GENERAL INFORMATION NOTE ON PROCESSING PERSONAL DATA
I. WHO ARE WE?
ANTIBIOTICE SA (hereinafter referred to as “the Company”) with the registered office in Iași , 1 Valea Lupului St. registered in the Trade Register under the no. J22/285/1991, URC 1973096, processes personal data in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 (the Regulation) and other applicable legal provisions concerning the processing of personal data. The Company acts as a Data Controller.
This informative note describes why and how we process personal data and provides information about your rights.
You can contact us at:
Address: Iasi, 1 Valea Lupului St. 707410 România
Fax: 0232/209.633
Site: http://www.antibiotice.ro/contact/formular-contact/
Email: dpo@antibiotice.ro
The processing of your personal data is done according to the quality you have in relation to S.C. Antibiotice S.A.:
I. Investors / Shareholders / Representatives of natural or legal persons / Heirs of the shareholders
1) Data or categories of personal data processed by the company:
Investor/ Shareholder: identifier, name and surname, series and number of the identity card, personal identification number, address, locality, county, country, citizenship, number of shares;
Representative of a legal person : name and surname, series and number of the identity card, personal identification number, address, locality, county, country, citizenship, workplace, any information from the Power of Attorney;
Representative of a natural person: name and surname, series and number of the identity card, personal identification number, address, locality, county, country, citizenship, any information from the Power of Attorney;
Heirs: name and surname, series and number of the identity card, personal identification number, address, locality, county, country, citizenship, any other information from the Inheritance Act and the from the Marriage Certificate.
2) Purposes for which personal data are processed:
(1)to offer responses to the requests submitted;
(2)to comply both with the legal provisions and those issued by the regulatory authorities;
(3)to protect your interests.
3) Legal bases for the processing of personal data:
U. E. Regulation no. 679/2016 art. 6, paragraph (1) letter c – in order to fulfill a legal obligation incumbent upon the operator (the trading company Antibiotice S.A.).
4) How long we keep personal data:
50 years
5) Recipients or categories of recipients of personal data:
The Central Depository, Financial Supervisory Authority, House of Savings and Consignments (CEC), National Agency for Fiscal Administration, financial investment services companies (brokerage companies), administrative and judicial institutions.
6) Consequences of refusing to provide personal data:
Depending on your request, in the absence of providing certain information, we may not be able to respond favorably to your requests.
2. People acting on behalf of our customers or suppliers
1) Data or categories of personal data processed by the company:
Name and surname, position, job, signature, telephone, mail, work schedule
2) Purposes for which personal data are processed:
To negotiate, conclude or execute a business contract with the company / organization represented by you.
3) Legal bases for the processing of personal data:
U. E. Regulation no. 679/2016 art. 6, paragraph (1)
letter b – processing is necessary for the performance of a contract to which the data subject is party or in order to make steps at the requests of the data subject prior to entering into a contract;
or/and
letter c – the processing is necessary in order to fulfill a legal obligation incumbent upon the operator ( the trading company Antibiotice S.A.)
4) How long we keep personal data:
For a period of 10 (ten) years after termination of the contract or as long as the data are necessary to fulfill the purpose for which they were collected.
5) Recipients or categories of recipients of personal data:
The data will be processed exclusively within the company Antibiotice S.A. and only for the purpose for which they were transmitted, except when they are necessary to resolve legal disputes or are subject to lawful requests of the public authorities.
6) Consequences of refusing to provide personal data:
The information represents a minimum necessary for the conclusion or execution of a contract.
3. The patients and medical staff involved in the pharmacovigilance activity
1) Data or categories of personal data processed by the company
Patients: consultation sheet / medical record number, gender, age, date of birth, time-to-onset of adverse drug reaction, duration, effect of the adverse reaction (death, disability, etc.), description of the adverse reaction, medications administered, route of administration, time of administration, the disease for which the medicines were administered, way of treating the side effects, recovery after the adverse reaction, if the administration of suspected drug has been resumed, any other information such as the case history, allergies, etc.
