Privacy Policy

PRIVACY POLICY

Privacy Policy

The following information provides a brief overview of how we process your personal data. Personal data means any information relating to an identified or identifiable individual. More detailed information on data protection is provided in the Privacy Policy below.

Content

Privacy policy

1. Name and contact details of the controller
2. Collection and storage of personal data, and the nature and purposes of processing when you visit our website
3. Disclosure of data
4. Cookies
5. Communication channels
6. Processing of purchases
7. Pharmacovigilance, quality defects and medical enquiries
8. General product information
9. Data processing in connection with contact by our field sales force
10. Information for existing customers
11. Rights of data subjects
12. Data security
13. Validity and amendments to this Privacy Policy

1. Name and contact details of the controller responsible for processing

This Privacy Policy applies to the processing of personal data by:

Nordic Pharma GmbH
Baarerstrasse 23
6300 Zug

E-Mail: [email protected]

Telephone: +41 43 444 9291

The controller responsible for the processing activities described in this Privacy Policy is Nordic Pharma GmbH, based in Zug. Administrative and financial services, as well as support on data protection matters, are provided on our behalf by the company of the same name, Nordic Pharma GmbH, based in Ismaning, Germany, under a service agreement and in accordance with our instructions. If you have any questions about data protection or wish to exercise your rights, you can contact us at [email protected].

This Privacy Policy is intended for individuals in Switzerland and Liechtenstein. Nordic Pharma GmbH, based in Zug, is responsible for Switzerland and Liechtenstein. Processing is governed by the Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO). Where we process the personal data of individuals in Liechtenstein, the General Data Protection Regulation (GDPR) and the Liechtenstein Data Protection Act also apply to such processing, as Liechtenstein is a member of the European Economic Area.

For processing activities subject to the GDPR, we have appointed Nordic Pharma GmbH, Fraunhoferstrasse 4, 85737 Ismaning, Germany, as our representative in the European Union (Art. 27 GDPR). You may also contact this representative by email with any questions concerning the processing of your personal data or the exercise of your rights at [email protected].

2. Collection and storage of personal data as well as the nature and purpose of processing when visiting the website

When you visit our website www.nordicpharma.ch, your browser automatically transmits information to our web server. This information is temporarily stored in log files and is automatically deleted once it is no longer required for technical purposes.

The following information is processed automatically, without any action on your part:

  • IP address of the device making the request,
  • date and time of access,
  • name and URL of the retrieved file,
  • website from which you accessed our website (referrer URL),
  • browser used and, where applicable, your device’s operating system and the name of your internet service provider.

Depending on how you use our website, additional technical information may be processed where necessary to ensure the website’s secure operation and availability or to provide the functions you use.

These data are processed for the following purposes:

  • ensuring a reliable connection to the website,
  • ensuring the user-friendly operation of our website,
  • assessing system security and stability, and
  • performing technical and administrative tasks necessary to provide the service.

This processing is based on our overriding interest in providing a secure, stable and functional website (Art. 31 para. 1 FADP). Where the GDPR applies, this processing is based on Art. 6 para. 1 lit. f GDPR.

These data are not combined with data from other sources.

Where certain personal data are required in order to use specific functions of our website, failure to provide those data may mean that the relevant functions are unavailable or only available to a limited extent.

Further information on this can be found under Sections 3 and 4 of this Privacy Policy.

3. Disclosure of data

We disclose your personal data to third parties only where:

  • you have given your consent,
  • the disclosure is necessary for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in preventing such disclosure,
  • there is a legal obligation to disclose the data, and
  • the disclosure is legally permissible and necessary for the performance of a contractual relationship with you.

Recipients of your personal data may include, in particular:

  • Nordic Group B.V., Siriusdreef 41, 2132 WT Hoofddorp, Netherlands, as well as other affiliated companies of the NORDIC PHARMA group of companies,
  • IT, cloud and hosting service providers; the central systems are provided and maintained by Nordic Group B.V.,
  • maintenance and support service providers,
  • logistics and distribution service providers for the storage and delivery of our products,
  • accounting and fiduciary service providers as well as service providers for Regulatory Affairs and Quality,
  • disposal companies for returned products,
  • authorities or courts, where there is a legal obligation to do so.

