CAMURUS PRIVACY NOTICE


Information regarding processing of your personal data

The purpose of this privacy notice is to provide information on how companies within the Camurus group (“we”) process your personal data.

We respect your privacy and duly protect the personal data we process about you. All processing of personal data is carried out in accordance with the European Union’s General Data Protection Regulation (the “GDPR”). The following describes how we collect, process and share your personal data. In Part I of this privacy notice, you find different categories of data subject and may find specific information applicable to each category of data subjects. In Part II, you find information applicable to all categories of data subjects, such as your rights as a data subject.

PART I

1. WEBSITE VISITORS

1.1 What personal data will be processed?

We collect and process personal data that your web browser makes available whenever you visit a Camurus website, including Internet Protocol (IP) address, browser language, geographical location data, date and time, cookies, and information about accessed pages.

If you:

  • leave your email address in order to download logos and images from this website;
  • subscribe for our financial reports and/or press releases; or
  • contact us through this website;

we will also process your name and email address that you submit to us.
For more information about cookies, please see out Cookie Policy available at camurus.com.

1.2 What are the purposes and legal grounds of processing your personal data?

We process your personal data:

a) In order to make the website available to you and to improve, develop, and enhance the usability of the website; and

b) If applicable, in order for you to download logos and images, to obtain information from us and/or in order for you to contact.

We process your personal data The processing of your personal data for the purposes described in (a) and (b) above is based on Camurus’ legitimate interest, as we wish to make the website available to you and to improve, develop and enhance the usability of the site in order to satisfy your needs and improve our support of the website, as well as to provide information to you as requested. The personal data being processed is of simple nature and the processing is limited and does not affect personal integrity to a large extent. Furthermore, we believe there is a mutual interest in the purposes described. Based on these factors, we have performed a balance of interest assessment and have concluded that our legitimate interest to make the website available to you and to improve, develop and enhance the usability of the site, outweighs your potential interest in not having your personal data processed for these purposes.

You are always entitled to object to our assessments. You can read further about your rights in Part II, Section 2 below.

1.3 For how long is your personal data stored?

We store the personal data as long as it is necessary to fulfil the purpose for which the personal data has been collected. You may always request that we delete your personal data sooner, read more about your rights in Part II, Section 2 below.

2. BUSINESS REPRESENTATIVES AND OTHERS

2.1 What personal data will be processed?

If you act as a representative or point of contact of a company or organisation with whom Camurus has a business relationship (e.g. a customer, collaboration partner, manufacturer, distributor, CRO), or with whom Camurus is contemplating establishing a business relationship with, or if you otherwise interact with us (e.g. email us or participate at an event organised by us), we may collect and process the following personal data about you:

  • Contact information (name, email and telephone number);
  • Position and company/organisation, if you represent a company/organisation; and
  • CVs and information on work experiences, if you are an investigator of a clinical trial.

The personal data listed above will be collected directly from you or from the organisation/company that you represent. We may also collect your personal data from publicly available sources.

2.2 What are the purposes and legal grounds of processing your personal data?

We process your personal data:

c) In order to be able to manage our (actual or potential) business relationship and administrate our interaction; or

d) If you are an investigator of a clinical trial, for the purpose of obtaining required regulatory approvals for the applicable trial.

The processing of your personal data for purpose (a) stated above is based on our legitimate interest to manage our (actual or potential) business relationship and interact with you. The personal data which is processed is of simple nature and the processing is limited and does not affect personal integrity to a large extent. Furthermore, the processing is necessary for us to conduct our business. Based on these factors, we have performed a balance of interest assessment and have concluded that our legitimate interest to manage our (actual or potential) business relationship and interact with you, outweighs your potential interest in not having your personal data processed for these purposes.

The processing of your personal data for purpose (b) stated above is based on our legal obligation to have regulatory approvals for our clinical trials.

You are always entitled to object to our assessments. You can read further about your rights in Part II, Section 2 below.

2.3 For how long is your personal data stored?

Your personal data will only be stored as long as the purpose for which it is kept exists and as long as permitted or required under applicable law. This means that personal data (contact information, organisation/company, position) which is processed in order to manage our (potential or actual) business relationship and to interact with you will be deleted without undue delay once we believe there we do longer have an actual or potential relationship with you, or without undue delay after we have been informed that you have left the company or organisation with whom we have a business relationship. You may always request that we delete your personal data sooner.

We have a legal obligation to store all data related to Camurus’ medicinal products and clinical trials at least 15 year after a clinical trial is completed; or for a period of 2 years following the expiration of the last marketing authorization in European Union; or at least 2 years after termination of a development program. All information related to clinical trials performed in relation to such products, including personal data (e.g. name of investigator) must be included and stores in accordance with such legal requirements. If you are an investigator, business representative or other whose personal data we process in connection with a clinical trial, your personal data may therefore be saved for this time period.

Read more about your rights in Part II, Section 2 below.

3. HEALTHCARE PROFESSIONALS

If you are a healthcare professional, we may collect and process the following personal data about you:

  • Contact information (name, email and telephone number); and
  • Position and organisation/company.

The personal data listed above will mainly be collected directly from you or from the organisation/company that you represent. However, we may also receive your personal data from external parties who organise and host conferences or events where you have participated or otherwise provided your information. We may also collect your information from publicly available sources.

3.1 What are the purposes and legal grounds of processing your personal data?

We process your personal data in order to

(a) Provide you with information on our products and our business;
(b) Invite you to events, etc.;
(c) Manage our (potential or actual) relationship (e.g. to request services from you in the future, in your role as a healthcare professional);
(d) Respond to or otherwise handle any requests or questions you may send us, or otherwise interact with you when you send us an email or contact us by phone; and
(e) Maintain our pharmacovigilance system, scientific service system and ensure product safety, as applicable;

The provision of some of your personal data, including name and contact information, is necessary in order to provide information requested by you. If you do not provide your personal data to us, we will not be able to share requested information with you.

