THE FLAG PHARMACEUTICALS, S.L. is committed to ensuring that your personal information is protected and not misused.

In this document we explain who is responsible for processing and for what purpose your personal data will be processed, the legitimacy of the processing, how we collect it, why we collect it, how we use it, what your rights are, and explain the processes that we have set up to protect your privacy.

By providing us with your personal data and using our websites, we understand that you have read and understood the terms relating to the personal data protection information set out. THE FLAG PHARMACEUTICALS, S.L. assumes responsibility for complying with current national and European data protection legislation, and we aim to treat your data in a lawful, fair and transparent manner.


All the information in this document is applied to THE FLAG PHARMACEUTICALS, S.L.



The definition of Data Controller is described in the General Data Protection Regulation, and is as follows:


The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. THE FLAG PHARMACEUTICALS, S.L. is responsible for processing of the personal data of their customers. If you have any questions, comments or concerns, or if you would like to make a suggestion about how we use personal information, you can send an email to THE FLAG PHARMACEUTICALS, S.L. Data Protection Officer, at the following email address admin@theflagpharma.com


Innovation and exclusivity are the hallmarks of THE FLAG PHARMACEUTICALS, S.L., seeking excellence in all our activities. This drives us to the development and offering of innovative, high quality nutraceutical products into the market, aimed at improving the lives of our customers.


Address: Ronda General Mitre, 126 6th floor 08021 BARCELONA
E-mail: admin@theflagpharma.com
Telephone number: 93 50019 01
Tax number: B87544649
N.I.F: B87544649
Registro Mercantil de Madrid, Tomo 34908, Folio 140, Sección 8ª, Hoja núm. M-627788, inscripción 1ª.
Webpage address: theflagpharma.com


The main reason we collect your personal data is to facilitate and improve the service which you as a customer expect from us. Below are the main purposes for which your data will be used:

  • Channel requests for information, suggestions and customer complaints for their management and resolution.
  • Conduct profiles and analyses of our customers’ behavior regarding the use of the site.


We collect personal data about you by different means; in some cases, you will contact us to share your personal data, or it will be obtained by your behavior while using our website. Here are the different ways we collect personal data about you and some examples of how we use such information.


We collect personal data that you provide to us when you contact us through a web form or browse the website. In each case, at the time of collection you will be informed by the Data Controller the purpose of the processing, the recipients of the information, as well as how to exercise the rights granted to you by the current legislation on data protection. Generally, the personal information you provide to us is: first and last name, email and contact phone number.


We collect and store limited personal information and anonymous aggregate statistics from all users who visit our websites, either because you actively provide such information to us or are simply browsing our websites. The information we collect includes the Internet Protocol (IP) address of the device you are using, the browsing program you use, your operating system, the date and time of access, the Internet address of the website by which you accessed our websites and also information about how you use our websites. We use this information to know the loading time of our websites, how they are used, the number of visits to the different sections and the type of information that attracts visitors the most. It also helps identify if the website works properly, and, if we detect malfunctions or errors in the operation, to fix them and improve the performance of our websites, in order to offer a better service to all users. This information is collected through cookies; for more information see the cookies policy which is located on the website.


The use of social networks is becoming more frequent and, as the THE FLAG PHARMACEUTICALS, S.L. is present on most of them, it is another way to contact you. The data we collect through social media sometimes includes personal data that is available online and to the public. We always make sure that all the data we use is attributed to your source correctly or anonymously. These social networks are likely to have their own privacy policies, which explain how they use and share your personal data. We encourage you to carefully review privacy policies before using these social networks to ensure that you are happy with the way your personal data is collected and shared.


For the processing of your personal information we rely on the legal requirements for several reasons:

  • For the fulfillment of a contract and/or commercial relationship.
  • For the fulfillment of different legal obligations.
  • For legitimate interests, for example, for security reasons, fraud prevention, to improve our services and products through market research, or to manage requests, inquiries or possible claims that may arise.


If you have given us your consent, the information you provide us will be communicated to THE FLAG PHARMACEUTICALS, S.L. , to be treated for the purposes described above. Not all the purposes described involve a transfer of data, in particular, considering that the data is collected directly by the website. In some cases, we may need to communicate the information you have provided to us to third parties for the purpose described above. In addition, there are companies that provide us with other types of services such as: information technology (storage and processing of information), security services, financial services, auditing services, etc. These third parties only have access to the personal data they need to perform such services. They are required to keep your personal data confidential and cannot use it in any way other than how we have requested it from you. In all cases, THE FLAG PHARMACEUTICALS, S.L assumes responsibility for the personal data you provide to us, and we ask those companies with which we share your personal data to apply the same degree of data protection as we do. In addition, your personal data will be available to Public Administrations, Judges and the Courts, for the attention of the possible responsibilities arising from their treatment.


In the event that we provide links to websites that are not operated or controlled by THE FLAG PHARMACEUTICALS, S.L. , you will be promptly informed by THE FLAG PHARMACEUTICALS, S.L. that they have no control over such sites, nor are they responsible for the content of such sites, nor do they have control over how third parties collect and use your personal data, nor are they responsible or provide any declarations about third-party websites. These websites may have their own privacy policies, explaining how they use and share your personal data. We encourage you to carefully review privacy policies before using these websites to ensure that you are satisfied with the way your personal data is collected and shared.


We only store your personal data to the extent that we need it, in order to be able to use it for the purpose for which it was collected, and according to the legal basis of the processing thereof in accordance with applicable law. We will keep your personal data for as long as there is a contractual and/or commercial relationship with you, or as long as you do not exercise your right of deletion and/or limitation of the processing of your data. In these cases, we will keep the information duly blocked, without use, as long as it may be necessary for the exercise or defence of claims or any type of judicial, legal or contractual responsibility that may arise from its treatment which must be attended, and for which its recovery is necessary.