Recipients receive personal data only to the extent necessary to provide the relevant services or comply with legal obligations. Nordic Pharma GmbH in Ismaning (Germany) provides administrative and financial services on our behalf. It processes personal data only in accordance with our instructions. Depending on the recipient, disclosure is based on the performance of a contract with you, compliance with legal obligations or our overriding interest (Art. 31 FADP). Where service providers process personal data on our behalf, we conclude a data processing agreement with them in accordance with Art. 9 FADP. We assess service providers before engaging them. Upon request, we will provide information about the service providers used in individual cases.

Where personal data are disclosed to recipients in countries outside Switzerland, such disclosures are made only in compliance with applicable data protection law and subject to appropriate safeguards (e.g. standard contractual clauses). No additional safeguards are required for disclosures to countries whose legislation has been recognised as providing an adequate level of data protection by the Federal Council (Annex 1 DPO, which includes all EU and EEA countries). For disclosure to other countries, in particular the USA we rely on the standard contractual clauses recognised by the FDPIC or on certification under the Swiss-U.S. Data Privacy Framework (Arts. 16 and 17 FADP). Personal data may, in particular, be disclosed to the following countries:

  • Germany
  • Netherlands
  • where applicable, other countries within the EU
  • USA, in particular in connection with the protection of our website (Cloudflare, Inc.) and with the group’s central cloud and CRM systems,

where is this necessary for intra-group services or the use of central IT systems.

Personal data relating to individuals in Liechtenstein are processed in Switzerland. The European Commission has recognised Switzerland as providing an adequate level of data protection; processing in Switzerland is therefore also permissible under the requirements of the GDPR.

4. Cookies

Our website uses cookies. Cookies are small text files stored on your device by your web browser. Our website uses only one technically necessary cookie to ensure website security. We do not use cookies for analytics, marketing or tracking purposes where consent would be required.

We use the services of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) to ensure the security and availability of our website. Cloudflare protects our website against abusive bots and malicious traffic in order to prevent attacks and ensure high performance. In this context, a cookie is set that is strictly necessary for Cloudflare’s security functions. This cookie distinguishes human visitors from automated bots.

Information about the cookie used:

Cookie name: cf_clearance

Purpose: This cookie is part of Cloudflare’s security check (“Challenge”). It records that a visitor has successfully completed a security check, allowing the visitor to be recognised as a trusted human user and avoiding repeated checks during the same session.

Storage period: The cookie is generally valid for the duration of the session (up to 15 minutes) and is renewed if the website continues to be used.

Data recipient: The information generated by the cookie is transmitted to Cloudflare.

This technically necessary cookie is set on the basis of Art. 45c lit. b of the Telecommunications Act (TCA), as it is strictly necessary for the provision of a secure website requested by you. The subsequent processing of data to ensure network security and the functionality of our website is based on our overriding interest pursuant to Art. 31 para. 1 FADP. Our overriding interest is to protect our website against attacks, ensure its availability and optimise it for visitors. Further information about data protection at Cloudflare can be found in Cloudflare’s Privacy Policy at: https://www.cloudflare.com/de-de/privacypolicy/. Where the GDPR applies, this processing is based on Art. 6 para. 1 lit. f GDPR.

5. Communication channels

If you contact us outside an existing contractual relationship or registration (e.g. by email, contact form or telephone), we process the personal data you provide solely for the purpose of handling and responding to your enquiry.

In particular, we may process the following data:

  • Name
  • Contact details (email address, telephone number, postal address)
  • Content of your enquiry
  • Any other information you provide voluntarily

We process these data solely for the purpose of handling your enquiry. Where necessary to handle your enquiry, your data may be disclosed to internal specialist departments, affiliated companies of NG B.V. or commissioned service providers.

The processing is carried out in order to respond to your enquiry and is therefore based, as applicable, on steps taken prior to entering into or performing a contract, compliance with legal obligations, or our overriding interest (Art. 31 FADP). Reports of adverse reactions, quality defects and medical enquiries are handled in accordance with Section 7. Where the GDPR applies, this processing is based on Art. 6 para. 1 lit. b, lit. c and lit. f GDPR.

