Privacy Policy

  1. Data controller

Controller: ONA THERAPEUTICS, S.L.

Tax ID (NIF): B67371484

Address: Calle Baldiri Reixac 10, Parc Científic de Barcelona, 08028 Barcelona, Spain.

General email: info@ona-therapeutics.com

Contact for privacy matters and the exercise of rights: dp@ona-therapeutics.com

Website: www.ona-therapeutics.com

This Privacy Policy applies solely to the processing of personal data carried out through the website and its contact and browsing channels. It does not cover processing arising from clinical trials, research, employment relationships, professional relationships or other channels of ONA THERAPEUTICS, S.L., which have their own data protection information where applicable.

 

  1. Data we process through the website

Through the contact form and the email address provided on the website, we may process the data that users themselves provide, in particular:

  • Identification and contact data, such as name and email address.
  • Data relating to the reason for the enquiry, area of interest and content of the message.
  • Any other information that the user voluntarily includes in their communication.

In addition, while the user is browsing, we may process technical data that is strictly necessary for the operation and security of the site, as well as data derived from analytics cookies where the user has consented to them, in accordance with the Cookie Policy.

 

  1. Purposes and legal bases
  • Handling enquiries and requests

Data provided through the form or by email will be processed in order to receive, manage and respond to the user’s enquiry or request. The legal basis is the legitimate interest of ONA THERAPEUTICS, S.L. in responding to communications addressed to it (Article 6(1)(f) GDPR). Where the request is aimed at taking pre-contractual steps at the request of the data subject, Article 6(1)(b) GDPR may apply.

  • Security and proper operation of the website

Technical connection data or logs that are essential to prevent misuse, maintain the security of the site and resolve technical incidents may be processed. The legal basis is the legitimate interest of ONA THERAPEUTICS, S.L. in ensuring the security and proper operation of its systems (Article 6(1)(f) GDPR).

  • Analytics cookies

Where the user accepts analytics cookies, the data derived from these technologies will be processed to obtain browsing statistics and improve the website. The legal basis will be the user’s consent (Article 6(1)(a) GDPR and Article 22.2 LSSI).

  • Informational communications by electronic means

Where the user expressly authorises it by ticking the checkbox provided for that purpose, ONA THERAPEUTICS, S.L. may use their email address to send them information about its news, projects, activities and services.

The legal basis for this processing is the data subject’s consent, in accordance with Article 6(1)(a) GDPR and Article 21 LSSI. Authorising the receipt of these communications is voluntary and is not a condition for handling the enquiry submitted through the website.

The user may withdraw their consent at any time by using the unsubscribe link included in each communication or by writing to dp@ona-therapeutics.com, without this affecting the lawfulness of processing carried out prior to withdrawal.

 

  1. Retention periods

Data relating to enquiries will be kept for as long as necessary to handle and close the request. Thereafter, it may be retained, appropriately restricted, for the applicable limitation periods in order to address any liabilities arising from the relationship or communication.

If the user has consented to receiving informational communications, their data will be kept until they withdraw their consent or unsubscribe, without prejudice to the minimum retention necessary to evidence the unsubscription and compliance with legal obligations.

Data associated with cookies will be kept for the periods indicated in the Cookie Policy and, in any event, in accordance with the technical configuration actually implemented.

 

  1. Recipients and data processors

Data will not be disclosed to third parties except where required by law. However, providers that supply ONA THERAPEUTICS, S.L. with services necessary for the operation of the website and its information systems may have access to the data, acting as data processors where appropriate.

These providers include web maintenance and technology support providers. The corporate email and other cloud services used by ONA THERAPEUTICS, S.L. are provided through Microsoft 365.

Providers that access personal data on behalf of ONA THERAPEUTICS, S.L. will be subject to the corresponding contractual confidentiality, security and data protection obligations.

Web hosting: ONA THERAPEUTICS, S.L. uses the services of Bluehost, part of the Newfold Digital group, to host and operate its website. In the course of these services, the provider may access certain technical browsing data and, where applicable, information transmitted through the website, acting as a data processor.

 

  1. International data transfers

ONA THERAPEUTICS, S.L. uses Microsoft 365 for its corporate email and other cloud services. Microsoft Corporation participates in the EU-U.S. Data Privacy Framework and its terms applicable to business services also incorporate Standard Contractual Clauses and additional safeguards for any processing or international transfers not covered by that framework.

With regard to analytics cookies, the website currently provides for the use of Google Analytics. Its actual use and configuration must be confirmed through the technical cookie review. If it remains active, it will only be used with the user’s prior consent, and the associated international transfers will be carried out in accordance with the safeguards set out in the Cookie Policy.

Some of the technology providers used by ONA THERAPEUTICS, S.L. may involve the processing of data outside the European Economic Area. In particular, the website is hosted by Bluehost / Newfold Digital, Inc., in the United States. International transfers associated with this service are carried out on the basis of the Standard Contractual Clauses approved by the European Commission, incorporated into the provider’s data processing terms, in accordance with Article 46 GDPR.

Further information on the safeguards applicable to international transfers can be requested from dp@ona-therapeutics.com.

 

  1. Data subjects’ rights

Where applicable, the user may request ONA THERAPEUTICS, S.L. to exercise the rights of access, rectification, erasure, objection, restriction of processing and data portability. In addition, where processing is based on consent, the user may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

These rights may be exercised by writing to:

  • ONA THERAPEUTICS, S.L., Calle Baldiri Reixac 10, Parc Científic de Barcelona, 08028 Barcelona, Spain.
  • Email: dp@ona-therapeutics.com.

Where necessary to verify the identity of the requester, ONA THERAPEUTICS, S.L. may request additional information that is appropriate and proportionate.

If you consider that the processing of your data does not comply with the applicable legislation, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD): www.aepd.es

 

  1. Special categories of data and content of enquiries

The website’s general contact form is not designed to collect special categories of personal data. Users are asked not to send through this channel any information concerning health, genetic data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, or any other particularly sensitive information that is not necessary for the enquiry.

Information relating to clinical trials, biomedical research or patient data is handled through specific channels and in accordance with the corresponding data protection documentation, not through the website’s general contact form.

 

  1. Minors

The website is not specifically aimed at children under the age of 14. Children under that age should not submit personal data through the contact form without the involvement or authorisation of the person holding parental authority or guardianship, where this is legally required.

 

  1. Automated decision-making

Data collected through the website’s channels is not used for automated individual decision-making or for profiling that produces legal effects concerning the user or similarly significantly affects them.

 

  1. Security

ONA THERAPEUTICS, S.L. applies appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss or alteration, unauthorised disclosure or access, and any other form of unauthorised processing, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to the rights and freedoms of individuals.

  1. Updates to the Privacy Policy

ONA THERAPEUTICS, S.L. may update this Privacy Policy to reflect regulatory or technical changes or changes in the processing carried out through the website.

Date of publication: 28 September 2026