Personal Data Protection Information - General Meeting of Shareholders
1. Data Controller
The controller responsible for processing personal data is ORYZON GENOMICS, S.A. (hereinafter, “Oryzon”), with Tax Identification Number A-62291919 and registered office at Carrera de San Jerónimo, 15, 2nd floor, 28014 Madrid, Spain.
You may contact Oryzon's Data Protection Officer at [email protected].
2. Purposes of Processing and Legal Bases
Oryzon will process the personal data of shareholders and, where applicable, their representatives and gift recipients for the following purposes:
a) Managing participation in the General Meeting of Shareholders
To identify shareholders and verify their shareholder status, manage the exercise or delegation of voting rights, verify representation, and carry out the activities necessary to organise, hold and document the General Meeting.
The legal basis for this processing is compliance with the legal obligations applicable to Oryzon under corporate law, pursuant to Article 6(1)(c) of Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”).
b) Managing gift delivery
To verify compliance with the eligibility requirements established for receiving the gift offered in connection with the General Meeting, organise its preparation, dispatch and delivery, handle any delivery-related incidents, and prevent duplicate or improper deliveries.
The legal basis for this processing is Oryzon's legitimate interest in properly managing the delivery of gifts requested by shareholders and ensuring compliance with the applicable eligibility conditions, pursuant to Article 6(1)(f) GDPR.
Requesting the gift is voluntary and does not affect the exercise of shareholders' corporate rights.
Personal data provided for gift delivery will not be used for unrelated commercial purposes.
3. Categories of Personal Data Processed
Depending on the activities involved, the following categories of personal data may be processed:
- Shareholder and representative identification data: name and surname, identification document details and, where necessary, information relating to shareholder status and representation.
- Data relating to participation in the General Meeting: exercise or delegation of voting rights, supporting documentation and records necessary for their management.
- Data required for gift delivery: recipient's name and surname, postal address, contact telephone number, email address where provided, and any instructions necessary to complete the delivery.
- Delivery management data: information relating to preparation, tracking, delivery and any incidents that may arise.
No special categories of personal data will be requested for these purposes.
4. Sources of Personal Data
Personal data may be obtained directly from shareholders or their representatives, as well as from the documentation and records necessary to verify share ownership, representation and participation in the General Meeting.
Where a shareholder designates a person other than themselves as the gift recipient, that person's identification and contact details will be provided by the shareholder solely for the purpose of arranging delivery.Personal data may also be obtained from financial institutions or intermediaries through which shareholders hold their shares, via the entities legally authorised to maintain securities registers, including Iberclear, where applicable.
5. Mandatory and Voluntary Provision of Data
The provision of data necessary to manage voting rights or their delegation is subject to the applicable requirements governing the exercise of those corporate rights.
Requesting the gift is voluntary. However, the identification and contact details strictly necessary for delivery must be provided in order to receive it.
Failure to provide these details may prevent delivery of the gift but will not affect the shareholder's right to participate in the General Meeting.
6. Recipients of Personal Data
Personal data may be disclosed to competent authorities, bodies or other legally authorised third parties where necessary to comply with applicable corporate or other legal obligations.
In addition, the personal data strictly necessary for gift delivery may be provided to transport, courier or logistics companies involved in preparing and delivering the gift.
Service providers acting on behalf of Oryzon may also access personal data, subject to the applicable contractual data protection obligations.
Personal data will not be disclosed for commercial purposes unrelated to those described above.
Personal data may also be disclosed to the notary public attending the General Meeting, where applicable, and to persons or entities legally entitled to access the relevant corporate information.
7. International Data Transfers
As a general rule, no international transfers of personal data are envisaged for these purposes.
If a transfer of personal data outside the European Economic Area becomes necessary due to the destination country of a delivery or the involvement of service providers, Oryzon will ensure compliance with the requirements of Articles 44 et seq. GDPR and, where applicable, provide information on the relevant safeguards.
8. Data Retention Periods
Personal data relating to shareholder status, participation in the General Meeting and the exercise or delegation of voting rights will be retained for the periods necessary to comply with Oryzon's applicable corporate law obligations and to address any potential liabilities arising from such compliance.
Personal data specifically provided for gift delivery will be retained for the period necessary to arrange and verify delivery and resolve any related incidents.
Once these activities have been completed, data that are no longer necessary will be deleted, without prejudice to the retention of any data required during applicable statutory limitation periods to address potential liabilities or claims, subject to appropriate restrictions on processing where required.
9. Data Subject Rights
Data subjects may exercise the following rights, subject to the conditions established by applicable law:
- Access to their personal data.
- Rectification of inaccurate or incomplete personal data.
- Erasure of their personal data where the applicable legal conditions are met.
- Objection to processing, particularly where processing is based on Oryzon's legitimate interests.
- Restriction of processing in the circumstances provided for by law.
- Data portability, where applicable.
To exercise these rights, data subjects may contact Oryzon's Data Protection Officer by email at [email protected] or by post at the registered office indicated above.
Where Oryzon has reasonable doubts concerning the identity of the person submitting a request, it may request only such additional information as is strictly necessary to verify their identity.
Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) through its website at www.aepd.es if they believe that the processing of their personal data infringes applicable data protection legislation.
10. Automated Individual Decision-Making
Oryzon does not envisage making decisions based solely on automated processing, including profiling, that produce legal effects concerning data subjects or similarly significantly affect them.
11. Information Concerning Gift Recipients Other Than Shareholders
Where a gift is to be delivered to a person other than the shareholder, Oryzon will process the identification and contact details provided by the shareholder solely for the purpose of arranging and completing delivery.
The source of such personal data will be the shareholder who requested delivery to that person.
The information provided on this page also applies to those recipients, without prejudice to Oryzon's obligation to comply with the information requirements set out in Article 14 GDPR.