Privacy Policy

Privacy Policy of ImunomedicA, a.s.

This document summarizes the principles of processing your personal data by ImunomedicA, a.s. and also provides information about your rights regarding the processed personal data and the ways to exercise them.

The protection of your personal data is very important to our company. Below you will find information about the protection and processing of your personal data, as well as the rights you can exercise in connection with the processing of personal data.

We process your personal data in accordance with the applicable legal regulations, especially in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “GDPR Regulation“).

Identification of the Data Controller

Company: ImunomedicA, a.s. (hereinafter also referred to as “Imunomedica”)

Company ID: 25009508

Registered Office: Chuderov 118, 400 02 Ústí nad Labem

E-mail: info@imunomedica.cz

Processed Personal Data and Their Source

Personal data refers to all information about an identified or identifiable natural person. In the course of our activities, the following personal data of yours may be processed:

  1. Identification data, especially name, surname, title, date of birth or birth number, identification document numbers, information about health insurance;
  2. Health-related data (including data whose processing is associated with obligations arising from anti-epidemic measures), which mainly include information about medical history, medications used, examinations performed, or adverse events. Since these are sensitive personal data, they are processed with due care and provided with a high standard of protection;
  3. Contact details, especially phone number, email, address, bank details;
  4. Professional qualification data, which means information about your work experience and other facts stated in your CV or similar documentation sent to the controller, in case you are applying for a job or if you are a healthcare professional and this data is necessary to verify your knowledge and experience (e.g., if you are to be included as an investigator in clinical trials);
  5. Records from security cameras at the company headquarters;
  6. Data obtained from cookies if you have visited any of the websites of companies belonging to Imunomedica.

We obtain your personal data directly from you, as the data subject (e.g., through email or telephone communication), or we have obtained it from other public sources (e.g., databases publicly available on websites), or from third parties, provided that these parties are authorized to pass your personal data to Imunomedica.

Legal Basis for Processing and Purpose of Processing

We process your personal data:

a) with your consent to the processing of personal data – in such cases, you have been provided with information about the processing of personal data before giving your consent. If you have any additional questions or requests regarding GDPR, please contact us via the above-mentioned contact details.

b) without your consent to the processing of personal data – in such cases, we process your personal data based on another legal basis (specified in Article 6 of the GDPR Regulation) other than consent. This may include processing personal data necessary for the performance of a contract, processing personal data necessary for compliance with a legal obligation, or processing personal data based on the legitimate interest of the controller.

Cases in which your personal data are processed based on a legal basis other than consent are listed below. In the following text, you can find the situation on the basis of which you provided personal data to Imunomedica, and get acquainted with the legal basis, purpose, and scope of processing your personal data.

  1. Are you entering into or have you entered into a contract with Imunomedica, negotiating its modification or termination?

Especially in connection with your activities as a doctor, pharmacist, or other healthcare professional, or in connection with the activities of your employer as a healthcare facility, you may be negotiating the conclusion, modification, or termination of a contract with us, or fulfilling an already concluded contract or receiving fulfillment from such a contract. In these cases, your identification and contact details are mainly processed for the purpose of negotiating the terms of the contract or fulfilling such a contract. The legal basis for processing personal data in this case is the fulfillment of obligations under the contract.

  1. Are you applying for a job at Imunomedica?

If you are a job applicant, Imunomedica processes your personal data to the extent of identification data, contact details, and professional qualification data. Imunomedica processes your personal data as a controller based on a legitimate interest, as the processing of the above-mentioned personal data is essential for assessing the suitability of a candidate for a specific job position. Your personal data is processed solely for the purpose of the recruitment process and mutual communication between you and the company.

If you are successful in the recruitment process and become an employee of Imunomedica, your personal data obtained during the recruitment process will become part of your personnel file, which Imunomedica is entitled to maintain for each employee according to the Labor Code, and in which your personal data will be stored for the entire duration of your employment relationship. If you are not successful in the recruitment process, your personal data will be retained for the duration of the recruitment process, but no longer than 6 months.

  1. Are you an employee of Imunomedica?

If you are an employee of Imunomedica, the company processes your personal data to the extent of identification data, contact details, and professional qualification data. Imunomedica processes your personal data as a controller based on the fulfillment of obligations under the contract, compliance with legal obligations, legitimate interest, or consent (processing based on consent occurs only if its voluntariness and freedom are guaranteed). Employees are separately informed about the details of this processing and related rights in an internal directive.

