Last update: April 2021
Dear suppliers and service providers,
With this privacy policy we would like to inform you about
- the personal data we collect, store, process, block and erase (collectively referred to as ‘processing’),
- what we use these data for,
- how you can object or withdraw your consent to the use of these data and
- the other rights you have as a data subject and how you can assert them.
1. Who is responsible for data processing and who can I contact?
The responsible body for data processing (data controller) in the sense given in the GDPR is:
Bionorica SE
Kerschensteinerstr. 11–15
92318 Neumarkt, Germany
Phone: +49 (0) 9181 231-90
Fax: +49 (0) 9181 231-265
E-mail: info@bionorica.de
Our company data protection officer can be reached via email at datenschutz@bionorica.de or by post at the above address (please include the line ‘ATTENTION: Data Protection Officer’).
As parent company of the Bionorica group we pursuant of a consistent corporate controlling provide different services for our subsidiaries (e.g. cross-company IT-, communication- and database-systems, central HR or financial accounting services as similar activities at our headquarter in Neumarkt) and also process personal data in this context.
In terms of data protection law, this processing is carried out under the joint responsibility of Bionorica SE and the respective subsidiary in accordance with Art. 26 GDPR. The following key points apply to joint processing:
- Bionorica SE and the respective subsidiary are equally responsible for the legality of the joint processing and take appropriate technical and organizational measures so that the rights of the data subjects are guaranteed at all times.
- Bionorica SE undertakes to make the information required by Art. 13 and 14 GDPR also publicly available with regard to joint processing.
- In order to ensure adequate transparency and reliable assertion of data subject rights, all data subject rights during joint processing can always be asserted against Bionorica SE as the parent company.
- Bionorica SE and the respective subsidiary are equally responsible for the information obligations resulting from Art. 33, 34 GDPR towards the supervisory authority or those affected by a violation of the protection of personal data.
- Both parties are jointly liable for the damage caused by processing that does not comply with the GDPR in the external relationship together towards the data subject.
We would be happy to provide you with an extract from our "Agreement on the joint processing of personal data in accordance with Art. 26 GDPR". For this purpose, please simply contact the above-mentioned contact.
2. Am I obligated to provide data?
In the context of our business relationship, you only have to provide the personal data which are required for entering into and conducting a business relationship and for fulfilling the associated contractual obligations or which we are legally obligated to collect. Without these data we will usually not be able to conclude the contract with you or perform the contract.
3. Which sources and data does Bionorica SE use?
We process personal data which we receive from our suppliers and service providers as part of our business relationships. We also process personal data which we permissibly acquire from publicly accessible sources (e.g. commercial register, press and/or internet) or which are permissibly communicated to us by other companies in the Bionorica Group or by other third parties (e.g. credit bureaus) – to the extent needed to provide our service.
The personal data which we process include in particular:
- personal particulars (name, address and other contact data),
- order data and data from contract execution (e.g. information on orders and deliveries),
- data from performing audits (e.g. contact person data)
- data from the execution of tenders (e.g. CVs, certificates)
- video recording (in the correspondingly marked building areas) as well as access information to the company premises (e.g. for goods deliveries), and
- other data comparable to the categories mentioned above.
4. Processing purposes and legal basis
We process personal data in accordance with the provisions of the European General Data Protection Regulation (EU GDPR) and the German Federal Data Protection Act (BDSG) according to the following legal bases:
4.1. To fulfil contractual obligations (Art. 6 para. 1 cl. 1 lit. b GDPR)
Data are processed for performance of contracts concluded with our suppliers and service providers, for implementation of pre-contractual measures at the request of our suppliers and service providers or for carrying out of all activities necessary for operation and/or administration of a pharmaceutical company.
4.2. Based on legitimate interests (Art. 6 para. 1 cl. 1 lit. f GDPR)
As far as necessary, we process personal data beyond the scope of performance of the contract for protecting our legitimate interests.
This particularly covers the following activities and processes:
- assertion of legal claims and defense in legal disputes,
- ensuring IT security and IT operations in our company,
- comparison with sanctions lists that go beyond the legally prescribed but usual.
4.3. Based on your consent (Art. 6 para. 1 cl. 1 lit. a GDPR)
If you granted us consent to process personal data for specific purposes, this processing is lawful based on this consent.
After granting your consent, you can withdraw it at any time. This also applies to the withdrawal of declarations of consent given to us before the GDPR came into effect. Please note that withdrawal of your consent does not affect the lawfulness of processing carried out up to the time of withdrawal.
You can withdraw consent free of charge by sending a formless statement to the contact given in Section 1. If you withdraw your consent by telephone, we may ask you to provide additional proof of your identity in another way.
4.4. Based on legal requirements (Art. 6 para. 1 cl. 1 lit. c GDPR) or in the public interest (Art. 6 para. 1 cl. 1 lit. e GDPR)
Like every company, Bionorica SE has numerous legal obligations which make processing of personal data necessary. As examples, e.g., identification obligations for prevention of money laundering, supplier qualifications, the comparison with legally prescribed sanction lists or compliance with tax documentation obligations can be mentioned here.
5. When is automated individual decision-making used?
We generally do not use fully automated decision-making according to Art. 22 GDPR for establishing and conducting the business relationship. If we employ these techniques in individual cases, we will inform you about this separately insofar as we are required to do so by law.
6. Who gets my data?
Within Bionorica SE, those offices and departments requiring your data for the fulfilment of our contractual and legal obligations receive your data. Carefully selected and controlled service providers employed by us may also receive data for these purposes, but within the scope of so-called contract data processing they are obligated to meet the data protection requirements that are also applicable to us. For example, companies in the fields of IT services, logistics, print services and telecommunications as well as consultancies and marketing agencies.
A transfer to recipients outside of Bionorica only takes place if there is a legal basis (e.g. legal obligation).
7. Are data transferred to companies in third countries or to international organisations?
Data are only transferred to locations in countries outside the European Union (so-called third countries) if, in addition to general requirements for data transfer, there is also an adequacy decision (Art. 45 GDPR) or appropriate safeguards (Art. 46 GDPR) and, if necessary, additional measures are taken or the requirements of Art. 49 are fulfilled (for example, the corresponding consent).
8. How long are my data stored?
We process your personal data only as long as necessary to fulfill the processing purposes described above. Once the data are no longer needed to fulfill the processing purposes described above, they are erased unless their further processing is necessary – for a limited period – for the following purposes:
- fulfilment of retention obligations according to commercial and tax law: the German Commercial Code (HGB) and the German Money Laundering Act (GwG) should be mentioned. The retention and documentation periods prescribed there can be up to ten years.
- preservation of evidence in the context of the statute of limitations. Pursuant to Sections 195ff. of the German Civil Code (BGB) these statutory limitation periods can be up to 30 years, whereby the normal limitation period is three years.
9. What rights do I have as a data subject?
As a data subject you have the right to access pursuant to Article 15 GDPR, the right to rectification pursuant to Article 16 GDPR, the right to erasure pursuant to Article 17 GDPR, the right to restriction of processing pursuant to Article 18 GDPR and the right to data portability according to Article 20 GDPR. With respect to the right to access and the right to erasure, the limitations set forth in Sections 34 and 35 BDSG apply. You also have the right to lodge a complaint with a responsible data protection supervisory authority (Article 77 GDPR in conjunction with Section 19 BDSG).
You also have the right to object under Art. 21 GDPR. You can object to the processing of personal data on the basis of Art. 6 para. 1 lit. e or f GDPR at any time without giving reasons.