Personal data are deleted once the relevant processing has been completed and, in any event, no later than three years thereafter, unless statutory retention obligations apply.

Application materials submitted to us through these communication channels are deleted no later than six months after completion of the recruitment process, unless you have consented to longer retention. Where the GDPR applies, the processing of application documents is based on Art. 6 para. 1 lit. b GDPR.

6. Processing of purchases

6.1 Orders

If you order products from us, we process the personal data necessary to process and deliver your order and to comply with legal obligations relating to the distribution of our products.

In particular, we may process the following data:

  • Name
  • Delivery address
  • Contact details
  • Order data
  • Product-related information

Where necessary to process the order, your data may be disclosed to logistics service providers or other service providers involved in the performance of the contract. We use Alloga AG as our logistics service provider for Switzerland; further information is available at: https://www.alloga.ch/de/datenschutz.php. Orders by private individuals are not possible. The processing is necessary for the performance of our contract with you. Because this processing concerns data relating to our contractual partners in connection with the conclusion and performance of a contract, we have an overriding interest pursuant to Art. 31 para. 2 lit. a FADP. We retain order, delivery and accounting documents for ten years (Art. 958f). Our products are distributed in Switzerland and Liechtenstein, in part through Swiss wholesalers. Where we supply a wholesaler, we process its order and delivery data as well as, where necessary for traceability and recalls, information concerning the establishments subsequently supplied. Where the GDPR applies, this processing is based on Art. 6 para. 1 lit. b and lit. c GDPR.

6.2 Returns

Where products are returned to us, we process the personal data necessary to handle the return and comply with our legal and contractual obligations.

In particular, order information, contact details and information about the returned product may be processed. For the proper disposal of returned products, we work with suitable service providers. These service providers receive only the information necessary for disposal. Processing is carried out for the performance of the contract with you. For disposal, we additionally rely on our overriding interest in safe and environmentally appropriate destruction (Art. 31 para. 1 FADP). Documents relating to returns are retained for ten years. Where the GDPR applies, this processing is based on Art. 6 para. 1 lit. b, lit. c and lit. f GDPR.

6.3 Product recalls

In the event of a product recall or the communication of safety-related product information, we process personal data in order to inform affected customers as quickly as possible and to comply with legal obligations.

For this purpose, the name, contact details and information concerning the affected product may be processed in particular.

The data are used solely for this purpose. Processing is carried out in particular to comply with reporting obligations concerning quality defects and adverse effects, the obligation to ensure traceability of deliveries and the requirements of Good Distribution Practice regarding the handling of recalls. If the competent local authority orders a recall as part of market surveillance, we process personal data in order to implement that order. The legal basis is therefore the statutory provision (Art. 31 para. 1 FADP). The processing also serves to protect life and health. Documents relating to product recalls are retained for ten years. Where the GDPR applies, processing is based on Art. 6 para. 1 lit. c and lit. d GDPR and, for health data, on Art. 9 para. 2 lit. i GDPR.

6.4 Customer qualification

Before the first delivery and at regular intervals thereafter, we verify whether the legal requirements for obtaining our products are met. For this purpose, we process your name, institution, address and contact details as well as the documents and/or information submitted to us. These documents and/or information may contain additional personal data.

If documents and/or information are missing or unclear, we contact you via the communication channels you have provided. The processing is carried out to comply with our legal obligations, in particular the obligation to supply products only to persons and establishments entitled to receive them and to document deliveries in a traceable manner. The documents are retained for ten years and are subsequently deleted or destroyed, unless longer statutory retention obligations apply. Where the GDPR applies, this processing is based on Art. 6 para. 1 lit. c and lit. b GDPR.

7. Pharmacovigilance, quality defects and medical enquiries

The safety of our products is our highest priority. If you report adverse reactions, quality defects or medical enquiries concerning our products, we process the personal data required for this purpose.

In particular, we may process the following data:

  • Name
  • Contact details
  • Health data
  • Information about the product used
  • Description of the reported incident or event

Where necessary to comply with legal obligations, the information may be disclosed to the competent authorities.

