CAMURUS PRIVACY NOTICE


Information regarding processing of your personal data

The purpose of this privacy notice is to provide information on how companies within the Camurus group (“we”) process your personal data.

We respect your privacy and duly protect the personal data we process about you. All processing of personal data is carried out in accordance with the European Union’s General Data Protection Regulation (the “GDPR”). The following describes how we collect, process and share your personal data. In Part I of this privacy notice, you find different categories of data subject and may find specific information applicable to each category of data subjects. In Part II, you find information applicable to all categories of data subjects, such as your rights as a data subject.

PART I

1. WEBSITE VISITORS

1.1 What personal data will be processed?

We collect and process personal data that your web browser makes available whenever you visit a Camurus website, including Internet Protocol (IP) address, browser language, geographical location data, date and time, cookies, and information about accessed pages.

If you:

  • leave your email address in order to download logos and images from this website;
  • subscribe for our financial reports and/or press releases; or
  • contact us through this website;

we will also process your name and email address that you submit to us.
For more information about cookies, please see our Cookie Policy available at camurus.com.

1.2 What are the purposes and legal grounds of processing your personal data?

We process your personal data:

a) in order to make the website available to you and to improve, develop, and enhance the usability of the website; and

b) if applicable, in order for you to download logos and images, to obtain information from us and/or in order for you to contact.

The processing of your personal data for the purposes described in (a) and (b) above is based on Camurus’ legitimate interest, as we wish to make the website available to you and to improve, develop and enhance the usability of the site in order to satisfy your needs and improve our support of the website, as well as to provide information to you as requested. The personal data being processed is of simple nature and the processing is limited and does not affect personal integrity to a large extent. Furthermore, we believe there is a mutual interest in the purposes described. Based on these factors, we have performed a balance of interest assessment and have concluded that our legitimate interest to make the website available to you and to improve, develop and enhance the usability of the site, outweighs your potential interest in not having your personal data processed for these purposes.

You are always entitled to object to our assessments. You can read further about your rights in Part II, Section 2 below.

1.3 For how long is your personal data stored?

We store the personal data as long as it is necessary to fulfil the purpose for which the personal data has been collected. You may always request that we delete your personal data sooner, read more about your rights in Part II, Section 2 below.

2. BUSINESS REPRESENTATIVES AND OTHERS

2.1 What personal data will be processed?

If you act as a representative or point of contact of a company or organisation with whom Camurus has a business relationship (e.g. a customer, collaboration partner, manufacturer, distributor, CRO), or with whom Camurus is contemplating establishing a business relationship with, or if you otherwise interact with us (e.g. email us or participate at an event organised by us), we may collect and process the following personal data about you:

  • contact information (name, email and telephone number;
  • position and company/organisation, if you represent a company/organisation; and
  • CVs and information on work experiences, if applicable.

The personal data listed above will be collected directly from you or from the organisation/company that you represent. We may also collect your personal data from publicly available sources.

2.2 What are the purposes and legal grounds of processing your personal data?

We process your personal data:

c) in order to manage our (actual or potential) business relationship and administrate our interaction; or

d) for the purpose of ensuring high standards of our business partners and people we collaborate with.

The processing of your personal data for purpose (a) stated above is based on our legitimate interest to manage our (actual or potential) business relationship and interact with you. The personal data which is processed is of simple nature and the processing is limited and does not affect personal integrity to a large extent. Furthermore, the processing is necessary for us to conduct our business. Based on these factors, we have performed a balance of interest assessment and have concluded that our legitimate interest to manage our (actual or potential) business relationship and interact with you, outweighs your potential interest in not having your personal data processed for these purposes.

The processing of your personal data for purpose (b) stated above is based either on our legitimate interest to ensure high standards or our business partners and people we collaborate with, or on our legal obligations in relation to clinical trials and other parts of our business.

You are always entitled to object to our assessments. You can read further about your rights in Part II, Section 2 below.

2.3 For how long is your personal data stored?

Your personal data will only be stored as long as the purpose for which it is kept exists and as long as permitted or required under applicable law. This means that personal data (contact information, organisation/company, position) which is processed in order to manage our (potential or actual) business relationship and to interact with you will be deleted without undue delay once we believe there we do longer have an actual or potential relationship with you, or without undue delay after we have been informed that you have left the company or organisation with whom we have a business relationship. You may always request that we delete your personal data sooner.

