Data protection policy

THE MIND HUB COMPANY S.L., puts at your disposal the additional information concerning the processing of your personal data, as established by the regulations on the subject: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 (GDPR). In this sense and aligned with the privacy policy of THE MIND HUB COMPANY S.L. based on the model of information by layers or levels, below, we collect additional information (second level) where the basic information regarding the processing of data that you should know is presented in detail.

Data of the Responsible

Identity: THE MIND HUB COMPANY S.L., Address: Calle Aragón, 264 Attic, 08007, Barcelona (Spain) Data Protection Delegate: dpo@tmhsuite.com

Why do we process your personal data?

In THE MIND HUB COMPANY we process the information provided by the persons concerned in accordance with the following purposes:

a) To provide the services offered on the Web Site.

b) Sending the request to the client.

c) Advertising and commercial prospecting activities through different media and communication channels for our own products and services. We may offer you, by any of the following means: postal mail, email, SMS, telephone, mobile applications and/or in-person home visit, opinion surveys, distance selling offers, advertising, promotions and free samples of our services and/or products.

d) Advertising and commercial prospecting activities by different means and channels of communication of products and services of third parties from different sectors of activity, which may involve in some cases the communication of personal data of interested parties to such third party recipients. Thus we may send you, by any of the following means; postal mail, email, SMS, telephone, mobile applications, Internet and / or face-to-face visit at home, surveys, distance selling offers, advertising, promotions and free samples of services and / or products of other entities related to the sectors of activity of: education, training, sectorial events, financial and credit, insurance, home, health and pharmaceuticals, leisure, mass consumption, personal care, IT, electronics, telecommunications, water, energy and transport, tourism and travel, real estate, toys, textile, and products/services for animals and pets.

e) Segmentation tasks. Segmentation or profiling may be performed for the purpose of targeting editorial content and advertising to be sent. No automated decisions are made based on the profiles. Under no circumstances will the segmentation or profiling carried out by the Company have any legal or significant effects on the interested party.

f) Evaluate the quality of the services offered.

g) Appointment control and management actions.

h) Include opinions of the Users of the services they have received.

i) To attend your requests and queries related to the Portal.

How did we obtain your data?

The personal data processed by the Company are those that you can fill in at the time of registration of your requests, including the voice recording if you communicate with the Company by phone call and the data from the navigation of the Website. These data come directly from the interested parties through the channels provided by the Company (forms, e-mail, telephone, videoconference, instant messaging, among others).

How long do we keep your data?

Personal data will be kept for as long as you are a user and you do not request the limitation, opposition to the processing of your data or their deletion. If you have contracted any of the services offered on the website, your data will be kept for as long as the contractual relationship is in force, and once it is terminated, for the time necessary to comply with the legal obligations of the Company. Personal data will be kept to prove the management of the services and the exercise of your rights. Likewise, the Company periodically carries out an analysis of the data retention periods, deleting the data ex officio when it considers that the information has become obsolete or outdated.

What is the legal basis for the processing of your data?

The legal basis for the processing of your data is based on the consent given by the user, and the fulfillment of a contractual obligation if you have contracted any of the services of the website.

The prospective offer of own or third party products and services is based on consent, without in any case the withdrawal of consent for own or third party commercial prospecting conditions, if any, your status as a registered user. For the due execution of the services offered through this Web Site, the data of the client users may be communicated to the psychological centers, psychologists and/or independent psychotherapists previously registered at www.tmhsuite.com, who will have the condition of co-responsible for the treatment, and must assume all the obligations in force regarding data protection, In particular, by virtue of the principle of transparency, they must inform you when they establish the first contact with you, the identity and contact details, or, where appropriate, of their representative; the purposes of the processing for which the personal data are intended, as well as the legal basis of the processing; the categories of personal data they process; the recipients or categories of recipients of the personal data, in the event that they transfer data to third parties; the intention or not to transfer data to a third country, the period of conservation of personal data, your right to request the right of access, rectification, erasure, limitation, opposition, portability of the processing of your data, your right to request the right of access, rectification, erasure, limitation, opposition, portability of the processing of your data, providing a free way to exercise these rights; and your right to file a complaint with a supervisory authority.

THE MIND HUB COMPANY SL respects the confidentiality of the data of users and visitors, including their personal identity, and therefore has signed an agreement that duly reflects the respective roles and relationships in terms of data protection with the aforementioned psychological centers, psychologists and / or independent psychotherapists, and provides its commitment to respect the legal requirements of privacy of medical or health information according to the regulatory requirements where they are. The interested parties must obtain the response of their rights from all the responsible parties that process their data as a result of the use of the services available at www.tmhsuite.com.

Certain service providers will also have access. These suppliers may only access the data for the sole purpose of providing the contracted service, following the instructions of the Company and may not use it for any other purpose. All suppliers subscribe to confidentiality commitments in the use of the information to which they have access for their service in accordance with the regulations in force.