  1. Are you a subject of evaluation in a clinical trial?

If you are a subject of evaluation in a clinical trial, your personal data is processed based on a legitimate interest. Given that clinical trials also involve the processing of so-called sensitive personal data, we process these data based on Article 9(2)(i), i.e., processing necessary for reasons of public interest in the area of public health, and Article 9(2)(j), i.e., processing for scientific research purposes. Personal data about your health status is processed with due care and protection as sensitive data, solely for the purpose of conducting the relevant clinical trial and for the period necessary to achieve that purpose. Subjects of evaluation are separately informed in writing about the details of this processing and related rights within the clinical trial.

  1. Have you reported adverse effects of medicinal products (pharmacovigilance report)?

If you have reported adverse effects to Imunomedica and made a pharmacovigilance report, Imunomedica processes your personal data as a controller to the following extent: identification data (initials, possibly name, surname, address, date of birth, gender), contact details, health-related data (health status (medical history), used medicinal products, and data on adverse effects and other safety information of medicinal products), and possibly other information if provided to the controller. The processing of these personal data is based on the fulfillment of a legal obligation under the relevant legal regulations, especially Act No. 387/2007 Coll., on Medicines, as amended, and Decree No. 228/2008 Coll., on the Registration of Medicinal Products. Your personal data is processed solely for the purpose of monitoring the safety of medicinal products to the extent of identification, possibly contact details, and sensitive health data provided to the controller.

If you are a doctor and your report included personal data of other individuals (patients), please inform the relevant patients about the processing of personal data to the extent of this information on the processing of personal data.

  1. Have you contacted Imunomedica with a question about the use, availability of Imunomedica products, or with a similar query (medical inquiries)?

If you have contacted Imunomedica with a medical inquiry, Imunomedica processes your personal data as a controller based on a legitimate interest, as it considers it important to provide you with the requested information regarding Imunomedica’s medicinal products, especially considering that this information may affect the proper use of the relevant products and, above all, your health. Your personal data will be processed to the necessary extent and only so that we can provide you with a response to your inquiry. In minimal cases, your personal data may be processed for up to 30 years.

  1. Are you a participant in a congress/meeting organized or supported by Imunomedica?

In connection with your activities as a doctor, pharmacist, or other healthcare professional, you may be invited to a meeting organized or supported by our company. In these cases, your identification and contact details are processed for the purpose of covering transportation and accommodation costs at the congress venue and possibly the participation fee. The legal basis for processing personal data in this case is compliance with legal requirements.

  1. Are you a recipient of email communications?

If Imunomedica sends you email communications, it processes your identification and contact details (email address) for this purpose. Imunomedica, as a controller, is entitled to process your personal data for this purpose based on a legitimate interest if you (or your employer) have previously established a business relationship with Imunomedica. Without processing personal data, it would not be possible to continue mutual email communication.

  1. Are you a doctor, other healthcare professional, or another team member involved in a clinical trial or non-interventional study?

If you are a doctor, other healthcare professional, or another team member involved in a clinical trial or non-interventional study, we process your personal data based on the contract you have concluded with Imunomedica or based on the contract that Imunomedica has concluded with your employer. Your personal data is processed to the extent of identification data, contact details, and possibly professional qualification data proving your expertise or experience. Your personal data is processed for the purpose of maintaining a database of doctors involved in clinical trials or non-interventional studies and contacting you in connection with these activities. Your personal data may also be processed for administrative purposes related to the implementation of the contract (e.g., payment of remuneration).

  1. Do you move around the premises of Imunomedica?

Please note that the company’s premises are equipped with a camera system. The camera system is operated for the protection of Imunomedica’s property, the life and health of employees and visitors, and is also used for the subsequent detection of errors in the technological process of manufacturing medicinal products. A plan indicating which areas are monitored is placed at the Imunomedica headquarters. The cameras record only images, not sound. Camera recordings are retained in a time loop for 10 days, after which they are deleted.

We process personal data to the extent necessary to properly manage Imunomedica, to fulfill legal obligations, and to secure our internal processes. Personal data is processed both manually and automatically.

Recipients of Personal Data

Your personal data may be disclosed to other companies with whom we cooperate in specific products or services. This may include our partners in the joint promotion of products – medicinal products that we manufacture and market as part of mutual cooperation, as well as companies with whom we cooperate in conducting clinical trials.

