Privacy policy

Scope of the document

By means of this notice, NORTH POINT SOLUTION, S.L., (hereinafter NORTH POINT), with registered office at calle Museu, 4, 08911 Badalona (Barcelona), Spain, and in its capacity as the company representing UPON Group, informs the users of www.irisneural.com (hereinafter the Website) of its personal data protection policy so that they may freely and voluntarily determine whether they wish to provide NORTH POINT with the personal data requested from them in subscriptions, registrations or the completion of online forms or through emails.

This Privacy Policy, together with the one included in the various forms available at any given time on the Website, is applicable to the personal information collected in connection with the services provided by NORTH POINT through www.irisneural.com, as well as to that collected through applications or services of NORTH POINT that refer to this Privacy Policy or contain a link to it, regardless of the device used to access the Website or to use the services.

This document has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), and with Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

The data controller is NORTH POINT SOLUTION, S.L., of Calle Museu, 4, 08911 Badalona (Barcelona), Spain, telephone +34 902 02 70 91. Any query about the processing of your personal data, including any that should be handled by the data protection officer where one has been appointed, may be sent to [email protected].

Categories of personal data

The personal data that NORTH POINT may collect and process includes:

Contact information that allows us to communicate with you such as, for example, your name, position, title or form of address, age, user name, postal address, telephone numbers, email address or other addresses to which we may send you messages, information about your company or registration information that you have supplied on the Website.

In relation to the information collected through the Website, we inform you that the fields marked with an asterisk in the various data collection forms are mandatory. In the event that you do not provide the data requested through those fields, NORTH POINT may, at its sole discretion, not process the corresponding enquiry or service requested by the user.

At the moment of completing any form providing his or her personal data, the user guarantees the authenticity, accuracy and truthfulness of all the information provided, undertaking to keep up to date the personal data provided to us so that it corresponds, at all times, to his or her real situation. The user shall be solely responsible for false or inaccurate statements and for the damage that these may cause to NORTH POINT.

Information that allows us to maintain a commercial relationship with you, such as the types of products and services that may be of interest to you, your contact and language preferences, creditworthiness data, marketing preferences and demographic data.

Information about the way in which you interact with us, which includes purchases, enquiries, customer account data, order and contract data, delivery data, financial and billing data, tax data, the history of transactions and correspondence, and information about the way in which you use our website and interact with it.

Information relating to the installation, configuration and operation of the systems and events for which you request our services, as well as the data recorded in the course of such events.

Beyond the above, and only if you authorise it, browsing data on this site is processed — which pages you looked at, when, from what kind of device and from roughly what country — for the sole purpose of knowing which content is useful. The legal basis is your consent, Article 6(1)(a) GDPR, and you may withdraw it at any time from the foot of any page. The Cookie Policy explains it in detail.

Legal bases for the processing of the data

In accordance with Article 6(1) GDPR, the processing of your data rests, depending on the case, on one of these bases:

The performance of the contracts entered into with our clients and suppliers.

The legitimate interest of NORTH POINT, which arises from the conduct of its ordinary business activity.

Compliance with our legal obligations under the applicable legislation.

Consent, where this is mandatory and within the limits of the applicable law.

The protection of the vital interests of natural persons, where this is mandatory and within the limits of the applicable law.

Purposes of the data processing

The data collected by NORTH POINT has the following purposes:

To register your data in the requested service, to deal with your enquiries, claims or requests for information and to guarantee the fulfilment, maintenance, development, control and improvement of the relationships that you may, where applicable, maintain with NORTH POINT.

To serve your orders for products or services and the associated activities, which may include the delivery of the product or service, the provision of the customer service, accounting and billing administration, technical service and training, notifications about the security and updating of the products, support and technical assistance in relation to our products, as well as other services related to the purchase process.

To fulfil our contractual obligations and manage your relationship with us, which includes interacting with you, analysing and improving the products and services that we offer, informing you about our products or services, and about special offers and promotions.

To guarantee the security of our website www.irisneural.com, networks, systems and premises, as well as to protect ourselves against fraudulent activities.

To manage our business activity, which includes the processing of payments, accounting administration, product development, contract management, website administration, the delivery of orders, corporate governance, the performance of audits, the preparation of reports and regulatory compliance.

Additionally, and having first obtained your consent, whether at the time of the collection of your data or subsequently, NORTH POINT may use the information provided by you for any of the following purposes:

For the monitoring, assessment and analysis of our market, clients, products and services (including asking your opinion about our products and services and carrying out surveys among clients).

For carrying out segmentations of your data and creating profiles or “profiling”, in order to be able to send you personalised information about the products and services of NORTH POINT. Carrying out this processing could involve combining the information that we collect about you through the Website with data that you provide or have provided to us through other means or that is lawfully supplied to us by third parties.

For carrying out and managing prize draws, competitions, promotions or special offers.

In this way, depending on the consent given, we may send you such information using any of the following means:

Email;

Telephone;

Postal mail;

Any other equivalent means that we consider appropriate at any given time.

