Privacy Notice

This privacy notice was last updated on July 2023

Kyowa Kirin International UK HoldCo Ltd. (soon to be renamed as KKI Grünenthal UK HoldCo Ltd.) and Kyowa Kirin International UK NewCo Ltd. (together known as “Grünenthal Meds”) is the controller of your personal data. Grünenthal Meds commits to protecting your privacy and personal data in accordance with this Privacy Notice. This Privacy Notice is addressed to all visitors of our website and individuals we may interact with offline or online. It is meant to help you understand what personal data we collect, how and why we collect it, and how you can exercise your data protection rights including, where applicable, a right to object to the processing we carry out. “Personal data” in this Privacy Policy is any information relating to an identified or identifiable natural person, by direct or indirect means.

I. Categories of Personal Data We Collect

In connection with our business, for the purpose of responding to your questions about our company and/or our products etc., we collect the following personal data.

Categories of data subject

Healthcare Professionals (HCPs): Doctors, nurses, other health care professionals;
Business Partners: Vendors, Contractors, suppliers, other business partners along with their representatives or staff members;
Patients: Patients (former or current), potential patients, parents or guardians and caregivers and members and staff of patient advocacy groups; and
Members of the Public: users of public-facing websites, mobile apps, other online platforms, or who attend our business or premises, job applicants

Categories of personal data

Contact information
- For example, your name, age, gender, username, address, telephone numbers, e-mail address, nationality, and any other registration information you provide on our website.
Financial details
- For example, bank account information, payment card details, payment details, income tax details, transaction data, billing information, tax numbers, tax administrative data.
Special Categories of Personal Data
- For example, data concerning health, genetic data, biometric data, data revealing racial or ethnic origin, data concerning sex life or sexual orientation whether through clinical trial program or otherwise.
Technical and usage information
- For example, information collected during your visits to our website(s), the Internet Protocol (IP) address, login data, browser type and version, device type, time zone setting, browser plug-in types and versions, operating system and platform, your preferences in receiving marketing information from us, your communication preferences and information about how you use our websites(s) and services, including the services you viewed or searched for, page response times, download errors, length of visits and page interaction information (such as scrolling, clicks, and mouse-overs). More details on our use of cookies can be found in our Cookie Notice.
Professional information
- For example, occupation, place of work, professional registration number, professional background and interests, medical specialisation, professional memberships and affiliations.
Employment and business information
- For example, your position and employer, your work contact details and your interaction with us in your role, including information provided in the course of the contractual or client relationship between you or your organisation and Grünenthal Meds, or otherwise voluntarily provided by you or your organisation.
Communications content
- For example, any other information you may provide in your communications with us.

II. How we collect your data

We will collect data from you, companies or organisations to which you belong, or from websites or other media to which you have registered to disclose information. We may also collect personal data from the following sources:

We may receive information about you if you use any of the other websites we operate or the other services that we provide.
We may receive information about you from healthcare professionals or pharmacies as a result of an Adverse Event report or complaint.
We also work with third parties (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, social listening providers and credit reference agencies) and may receive information about you from them. If you are a health care professional, we receive information about your professional life (such as medical specialisation and professional background) from data suppliers, such as IQVIA.
We may receive information if you have provided permission to other organisations to share it with us. Before providing permission to such third party organisations to share your personal data, you should check their privacy policies carefully.
We may take information from publicly available sources (where possible) to keep your information up to date, for example, from professional registration databases.
We may occasionally purchase the contact information of people who might be interested in hearing from us. Before purchasing such information, we will check with the vendor to ensure that your information was originally collected in a compliant manner, to make sure that we only contact people who have actively expressed an interest in receiving information from third parties.
We may receive information about you from recruiters if you seek a role at Grünenthal Meds.

III. Legal Basis for Processing

We are required to have a lawful basis to process your data. We explain each of these legal bases below. We also set out the purposes for which we process your data. For each purpose, we explain the legal bases for that processing, the processing operations that we carry out and the categories of data that we use in each case.

Legal bases relied upon by Grünenthal Meds for the processing described in this Privacy Notice:

where we rely on your consent to process your data;
processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;
processing is necessary for compliance with a legal obligation to which we are subject (e.g., when following the information disclosure orders based upon laws and regulations announced by government agencies);
processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms.

We may, on a case-by-case basis, rely on other legal grounds in accordance with applicable data protection law, as set forth in an applicable privacy policy.