We have a legal obligation to store all data related to Camurus’ medicinal products and clinical trials at least 15 year after a clinical trial is completed, for a period of 2 years following the expiration of the last marketing authorization in European Union, or at least 2 years after termination of a development program. All information related to clinical trials performed in relation to such products, including personal data (e.g. name of investigator) must be included and stored in accordance with such legal requirements. If you are an investigator, business representative or other whose personal data we process in connection with a clinical trial, your personal data may therefore be saved for this time period.

Read more about your rights in Part II, Section 2 below.

3. HEALTHCARE PROFESSIONALS

3.1 What personal data will be processed?

If you are a healthcare professional, we may collect and process the following personal data about you:

  • contact information (name, email and telephone number); and
  • position and organisation/company.

The personal data listed above will mainly be collected directly from you or from the organisation/company that you represent. However, we may also receive your personal data from external parties who organise and host conferences or events where you have participated. We may also collect your information from publicly available sources.

3.2 What are the purposes and legal grounds of processing your personal data?

We process your personal data in order to

(a) provide you with information on our products and our business;
(b) invite you to events, etc.;
(c) manage our (potential or actual) relationship (e.g. to request services from you in the future, in your role as a healthcare professional);
(d) respond to or otherwise handle any requests or questions you may send us, or otherwise interact with you when you send us an email or contact us by phone; and
(e) maintain our pharmacovigilance system, scientific service system and ensure product safety, as applicable.

The provision of some of your personal data, including name and contact information, is necessary in order to provide information requested by you. If you do not provide your personal data to us, we will not be able to share requested information with you.

The processing of your personal data for the purposes stated in (a) to (d) above is based on our legitimate interest to manage our (actual or potential) business relationship. The personal data which is processed is of simple nature, limited to your professional role and the processing does not affect personal integrity to a large extent. Furthermore, the processing is necessary for us to conduct our business. Based on these factors, we have performed a balance of interest assessment and have concluded that our legitimate interest to manage our (actual or potential) business relationship and interact with you, outweighs your potential interest in not having your personal data processed for these purposes. You are always entitled to object to this assessment.

The processing of your personal data for the purpose stated in (e) above is based on our legal obligation relating to pharmacovigilance, product safety and product liability.
You can read further about your rights in Part II, Section 2 below.

3.3 For how long is your personal data stored?

Your personal data will only be stored for as long as the purpose for which it is kept exists and for as long as permitted or required under applicable law. This means that certain personal data which is processed in order to provide requested information to you, invite you to future events or to otherwise manage our (potential or actual) relationship with you will be deleted without undue delay when we no longer have a (potential or actual) relationship. You may always request that we delete your personal data sooner. Notwithstanding the foregoing, all pharmacovigilance data relating to our medicinal products will be stored for 10 years after the marketing authorization has expired, in accordance with applicable pharmacovigilance legislation. Read more about your rights in Part II, Section 2 below.

4. PATIENTS, PATIENT ORGANISATIONS AND OTHERS

4.1 What personal data will be processed?

If you are a patient using a Camurus product, a person otherwise interested in Camurus’ products or business, or if you represent a patient organisation, we may collect and process the following personal data about you:

  • contact information (name, email and telephone number); and
  • information you provide us.

The personal data listed above will be collected from you.

4.2 What are the purposes and legal grounds of processing your personal data?

We process your personal data in order to:

(a) provide you with information on our products or our business, if requested by you; and
(b) handle any requests or questions you may send us, or otherwise interact with you when you send us an email or contact us by phone; and
(c) maintain our pharmacovigilance system, scientific service system and ensure product safety, as applicable;

The provision of some of your personal data, including name and contact information, is necessary in order to provide information requested by you. If you do not provide your personal data to us, we will not be able to share requested information with you.

The processing of your personal data for the purpose stated above is based on our legal obligation relating to pharmacovigilance, product safety and product liability. Sensitive personal data, such as information about your health, will only be processed if we have obtained your explicit consent or if the processing is necessary for us to ensure high standards of quality and safety of medicinal products on the basis applicable laws.

4.3 For how long is your personal data stored?

Your personal data will only be stored for as long as the purpose for which it is kept exists and for as long as permitted or required under applicable law. This means that personal data which is processed in order to provide requested information to you or in order to handle request and questions (e.g. contact information) will be deleted without undue delay after we have handled any question or request. Notwithstanding the foregoing, all pharmacovigilance data relating to a medicinal product of Camurus will be stored for 10 years after the marketing authorization has expired, in accordance with applicable pharmacovigilance legislation. Please read about the storage period for information related to clinical trials in Part I Section 2.3 above. Read more about your rights in Part II, Section 2 below.