The communications described herein may result in international data transfers in countries with an adequate level of protection according to regulatory requirements. For further information, please contact dpo@tmhsuite.com. No other data transfers are foreseen, except those required by law or court order.

Call recording

As informed prior to the beginning of any conversation with the person in charge, the calls made by telephone and/or videoconference will be recorded in order to evaluate the quality of the services offered. In case the call is made by telephone, your name, voice and the place from where you made the call will be processed. In the case of a videoconference, in addition to the aforementioned data, your image will also be processed. The basis of legitimacy of the aforementioned data processing is the fulfillment of a contractual obligation, in the event that the user has contracted any of the services offered on the Website and the legitimate interest of the Company to assess the quality of its services. These data will not be transferred, except for the aforementioned. These data will be kept as long as the right of opposition, limitation or suppression has not been exercised, and for a period of time necessary to comply with the legal obligations of the Company.

Payment platform

In order to complete the payment through the Website's payment platform, the Customer User must provide certain information: name and surname of the payment card holder, card number, security code, expiration date of the payment card, and, if applicable, zip code.

THE MIND HUB COMPANY SL does not store the data described here, who will only have the date of the transaction, user who performs it, and amount thereof, which will go to psychological centers, psychologists and / or independent psychotherapists beneficiaries of the economic operation.

The data associated with the payment are processed and stored in a secure environment thanks to the services offered by "Stripe". If you need more information about this payment method, you can consult its conditions on https://stripe.com. These data may be sent to the banks involved in the financial transaction. All the data described here will be stored for as long as they are necessary to comply with the legal obligations arising from the economic transaction carried out.

What are your rights when you provide us with your data?

Any person has the right to request access to their personal data, its rectification or deletion, or the limitation of its processing, or to oppose to the processing, as well as the right to data portability. As well as the right to withdraw consent in any of its purposes. To do this you can send a letter to THE MIND HUB COMPANY S.L., address Calle Aragón, 264 Ático, 08007, Barcelona (Spain) or by sending an email to dpo@tmhsuite.com indicating the right you wish to exercise. The identity of the applicant must be proven, for example by attaching a photocopy of the ID card.

We also inform you that you have the right to file a complaint with the competent supervisory authority (Spanish Data Protection Agency), if you consider that there has been any kind of violation in relation to the processing of your personal data. In the event that the limitation of the processing of your data is requested, we will only keep them for the exercise or defense of claims and in cases of opposition, the data will no longer be processed, except for compelling legitimate reasons, or the exercise or defense of possible claims.

Social media and data protection

THE MIND HUB COMPANY SL participates in different social networks in order to advertise their services.

If a user has a profile on the same Social Network and has decided to join the page created by the company, or contact through any of the channels provided in the Social Network with the company, thus showing interest in the information that is advertised on the Network, we consider that you provide your consent for the processing of those personal data published in your profile.

The user should be aware that their publications will be known by other users, so he himself is primarily responsible for their privacy. The images that may be published on the page will not be stored in any information system of THE MIND HUB COMPANY SL, but will remain in the Social Network.

The USER can access at all times to the privacy policies of the Social Network itself, as well as configure their profile to ensure their privacy.

In relation to the rights of access, rectification, deletion, limitation and opposition, of which you have and that can be exercised before THE MIND HUB COMPANY SL in accordance with the LOPD, should take into account the following nuances:

- Access: will be defined by the functionality of the Social Network and the access capacity to the information of the users' profiles.

- Rectification: can only be satisfied in relation to information that is under the control of THE MIND HUB COMPANY SL, for example, delete comments posted on the page itself. Normally, this right must be exercised before the Social Network.

- Deletion, limitation and / or Opposition: as in the previous case, can only be satisfied in relation to information that is under the control of THE MIND HUB COMPANY SL, for example, stop being attached to the profile.

THE MIND HUB COMPANY SL will perform the following activities:

- Access to public profile information. - Send personal and individual messages through the Social Network channels. - Page status updates to be posted on the user's profile.

The user can always control his connections, delete content that is no longer of interest to him and restrict who he shares his connections with by accessing his privacy settings.

DATA PROCESSING ON BEHALF OF THIRD PARTIES

Due to the nature of the services provided in this web platform by THE MIND HUB COMPANY S.L, may require access and treatment by THE MIND HUB COMPANY S.L of information and personal data responsibility of the PROFESSIONAL USER. Under the provisions of the data protection regulations, this access will be considered for all purposes as an access to data on behalf of third parties and THE MIND HUB COMPANY S.L as PROCESSOR.

That, in compliance with the regulations in force on Personal Data Protection, both parties freely agree to regulate the access and processing of the aforementioned personal data, based on the following.

PROVISIONS

FIRST - Purpose: the processing of personal data that the USER makes available to THE MIND HUB COMPANY S.L. so that it can provide the contracted services.

SECOND - Duration: the term of this contract is established by virtue of the commercial agreement that has been formalized between both parties.

THIRD - Purpose of treatment: access by THE MIND HUB COMPANY SL to personal data that are in the processing systems of the CUSTOMER, will be solely and exclusively to comply with the purposes related to the purpose of this contract.

