Privacy Policy
Last updated: 26 October 2026
1. Who is responsible for your data
- Controller
- Vigintake, S.L.
- NIF
- B22502371
- Registered office
- Av. de les Marines 52, 3r 1a, 08195 Sant Cugat del Vallès (Barcelona), Spain
- Contact
- contact@vigintake.com
- Data Protection Officer
- dpo@vigintake.com
This policy explains how we process personal data on this website (vigintake.com), in our relations with customers, prospects and suppliers, and in the Vigintake platform. It is written in line with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
2. What we process, why, on what legal basis and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering contact requests and booking calls (email, or the scheduling page on Cal.com) | Name, business email, company, phone if you give it, your message, date and time of the meeting | Steps taken at your request before entering into a contract (Art. 6.1.b GDPR) and our legitimate interest in answering business enquiries (Art. 6.1.f GDPR) | While we handle your request, then up to 2 years from our last contact, unless a contract follows |
| Website analytics, only if you accept analytics cookies | Online identifiers, pages visited, device and browser data, approximate location | Your consent (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE), which you can withdraw at any time | Cookie durations listed in our Cookie Policy; analytics data no longer than 14 months |
| Managing customers, prospects and suppliers | Name, job title, business contact details, contract, billing and payment data | Performance of the contract (Art. 6.1.b GDPR), legal accounting and tax obligations (Art. 6.1.c GDPR) and legitimate interest in B2B communication (Art. 6.1.f GDPR) | Duration of the relationship, then 6 years (Art. 30 Spanish Commercial Code) or the applicable tax limitation period |
| Platform user accounts | Name, business email, role, organisation, login records and audit trail entries | Performance of the contract with your organisation (Art. 6.1.b GDPR) and legitimate interest in the security and traceability of the system (Art. 6.1.f GDPR) | Duration of the contract; audit trail records for the period agreed with the customer under GxP requirements |
| Pharmacovigilance data processed for our customers | See section 3. | ||
3. Pharmacovigilance data in the Vigintake platform
Our role. When we screen literature and process safety cases in the platform, we act as a processor (Art. 28 GDPR) for our customers, pharmaceutical companies that hold marketing authorisations. The customer is the controller and we follow its documented instructions under a data processing agreement.
Sources. Published scientific and medical literature, currently retrieved from PubMed (MEDLINE, U.S. National Library of Medicine), and documents that the customer gives us. We do not collect data from social media. If we add a new source, we will update this policy before using it.
Data. Published articles may describe patients (usually without direct identifiers) and include health data such as age, sex, medical history, medicines and adverse reactions, as well as the names of authors and reporting healthcare professionals.
Purpose. To help customers meet their pharmacovigilance obligations: screening literature for suspected adverse reactions, case intake and drafting of case narratives. AI-assisted outputs are always reviewed and approved by qualified people. No decision with legal or similar effects on individuals is taken solely by automated means.
Legal basis (of the customer as controller). Compliance with a legal obligation (Art. 6.1.c GDPR) under EU and Spanish pharmacovigilance law, including Directive 2001/83/EC, Regulation (EC) 726/2004, Implementing Regulation (EU) 520/2012 and Royal Decree 577/2013. Health data are processed for reasons of public interest in the area of public health, to ensure high standards of quality and safety of medicinal products (Art. 9.2.i GDPR, in connection with Art. 9.2 LOPDGDD).
Retention. As instructed by the customer under the contract and the applicable pharmacovigilance rules. When the contract ends, we delete or return the data as set out in the data processing agreement.
Your rights. Requests about these data should go to the pharmaceutical company concerned. If we receive one, we forward it to that customer without delay and assist it in replying.
4. Who receives your data
We do not sell personal data. We share it only with:
- Service providers acting as processors, under contracts that meet Art. 28 GDPR: Google Cloud Platform and Firebase (hosting, EU), Microsoft (email and office tools, EU), Cal.com, Inc. (meeting scheduling, USA) and, only if you accept analytics cookies, Google Analytics and PostHog (EU Cloud). Other technology providers that support the platform are listed in the data processing agreement we sign with each customer.
- Our customers, for the pharmacovigilance data we process on their behalf.
- Professional advisers (accounting, legal, audit), banks, and public authorities and courts when the law requires it.
5. International transfers
Some providers (Cal.com and, for analytics, Google) may process data in the United States. These transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the provider is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards at dpo@vigintake.com.
6. Your rights
You can ask for access to your data, rectification, erasure, restriction of processing, portability, and you can object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw it at any time; for cookies, use the "Cookie preferences" link at the bottom of every page. You also have the right not to be subject to decisions based solely on automated processing.
Write to dpo@vigintake.com or to our registered office, reference "Data protection". We may ask you to prove your identity. We reply within one month.
If you are not satisfied with our answer, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
7. Security
Personal data are stored in Google Cloud Platform data centres in the European Union (Belgium). We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access control and audit trails.
8. Changes to this policy
We will publish any change on this page with a new date. If a change is significant, we will tell customers and platform users directly.