5. JOB APPLICANTS

5.1 What personal data will be processed?

If you apply for a position with Camurus (as an employee or as a consultants), directly through Camurus’ or through any of Camurus’ third party service providers (e.g. recruitment agencies), we may collect the following personal data in connection with the recruitment process in order to evaluate if you are a suitable candidate for the position:

  • contact information (e.g. name, address, email and telephone number);
  • personal identity number;
  • pictures (if shared as part of your application);
  • information regarding prior working experience and education;
  • information regarding prior work performance (e.g. received from references or your past employers);
  • information received during interviews;
  • CV and application, and any information provided by you in any documents provided in connection with your application;
  • financial information (e.g. credit records);
  • results from personality and cognitive ability tests and analysis; and
  • if applicable for the advertised position and your potential employment, information that you have passed a drug and health test;
  • if applicable for the advertised position and your potential employment, a report from a screening and background check performed by an external service provide.

We collect personal data directly from you. However, we may collect personal data about you from external parties, e.g. from recruitment agencies, background check service providers, prior employers and other business partners, and publicly accessible sources such as national tax authorities and other public agencies or authorities.

5.2 What are the purposes and legal grounds of processing your personal data?

We process your personal data in order to:

(a) To interact with you during the recruitment process;
(b) To review if you are a suitable candidate for the advertised job or position you apply for;
(c) To request credit information;
(d) To carry out statistical analysis of job applicants to analyse for example the number of female/male applicants, etc.;
(e) To process potential claims relating to the recruitment process (e.g. discrimination claims, etc.);
(f) To draft an employment contract that will be concluded if you are hired; and
(g) If applicable for your potential employment, to see that you are not using drugs or have other health issues making you unfit for the advertised job or position you apply for;
(h) If applicable and if your explicit consent has been obtained, to store your information if we wish to contact you for future positions.

The processing of your personal data for purposes (a) to (g) is based on our legitimate interest, as further outline in detail below.

The legitimate interest in relation to purposes (a) and (c) is to evaluate if you are a suitable candidate for the advertised position which is also to your advantage. In order to do so we must review certain information regarding, for example, your prior experience and financial position. We only review and request information that is necessary for such purpose.

We also have a legitimate interest to process your Personal Data for purpose (d) since we would like to ensure that we attract all types of individuals in order to maintain diversity and to take appropriate actions considering the results of the analysis. The personal data collected for statistical analysis will be compiled in an aggregated form which does not enable your identification.

In case you would like to challenge our decision taken in connection with our recruitment process as described in purpose (e), it is essential that we have documented our decisions in order to be able to motivate our decision and to defend potential legal claims.

Considering the nature of Camurus’ business, legal obligations, security reasons and the importance of mitigating the risk of exposure to and potential leackage of controlled substances (such as narcotics), we have a legitimate interest to carry out drug tests and other relevant health checks in case you are offered a position with Camurus where you will be handling controlled substances or be allowed access to facilities where controlled substances are kept. Such tests and checks are only conducted if they are relevant for the position you apply for. Tests and checks will be performed by an external service provider. Camurus will only receive information whether the test was positive or negative and/or a notice of any red flags, and Camurus will not receive, or store, any other information in relation to such tests. Camurus acknowledges that information received from the external service provider may be considered sensitive data under the GDPR. If applicable, in addition to Camurus’ legitimate interest to process this information, Camurus has a legal obligation to mitigate the risk of exposure to and potential leackage of controlled substances and must therefore assess the working capacity of you as an employee as described.

Considering the nature of Camurus’ business, we also have a legitimate interest to have an external service provider perform a screening and background check if you have applied for a position with great responsibilities or that would otherwise require Camurus to ensure that you are fit for the position. Such background check is only conducted if it is relevant for the position you are applying for. In such case, we will receive a summary report from the external party having performed the screening and background check and Camurus will not store any of this information.

In case you are offered a position with Camurus where you will be handling controlled substances or be allowed access to facilities where controlled substances are kept. Such tests and checks are only conducted if they are relevant for the position at hand. Tests and checks will be performed by an independent healthcare services provider. Camurus will only receive information whether the test was positive or negative and whether any red flags and Camurus will not receive, or store, any other information in relation to you visit to the healthcare service provider.

