EPHMRA’s Privacy Notice
EPHMRA: Privacy Notice – updated April 2024
Thank you for taking the time to read our privacy notice. Please read it carefully and if you have any questions about this notice or our data protection practices, please contact the EPHMRA General Manager on generalmanager@ephmra.org.
We want to make sure that you feel confident about how your data will be collected and used as part of your journey with EPHMRA. This privacy notice explains how EPHMRA collects and processes your personal data when you visit our website, or use our services as a member, customer or a member of the public.
- IMPORTANT INFORMATION ABOUT WHO WE ARE AND WHAT WE DO
EPHMRA is a Swiss company registered in Basel with a registration number: PersID 585040 / UID CHE 113.450.376 and is subject to the Federal Act on Data Protection 2020 (FADP). We registered with the Federal Data Protection and Information in Switzerland as an organisation that collects and uses personal data (a “Data Controller”).
EPHMRA is a global association for research and insight in the pharmaceutical and healthcare sector.
EPHMRA’s main aims are to inspire and empower members to influence decision through expert advice and insights to help drive business performance and gain competitive advantage.
- EPHMRA is the hub for excellence to empower members to become the business partner of choice in providing insights and expert advice.
- Creating a Healthcare ‘Market Research and Analytics’ Community that defines, develops and shares best practice.
- Continuously developing and strengthening the core competencies that allow Members to achieve excellence as business partners and expert advisers.
- Excellence means that EPHMRA sets the ‘Gold-standard’ in healthcare ‘market research and analytics’ and continues building excellence by focussing on core competencies that relate to the strategic components of market research, data and analytics and business insights. This includes primary and secondary market research, forecasting, data analysis, competitive monitoring, KPI performance specialists etc.
- Furthermore EPHMRA will provide expert guidance to its members on healthcare ‘market research and analytics’ standards and ethics.
CONTACT DETAILS
Our full details are:
Organisation: European Pharmaceutical Market Research Association known as EPHMRA
An association entitled the European Pharmaceutical Market Research Association (Association Européenne des Etudes du Marché Pharmaceutique, Europäische Vereinigung für Pharmazeutische Marktforschung, Associazione Europea per lo Studio del Mercato Farmaceutico) exists within the meaning of Art. 60 ff. of the Swiss Civil Code. The Association is established without limit of time. The registered office of the Association is in Basel.
Name: European Pharmaceutical Market Research Association known as EPHMRA
Email address: generalmanager@ephmra.org
Phone: Tel + 44 (0) 759 578 621
- PERSONAL DATA WE COLLECT ABOUT YOU
Personal data means any information about an individual from which that person can be identified, or any information about an identifiable individual. It does not include data which cannot be connected to an identifiable individual (anonymous data).
There are different types of personal data about you which we might collect use, store or transfer. In addition to these specific categories of data, we might also collect other personal data about you. We have grouped these together as follows, and provided some examples of the type of personal data which might fall into each grouping:
- Identity Data could include your first name, maiden name, last name, username or similar identifier, marital status, title, date of birth or gender.
- Contact Data could include your home or work address, email address, telephone numbers or another unique identifier for use with electronic communication.
- Financial Data could include bank account and payment card details.
- Transaction Data could include details about payments to and from you and other details of services you have purchased from us.
- Technical Data could include your internet protocol (IP) address, your login data, browser type and version, operating system and platform, and information about other technology on the devices you use to access this website, EPHMRA events and webinars, etc.
- Profile Data could include your membership interests, preferences, feedback and survey responses.
- Usage Data could include information about how you came to and leave our website, and how you use our website, products and services.
- Marketing & Communications Data could include what information you want to receive from us and how you would prefer it to be delivered.
- Aggregated Data such as statistical, research, survey or demographic data for any purpose. Aggregated Data could be derived from your personal data, but this data will not directly or indirectly link to you as an identifiable individual. For example, we may aggregate survey data to report on the evaluation of an EPHMRA event. However, if we combine or connect Aggregated Data with your personal data so that it can be linked directly or indirectly to you, we treat the combined data as personal data which will only be used in accordance with this privacy notice.
- Special category data includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data. We do not routinely collect this type of data except for dietary information (i.e. health data) which is required to supply refreshments for EPHMRA events.). Nor do we collect any information about criminal convictions. If we ever needed such information we will ensure we have an appropriate lawful basis for the processing .
- HOW WE COLLECT YOUR PERSONAL DATA
EPHMRA collects your personal data either directly (when you have given it to us) or indirectly (when someone else has given it to us) or through automated means.
