PRIVACY AND PERSONAL DATA PROTECTION POLICY
Pharma Mar, S.A. processes personal data in order to develop its main activities in the pharmaceutical sector.
Management of Pharma Mar, S.A. is firmly committed to ensuring compliance with data protection legislation and thus to ensuring legal rights and the proper management of personal data.
With this objective, Pharma Mar, S.A. has adopted the principle of ‘proactive responsibility’ (“accountability”), providing itself with a management system that guarantees:
- the lawfulness of the data, establishing an appropriate purpose for the processes for which they are collected, in order to comply with the lawful objectives of Pharma Mar, S.A.
- collect the data strictly necessary, informing the data subjects in accordance with the law. Depending on the method of collection, the data that will be collected through the corresponding forms, will only contain the essential fields to be able to carry out its treatment according to the purpose informed to the holder of the data.
- the exercise of the legal rights of the interested parties.
- the confidentiality of personal data throughout the processing process and compliance with the obligation of secrecy with regard to personal data.
As part of this system, we make available to you the common elements for all processing of personal data processed by Pharma Mar, S.A., as Data Controller:
Who is responsible for processing your data?
PHARMA MAR, S.A., CIF: A-78267176,
Postal address: Avda. De los Reyes, 1, 28770 – Colmenar Viejo (Madrid), Spain
(Hereinafter Pharma Mar)
Data Protection Officer Contact: firstname.lastname@example.org
What measures has Pharma Mar taken to ensure the security of your data?
Pharma Mar has taken the following measures to ensure that data protection is respected from the outset:
- Appoint a Responsible for Data Protection.
- Establish appropriate safety principles.
- Review the documentation requirements necessary to comply with the Regulations.
- Applying the risk-based approach by analysing and assessing the risks to individuals inherent in the data processing carried out by Pharma Mar
- To ensure the implementation and maintenance of sufficient technical and organisational measures for the protection of personal data in its own organisation, facilities and information systems, in accordance with the regulations in force at any given time, arising from risk analysis, in order to guarantee confidentiality in the storage and processing of personal data, as well as to prevent access by unauthorised third parties and their alteration, loss, unauthorised processing.
- Ensure that the disclosure or transmission of the personal data described for each processing of personal data to any third party is subject to the policies of PharmaMar, which will have guaranteed an adequate level of data protection according to the agreements or any other means required by law.
How did we obtain your data?
- From the owner of the data
- From a third party.
In the first case, when you provide us with your personal data, you guarantee that you are authorized to provide this information and that the information is true, truthful, exact and updated, that it is not confidential, that it does not violate any contractual restrictions or rights of third parties and you undertake not to impersonate other users by using their registration data to the different services and/or contents of the website.
You are responsible for keeping your information correct and up to date and for communicating any changes that affect it. Consequently, PharmaMar shall not be held liable for any liability arising from the breach by the data subject of this guarantee, and the data subject shall be liable to PharmaMar and third parties for any damages caused as a result of the breach of the obligations assumed in this clause.
In the second case, that it is not the interested party himself but a third party who provides us with data about him (for example, public or private entities or collaborators with whom we have reached agreements or collaboration agreements), it is the third party who expressly guarantees that he has the authorization of the interested party for this contribution, exonerating us of any responsibility in the event of any claim by the interested party, responsibility which is assumed solely and exclusively by the person who has communicated the data to us on behalf of or in the interest of the latter.
Why and for what purpose do we treat your personal data?
