Privacy Policy

Last update: January 2023

Almirall ApS («Almirall», «we», «us», «our») is committed to protecting and respecting your privacy.

This Privacy Policy (together with our Terms of Use, our Cookies Policy and any other documents referred to in it) sets out the basis on which any personal data we collect from you, when you navigate in this site (the «Site«), or that you provide to us on a voluntary basis, will be collected and processed by us.

By visiting our Site, you are accepting and consenting to the practices described in this policy.

1. Basic information

2. Additional information

2.1 Who is the controller of the data you provide?

The data controller for this Site is Almirall ApS addressed at Vandtårnsvej 77, 2860 Søborg- Denmark: company registration number TIN: DK3762891.

For more information about this document or how we process your personal data, you can contact our Global Data Protection Officer at the e-mail address dpo.global@almirall.com.

2.2 What kind of personal data we process?

We may collect and process the following data about you:

1. Information you give us. You may give us information about you through different forms available in the Site or by corresponding with us by phone, e-mail or otherwise. This includes information you provide to us for the following purposes:
   
   1. Report an adverse event.
   2. Medical information enquiries about our products.
   3. To solve your queries related to media, investors, R&D activities, partnering with Almirall and job opportunity enquiries.
   4. Feedback on any particular matter (i.e Report a problem with the Site).
   5. If you are a Supplier or a Partner of Almirall, we may process your personal data to manage our relationship and contracts with you and/or to check whether there is any conflict of interest or to ensure compliance with legal requirements or with our policies.

   We try to only collect the necessary information to process your request. The information you give us may include your name, surname, address, e-mail address, country, and phone number.

   In relation to drug safety, we may contact you to follow up the particular case reported and additional personal data might be collected for such purposes.

2. Information we collect about you. When you visit our Site, we may automatically collect the following information:
   • Using cookies: Cookies are pieces of information stored directly on the computer you are using. Cookies allow us to collect information such as browser type, time spent on the Site, pages visited, and language preferences. We and our service providers use the information for security purposes, to facilitate navigation and to display information more effectively. We also use cookies to recognize your computer or device, which makes your use of the Site easier and makes the Site display properly on your device. In addition, we use cookies to gather statistical information about Site usage in order to continually improve its design and functionality, understand how individuals use it, and to assist us with resolving questions regarding it. Some of our cookies are managed for us by third parties. You can refuse to accept these cookies by following your browser’s instructions; however, if you do not accept them, you may experience some inconvenience in your use of the Site. To learn more about cookies, please take a look to our Cookies Policy.
   • Through your browser: The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are: browser type and browser version, operating system used, deferrer URL, host name of the accessing computer, time of the server request and IP address.

   These data are not combined with other data sources.

   The provision of your personal data is voluntary (except where expressly stated). However, missing or incorrect mandatory personal data may make it impossible for Almirall to provide the information you have requested.

2.3 What uses are made of your information?

We use your personal data in the following ways:

1. Report an adverse event: At Almirall, our commitment to the safety of our medicines, cosmetics and healthcare products starts from the Research and Development (R & D) department. Therefore, we will use the personal data you provide us through the «Report an adverse event» form to identify, quantify, assess and prevent potential risks arising from the use of our products, as well as proactively contacting you to obtain further information about any case that you report. When contacted in the first instance you can choose to be contacted again or not, and if not, we will block contact with you on the database. All these activities are in compliance with our legal obligations with the Competent Authorities in the field. Please check our Drug Safety Privacy Policy for more details.
2. Medical information: As part of our obligation as pharmaceutical company, we also collect your personal data to respond to your enquiries related to our products.
3. General enquiries or feedback in relation to other matters: to solve your enquiries in relation to media, R&D activities, job opportunities and partnering with Almirall, or simply to receive your feedback.
4. Provide you access to specific information (product-related press releases, access to our webcasts, conferences and other presentations, etc.).
5. Relations with our Partners and Suppliers: The personal data we process from our partners or suppliers is generally limited to contact information (name, name of the organization, phone, email and other contact details) and financial information (payment-related information). In addition, we may also process some data to check whether there is any conflict of interest or to ensure compliance with legal requirements or with our policies.
6. Site maintenance: Part of the data is collected in order to ensure error-free provision of the Site and improve the services offered through the Site.

Your personal data will not be used for any other different purposes.