Direct. You may give us your identity, contact and financial data by filling in membership, product or event forms or by corresponding with us via the EPHMRA website, by post, phone, email or other means. This includes personal data you provide when you or an organisation you work for:
- ask for information about EPHMRA’s services or subscribe to them;
- agree to become a member or customer of EPHMRA;
- respond to a survey that we are running;
- request communications to be sent to you; or
- give us feedback or contact us.
Automated technologies or interactions. As you interact with the EPHMRA website, our digital systems will automatically collect technical data and usage data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our cookie policy for further details.
User Generated Data. We may generate transaction, usage, marketing and communications data about you, by way of records of the direct and automated interactions that you have with us or our website.
Indirectly. We will receive personal data about you from various third parties as set out below:
- analytics providers e.g. Google Analytics;
- content management system providers;
- social media – Facebook, LinkedIn or Twitter.
- HOW WE USE YOUR PERSONAL DATA
Table 1 sets out the purposes we need your data, the type of data used and the lawful basis we rely on.
Table 1: How EPHMRA uses your personal data
|
Purpose for using the data |
Type of data used for purpose (see list of data types in section 2 of this notice) |
Lawful basis for processing |
|
To identify potential members who may benefit from joining EPHMRA or to process EPHMRA member applications |
|
|
|
To deliver EPHMRA services as an association and service provider representing research and insight within the pharmaceutical and healthcare sector:
|
|
|
|
To manage our relationship with you which may include:
|
|
|
|
To satisfy external audit and/or legal requirements and standards |
|
|
|
To administer and protect EPHMRA as an organisation including website and digital infrastructure e.g. testing and checking systems, maintenance of the website, etc. |
|
|
|
To deliver relevant website content including information about EPHMRA’s services, events, conferences, training courses and other activities |
|
|
|
To use data analytics to measure and improve EPHMRA’s website performance and customer communications |
|
|
|
To issue communications such as newsletters and email marketing communications |
|
|
|
To make suggestions to further engagement with you as a member and/or customer of EPHMRA |
|
|
If our purposes of processing change
We will only use your personal data for the purposes set out above, unless we reasonably consider it can be used for another purpose that is compatible with any of the above. If we need to use your personal data for an unrelated purpose, we will always inform you about this and explain the lawful basis which allows us to do so.
Am I under a contractual or legal obligation to provide my data?
Where we need to collect personal data by law, or under the terms of a contract we have with you (such as to fulfil the terms of EPHMRA subscriptions or the purchase of EPHMRA products and services), and if you decide not to provide that data when requested, we may not be able to carry out our business functions, perform the contract we have or are trying to enter into with you (for example, to provide you with association membership or goods or services), or proceed with some other activity. In this case, we will inform you of the consequences at the time, but these may include being unable to complete any commercial or contractual activity that you may have asked us to undertake.
- HOW WE SHARE YOUR PERSONAL DATA
We may share your personal data with the parties set out below for the purposes set out in Table 1 at Section 5.
Internal Third Parties, including:
- service suppliers we have appointed to ensure that the services we provide and the events that we organise are run smoothly and safely and that your personal needs are met;
- experts who are appointed by us to deliver services;
- external professionals appointed to provide advice and recommendations on areas connected with their expertise;
External Third Parties, which might include:
- credit reference agencies such as Experian (if we need to carry out credit checks);
- providers of our IT infrastructure, such as Microsoft, Google or Amazon;
- governmental or other investigatory bodies (where required by law).
We will only share the minimum amount of personal data with a third party that is necessary to fulfil the data sharing purpose. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes, to the minimum extent necessary and in accordance with our instructions.
- WHAT INTERNATIONAL TRANSFERS WE UNDERTAKE AND HOW THESE ARE MANAGED
EPHMRA is based in Switzerland and its main service providers are based abroad which requires EPHMRA to frequently process and transfer data between other countries.
EPHMRA uses suppliers in the UK and in the EU. Transfers of data to these destinations is done so under the “Adequacy Decisions” transfer mechanism. This means the countries have an equivalent standard of data protection as Switzerland and are deemed to be adequate.
On occasion it might also be necessary for EPHMRA to make a transfer of your personal data to a country which are not covered by an Adequacy Decision, such as the US. In those circumstances the transfer mechanism we rely on is one of the appropriate safeguards, which include standard data protection clauses, binding corporate rules, and codes of conduct and certification.
- DATA SECURITY FOR YOUR PERSONAL DATA
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those EPHMRA Board and Committee members, service suppliers and other third parties who have a reason for needing your personal data e.g. to deliver an EPHMRA service to you. They will only process your personal data on EPHMRA’s instructions, and they are subject to a duty of confidentiality.