FOURTH - THE MIND HUB COMPANY S.L. may access the categories of data necessary to provide the service, given the purpose of the website and Saas software, THE MIND HUB COMPANY S.L. as responsible for carrying the maintenance of these platforms may access customer health data and identifying data.

FIFTH. - Obligations of the parties: the obligations of the Controller and Processor shall be set forth in the SIXTH and SEVENTH stipulations, without being considered co-responsible for the processing.

SIXTH - Obligations and rights of the Data Controller (THE USER): as established in the current regulations on Personal Data Protection, the Data Controller shall:

a) Apply appropriate technical and organizational measures in order to guarantee and demonstrate that the treatment complies with current legislation.
b) Adopt data protection policies.
c) Guarantee that the Data Protection Officer or, failing that, the Privacy Officer participates appropriately and in a timely manner in all issues related to the protection of personal data.
d) Keep a record of processing activities in the event of processing personal data that pose a risk to the rights and freedoms of the interested party and/or in a non-occasional manner, or that involves the processing of special categories of data and/or data relating to convictions and violations.
e) Make the essential aspects of this agreement available to interested parties.
f) Indiscriminately attend to the legal exercises established in the current regulations on the Protection of Personal Data and complying with the stipulations indicated in the EIGHTH stipulation, even if said exercise is directed to the Data Processor.

SEVENTH - Obligations and rights of the Data Processor: as established in the current regulations on Personal Data Protection, the Data Processor shall:

a) Process personal data only on the documented instructions of the controller, including with regard to transfers of personal data to a third country or an international organization, unless obliged to do so under Union or Member State law applicable to the processor; in such a case, the processor shall inform the controller of such a legal requirement prior to processing, unless such law prohibits it for important reasons of public interest.
b) Ensure that persons authorized to process personal data have undertaken to respect confidentiality or are subject to a statutory confidentiality obligation..
c) Take all appropriate technical and organizational measures to ensure a level of security appropriate to the risk of the processing.
d) Respect the conditions to resort to another Data Processor, as established in the current regulations on Personal Data Protection.
e) To assist the controller, taking into account the nature of the processing, through appropriate technical and organizational measures, whenever possible, to enable the controller to fulfill its obligation to respond to requests aimed at exercising the rights of data subjects.
f) Assist the controller in ensuring compliance with its obligations, taking into account the nature of the processing and the information at its disposal.
g) At the controller's option, delete or return all personal data upon termination of the provision of processing services, and delete existing copies unless the retention of personal data is required by Union or member state law.
h) Make available to the person in charge all information necessary to demonstrate compliance with the obligations set forth in this article, as well as to allow and contribute to the performance of audits, including inspections, by the person in charge or by another auditor authorized by said person in charge.
i) To treat the personal data made available to the Data Controller in a way that ensures that the personnel in charge of the Data Controller follows the instructions of the Data Controller.
j) Ensure that the Data Protection Officer or, failing that, the Privacy Officer is involved in an appropriate manner and in a timely manner in all matters relating to the protection of personal data.
k) Keep a record of processing activities in the event of processing personal data that poses a risk to the rights and freedoms of the data subject and/or on a non-occasional basis, or that involves the processing of special categories of data and/or data relating to convictions and offences.
l) To inform the Controller of the exercises of rights established in the regulations in force on Personal Data Protection of which it is aware, and complying with the stipulations indicated in the stipulation.

EIGHTH - THE CLIENT authorizes THE MIND HUB COMPANY S.L. to hire third parties to assist in the management of the services covered by the contract. THE MIND HUB COMPANY S.L. will sign with these third parties a contract with the obligations set out in this contract.

tmhsuite_dataprotect_third_parties_data_processing_stipulations9_txt

TENTH. - International Data Transfer: International Transfers of personal data may only be carried out if they comply with the requirements set forth by the Spanish Data Protection Agency, or any other national or community regulations that regulate them.

ELEVENTH. - Data security breach: as long as there is an instruction from the supervisory authority, a national legislative development regulating these communications or a delegated act, in the event of a personal data security breach, the Controller and/or the Processor shall notify the competent Supervisory Authority without undue delay and, if possible, no later than 24 hours after it has taken place.

TWELFTH. - Information TMH Suite Collects from Other Sources:

TMH Suite may also obtain information about you from other sources. For example, if you create or log into your TMH Suite account(s) through another service (such as the Google Identity Platform), TMH Suite will receive information from that service. This information may include your username, email address, profile picture URL, organization units, and user groups, as provided by the authorization procedures of that service. Additionally, TMH Suite accesses your calendar information to enhance your experience with our services. Specifically, we read your calendar list to allow you to choose which calendar you wish to sync with TMH Suite  . We use this information to identify your available times, ensuring that appointments are not scheduled during your busy hours. We also utilize this data to display and edit your calendar events, and to enable the automatic addition or deletion of appointments created in our app to your calendar.