corrected if it is inaccurate.

Right of erasure: The right to request that your data be erased or deleted due to having been unlawfully processed, because the reason for collecting or processing it no longer exists, if you revoke your consent or object to it being processed or when it must be deleted to comply with a legal obligation.

Right of opposition: The right to object, at any time, for reasons related to your specific situation, to the processing of personal data that concerns you on the grounds of public interest or the legitimate interest of the data controller or a third party.

Right of limitation of the processing: The right to restrict the processing of your data, if you contest its accuracy, if it is being processed unlawfully, if your personal data is no longer needed for the purpose it was originally being processed for, or if you have exercised your right to object to the processing of your data.

Right of portability of the data: The right to receive the personal data that concerns you in a structured, commonly-used format that can be digitally read, and to transmit it to another data controller, provided it is technically possible.

The right not to be subject to individual automated decisions: The right to object to being the subject of decisions solely based on the automated processing of personal data, including creating profiles, when this decision may legally or significantly affect you.

​The aforementioned rights may be exercised by sending a written communication to FREMAP, as follows:

• In person: At any of FREMAP's offices or hospitals, showing an original National Identity Card or equivalent identification document.
  
  
• By e-mail: Submit the application signed with a digital certificate to the mailbox of derechos_arco@fremap.es​.

If the request is submitted by a representative:

• If the application is submitted in person by the voluntary representative, it will be necessary to include authorization from the represented person and to show the original ID card or equivalent document of the representative and of the represented person, and to include the specific authorization or power of representation (which authorizes access to health data in case of a request for medical information), a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted in person by the legal representative, it will be necessary to include the document that proves the legal representation (judgment or notarized power of attorney) and to show the original of the ID card or equivalent document of the representative.
  
  
• If the request is sent by email by the voluntary representative, it will be necessary that it be signed with a digital certificate and accompanied by the authorization or specific power of representation (which empowers access to health data in case of a request for medical information), also signed with a digital certificate, a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted by email by the legal representative, it must be signed with a digital certificate and accompanied by the document that proves the legal representation (judgment or notarized power of attorney).

Data protection rights will be handled immediately and at the latest within 1 month from when the request is submitted by the data subject. If your request has not been resolved within this period and you submitted it by email, please notify the Contact Office or any of our offices or hospitals whose details are posted on this website.

Furthermore, you have the right to:

Revoke the consent given: If you have given your consent for your data to be processed in this way, you have the right to revoke it. Revocation may be requested in the manner indicated above for the exercise of rights.

File a claim: You can, in any case, contact the Data Protection Officer (dpd@fremap.es), you also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

From yourself when you provide them to us when submitting the communication. They may also originate from the communication made by third parties when expressly mentioned.​

Your personal data will be processed for the purpose of dealing with your request regarding the urgent healthcare you need, medical transfers you require, or administrative matters you need to resolve. It is necessary to record the conversation to ensure the service is provided correctly.

Your data will be stored for the time required to meet the purpose for which it was collected and deal with any liabilities and claims that could be lodged against the company, in accordance with applicable regulations.

We are entitled to process your personal data under article 6.1 e) of Regulation (EU) 2016/679, General Personal Data Protection Regulation, as such processing is necessary to perform a task carried out in the public interest, arising from Social Security protective action cooperation duties, which are entrusted to Mutual Societies by Social Security regulations (art. 80 et seq. of Royal Decree 8/2015 of 30 October, approving the revised text of the General Social Security Act, Royal Decree 625/2014 of 18 July, regulating certain aspects of the management and supervision of temporary incapacity processes in the first three hundred and sixty-five days of their duration, Royal Decree 860/2018 of 13 July, regulating the Social Security protective action preventive activities to be carried out by Mutual Societies that partner with the Social Security Institute, Royal Decree 1993/1995 of 7 December on Mutual Society partnerships with the Social Security Institute and implementing regulations), and on the basis of the applicable health regulations (Primary Law 41/2002 of 14 November, regulating patient autonomy and health documentation and information-related rights and obligations).