At the time of data collection, Pharma Mar will inform you of the purposes of the processing and the legal basis for the processing. Below, we inform you about the treatments and their main purposes that Pharma Mar currently carries out:
|Treatment||Purpose||Legal grounds for data processing|
|Subscription to the newsletter via the Pharma Mar website||Provision of electronic communications services||Consent if you have subscribed to our newsletter|
|Contact and questions||Answering queries||Consent by giving your contact, using the contact form or formulating the query.|
|Contacts and email addresses||Maintain communication via e-mail for work / commercial reasons, provided it is related to the work, commercial or commercial relationship.||Contractual relationship and Pharma Mar’s legitimate interest in continuing to maintain the relationship and information, provided that it is related to the employment, commercial or commercial relationship.|
|Clinical trials||Epidemiological Research and Similar Activities , Real Decreto 1090/2015, of 4 December, regulating clinical trials on medicines, the Ethics Committees for Research on Medicines and the Spanish Register of Clinical Studies||Patient consent and compliance with Real Decreto 1090/2015 of 4 December 2015|
|Pharmacovigilance,||Epidemiological Research and Similar Activities, Real Decreto 577/2013, of 26 July, regulating the pharmacovigilance of medicines for human use.||Patient consent and compliance and Real Decreto 577/2013, of 26 July.|
|Treatment of Clinical Trial Staff||Verification of the qualifications of the personnel participating in the Clinical Trial: investigators, staff of the sites (“investigator’s team”) where the clinical trials are conducted, as well as of any person who performs an activity in the trial (“CRO”, “Monitors”) and other providers to whom an activity is subcontracted.||Existing pre-contractual-contractual relationship, compliance with Royal Decree 1090/2015 on Clinical Trials and the legitimate interest to verify their adequate qualification.|
|CRM||Monitoring of the company’s promotional activities||Consent|
|Value Transfer to medical and healthcare professionals and organizations||Code of Ethics of Farmaindustria||Consent and Legitimate Interest of Pharma Mar|
|Medical Information System for Healthcare Professionals||Responding to the request for information from the health professional||Legitimate interest of the company to ensure adequate information to the consumer/health professional and safety in the use of medicines.|
|Supplier management||Manage the commercial relationship, administrative, accounting and fiscal management, as well as the control of the contracted service(s) and the maintenance of contact.||Existing pre-contractual-contractual relationship|
|PRL and CAE management of suppliers||Control of compliance with current legislation on the prevention of occupational risks for external personnel carrying out work at PharmaMar facilities.||Execution of the contract for the provision of services and compliance with the legal obligations regarding Risk Prevention (“PRL”) and Coordination of business activities (“CAE”).|
|RRHH Recruitment||Attend to your professional offer and carry out the selection process||Consent|
|Treatment of Inventors and Patents||Registration of the patent||Consent|
|Judicial and extrajudicial proceedings||Management of judicial and extrajudicial labour and commercial procedures||Fulfillment of a legal obligation.|
|Management of general meetings of shareholders||Managing the development, compliance and control of the existing shareholder relationship, in compliance with legal obligations||Compliance with the legal obligations of the Capital Companies Act|
|Human Resources Management||The main purpose is to maintain and manage the existing working relationship with employees,Other related purposes: preparation of payrolls, management of social benefits established in agreements, prevention of occupational risks, training, code of conduct, IT management, etc..||Contractual relationship, legal labor obligations and Pharma Mar’s legitimate interest|
|Facility access control and video surveillance||Ensuring safe access to facilities for people and vehicles||Pharma Mar’s legitimate interest.|
How long will we keep your data?
|Treatment||Data retention periods or criteria|
|Subscription to the newsletter via the Pharma Mar website||The personal data of the persons interested in receiving the newsletter will be kept in the system for an indefinite period of time as long as no request is made for their deletion by the interested party.|
|Contact and questions||The data provided shall be kept for the time necessary for the processing and reply of the enquiry, until such time as the data subject requests that they be deleted.|
|Contacts and email addresses||The data provided to maintain contact shall be kept for an indefinite period of time until such time as the data subject requests that they be deleted.|
|Clinical trials and Pharmacovigilance||In accordance with legal requirements, personal data will be retained in databases and/or paper files for at least 25 years after the end of the trial or for a longer period if required by applicable law or as necessary for the purpose of obtaining regulatory approval of the study drug.|
|Treatment of Clinical Trial Staff||The data provided will be kept as long as the contractual relationship is maintained and subsequently for the years necessary to comply with the legal obligations in compliance with Real Decreto 1090/2015 on Clinical Trials and to determine the possible responsibilities that may arise from this purpose and the processing of the data.|
|CRM||The data provided in order to maintain contact will be kept for an indefinite period of time as long as the data subject does not request their deletion or exercise his or her right of objection.|
|Value Transfer to medical and healthcare professionals and organizations||The data provided will be kept for as long as the contractual or commercial relationship is maintained and subsequently for the years necessary to comply with the legal obligations and to determine the possible responsibilities that may arise from this purpose and from the processing of the data. (Economic data are kept in accordance with current tax and accounting legislation at the request of the competent public entity (tax office or court).|