Your personal data may also be disclosed to administrative authorities, law enforcement authorities, or other public authorities if such disclosure is required by applicable legal regulations or is necessary for the performance of our activities and the exercise of our rights (e.g., insurance companies).

If you participate in a clinical trial as an investigator, your personal data may also be transferred to the State Institute for Drug Control (SÚKL).

Your personal data may also be provided to third parties in connection with reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of the entire company Imunomedica (including insolvency or similar court proceedings).

We may also share personal data to the necessary extent with third parties, which include:

  • Providers of IT services, accounting services, tax and legal advisory services, other professional advisors of our company;
  • Auditors;
  • Other recipients according to justified needs.

Transfer of Personal Data to Third Countries

Your personal data will not be transferred to countries outside the EU.

Duration of Personal Data Processing

Personal data will be processed for the period necessary to fulfill the specified purpose unless a legal regulation imposes an obligation to process personal data for a different specified period. For completeness, we note that in some cases, specific retention periods may apply (e.g., retention periods for camera recordings, retention periods for emails). Personal data obtained based on consent are processed only for the period covered by the provided consent, no longer than until its withdrawal.

Criteria used to determine the length of data retention include: (i) the duration of the contractual relationship; (ii) the existence of a legal obligation; (iii) the admissibility of such retention given our legitimate interest; and (iv) statutory deadlines for archiving and destruction.

Rights of Data Subjects

Legal regulations grant you the following rights concerning your personal data that we process.

Right of Access: You have the right to request information from Imunomedica as the controller about whether your specific personal data are being processed, the purpose of their processing, the categories of your personal data that Imunomedica processes, who is the recipient of your personal data, how long your personal data will be processed, and what rights you have in connection with the processing of personal data. Imunomedica also has an obligation to provide you with information about whether your personal data are transferred to third countries. You can also request a copy of the processed personal data from Imunomedica free of charge.

Right to Rectification: You have the right to have us rectify inaccurate personal data concerning you without undue delay at your request. You have the right to complete or correct incomplete personal data at any time.

Right to Erasure: You have the right to have your personal data erased at your request, provided that one of the following reasons is met: (a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; (b) you withdraw your consent to the processing and there is no other legal basis for the processing; (c) you object to the processing of personal data if they are processed based on the controller’s legitimate interest and there is no overriding legitimate interest of the controller; (d) you object to the processing of personal data for direct marketing purposes; (e) the personal data have been processed unlawfully.

Even if it is proven that one of the above conditions for erasure is met, your personal data may still be processed to the necessary extent and for the necessary time if another legal reason for their processing persists (e.g., compliance with the controller’s legal obligations).

Right to Restriction of Processing: You have the right to restrict the processing of your personal data in the following cases: (a) you contest the accuracy of the personal data – we will restrict the processing for the time necessary to verify the accuracy of the personal data; (b) there is no legal basis for processing your personal data, but you prefer their restriction over erasure; (c) we no longer need your personal data, but you require them for the establishment, exercise, or defense of legal claims; (d) you have objected to the processing – we will restrict the processing until it is verified whether our legitimate grounds override your legitimate grounds.

Right to Data Portability: Concerning personal data that we process automatically based on your consent or for the performance of a contract concluded with you, you may request that we provide these data in a commonly used and machine-readable format. You can then transfer these data to another controller, or if technically feasible, request that we transfer them directly to another controller. Imunomedica will no longer bear any legal responsibility for the processing of your personal data by this other controller.

Right to Object: You may object to the processing of your personal data. If you object to the processing of your personal data for direct marketing purposes, we will stop processing your data. If the objection concerns another purpose, we will not continue processing your personal data unless we demonstrate compelling legitimate grounds for the processing that override your rights and interests or for the establishment, exercise, or defense of legal claims.

Right to Lodge a Complaint: If you believe that your personal data are being processed in violation of applicable legal regulations, you can file a complaint with the supervisory authority – the Office for Personal Data Protection (https://www.uoou.cz); if your personal data are processed in Slovakia (e.g., participants in a clinical trial conducted in Slovakia), you can contact the supervisory authority in Slovakia – the Office for Personal Data Protection of the Slovak Republic (https://dataprotection.gov.sk/uoou/sk).

More information about your rights is available on the above-mentioned websites of the supervisory authorities.

Date of last text revision: June 13, 2022

Ing. Dušan Svoboda

Director of the company