The Company Menarini Diagnósticos, S.A. (“Company”, or “we”) takes its users’ privacy very seriously and undertakes to comply in full with the applicable law (Regulation (EU) 2016/679 – hereinafter defined as the “GDPR”).
Data Controller and DPO
The Data Controller is Menarini Diagnósticos, S.A., with registered offices in Avda. del Maresme 120, 08918 Badalona, Barcelona, Spain (“Controller”). E-mail: email@example.com
The Data Protection Officer (“DPO”) can be contacted at the following address: firstname.lastname@example.org.
The Data we process
The following data can be processed:
2) Special categories of data such as those relating to health status (Article 9 of the GDPR). Where that occurs, processing is performed on the basis of the user’s consent, to comply with the obligations connected to adverse event reporting, to fulfil legal or regulatory obligations or contractual or pre-contractual obligations involving the supply of goods or services (including requests for information on our products and their correct use). In any event, the legal basis for processing of particular categories of data is Article 9.2 (a) and (i) of the GDPR.
Why and how we process your personal data
With your consent, the Company may process your ordinary personal data to enable you to benefit from the available services and functionalities and optimise their performance, to perform statistics on its usage, to manage requests and reports received through the Website, to manage your registration to any restricted-access areas and initiatives (e.g. competitions) which may be present on the Website pursuant to Article 6.1.a of the GDPR. The Company may also process your personal data to fulfil obligations stemming from laws, regulations and European Union law: the legal basis for the processing for this purpose is Article 6.1. (c) of the GDPR.
Furthermore, your ordinary and sensitive data may be processed by the Company to handle notifications of adverse events (i.e. so called device vigilance), pursuant arts. 9.2.(a), (g) and (i) of the GDPR.
Finally, the Company may process your ordinary and sensitive personal data to protect its rights in legal proceedings or to apply the Menarini Group Code of Conduct (Articles 6.1.(f) and 9.2.(f) of the GDPR).
You may not share personal data of third parties with us unless you have an appropriate legal basis to do so (e.g. consent, fulfilling a legal obligation, etc.) and you have adequately informed such third parties, where required by the GDPR.
All your data are processed using automatic and electronic instruments suitable to ensure full security and confidentiality.
Necessary processing and optional processing
The forms to be completed on this website require you to confer personal data which are strictly necessary to handle your communications and requests. Such Data are marked with an asterisk [*]. If you do not wish to confer them, we will not be able to handle your communication/request.
Conversely, forms may also provide the possibility to confer personal data which are not strictly necessary to handle your requests: providing such data is optional - failure to do so has no consequence.
Links to other websites
How we store data and for how long
In compliance with Article 5.1.(c) of the GDPR, the computers and programmes used by the Company are set up in such a way to reduce the use of personal and identifying data to a minimum. Such data are processed only to the extent required to achieve the purposes indicated in this Policy, and will be stored for as long as strictly necessary for achievement of the specific purposes pursued - in any event, the criterion used to determine the storage period is based on compliance with time limits permitted by law and the principles of data minimisation, storage limitation or rational management of our records.
How we ensure your personal data’s security and quality
The Company undertakes to ensure security of the user’s personal data and comply with provisions on security provided by law to avoid data loss, illegitimate or unlawful uses of data or unauthorised access to data, with particular but not exclusive reference to Articles 25-32 of the GDPR. The Company uses many types of advanced security technologies and procedures intended to aid protection of the user’s personal data; for example, personal data are stored on secure servers situated on premises with protected and controlled access. The user can assist the Company to update and correct their personal data by communicating any change of address, qualifications, contact information, etc.
Persons who have access to the data
Persons belonging to the following categories are authorised to process the user’s data: technical and administrative staff, IT staff, internal audit and compliance staff, product managers, device vigilance staff, as well as other staff members who require processing the data for performance of their job duties.
The Data can be communicated also in countries outside the EU (“Third Countries”) to other companies of the Menarini Group for the same purposes and/or for administrative and accounting purposes pursuant to Article 6.1.(f) and Recital 48 of the GDPR.
Additionally, the Data can be communicated, also in Third Countries, to: (i) institutions, authorities, public bodies for their institutional purposes; (ii) professionals, independent consultants –working individually or in partnerships- and other third parties and providers which supply to the Company commercial, professional or technical services required to operate the Website (e.g., provision of IT and Cloud Computing services) for the purposes specified above and to support the Company with the provision of the services you requested; (iii) third parties in the event of mergers, acquisitions, transfers of business -or branches thereof-, audits or other extraordinary operations; (iv) company supervisory bodies, based at the Controller’s address, in the pursuit of their activities (oversight over the enforcement of legal obligations, ethical standards, the Menarini Group’s Code of Conduct, etc.). The mentioned recipients shall only receive the Data necessary for their respective functions and shall duly undertake to process them only for the purposes indicated above and in compliance with data protection laws. The Data can furthermore be communicated to the other legitimate recipients identified from time to time by the applicable laws. With the exception of the foregoing, the Data shall not be shared with third parties, whether legal or natural persons, who do not perform any function of a commercial, professional or technical nature for the Controller and shall not be disseminated. The parties who receive the Data shall perform processing as Data Controller, Processor or persons authorised to process personal data, as the case may be, for the purposes indicated above and in compliance with the applicable data protection law.
Regarding any transfer of Data outside the EU, including in countries whose laws do not guarantee the same level of protection to personal data privacy as that afforded by EU Law, the Controller informs that the transfer shall in any event take place in accordance with the methods permitted by the GDPR, such as, for example, on the basis of the user’s consent, on the basis of the Standard Contractual Clauses approved by the European Commission, by selecting parties enrolled in international programmes for free movement of data (e.g. EU-USA Privacy Shield) or operating in countries considered safe by the European Commission.
You may at any time exercise the rights afforded by Articles 15-22 of the GDPR, including the right to obtain confirmation of the existence of personal data which relate to you, check its content, origin, correctness, location (also with reference to any Third Countries), request a copy, request correction and in cases provided by law, restriction of processing, deletion, oppose to direct contact activities (also limited to particular means of communication). Likewise, you may always withdraw consent and/or make observations on specific issues regarding processing operations of your personal data which you regard as incorrect or unjustified by your relationship with the Company, or lodge a complaint with the Data Protection Authority. You may contact the Controller (email@example.com) and/or DPO at the addresses displayed above to make any requests regarding personal data processing by the Company, to exercise your legal rights and to obtain an updated list of the parties who have access to your data.