Health data processed in this context constitute particularly sensitive personal data (Art. 5 lit. c FADP). The processing is carried out to comply with our legal obligations. The report to the local authority is made by the Local Safety Officer of Nordic Pharma GmbH via the ElViS portal. Reports are anonymised before transmission so that the authority does not receive any information that identifies you. Where the GDPR applies, processing is based on Art. 6 para. 1 lit. c GDPR and, for health data, on Art. 9 para. 2 lit. i GDPR (public interest in the area of public health, in particular the safety of medicinal products).

The data are retained only for as long as required by applicable law. Documentation relating to medical enquiries, literature searches and risk management measures is retained for ten years after the end of the marketing authorisation. Reports concerning vigilance cases are anonymised once the purpose no longer applies. The anonymised data are retained in the Nordic Group B.V. system for at least ten years after withdrawal of the marketing authorisation for the medicinal product concerned and are subsequently deleted.

8. General product information

8.1 Professional information

As part of our business activities, we regularly provide healthcare professionals with information about new products, medical developments, continuing education and scientific information.

For this purpose, we process exclusively professional contact details and publicly available information.

The data are used solely to provide professional information.

Data subjects may object at any time to receiving such information. Processing is based on our overriding interest in providing professional information to medical professionals (Art. 31 FADP). When contacting persons by email, we comply with the requirements of Art. 3 para. 1 lit. o UCA (consent or existing customer relationship, correct sender information and the possibility to opt out). The information is processed for as long as you have not objected to receiving such information. Following an objection, we will no longer use the relevant data for this purpose. We retain consent until it is withdrawn. Where the GDPR applies, this processing is based on Art. 6 para. 1 lit. f GDPR; you may object at any time (Art. 21 GDPR).

8.2 Dispatch of marketing and information material

Upon request or as part of our professional support activities, we send information and training material, such as brochures, professional information, patient envelopes or demonstration devices. For this purpose, we process your name, the address of the medical practice or clinic, professional contact details and information concerning the requested material and its dispatch.

The envelopes are prepared by an agency in Germany and sent to employees in Switzerland via a parcel service. In doing so, the agency and parcel service receive no customer or patient data. Our employees then distribute the materials primarily in person and exclusively to medical practices and pharmacies. Materials are not delivered directly to patients; patients receive them through a medical practice or pharmacy.

The processing is carried out to fulfil your request and is also based on our overriding interest in providing professional information (Art. 31 para. 1 FADP). Only professional contact details of medical practices and pharmacies are processed; no patient data are processed. Address data are deleted once dispatch has been completed, unless statutory retention obligations apply. Documentation concerning approved advertising and information materials is retained in accordance with the requirements of medicinal products law. Where the GDPR applies, this processing is based on Art. 6 para. 1 lit. b and lit. f GDPR.

9. Data processing when contacted by the field sales force

In some cases, our field sales force contacts selected physicians to provide information about our products. The data underlying this contact are collected from publicly available sources (such as a medical practice’s website) and are used only in a professional context.

In particular, we may process the following data:

  • Name
  • Practice address
  • Professional contact details
  • Medical specialty
  • Information concerning professional interest in products
  • Documentation of the contact

This processing is based on our overriding interest in providing professional information to medical professionals (Art. 31 para. 1 FADP). Where the GDPR applies, this processing is based on Art. 6 para. 1 lit. f GDPR; the origin of the data from publicly available sources is indicated above (Art. 14 para. 2 lit. f GDPR).

At their request, interested parties may be added to our customer database in order to receive individually selected information free of charge. In this case, further processing is based on explicit consent, which is obtained on site by the field sales force. This processing is based on your consent (Art. 6 para. 6 in conjunction with Art. 31 para. 1 FADP). Consent must be given freely and on the basis of appropriate information. Where the GDPR applies, this processing is based on Art. 6 para. 1 lit. a GDPR.

Consent may be withdrawn at any time with effect for the future. Unless consent is renewed or withdrawn earlier, the corresponding data are deleted after no more than three years or are no longer used for this purpose.

10. Information for existing customers

If you have previously placed orders with us, we are required for certain products to maintain a list of orders containing customer data. We use these data to inform you about changes to the relevant product or about comparable products that may be relevant to you.

Where necessary, we communicate significant changes to professional information by post. This processing is carried out to comply with our legal obligations and to protect life and health.

