Information notice pursuant to art.13 of Regulation EU 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, so-called “GDPR”)
Quality Assurance
INFORMATION NOTICE FOR QUALITY COMPLAINTS
In accordance with the current personal data protection regulations, IBSA Farmaceutici Italia Srl (hereinafter, the "IBSA” or “Company") as "Data Controller", is required to provide certain information regarding the use of your personal data.
1. Purpose of the personal data processing
Your personal data may be processed for the following purposes related to the management of product quality complaints:
a) identification of the quality defect of the product;
b) the recovery of contested samples;
c) feedback to the complainant on the outcome of the investigation and any further contacts in relation to the complaint.
2. Nature of the provision of the personal data and consent
We inform you that the processing of your personal data for the purpose referred to in point 1a and point 1b of this information is carried out pursuant to art. 6.1 lett. c) of the EU Regulation 2016/679. The provision of data is optional but essential for the achievement of the purpose itself, therefore the consent to the processing of Data for these purposes is not necessary as the treatment is essential for the fulfillment of a legal obligation to which IBSA Farmaceutici Italia Srl is obligated.
We inform you that the processing of your personal data for the purpose referred to in point 1c of this information is carried out pursuant to art. 6.1 lett. f) of the EU Regulation 2016/679. The provision of data is optional but indispensable for the achievement of the purpose itself, therefore the consent to the processing of the personal data is not necessary as there is a legitimate interest of IBSA Farmaceutici Italia Srl as the Data Controller of the personal data processing.
We also inform you that the processing operations connected to the management of the complaint could involve the processing of data relating to your state of health: as particular data. The condition that makes the processing legitimate is art. 9 par. 2 lett. i) of EU Regulation 2016/679.
3. How the data are processed
The data are processed through computer procedures or by automated means or paper by persons, internal or external, specifically assigned to this task and required to confidentiality with logic closely related to the purposes for which the data were collected in any case suitable to ensure the security and confidentiality of the data are protected by security measures provided by law, to prevent unauthorized access, loss or destruction.
4. How long the data are kept
The data will be kept for the time strictly necessary for the accomplishment of the purposes set out in this notice and in any event up to the statutory and legal time limit in compliance with the rights and the resulting obligations. In particular the retention time for your personal for above purposes referred to point 1a, point 1b and point 1c is 10 years, 15 years for complaints on implantable medical devices in addition to a further year to carry out the activities for the cancellation and / or deletion of data.
5. Scope of circulation of the data
The data may be used by personnel of the Company and of its parent company IBSA Institut Biochimique SA, that have been given appropriate operating instructions under an obligation of confidentiality. The data may also be used by third-party providing operational and additional services on behalf of the Company, which act as external data processors under the direction and supervision of the Company.
The list of the Data Processors is available by sending a request to privacy@ibsa.ch.
6. Communication of the data
In accordance with the laws and regulations that we are subject to, we may be required to communicate the data to the competent Authorities and healthcare associations in third countries outside the EU and to legitimate recipients in accordance with the law and the regulations. These parties will act as independent Data Controllers.
7. Transfer of the data abroad
The aforementioned personal data may be transferred to its parent company IBSA Institut Biochimique SA in Switzerland, solely for the purposes set out in paragraph 1. In accordance with the laws and regulations to which we are subject to, your personal data may also be communicated and/or transferred to organizations located in other countries, both in EU countries and outside the EU, including countries that may not provide the same level of protection as provided by the applicable legislation, we inform you that the transfer of data abroad is subject to specific guarantees for the protection of personal data through the adoption of standard contractual clauses.
8. Rights of the data subject
In relation to the processing of your personal data, you have the right to be informed at any time about your data held by the Company and how they are used. You also have the right to have the data updated, corrected or erased, to request their portability or restriction of processing, in the cases provided for by law, and to object to the processing of the data unless the Company has a legitimate interest in the data. To exercise your rights and to obtain more detailed information about the persons or categories of persons to whom the data are communicated and/or transferred or who become aware of the data as controllers or processors, you can contact us:
- by e-mail, at: privacy@ibsa.ch ;
- by post, at: IBSA Farmaceutici Italia Srl, Ufficio Privacy, via della Filanda 30 – 26900 Lodi (LO)– Italy.
Lastly, we remind you that you have the right to lodge a complaint with the Personal Data Protection Authority if you consider that your rights have not been respected or that you have not received a response to your requests in accordance with the law
9. Data Controller
The Data Controller is IBSA Farmaceutici Italia Srl with registered office in Via Martiri di Cefalonia, 2 – 26900 Lodi (LO), Italy.
10. Data Protection Officer
The Company has appointed a Data Protection Officer or DPO. The DPO can be contacted via the following communication channel: dpo@ibsa.it