Based on the above-mentioned factors, we have performed a balance of interest assessment and have concluded that our legitimate interests outweigh your potential interest in not having your personal data processed for the purposes listed herein. You are always entitled to object to this assessment. You can read further about your rights in Part II below.

The processing of your personal data for purpose (f) is based on the necessity of such processing to conclude an employment contract with you, in the event you are offered employment.

The processing of your Personal Data for purpose (h) is based on your explicitly given consent to such processing, which we will ask for if applicable. You can always withdraw your consent. You can read further about your rights in Section 7 in the below.

5.3 For how long is your personal data stored?

Your personal data will only be stored as necessary for the purpose and as long as permitted or required under applicable laws and regulations. For instance, this means that your personal data set forth in Section 5.1 will be stored for the following specified periods:

  • Your CV, contact information, information regarding prior working experience and education, interview notes, results from intelligence and personality tests will generally be deleted when the recruitment process is completed. However, if you are one of the last candidates, we will save your documents for up to two (2) years, for defending potential legal claims, e.g. relating to discrimination. If you have provided your consent in Appendix 1, we may also store some of this information for a longer period.
  • Your credit records will not be saved after collection and we will only note that we have received it and will not retain any information regarding your financial position.
  • The personal data used for statistical purposes will be deleted once the results are compiled. The compiled results will be saved in an aggregated form which does not enable identification of you.
  • The results from drug tests and health checks will not be saved, as we will only note that the tests and checks have been carried out.

PART II

1. WHO HAS ACCESS TO YOUR PERSONAL DATA?

1.1 We have implemented appropriate technical and organisational measures to protect your personal data against loss, unlawful access, etc. The number of persons with access to your personal data is limited. Only individuals associated with Camurus that need to process your personal data in accordance with the purposes above will have access to your personal data.

1.2 We may share your personal data with other companies within the Camurus group in order to fulfil the purpose for the data processing, to ensure that we send you relevant information or otherwise interact with you as requested.

1.3 We may also share your personal data with external parties that carry out services on our behalf or that we otherwise collaborate with to the extent necessary for the purposes identified herein, such as IT-suppliers, pharmacovigilance service providers, clinical research organisations (CROs), collaboration partners such as recruitment agencies that process personal data for the purpose of evaluating candidates, your previous employers or other business partners if you are a job applicant, providers of PR and communication services, and providers of CRM-systems. Your personal data may also be shared with third parties working for Camurus as consultants, but only to the extent necessary for the purposes listed in this privacy notice. Furthermore, your personal data may be shared with regulatory and governmental authorities if required under applicable laws and regulations or otherwise for the purposes set forth herein.

1.4 Your personal data may be transferred to a country outside of EU/EEA which may have a lower level of protection than within the EU/EEA. For instance, we may share your personal data with companies within the Camurus group established outside the EU/EEA, i.e. in Australia, if necessary for the intended purpose listed in this privacy notice. When transferring personal data to countries outside the EU/EEA, we use standard contractual clauses approved by the European Commission to ensure sufficient levels of protection for your personal data. The standard contractual clauses can be found via the following link: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en.

2. WHAT ARE YOUR RIGHTS?

2.1 Camurus AB, Reg. No. 556667-9105, address Sölvegatan 41, SE-223 70 Lund, Sweden or the Camurus company that you interact with is the controller of the processing of your personal data. This means that Camurus AB or the Camurus company that you interact with is responsible for your personal data being processed correctly and in accordance with applicable laws and regulations. The email address to the data controller is privacy@camurus.com.
Contact information to other Camurus companies may be found on our website, www.camurus.com.

2.2 You are entitled to know what personal data we process about you and you can request a copy of such data. You are entitled to have incorrect or misleading personal data about you corrected and, in some cases, you may request that we delete your personal data. You are also entitled to object to certain processing of your personal data, and request that the processing of your personal data be limited.

2.3 If you have questions regarding how we process personal data about you, you are most welcome to contact us at privacy@camurus.com or by mail to the address above.

2.4 If you have any objections or complaints about the way we process your personal data, you have the right to file a complaint with the applicable Data Protection Authority.

3. CHANGES

If any changes are made concerning the processing of your personal data, we will publish an updated version of this privacy notice on this site.