The data security measures that we have in place include:
- Password protected CRM which is hosted in the UK
- On-going support from a specialist IT company ensuring EPHMRA’s security is up-to-date
- Encrypting and protecting our documents and servers
- Having effective clear desk policy and subsequent secure destruction of confidential waste paper
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach, in a timely manner, where we are legally required to do so. We will endeavour to work with you and them to minimise the impact of the breach.
- RETAINING YOUR DATA
We will only keep your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period if we reasonably believe there is a specific need, e.g. prospect of litigation, in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the data minimisation principle and balance the need for retention and the need for minimisation. This balance is determined by the amount, nature and sensitivity of the personal data we have processed about you, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and other requirements such as applicable legal, regulatory, tax or accounting purposes.
The periods for the different types of personal information that we hold is detailed in Table 2.
Table 2: EPHMRA’s current data retention periods
|
Record Type |
Retention Period/Retention Criteria |
|
General correspondence |
2 years |
|
Emails |
8 years |
|
Membership |
|
|
Membership application forms |
10 years |
|
Membership correspondence |
5 years |
|
Lapsed member records |
5 years |
|
Perspective members |
5 years |
|
Changes in member details |
|
|
Training |
|
|
Training booking forms |
2 years |
|
In-person event |
|
|
Dietary information for in-person events |
4 years |
|
Conferences, webinars and events |
|
|
Conference, webinar and events booking forms |
8 years |
|
Dietary information for f2f events |
4 years |
|
Photographs from events |
indefinitely |
|
Recordings from webinars |
indefinitely |
|
Research and surveys |
|
|
Identifiable research responses |
Non collected – all anonymised |
|
Financial data |
|
|
Invoices |
indefinitely |
In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research, survey or statistical purposes, in which case we may retain this aggregate data for an indefinite period as the data will no longer be identifiable.
- YOUR LEGAL RIGHTS
Depending on the purpose and the lawful basis we rely on for processing your personal data, there are various rights available to you. You can:
- request access to the personal data we keep about you and be given specific information about the processing – this right always applies regardless of the processing activity we undertake;
- request we rectify inaccurate personal data we hold about you – this right always applies regardless of the processing activity we undertake;
- request us to delete your personal data – this right only applies in specific circumstances, this means EPHMRA does not always need to comply with this type of request;
- request a restriction of the processing of your personal data – this right only applies in specific circumstances, this means EPHMRA does not always need to comply with this type of request;
- object to the processing when we have relied on the “legitimate interest” lawful basis to undertake the processing activity and you believe we have infringed your rights – we don’t always have to comply with such objections if we can demonstrate compelling reasons to continue with the processing;
- opt out of marketing communications at any time – this right is absolute, and we will stop sending you marketing communications on receipt of your opt out request;
- transfer your personal data from us to another service provider or to yourself – this right only applies to personal data you have given to us and when the processing is based on your consent or contractual basis and the processing is automated; and
- withdraw your consent at any time – this right only applies when we have relied on your consent to process your personal data, furthermore it does not affect the lawfulness of processing carried out before you withdraw your consent and EPHMRA may not be able to provide certain services to you after you withdraw consent.
We do not undertake any solely automated decision marking, including profiling, about you.
If you wish to exercise any one of your rights, please contact our General Manager by:
Email – generalmanager@ephmra.org
Post – EPHMRA, c/o Streicher & Brotschin Treuhand AG, Gartenstrasse 101, 4052 Basel, Switzerland
Telephone – + 44 (0) 7597 578621
We shall respond to a valid request within one month of receiving it.
How to make a complaint about us to the Federal Data Protection and Information Commissioner
If you are not happy with how we are processing your personal data, or you believe we have not dealt with one of your rights correctly you are entitled to make a complaint to the Federal Data Protection and Information Commissioner. The Commissioner has several ways in which you can contact them, full details are on their website – https://www.edoeb.admin.ch/edoeb/en/home/deredoeb/kontakt.html
- CHANGES TO OUR PRIVACY NOTICE
We keep our privacy notice under review to ensure it remains accurate and up to date and we reserve the right to modify it at any time.
This privacy notice was last updated April 2024.
The current version of this Policy, together with its previous versions, shall be recorded below.
Version Control
|
Version |
Author Job title + Initials |
Date |
Changes |
Approved by: Job title + Initials |
Effective date |
|
V0.1 |
Compliance Lead / SD |
April 2024 |
Document Formation |
General Manager – B Rogers |
22.7.24 |
|
V0.2 |
Compliance Lead / SD |
22.7.24 |
Document Formation |
General Manager – B Rogers |
22.7.24 |
|
|
|
|
|
|
|