For certain products, we also use addresses from purchased contact lists and publicly available sources. This processing is based on our overriding interest in providing professional information (Art. 31 para. 1 FADP). Your data are processed for this purpose for a maximum of three years after the last order or contact. Where the GDPR applies, information concerning product changes is based on Art. 6 para. 1 lit. c GDPR and professional information sent by post is based on Art. 6 para. 1 lit. f GDPR. The origin of the addresses is indicated above (Art. 14 para. 2 lit. f GDPR).

11. Rights of data subjects

Under applicable data protection law, you have, in particular, the following rights:

  • Right to information about the processing of your personal data (Art. 25 FADP),
  • Right to rectification of inaccurate or incomplete personal data (Art. 32 para. 1 FADP),
  • Right to the deletion of your personal data, where there are no statutory retention obligations preventing deletion (Art. 32 para. 2 lit. c FADP),
  • Right to prohibit disclosure to third parties, restrict processing or have a note of dispute added (Art. 32 para. 2 FADP),
  • Right to receive your personal data, or have them transferred, in a commonly used electronic format (Art. 28 FADP),
  • Right to withdraw consent at any time with effect for the future (where the GDPR applies: Art. 7 para. 3 GDPR),
  • Right to object to the processing of your personal data where it is based on an overriding interest (Art. 30 para. 2 lit. b FADP),
  • Right to report a matter to the Federal Data Protection and Information Commissioner (FDPIC) (Art. 49 FADP), as well as to enforce your claims through civil proceedings (Art. 32 FADP).

Information is generally provided free of charge within 30 days (Art. 25 FADP). To verify and process your request, we may require suitable proof of identity.

These rights may be restricted where permitted by law, where overriding interests of third parties conflict with them or where fulfilling your request would jeopardise our trade secrets (Art. 26 FADP). In such a case, we will inform you why we are restricting the provision of information.

You may exercise these rights against us as the controller. Where service providers process personal data on our behalf, we ensure that your request is also implemented there.

Where the GDPR also applies to the processing, you are entitled to the rights provided therein, in particular access, rectification, erasure, restriction of processing, data portability and objection (Arts. 15 to 22 GDPR). You also have the right to lodge a complaint with a supervisory authority; for persons in Liechtenstein, this is the Datenschutzstelle Liechtenstein, Äulestrasse 51, 9490 Vaduz.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 21 FADP). If you wish to exercise any of your rights, please contact us in writing or by email using the contact details specified in Section 1.

12. Data security

We implement appropriate technical and organisational measures in accordance with Art. 8 FADP and Arts. 1–6 DPO. We report data security breaches to the Federal Data Protection and Information Commissioner (FDPIC) and, where necessary, to the affected persons (Art. 24 FADP). Where the GDPR applies, these measures comply with the requirements of Art. 32 GDPR.

When you visit our website, we use the widely adopted SSL (Secure Sockets Layer) protocol in conjunction with the highest level of encryption supported by your browser. As a rule, 256-bit encryption is used.

If your browser does not support 256-bit encryption, 128-bit v3 technology is used instead. You can determine whether a page of our website is transmitted in encrypted form by the closed key or padlock symbol displayed in the lower status bar of your browser. Although we cannot accept liability for accidental or intentional manipulation, partial or complete loss, destruction or unauthorised disclosure of data, we use appropriate technical, electronic and operational security measures to protect your data as effectively as possible and to prevent the events listed above.

Our technical and organisational security measures are reviewed regularly and further developed in line with the state of the art.

We process personal data only for as long as necessary to fulfil the relevant purpose or for as long as statutory retention obligations apply. The specific retention periods are stated for the respective processing activity. Compliance with these retention periods is reviewed annually. Once the period has expired, the data are deleted, destroyed or anonymised.

13. Validity and amendments to this Privacy Policy

This Privacy Policy does not form part of any contract.

As our website and the services offered through it evolve, or as statutory or regulatory requirements change, we may need to amend this Privacy Policy. The current version of the Privacy Policy is published on our website at https://www.nordicpharma.ch/datenschutzerklarung/.

The current version of this Privacy Policy can be accessed on our website. Previous versions are archived where necessary.