|Medical Information System for Healthcare Professionals||The data provided shall be kept for the time necessary for the processing and reply of the request, for a maximum period of 10 days from the date of the request, until such time as it is deleted by the data subject.|
|Supplier management||The data provided will be kept as long as the contractual relationship is maintained and subsequently, for the years necessary to comply with the legal obligations and to determine the possible responsibilities that may arise from this purpose and the processing of the data (The economic data are kept according to current legislation on tax and accounting matters at the request of the competent public entity (tax office or jurisdictional bodies).|
|PRL and CAE management of suppliers||The data provided will be kept for as long as the contractual relationship is maintained and subsequently, for the years necessary to comply with the legal obligations and to determine the possible responsibilities that may arise from this purpose and the processing of the data.|
|RRHH Recruitment||The personal data you provide will be kept in our database for a maximum period of 5 years. If you wish to continue participating in Pharma Mar’s selection processes after this deadline, please send us your CV again.|
|Treatment of Inventors and Patents||They will be kept for the time necessary to comply with the purpose for which they were collected and to determine the possible responsibilities that may arise from this purpose and the processing of the data.|
|Judicial and extrajudicial proceedings||They will be kept for the time necessary to comply with the purpose for which they were collected and to determine the possible responsibilities that may arise from this purpose and from the processing of the data.|
|Management of general meetings of shareholders||The data will be kept as long as the condition of shareholder is maintained, and will only be kept later, only for the purpose of attending to potential liabilities that may arise from said condition, due to the periods of limitation of said liabilities, as provided for in the applicable legislation at any given time.|
|Human Resources Management||The data will be kept for the necessary period of time, while the contractual relationship is maintained and, once these have been concluded, to comply with current legislation on labour matters, and/or during the legal periods foreseen to determine the possible responsibilities that may arise from this purpose and from the processing of the data.|
|Facility access control and video surveillance||The period of storage of the data for access control to the facilities including images shall be a maximum of one (1) month from the date of collection.|
To which third parties do we pass on your data?
Please note that the data you provide us with may be disclosed to third parties for purposes directly related to the legitimate functions of PharmaMar or the third party, and for legal obligations. At the time of data collection, they shall be informed of the recipients of the data as well as of the existence or otherwise of international data transfers for each processing operation on a case-by-case basis.
In the event that data is transferred to third parties (such as data transfers between PharmaMar Group companies) or suppliers are used to provide us with auxiliary services for our activities (hosting, housing, SaaS) outside the European Economic Area that may have access to personal data, PharmaMar will choose companies that are members of the Privacy Shield agreement between the USA and the EU, or will implement other appropriate protection guarantees, such as the signing of standard contractual clauses between the parties or the adoption of binding corporate rules between the companies of the group, which means that they are obliged to comply with equivalent data protection requirements to those of European companies.
What are your rights when you give us your details?
The owner of the data has the following rights recognized at any time, when it is legally appropriate:
- Access: the right to know what personal data Pharma Mar holds about them and how they are processed. and the right to obtain a copy of the personal data processed.
- Correction: Request a correction or update of the personal data held by PharmaMar if it is inaccurate, erroneous or incomplete.
- Deletion: to request its deletion when the purpose for which it was processed or collected has ceased to exist, due to unlawful processing of data, for example, unnecessary or obsolete data, withdrawal of your consent or compliance with a legal obligation.
- and opposition to processing: In certain circumstances and on grounds relating to their particular situation, data subjects may object to the processing of their data (e.g. where the processing is for the purpose of direct marketing). Pharma Mar will cease processing the data, except for compelling legitimate reasons, or the exercise or defence of any claims.
- data portability: in certain circumstances, the right to receive personal data, which you have provided to PharmaMar, in a structured, commonly used and machine-readable format, and to transmit them to another controller.
- limitation of processing: in certain circumstances, data subjects may request a limitation of the processing of their data (suspension of processing in each case), in which case they will only be retained for the purpose of exercising or defending claims.
- rectify the consent: at any time, the data subject may withdraw the consent given for the processing of personal data.
To exercise all these rights, you may write to us with a letter including the ‘Ref. Data Protection’, in which the corresponding request is specified and accompanied by a photocopy of the ID card to Avda. de los Reyes, 1, 28770 – Colmenar Viejo (Madrid), Spain or by e-mail to email@example.com
In accordance with the applicable regulations, you will also have the right to file a complaint with the Spanish Data Protection Agency, if you consider it necessary, especially when you have not obtained satisfaction in the exercise of your rights, and how to contact it. For more information, please visit the website of the Spanish Data Protection Agency, www.agpd.es