Information about the person submitting the form: first and last name, specialty, telephone, date, address of the health unit.
2) Purposes for which personal data are processed:
to comply with the legal obligation of monitoring and reporting the adverse reactions related to the medicines from the Antibiotice portfolio.
3) Legal bases for the processing of personal data:
U. E. Regulation no. 679/2016, art. 9, paragraph (2) letter i – public interest in the field of public health, such as, […] ensuring high quality and safety standards for medicines or medical devices.
4) How long we keep personal data:
10 years from the expiry time or withdrawal of the Marketing Authorization of the product.
5) Recipients or categories of recipients of personal data:
International regulatory authorities in the pharmaceutical field.
4. Healthcare professionals
1) Data or categories of personal data processed by the company:
Name and surname, position, field of study, professional rank, institution where you carry out your professional activity and its address, your contact details (telephone, e-mail – when we have them) and if, applicable, the work program.
If you have at least one contract concluded with Antibiotice S.A, and depending on its nature, we can process data additional to those specified above: profession, scientific title, domicile, signature, seal, seal code, PIN, series and number of the identity card, your membership to a professional association and its contact details, information in your CV, bank account and the financial institution where you have opened the account, whether or not you are tax registered, as well as any other information needed to conclude the contracts, reports on the fulfillment of contractual obligations, photo and video images (as a result of your participation in different events).
We also process data provided by you through the questionnaires you choose to fill in and the forms through which you register for events where the company is an organizer or sponsor.
2) We process personal data for the purposes of:
- providing you with answers to your requests (related to our products, our activity or to the reports on adverse effects of the products from the Antibiotice’s portfolio). on the legal bases set out below in points (1), (2)
- complying with the legal and regulatory authorities provisions. on the legal basis set out below in point 1
- entering a contract where you are part of or represent the company. on the legal basis set out below in point (3)
- providing you with information about our products and services. the legal basis set out below in point (4)
- informing you about the events we organize. on the legal basis set out below in point (4)
- improving our products and services. We include here marketing research, such as, for example: customer satisfaction, company or product brand awareness on the legal basis set out below in point (4)
3) Legal bases for the processing of personal data:
U. E. Regulation no. 679/2016 art. 6, paragraph (1)
(1) letter b – processing is necessary for the performance of a contract to which the data subject is party or in order to make steps at the requests of the data subject prior to entering into a contract;
(2)letter c – the processing is necessary for compliance with legal obligation of the operator;
(3) letter d – processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(4)letter f – processing is necessary for the legitimate interests pursued by the operator.
4) How long we keep personal data
For the period of time provided by the legislation in force or until the fulfillment of the purposes for which they were collected.
5) Recipients or categories of recipients of personal data
These data are not transmitted and we do not intend to transmit them to international organizations or companies outside Romania.
5. Candidates for the vacancies within Antibiotice S.A.
1) Data or categories of personal data processed by the company:
Those offered by you in your CV, letter of intent and other supporting documents (e.g. diplomas) such as, but not limited to: first and last name, address, telephone, mail, current occupation, professional experience, studies, skills (linguistic, communication, managerial, IT, etc.) type (s) of driving license (s) held, certifications obtained.
2) Purposes for which personal data are processed:
To attract staff within the company Antibiotice S.A. (to contact you for employment or participation in the selection).
3) Legal bases for the processing of personal data:
The E.U. Regulation no. 679/2016 art. 6, paragraph (1) letter b – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
4) How long we keep personal data:
For a period of up to 6 months.
5) Recipients or categories of recipients of personal data:
The recruitment stage does not involve the transmission of your data to third parties.
6) Consequences of refusing to provide personal data:
In case of non-provision of data, participation in the selection and implicitly the conclusion of an individual employment contract will not be possible.