IV. Purposes of Processing

We use information held about you in the following ways as set out in the below table, relating to your online and offline interactions with us regarding our services, products and wider business activities. Data that is mandatory is indicated on relevant forms that you complete or communicated by us separately. Where provision of data is mandatory, if relevant data is not provided, then we will not be able to fulfil your requests. All other provision of your information is optional:

Purpose of processing	Data subject	Categories of personal data	Legal basis
To manage and administer our contractual relationship with you, entering into and to carry out our obligations arising from any contracts entered into between you and us, including processing payments and transactions	HCPs, Patients, Business Partners	Contact information, employment and business information, financial information, communications content	This processing is necessary for the performance of a contract to which you or your employer are party, or in order to take steps at your request prior to entering into a contract. Sometimes, we rely on legal obligations under medical laws.
To respond to your requests and questions about our company and/or products, to notify you about changes to our service	HCPs, Patients, Business Partners	Contact information, communications content	This processing is necessary for the performance of a contract to which you or your employer are party It is in our legitimate interests to respond to your queries.
To manage our relationship with you as a relevant contact of our business, and to record your interactions with our events and representatives	HCPs, Patients, Business Partners, Members of the public	Contact information, employment and business information, Professional information, communications content	It is in our legitimate interests to collect and use your personal data about your interactions with Grünenthal Meds to ensure that we best manage our relationship with you.
To contact me via e-mail, phone, remote calls, web meetings, fax, text or multimedia messages or similar means, to provide me with marketing and scientific information, and to carry out market research in relation to Grünenthal Meds' medicinal products, services, events and other activities and create an individual customer profile based on my digital interactions in order to customize and improve my customer experience and the communication with me, e.g. by offering me specific events, other activities, medicinal products and services of Grünenthal Meds based on my preferences and interests	HCPs, Patients, Business Partners, Members of the Public	Contact information, technical and usage information, Professional information, communications content	We rely on your consent for this processing.
To conduct research and development including clinical trials	HCPs, Patients, Business Partners, Members of the Public	Contact information, technical and usage information, Professional information, communications content	This processing is based on the necessity for our legitimate interests for the purposes of improving health care products and services and conducting scientific research. As a pharmaceutical company we have a legitimate interest in using information relating to your health and care for clinical trial you agree to take part in. We process special category data for the purpose of scientific research. Some of our processing in connection with clinical studies is also necessary when we have a respective legal obligation under medical laws. Under limited circumstances, where this is required by applicable law, we will rely on your (explicit) consent. More details about our processing and lawful basis for a specific study in which you participate will be available in study specific documentation.
To manage and follow up on Adverse Events reports and carry out our responsibilities under quality assurance laws	HCPs, Patients	Contact information, special category data	We are required to carry out this processing on the basis of legal obligations, such as pharmacovigilance rules or good manufacturing practice rules. We process your special category data on the basis of rules established to ensure public health.
To improve our level of products and services	HCPs, Patients, Business Partners, Members of the Public	Contact information, special category data	It is in our legitimate interests to run our business and improve security of our products and services, administer, optimise and protect our products and services including troubleshooting, data analysis, testing, system maintenance, support, reporting, hosting of data and detect, investigate or prevent activities that may violate our policies or be illegal.
To consider your application for employment	HCPs, Business Partners, Member of the Public	Personal Details, professional data, employment and business data, communications content, special categories of data	It is in our legitimate interests to collect and use your personal data so we can process your application so that Grünenthal Meds can employ the best people. We store, and where needed, update, your personal information to make informed decisions on recruitment and assess your suitability for the role, to communicate with you about your application, to respond to your inquiries and schedule interviews, and to reimburse you for any agreed expenses incurred in the application process. We also have a legitimate interest in carrying out appropriate checks to verify the information provided by applicants. We verify the details you have supplied and, where applicable, conduct pre-employment background checks. We will ask for your consent where we are required to do so by law to carry out appropriate background screening.
To record, investigate and respond to complaints	HCPs, Patients, Business Partners, Member of the Public	Contact information, communications content, special categories of data	It is in our legitimate interests to collect and use your personal data to comply with any reporting requirements under applicable law in the event we become aware of an adverse event or product complaint, so that we may respond to requests to public agencies with jurisdiction over our products, and to contact you for further information about the adverse event or product complaint.
To run our business and protect our legal interests	HCPs, Patients, Business Partners, Member of the Public	Contact information, professional data, communications content, special categories of data	It is in our legitimate interests to collect and use your personal data to protect our legitimate business interests and legal rights – for example, in connection with legal claims, dispute resolution compliance, regulatory, auditing, investigative purposes and to respond to legal requests.
To deploy cookies and similar technologies [please see link for more information]	HCPs, Patients, Business Partners, Member of the Public	Technical and usage information	We will ask for your consent to place cookies and similar technologies. We may also rely on our legitimate interests to process cookies and similar technologies.