Data protection regulations allow you to exercise before the Data Controller your rights of access, rectification, opposition, deletion, limitation of processing, portability, and not be subject to individualised decisions. These rights are characterised as the following:

  • Their exercise is free.
  • If the requests are manifestly unfounded or excessive (e.g. repetitive) the Data Controller may:
  • Charge a fee proportional to the administrative costs borne.
  • Refuse to act.
  • Requests must be answered within one month, although, considering the complexity and number of requests, the period may be extended by another two months.
  • The Data Controller is obliged to inform you about the means to exercise these rights. These means must be accessible, and this right cannot be denied merely because it elects another means.
  • If the application is submitted by electronic means, the information will be provided by these means when possible, unless the interested party requests that it be otherwise.
  • If the Data Controller does not submit the request, they shall make known no later than one month the reasons for their non-action and the possibility of issuing a complaint to a Supervisory Authority.
  • You can exercise your rights directly or through your legal representative.
  • It is possible that the person in charge is the one who attends your request on behalf of the Person Responsible if both have established it in a contract or binding legal act.


The right of access states that you can confirm from the Data Controller whether or not they are processing your personal data.


The right of rectification states that you can obtain the rectification of your personal data which are inaccurate, without undue delay of the controller. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing an additional statement. In your request you must indicate what data you are referring to and the correction to be made. In addition, when necessary, you must accompany your request with documentation that justifies the inaccuracy or incompleteness of your data.

The right to object, as the name implies, states that it may exclude the Data Controller from processing personal data in the following cases:
  • When they are subject to treatment based on a mission of public interest or legitimate interest, including profiling.
  • Where the purpose of the processing is direct marketing, which includes the profiling mentioned above.

The right to erasure may be exercised before the Data Controller to request the erasure of personal data when any of the following circumstances occur:

  • If your personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
  • If the processing of your personal data has been based on the consent you have given to the Data Controller, and you withdraw it, provided that the aforementioned processing is not based on any other legitimate cause.
  • The processing was based on the legitimate interest or the fulfillment of a mission in the public interest, and no other reasons have prevailed to legitimise the processing of your data.
  • To have your personal data subject to direct marketing, including profiling related to the aforementioned marketing.
  • If your personal data has been unlawfully processed. However, this right is not unlimited, so it may be feasible not to proceed with the deletion where the processing is necessary for the exercise of freedom of expression and information, for the fulfilment of a legal obligation, for the fulfilment of a mission carried out in the public interest or in the exercise of public powers conferred on the Data Controller, for reasons of public interest, in the field of public health, for public interest filing purposes, scientific or historical research purposes or statistical purposes, or for the formulation, exercise or defence of claims.

The Data Controller shall be obliged to block the data when rectifying or deleting it. The blocking of data consists in the identification and reservation of the same, adopting technical and organisational measures to prevent its processing, including its visualisation, except for making the data available to Judge and the Courts, the Public Prosecutor's Office or the competent public administrations, in particular the data protection authorities, for the requirement of possible responsibilities arising from processing, and only for the limitation period thereof. After this period, the data must be destroyed.


This new right is to obtain the limitation of the processing of your data carried out by the Data Controller, although its exercise has two aspects: You can request the suspension of the processing of your data:

  • When you challenge the accuracy of your personal data, for a period that allows the controller to verify it.
  • When you have objected to the processing of your personal data which the Data Controller carries out on the basis of the legitimate interest or mission in the public interest, while the controller verifies whether these reasons prevail over yours. Ask the Data Controller to keep your data:
  • When the processing is unlawful, and you have opposed the deletion of your data and instead request the restriction of its use.
  • When the Data controller no longer needs the personal data for the purposes of processing, but the data subject needs them for the formulation, exercise or defence of claims.


The purpose of this new right is to further strengthen the control of your personal data, so that when the processing is carried out by automated means, you receive your personal data in a structured, commonly used, mechanical and interoperable format, and can transmit it to another Data Controller, provided that the processing is legitimised on the basis of consent or in the context of the execution of a contract. However, this right, by its very nature, cannot be applied where the processing is necessary for the fulfilment of a mission in the public interest or in the exercise of public powers conferred on the Person Responsible.

You can contact us in order to learn more or exercise any of your rights by sending an email to this address: admin@theflagpharma.com


THE FLAG PHARMACEUTICALS, S.L. makes available the following means to exercise your rights:

  • By written and signed request addressed to THE FLAG PHARMACEUTICALS, S.L., and attaching a photocopy of the ID or documentation proving the identity of the applicant.
  • Sending a completed and signed form along with a photocopy and/or scanned copy of the ID or documentation proving the identity of the applicant to this email address admin@theflagpharma.com
  • Calling the Customer Service phone number in Spain: (34) 93.500.19.01

You can file a complaint with the Spanish Data Protection Agency, in particular when you are not satisfied with the response to the exercise of your rights. For more details, you can consult the website www.agpd.es


We are committed to protecting your personal data. We use appropriate technical and organisational measures to protect your personal data and privacy and review such measures from time to time. We protect your personal data by using a combination of physical, computer or logical security controls, including access controls that restrict and manage how your personal information and personal data are processed, administered and managed. We also ensure that our employees are properly trained to protect your personal data. Our procedures indicate that we may ask you for proof of identity before sharing your personal data with you.


The website of THE FLAG PHARMACEUTICALS, S.L., applications and products are not normally intended for minors, and therefore, we do not knowingly collect any personal data from minors, unless with the permission of a parent or guardian. If you are a minor, please do not attempt to register as a user on our website, apps or products. If we discover that we have mistakenly obtained personal data from a minor, we will delete such information as soon as possible.

This data protection information was last revised and updated in September 2020.