1. PERSONAL DATA OR DATA CATEGORIES PROCESSED BY OUR COMPANY
We generally collect the personal data directly from you. However, there are situations in which we can receive personal data from other sources, such as:
– personal data or access to these data received from our clients and partners, legal entities, public institutions and aothorities, third parties or public information sources, etc.;
– the form for reporting adverse drug reactions may be recorded at our company or may be communicated to us by third parties (NAMMD, pharmacies, doctors, etc.);
– BVB, Central Depository, ASF in relation to investors, as the case may be.
Our policy is to collect only personal data required for the agreed purposes and we ask our clients to communicate personal data only where strictly necessary for these purposes.
Due to the variety of products and services we offer, we can process multiple categories of personal data, depending on the type of product / service / activity / purpose of the processing.
The main data/ categories of data processed by the Company may, depending on the case and on the purposes associated with the processing, be one or more of the following:
– General: such as but not limited to:
– identity data such as, but not limited to surname, first name, serial number and ID number / civil status number, etc.
– contact data such as, but not limited to e-mail address, home/residence address, telephone number, etc.
– data related to the profession, status as a representative of a legal person, work place, data included in CVs, etc.;
– video images in the areas used by the Company or related to the events organized by the Company;
– data obtained as a result of your physical or online access to the Company’s sites (data from the access system within the Company’s areas, the on-line identifier of the persons accessing the Company’s site processed for the purposes mentioned in the cookies policy (for more information visit www.antibiotice.ro), potential data received through social networking sites (e.g. Facebook);
– unique identification number (e.g. PIN – personal identification number;
– information from criminal records, where appropriate,
– the stamp’s code, where appropriate.
– Special: such as but not limited to genetic data, biometric data, health data.
2 .PURPOSES FOR WHICH THE PERSONAL DATA ARE PROCESSED
Our company processes personal data for the purposes stated in this informative note, using for each purpose one or more data processing operations Our company processes personal data for multiple purposes, and procedures for collection, legal basis of processing, use, disclosure, storage periods, etc. may be different depending on each purpose.
We can use personal data for one or more of the purposes described in this informative note. If the Company subsequently processes your personal data for purposes other than those you have already been informed of and which are incompatible with the purposes for which the data were initially collected, the Company will provide information on that secondary purpose and any additional relevant information.
We mainly use the personal data for the following purposes:
– Fulfillment of the Company’s object of activity, supply of goods and services , especially related to the activity of developing and manufacturing pharmaceutical products of human use (production, sale, testing, etc.) as well as other related activities;
– Pharmacovigilance activity , specific medical documentation;
– Managing our commercial relations with customers, suppliers, distributors of pharmaceutical products, medical and/or pharmaceutical professionals, etc., enhancing the Company’s activity and services in relation to our clients, suppliers and partners, correspondence, offers, negotiations, management of contracts;
We processes personal data in order to fulfill the contractual obligations and commitments assumed towards you.
– Managing relationships with our investors in order to meet their needs and requirements, as well as fulfilling the obligations related to the capital market trading requirements;
– Managing the risks associated with our activity by taking security measures to protect personal data, which involves detecting, investigating and solving security threats.
– In accordance with the law in force, we use our clients’ and partners’ contact details to provide directly or indirectly information that we consider of interest to them. We can process personal data for organizing dedicated events, conferences, marketing activities such as promotion or marketing research, but not limited to them.
– If you visit our websites or our social networking pages, it is possible for us to process some information about the visitor’s online identifier for the purposes mentioned in the Cookies Policy (for more information visit www.antibiotice.ro) ;
– Meeting some legal /regulation requirements, such as those of a fiscal nature or those required by special normative acts that regulate our object of activity or, as the case may be, archiving procedure;
– Economic, financial, administrative management;
– Ascertaining, exercising or defensing a right in court;
– Internal statistics.
3. LEGAL BASIS AND LEGAL CONDITIONS ON WHICH DATA PROCESSING IS BASED
Legal bases of data processing take into account the provisions of the Regulation EU 2016/679 and the normative acts adopted in Romania regarding the processing of personal data, but also other normative acts applicable at national and European level.