Recipients of the personal data

The recipients of the personal data collected by NORTH POINT may be:

Third parties: we may make use of other entities so that they provide services and perform functions on our behalf. In such a case, we may hand over personal data to those entities for the fulfilment of their obligations. Any activity of processing of the personal data will be specified in our instructions and will be carried out in accordance with the purposes for which the data was collected.

In compliance with the law: on account of legal requirements, we could also make personal data available to the public or judicial authorities, the national or local law enforcement agencies and other public institutions, which includes the institutions and courts of justice of the countries where your information is stored, which could be located outside your country of residence. Where the law permits it, we may disclose such data to third parties (including law firms and legal advisers) when this is necessary for the bringing, enforcement or defence of legal claims, or in order to exercise our rights and protect our property or the rights, the property or the safety of others, as well as in order to make possible the performance of external audits, regulatory compliance and corporate governance functions.

Mergers and acquisitions: in the event of a sale, merger, liquidation, dissolution or other similar proceeding, personal data may be transferred to the party that acquires all or part of the assets or securities of NORTH POINT or of its business units.

Affiliates: we could also transfer the aforementioned information to the affiliates of NORTH POINT or share it with them, in accordance with the applicable law.

International transfers

The data you send us through the contact form is not transferred outside the European Economic Area: neither the site’s hosting nor the mailbox that answers enquiries sends it to a third country or to an international organisation.

There is one exception, and only if you authorise it. If you accept the measurement of visits, Google may process your browsing data in the United States. That transfer relies on the European Commission’s adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, to which Google is certified. If you do not accept it, no international transfer takes place. The Cookie Policy sets out the detail.

Retention periods

We will retain your personal data for as long as is necessary to fulfil the purpose for which it was collected, normally the period of validity of any contractual relationship and any subsequent period required or permitted by the applicable legislation.

Specifically: the data in an enquiry sent through the contact form is kept for as long as is needed to deal with it and, thereafter, for the applicable statutory limitation periods, after which it is erased. The data of a contractual relationship is kept for as long as it lasts and, once it ends, blocked and available to courts, tribunals and public authorities for the limitation periods of tax, accounting and liability obligations.

Protection of the personal data

NORTH POINT undertakes to maintain the privacy of its clients and users, using legitimate procedures for the processing of the information and in accordance with the applicable laws on data protection.

In order to protect this personal data, NORTH POINT applies appropriate technical, physical and organisational measures, designed within what is reasonable to protect the personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, and any other unlawful form of processing thereof. Access to the personal data is restricted to the authorised recipients and only to the extent to which they need to know it.

Links

Our Website may contain links to third-party websites that are outside our control. We are not responsible for the security or the privacy of any information collected on third-party websites or other services. You must exercise the utmost caution and review the privacy policies applicable to the third-party websites that you use.

Your rights

You have the right to request access to your data, as well as the rectification or the updating of incorrect or out-of-date personal data by contacting us at the email address [email protected]. To the extent permitted by the applicable law, you may request the erasure of your personal data, restrict its processing insofar as it concerns you and object to its processing.

In addition, and on the terms set out in Articles 15 to 22 GDPR, you have the following rights:

Right of access: to know whether we process data concerning you and, if so, to obtain a copy and know what we use it for.

Right to rectification: to have inaccurate data corrected and incomplete data completed.

Right to erasure: to ask that your data be deleted once it is no longer needed for the purpose that justified it.

Right to restriction of processing: to ask that your data be kept but not used while a challenge is verified or an objection is resolved.

Right to data portability: to receive the data you have provided to us in a structured, commonly used, machine-readable format, and to transmit it to another controller where the processing is based on your consent or on a contract and is carried out by automated means.

Right to object: to object at any time to processing based on our legitimate interest and, without needing to give reasons, to processing for direct marketing purposes.

Right not to be subject to automated decisions: not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.

To exercise any of these rights it is enough to write to [email protected] stating which one you are exercising and enclosing a copy of your identity card or an equivalent document proving who you are. The request is free of charge and is answered within one month of receipt, extendable by a further two months where the complexity or the number of requests so requires, in which case you will be informed of the extension and of the reasons for it.

If you consider that the processing of your data does not comply with the regulations, or if you are not satisfied with our answer, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), which is the competent supervisory authority, or with the supervisory authority of your country of residence. You may do so directly, without having to complain to us first.

Consent and withdrawal of consent

By supplying us with your personal data, you understand and accept that we may collect, process and use such information as specified in this Privacy Statement. Where the applicable law requires it, we will request your explicit consent. If you do not accept the practices described in the Privacy Policy, you must not access the Website or use the Services. At any time you may object to the use of your personal data for direct marketing activities or withdraw, free of charge, any consent previously granted for a specific purpose. To do so, you must contact us at the email address [email protected] enclosing a copy of your national identity document or equivalent official document proving your identity.

Amendments to our privacy statement

NORTH POINT reserves the right to change, modify and update this Privacy Statement at any time.

Please consult it periodically in order to make sure that you are aware of the latest version. By accessing the website or using our services after we have made such a modification, you will be accepting the new practice(s) identified in the update.

Effective date of this Privacy Statement: 05 April 2023.