The processing of your personal data for the purposes stated in (a) to (d) above is based on our legitimate interest to manage our (actual or potential) business relationship. The personal data which is processed is of simple nature, limited to your professional role and the processing does not affect personal integrity to a large extent. Furthermore, the processing is necessary for us to conduct our business. Based on these factors, we have performed a balance of interest assessment and have concluded that our legitimate interest to manage our (actual or potential) business relationship and interact with you, outweighs your potential interest in not having your personal data processed for these purposes. You are always entitled to object to this assessment.

The processing of your personal data for the purpose stated in (e) above is based on our legal obligation relating to pharmacovigilance, product safety and product liability.
You can read further about your rights in Part II, Section 2 below.

3.2 For how long is your personal data stored?

Your personal data will only be stored for as long as the purpose for which it is kept exists and for as long as permitted or required under applicable law. This means that certain personal data which is processed in order to provide requested information to you, invite you to future events or to otherwise manage our (potential or actual) relationship with you will be deleted no later than 24 months after our last contact. You may always request that we delete your personal data sooner. Notwithstanding the foregoing, all pharmacovigilance data relating to a medicinal product of Camurus will be stored for 10 years after the marketing authorization has expired, in accordance with applicable pharmacovigilance legislation. Read more about your rights in Part II, Section 2 below.

4. PATIENTS, PATIENT ORGANISATIONS AND OTHERS

If you are a patient using a Camurus product, a person otherwise interested in Camurus’ products or business, or if you represent a patient organisation, we may collect and process the following personal data about you:

  • Contact information (name, email and telephone number); and
  • Information you provide us, e.g. information about health.

The personal data listed above will be collected from you.

4.1 What are the purposes and legal grounds of processing your personal data?

We process your personal data in order to:

(a) Provide you with information on our products or our business, if requested by you; and
(b) Handle any requests or questions you may send us, or otherwise interact with you when you send us an email or contact us by phone; and
(c) Maintain our pharmacovigilance system, scientific service system and ensure product safety, as applicable;

The provision of some of your personal data, including name and contact information, is necessary in order to provide information requested by you. If you do not provide your personal data to us, we will not be able to share requested information with you.

The processing of your personal data for the purpose stated above is based on our legal obligation relating to pharmacovigilance, product safety and product liability.

4.2 For how long is your personal data stored?

Your personal data will only be stored for as long as the purpose for which it is kept exists and for as long as permitted or required under applicable law. This means that personal data which is processed in order to provide requested information to you or in order to handle request and questions (e.g. contact information) will be deleted without undue delay after we have handled any question or request. Notwithstanding the foregoing, all pharmacovigilance data relating to a medicinal product of Camurus will be stored for 10 years after the marketing authorization has expired, in accordance with applicable pharmacovigilance legislation. Please read about the storage period for information related to clinical trials in Part I Section 2.3 above. Furthermore, please read more about your rights in Part II, Section 2 below.

PART II

1. Who has access to your personal data?

1.1 We have implemented appropriate technical and organisational measures to protect your personal data against loss, unlawful access, etc. The number of persons with access to your personal data is limited. Only individuals associated with Camurus that need to process your personal data in accordance with the purposes above will have access to your personal data.

1.2 We may share your personal data with other companies within the Camurus group in order to fulfil the purpose for the data processing, to ensure that we send you relevant information or otherwise interact with you as requested.

1.3 We may also share your personal data with suppliers and partners that carry out services on our behalf, such as IT-suppliers, pharmacovigilance service providers, clinical research organisations (CROs), providers of PR and communication services, and providers of CRM-systems. Your personal data may also be shared with third parties working for Camurus as consultants, but only to the extent necessary for the purposes listed in this privacy notice. Furthermore, your personal data may be shared with regulatory and governmental authorities if required under applicable laws and regulations.

1.4 Your personal data may be transferred to a country outside of EU/EEA which may have a lower level of protection than within the EU/EEA. For instance, we may share your personal data with companies within the Camurus group established outside the EU/EEA, i.e. in Australia, if necessary to ensure that we send you relevant information or otherwise interact with you for the intended purpose. Furthermore, transfer to a country outside the EU/EEA may be necessary for us to store your data in a protected environment using our IT-tools (i.e. in our CRM-system and SharePoint). When transferring personal data to countries outside the EU/EEA, we use standard contractual clauses approved by the European Commission to ensure sufficient levels of protection for your personal data. The standard contractual clauses can be found via the following link: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en.

2. WHAT ARE YOUR RIGHTS?

2.1 Camurus AB, Reg. No. 556667-9105, address Ideon Science Park, Sölvegatan 41, 223 70 Lund, Sweden or the Camurus company that you interact with is the controller of the processing of your personal data. This means that Camurus AB or the Camurus company that you interact with is responsible for your personal data being processed correctly and in accordance with applicable laws and regulations. The email address to the data controller is privacy@camurus.com.
Contact information to other Camurus companies may be found on our website, www.camurus.com.

2.2 You are entitled to know what personal data we process about you and you can request a copy of such data. You are entitled to have incorrect or misleading personal data about you corrected and, in some cases, you may request that we delete your personal data. You are also entitled to object to certain processing of your personal data, and request that the processing of your personal data be limited.

2.3 If you have questions regarding how we process personal data about you, you are most welcome to contact us at privacy@camurus.com or by mail to the address above.

2.4 If you have any objections or complaints about the way we process your personal data, you have the right to file a complaint with the applicable Data Protection Authority.

3. CHANGES

If any changes are made concerning the processing of your personal data, we will publish an updated version of this privacy notice on Camurus’ website.