V. Recipients of Personal Data

We may share your personal information with any member of our group for the above purposes only.

Members of our group:

Kyowa Kirin International NewCo Netherlands B.V.
Kyowa Kirin International NewCo France S.A.S.
Kyowa Kirin International NewCo Germany GmbH
KKI NewCo Spain S.L.
Kyowa Kirin International NewCo Italy S.r.l.
Kyowa Kirin International NewCo Ireland Ltd.
Kyowa Kirin International NewCo Sweden AB

We may share your information with selected third parties as necessary to achieve the purposes set out in this notice, including:

When we use other companies to provide services on our behalf, e.g. customer service providers, patient analysis, assessment and profiling providers and auditors or other professional advisors.
Business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you.
Analytics and search engine providers that assist us in the improvement and optimisation of our site.
IT service providers.
Clinical Research Organisations.
Healthcare Professionals.
Other organisations including universities, when we run an event in partnership with such other organisations. In such case, your personal data may need to be shared. We will be very clear about what will happen to your personal data when you register for such events.
A new entity or purchaser, in the case we merge with another organisation or form a new entity. In such case, your personal data may be transferred to that new entity and/ or purchaser, including their professional advisors.
Appropriate third parties where it is necessary to:
- Comply with any court order or other legal obligation or when data is requested by our regulators or by government agencies or law enforcement agencies or is required by any stock exchange rules where a member of the Kyowa Kirin Group is listed;
- Enforce or apply our terms of use and any other agreements;
- Protect the rights, property, or safety of us, our employees or others. This may include exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

VI. International Data Transfers

Because of the international nature of our business, we may transfer your personal data within our group companies, and to third parties as noted in Section V, in connection with the purposes set out in this privacy policy. This may require that your personal data are ultimately transferred a destination outside of your country of residence. In this context, we will take appropriate measures such as obligating the third party to conduct appropriate security management through a data protection agreement.

When your country of residence is EU/EEA or United Kingdom, depending on the way your personal data is processed, your personal data may also be transferred outside the EU/EEA or United Kingdom. In these cases, we ensure that an adequate level of data protection exists before transferring your personal data. This means that via EU or United Kingdom standard contractual clauses or an adequacy decision or other valid adequacy mechanism, a level of data protection is achieved that is comparable to the standards within the EU or United Kingdom. A copy of the relevant mechanism can be provided for your review on request by contacting us using the details set out below.

VII. Retention, Erasure, and Disposal

We will retain your personal data for the period necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by law. Where we process personal data to meet legal requirements, we hold this for as long as the law requires. After we achieve the purpose for which your personal data was collected, we erase or dispose of it appropriately, or anonymize it so that it can no longer identify an individual, based on our rules for processing your personal data.

Where we process personal data for marketing purposes or with your consent, we process the data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data indefinitely so that we can respect your request in future.

VIII. Your Rights

You have the following rights regarding the processing of your personal data.

Right to withdraw your consent at any time
Right to access to your personal data and related information
Right to rectification of your inaccurate personal data without undue delay. You also have the right to request us to complete the information you believe is incomplete.
Right to erasure of your personal data without undue delay and under certain conditions
Right to restriction of processing your personal data under certain conditions
Right to data portability – you have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
Right not to be subject to a decision based solely on automated processing, including profiling. We do not conduct automated decision-making, including profiling.
Right to lodge a complaint with a supervisory authority - You might have the right to lodge a complaint with a supervisory authority against the processing of your personal data if you believe that the processing of your personal data violates data protection regulations. If you are dissatisfied with the processing of your personal data, you can lodge a complaint to a supervisory authority, in particular in the EEA member states of your habitual residence, place of work, or place where infringement occurs.
In addition, you have the right to object to the processing of your personal data at any time:
- if we process your personal data for direct marketing purposes; or
- insofar as we process your personal data for the pursuit of our legitimate interests and there are grounds based on your particular situation.

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where it would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in applicable national laws, and we will inform you or applicable exemptions in our response to your request.

IX. Contact us

If you have any questions or wish to exercise your rights, contact us using the details below, or contact us through at dataprivacy.grt-meds@grunenthal.com.

You may contact us, and our Data Protection Officer, through the following methods:

E-mail: dpo-grunenthalmeds@kinast.eu
Address: Hohenzollernring 54, 50672 Cologne Germany

How useful was this page to you?

Average:

References

1. KKI/UK/GEN/0119 November 2023