The processing shall be based on at least one of the following legal requirements:
– processing may be necessary to conclude a legal report / contract and / or to execute it;
– processing may be necessary to meet a legal obligation of the Company;
– processing may be necessary to carry out a task which is of public interest;
– processing is necessary for the legitimate interests pursued by the Company or a third party, namely:
– to manage our activity;
– to manage the risks related to our activity;
– to manage our business relationshisps with the potential clients or business partners, including but not limited to transmitting communications containing information and offers about our services and / or products, as well as those of our partners, under the terms of the law, about organizing specialized conferences and presentations of our products;
– to handle the complaints about our products, in order to be able to resolve any issues raised, namely to improve our products and / or services, to acknowledge, exercise or defense of a right in court;
– processing can be based on your consent, in the cases expressly provided by the Regulation.
4. HOW LONG DO WE KEEP THE PERSONAL DATA?
We keep the processed personal data for the period of time required by law as long as it is necessary for the purpose for which they were collected, such as:
– During the performance of the contract / legal relationship for the personal data necessary for its execution, including the personal data with which the Company may enter into contact in the conduct of the legal relationship;
– Until the expiry of the limitation period, in respect of cases in which the Company would have a legitimate interest in retaining certain personal data in connection with a potential litigation that might arise between the parties;
– During the management of the relationship with the potential clients / recipients of our products / partners of the Company and their representatives, until the exercise of the opt-out clause, for the transmission of communications containing information and offers regarding our services and / or products , business communications, invitations to events such as symposiums, conferences, presentations, etc .;
– Until the withdrawal of consent for the processing of personal data solely based on consent;
– 30 days for video monitoring images and 2 years respectively for the call-center audio recordings and data from the access system in the areas belonging to Antibiotice SA, as the case may be.
In any other hypotheses or in the absence of specific legal, regulatory or contractual requirements, our reference period for the storage of personal data is 3 years from the date of ceasing the relationship / last contact between the Company and the person in question. Any data may be kept by the Company, by way of exception from the previous provisions, if applicable, until the expiry of the limitation period, as regards the circumstances in which the Company would have a legitimate interest in retaining certain personal data for a potential dispute that may arise between the parties, for example in the context of the possible engagement of the legal liability of Antibiotice SA or of the person targeted by the processing. In any case, except as provided by applicable law, we will delete your data at the time you request it. The applicable exceptions will be communicated to the applicant through the response submitted by our company to the request for data deletion.
5. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF THE PERSONAL DATA
In principle, the company may transmit / grant access / disclose the personal data to the following categories of entities:
– public authorities and entities (such as the fiscal authorities, NAMMD, CNVM, ASF, BVB, etc);
– commercial partners (distributors of pharmaceutical products, medical and / or pharmaceutical professionals, etc.)
– service providers and / or empowered persons who process personal data on behalf of the Company in accordance with the instructions received from us and only if they comply with this informative note, data protection laws and any other appropriate privacy and security measures (such as specialized event organizers, marketing service providers, access and video monitoring, IT service providers who can access personal data, etc.)
Transfers and disclosures will not be made to entities outside Romania or European Union. If the Company transmits your personal data to a third country or to an international organization, we will ensure ourselves that these are properly protected and that we transmit data in a country that provides an adequate level of protection, in compliance with the evaluation made by the European Commission or, if it is considered that the country does not have laws equivalent to EU data protection standards, we will require the third party to conclude a legally binding contract / agreement / instrument that reflects the compliance with these standards or provide other appropriate warranties in this sense.
6. CONSEQUENCES OF A REFUSAL TO SUPPLY PERSONAL DATA
If personal data are collected directly from you, we hereby notify you that you are not normally required to provide your personal data to the Company, except when providing them constitutes a legal or contractual obligation or a necessary obligation to conclude a contract. Thus, insofar as you enter a legal relationship with the Company or otherwise benefit from our services / products, the provision of personal data is a necessity from the perspective of legal requirements and / or our legal relationship, because this information is necessary to meet the obligations assumed by the Company in relation to you or for supplying our products and / or services.
