Last update: April 2021
Dear Consumer,
With this privacy policy we would like to inform you about
The responsible body for data processing (data controller) in the sense given in the GDPR is:
Bionorica SE
Kerschensteinerstr. 11–15
92318 Neumarkt, Germany
Phone: +49 (0) 9181 231-90
Fax: +49 (0) 9181 231-265
E-mail: info@bionorica.de
Our company data protection officer can be reached via email at datenschutz@bionorica.de or by post at the above address (please include the line ‘ATTENTION: Data Protection Officer’).
As parent company of the Bionorica group we pursuant of a consistent corporate controlling provide different services for our subsidiaries (e.g. cross-company IT-, communication- and database-systems, central HR or financial accounting services as similar activities at our headquarter in Neumarkt) and also process personal data in this context.
In terms of data protection law, this processing is carried out under the joint responsibility of Bionorica SE and the respective subsidiary in accordance with Art. 26 GDPR. The following key points apply to joint processing:
We would be happy to provide you with an extract from our "Agreement on the joint processing of personal data in accordance with Art. 26 GDPR". For this purpose, please also contact the above-mentioned contact.
As a consumer you are in principle not obligated to provide us with personal data. Exceptions can arise, for example, with the use of our online services on the internet sites of Bionorica SE. In this context we refer to the corresponding privacy policy. It can be found on our website and all microsites.
We only process personal data which we receive from you personally (e.g. when reporting adverse drug reactions (ADRs)). An exception are ADR reports which we receive from members of the professional circles (e.g. doctors and pharmacists) if you provide them with personal data and declared your consent to their transmission to us.
The personal data which we process include in particular:
We process personal data in accordance with the provisions of the European General Data Protection Regulation (EU GDPR) and the German Federal Data Protection Act (BDSG) according to the following legal bases:
As far as necessary, we process personal data beyond the scope of performance of the contract for protecting our legitimate interests.
This particularly covers the following activities and processes:
If you granted us or a member of the professional circles consent to process personal data for specific purposes (e.g. within the scope of reporting adverse drug reactions), this processing is lawful based on this consent.
After granting your consent, you can withdraw it at any time. This also applies to the withdrawal of declarations of consent given to us before the GDPR came into effect. Please note that withdrawal of your consent does not affect the lawfulness of processing carried out up to the time of withdrawal.
You can withdraw consent free of charge by sending a formless statement to the contact given in Section 1. If you withdraw your consent by telephone, we may ask you to provide additional proof of your identity in another way.
We do not use any processes for automated decision-making.
Within Bionorica SE, those offices and departments requiring your data for the fulfilment of the task covered by your consent receive your data. Carefully selected and controlled service providers employed by us may also receive data for these purposes, but within the scope of so-called contract data processing they are obligated to meet the data protection requirements that are also applicable to us. For example, companies in the fields of IT services or telecommunications.
A transfer to recipients outside of Bionorica only takes place if there is a legal basis (e.g. consent).
Data are only transferred to locations in countries outside the European Union (so-called third countries) if, in addition to general requirements for data transfer, there is also an adequacy decision (Art. 45 GDPR) or appropriate safeguards (Art. 46 GDPR) and, if necessary, additional measures are taken or the requirements of Art. 49 are fulfilled (for example, the corresponding consent).
We process your personal data only as long as necessary to fulfill the processing purposes described above. Once the data are no longer needed for this purpose, they are erased unless their further processing is necessary – for a limited period – for the following purposes:
As a data subject you have the right to access pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. GDPR, the right to restriction of processing pursuant to Art. 18 GDPR and the right to data portability according to Art. 20 GDPR. With respect to the right to access and the right to erasure, the limitations set forth in Sections 34 and 35 BDSG apply. You also have the right to lodge a complaint with a responsible data protection supervisory authority (Art. 77 in conjunction with Section 19 BDSG).
You also have the right to object under Art. 21 GDPR. You can object to the processing of personal data on the basis of Art. 6 para. 1 lit. e or f GDPR at any time without giving reasons.