You will be required to provide the minimum personal data necessary to properly manage your request.

No data will be reported to third parties except in cases where it is necessary to comply with a legal obligation. In this regard, your data may be transferred to the Management and Supervisory Body of the Mutual, the Ministry of Employment and Social Security, its dependent bodies, Courts and Tribunals at the request or in defense of judicial or administrative processes and Security Forces and Corps in case of civil, criminal or administrative infringements [article 6.1.c) and f)] of Regulation (EU) 2016/679 General Data Protection Regulation.

International transfers of personal data will not be carried out, unless legally required.

Right of access: The right to obtain confirmation as to whether FREMAP, MUTUAL INSURANCE COMPANY NO. 61 PARTNERING WITH THE SOCIAL SECURITY INSTITUTE is processing personal data that concerns you and, if it is, the right to access it.

Right of rectification: The right to request that your data be amended or corrected if it is inaccurate.

Right of erasure: The right to request that your data be erased or deleted due to having been unlawfully processed, because the reason for collecting or processing it no longer exists, if you revoke your consent or object to it being processed or when it must be deleted to comply with a legal obligation.

Right of opposition: The right to object, at any time, for reasons related to your specific situation, to the processing of personal data that concerns you on the grounds of public interest or the legitimate interest of the data controller or a third party.

Right of limitation of the processing: The right to restrict the processing of your data, if you contest its accuracy, if it is being processed unlawfully, if your personal data is no longer needed for the purpose it was originally being processed for, or if you have exercised your right to object to the processing of your data.

Right of portability of the data: The right to receive the personal data that concerns you in a structured, commonly-used format that can be digitally read, and to transmit it to another data controller, provided it is technically possible.

The right not to be subject to individual automated decisions: The right to object to being the subject of decisions solely based on the automated processing of personal data, including creating profiles, when this decision may legally or significantly affect you. FREMAP does not make automated decisions using your data or create profiles based on the personal information you provide during your call.

​The aforementioned rights may be exercised by sending a written communication to FREMAP, as follows:

• In person: At any of FREMAP's offices or hospitals, showing an original National Identity Card or equivalent identification document.
  
  
• By e-mail: Submit the application signed with a digital certificate to the mailbox of derechos_arco@fremap.es​.

If the request is submitted by a representative:

• If the application is submitted in person by the voluntary representative, it will be necessary to include authorization from the represented person and to show the original ID card or equivalent document of the representative and of the represented person, and to include the specific authorization or power of representation (which authorizes access to health data in case of a request for medical information), a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted in person by the legal representative, it will be necessary to include the document that proves the legal representation (judgment or notarized power of attorney) and to show the original of the ID card or equivalent document of the representative.
  
  
• If the request is sent by email by the voluntary representative, it will be necessary that it be signed with a digital certificate and accompanied by the authorization or specific power of representation (which empowers access to health data in case of a request for medical information), also signed with a digital certificate, a general power of attorney is not sufficient and a power of attorney granted before a notary is not necessary.
  
  
• If the application is submitted by email by the legal representative, it must be signed with a digital certificate and accompanied by the document that proves the legal representation (judgment or notarized power of attorney).

Data protection rights will be handled immediately and at the latest within 1 month from when the request is submitted by the data subject. If your request has not been resolved within this period and you submitted it by email, please notify the Contact Office or any of our offices or hospitals whose details are posted on this website.

Furthermore, you have the right to:

Revoke the consent given: If you have given your consent for your data to be processed in this way, you have the right to revoke it. Revocation may be requested in the manner indicated above for the exercise of rights.

File a claim: You can, in any case, contact the Data Protection Officer (dpd@fremap.es), you also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

From yourself when you inform us of them in the telephone call you make to FREMAP (900 Helpline).