Through this Note, you have taken note of the information provided by Antibiotice S.A. in the light of the Regulation 679/2016 and you have been informed of the rights conferred by the Regulation and by the Romanian Law on the protection of individuals with regard to the processing of personal data and their free movement.
II. YOUR RIGHTS AND THEIR EXERCISE
Our company is responsible for facilitating the exercise of any of your rights listed below. For exercising these rights, as well as any further questions regarding this notification, or in connection with the use of the Personal Data by the Company, please contact us by choosing any of the means of communication described in Section I of this informative note.
In order to protect your data, to prevent the abuse of bad people who would intend to access your data, our company may require you to go through some identification steps in advance to ensure that you are the person who will exercise your below mentioned rights by means of an application. If we receive a request from you regarding the exercise of any of your rights, we may request you to give us additional information to verify your identity before acting on the basis of your request.
If the targeted person submits an electronic application for exercising his/ her rights, information will also be provided by our company in electronic format where possible, unless the targeted person requests a different format.
In the event that, as a result of applying the legal provisions, our company is not able, in whole or in part, to honour a request of the person targeted by the data processing, the applicable exceptions will be communicated to the applicant through the response sent to him by the company in connection with the application in question.
Access right You have the access right, namely to obtain from the Company a confirmation that it processes or not personal data that concern you. Upon your request, the Company provides you with a copy of the processed personal data.
Right to data rectification You have the right to obtain from the Company, without undue delay, the rectification of inaccurate personal data. Taking into account the purposes for which data were processed, you have the right to obtain the completion of personal data, including by providing a supplementary statement.
Right to delete data You have the right to obtain from the Company the deletion of your personal data, without undue delay, except for certain assumptions specified in the Regulation, if one of the following reasons applies:
a) personal data are no longer required for the purposes for which they were collected or processed;
b) you withdraw your consent based on which processing takes place to the extent in which the processing is based solely on consent and there is no other legal basis for the processing;
c) you object to the processing done for the purposes of a public interest or legitimate interests of the Company or of a third party and there are no legitimate reasons to prevail over your fundamental interests/rights and freedoms as regards the processing or you object to the processing for direct marketing purposes;
d) personal data were illegally processed;
e) personal data must be erased in order to comply with a legal obligation of the Company under the EU or domestic legislation;
f) other situations provided by the Regulation insofar as they are applicable.
Right to restrict the processing
You have the right to obtain the restriction of the processing in the cases expressly provided for in the Regulation (for example, if you challenge the accuracy of the data, the restriction of processing will be granted for the period necessary to verify the contested data).
Right to data portability
You have the right to receive your personal data you supplied to the company in a structured format, currently used and automatically readable and to transmit them to another operator, without any obstacles on the part of the Company, under the conditions expressly provided by the Regulation.
In the case of exercising the right to the personal data portability, these can be directly sent by the Company to another data controller specifically indicated by you, if this is feasible from a technical point of view.
Right of objection
At any time, you have the right to object to the processing of your personal data. In this case, the Company will no longer process your personal data, unless it proves that it has legitimate and compelling reasons that justify processing which prevail over your interests, rights and freedoms, or that the purpose is to establish, exercise or defend a right in court.
When direct processing is aimed at direct marketing (including profile creation), you have the right to object at any time to the processing of your personal data.
Right to withdraw consent If processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing under consent prior to its withdrawal. The withdrawal of consent is not applicable in cases where the data processing is not based on consent.
III. RIGHT TO SUBMIT A COMPLAINT
If you wish to complain about matters relating to the use of your personal data, please submit your complaint using any of the contact details provided in Section I of this informative note. Any complaint will be reviewed within a reasonable time, the claimant receiving an answer from the Company within the legal deadlines.
You also have the right to file a complaint with the National Authority for the Supervision of Personal Data Processing (ANSPDCP).