2.4 How long do we store your information for?

The personal data you provide to us will be stored and processed as follows:

1. Drug safety: The personal data provided will be kept in order to obtain follow up information relating to the case in accordance with our Drug Safety Privacy Policy.
2. Medical information: The personal data provided will kept for the time necessary in order to resolve your enquiry.
3. Solve your queries or receive your feedback in relation to other matters:the personal data provided will be kept for the time necessary to solve your query that will not exceed the maximum period of 30 days.
4. Access to specific materials and information: the personal data provided will be kept until you notify us that you want to cancel your access.
5. Relations with Partners or Suppliers: We will only retain Supplier’s personal data for as long as necessary to fulfil the purpose for which it was collected or to comply with legal or regulatory requirements. When this period expires, your personal data will be removed from our active systems.
6. Site maintenance: Part of the data is collected in order to ensure error-free provision of the Site, keep the Site safe and secure and improve the services offered through the Site to ensure content is presented effectively for you and your computer. The data retention period of the personal data you provide to us through the use of cookies is explained in our Cookies Policy.

2.5 Wich is our lawful basis to process your personal data?

The reasons why we use your personal data (indicated in section 4) and the lawful basis are the following:

1. Drug safety: We have a regulatory legal obligation in pharmacovigilance and cosmetovigilance and it also pursues an aim of public interest in the area of health (Arts. 6.1.c in connection with 9.2.i GDPR, when it requires to process special categories of data).
2. Medical information: We have a regulatory obligation as pharmaceutical company (Art. 6.1.c GDPR).
3. Solve your queries or receive your feedback: We have your consent when submitting your query or your comments (Art. 6.1.a GDPR).
4. Provide you access to specific materials or information: your consent (Art. 6.1.a GDPR).
5. Relations with Partners and Suppliers: depending on the circumstances, the processing can be based on the execution of a contract to which the data subject is party in case on an individual, or in our legitimate interest of conducting business with our partners and suppliers. Processing may also be necessary for compliance with a legal obligation to which Almirall is subject, as well as our legitimate interest or public interest in safeguarding any conflict of interests or to conduct investigations to avoid bribery or other illegal practices (Art. 6.1.b GDPR, 6.1.f and 6.1.e GDPR).
6. Site maintenance: the processing can be based on the execution of a contract or pre-contractual arrangement to which the data subject is party by means of our terms and conditions, we may have your consent and a legitimate business interest to run the site properly (Arts. 6.1.b, 6.1.a and 6.1.f GDPR)

In relation to the information, we gather through cookies from a technical perspective, we have a legitimate interest to run properly the Site. Other Cookies used for statistical purposes or to acquire an aggregate overview of our visitors shall be subject to consent, without making any predictions or drawing any conclusion about an individual. You can also visit our Cookies Policy for more information.

2.6 Who do we share your information with?

Except for legal obligation, your data will not be shared with third parties other than our services providers who help us to pursue our regulatory obligations and/or better provide you with the services or information requested (hereinafter, the «Recipients«).

Whenever information needs to be transferred to Recipients outside the European Economic Area to a country which has not received the decision of an adequate level of protection issued by the European Commission, personal data will be duly protected by standard contractual clauses approved by the European Commission or binding corporate rules of the data processor as well as any other adequate safeguards and supplementary measures, as necessary.

2.7 What are your rights as data subject and how you can exercise them?

You may exercise at any time any of the following rights:

1. Right of access: you can obtain access to your information.
2. Right to rectification: you are entitled to have your information corrected if it is inaccurate or incomplete.
3. Right to erasure: you can request the deletion or removal of the information concerning yourself where there is no compelling reason for an organisation to keep using it. This right is also known as «the right to be forgotten».
4. Right to restrict processing: you can ‘block’ or suppress further use of your information in certain circumstances. When processing is restricted, we may still store your information, but will not use it further.
5. Right to data portability: you can obtain and reuse your personal data for your own purposes across different services with a different data controller. If you request the direct transfer of the data to another data controller, this will only take place if it is technically feasible.
6. Right to object: you can object to certain types of processing, in certain circumstances.

If we have a legal or regulatory obligation to use your data, we will inform you that your consent withdrawal won’t be able to be fulfilled.

If you would like to exercise any of these rights, you can send us an electronic request to the following contact address, attaching a copy of your personal ID card/passport.

Additionally, you can contact with your local Data Protection Supervisory Authority for any claim related with the use of your personal data. You can find a list of the EU national Supervisory Authorities following this link: Our Members | European Data Protection Board (europa.eu).