How we handle the personal data you send us, and the rights you have over it.
Last updated: 1 August 2026
Popcorn Therapeutics SL is a company incorporated in Spain, so this website is governed by the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and by Spanish Organic Law 3/2018 on data protection and digital rights (LOPDGDD).
We only process the data you give us yourself. We do not buy contact lists, we do not build behavioural profiles, and we do not take automated decisions about you.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering enquiries sent through the contact form or by email | Name, email address, company or institution, type of enquiry and the content of your message | Our legitimate interest in responding to whoever contacts us (Art. 6(1)(f) GDPR); pre-contractual steps where the enquiry concerns a possible collaboration (Art. 6(1)(b)) | Up to 2 years after the last contact |
| Investor relations and scientific or clinical partnerships | Professional contact details and the correspondence exchanged | Pre-contractual steps and legitimate interest (Art. 6(1)(b) and (f) GDPR) | For the duration of the relationship and the applicable limitation periods |
| Complying with legal obligations | Only what the relevant law requires | Legal obligation (Art. 6(1)(c) GDPR) | The period set by each law |
Please do not send us personal health data, patient information or identifiable clinical records through this website. It is not a secure channel for that, and we do not process patient data here. If you need to discuss clinical matters, write to us and we will agree an appropriate channel.
By clicking the send button on the contact form you accept this Privacy Policy and the processing of your data for the purpose of answering your enquiry. Providing that information is necessary: without it we cannot reply.
We do not sell or rent your data. The following providers act as processors on our behalf and may only use the data to deliver their service to us:
Where a provider processes data outside the European Economic Area, the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision. Public authorities may also access data where the law requires it.
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent you have given (without affecting the lawfulness of processing carried out beforehand).
To do so, write to info@popcorn-tx.com stating which right you wish to exercise. We will reply within one month.
If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with the supervisory authority of your country of residence.
We apply reasonable technical and organisational measures to protect your data against loss, misuse and unauthorised access. The website is served over an encrypted connection (HTTPS).
This website sets no cookies of its own and uses no analytics or advertising tools. There is no Google Analytics, no social media pixel and no tracking of any kind, which is why you will not see a cookie banner: there is nothing to consent to.
The third-party services listed in section 4 (Google Fonts and jsDelivr) receive your IP address so they can deliver fonts and scripts, but they do not set tracking cookies through this site. You can still block third-party content from your browser's privacy settings.
We may update this policy to reflect legal or operational changes. The version in force is always the one published on this page, with the update date shown above.