Privacy Policy | UCB Medical Hub UK

WHO WE ARE AND HOW YOU CAN CONTACT US

UCB or we means UCB Pharma Limited, a company incorporated under the laws of England and Wales with registered office at 208 Bath Road, Slough, UK, SL1 3WE.

As the controller, i.e. the legal entity that decides why and how information relating to you (personal data) is collected and processed in the context of this [UCB Medical Hub] website (the Website), we respect your right to privacy.

We will only process your personal data as described in this [UCB Medical Hub] Privacy Policy (the Policy) and in accordance with the relevant data protection legislation, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation or GDPR).

We have a data protection officer (DPO), who can be contacted by any of the following means for any privacy-related questions, including regarding how we collect, store and use your personal data:

E-mail: dataprivacy@ucb.com; or
Regular mail: To the attention of the (global) Data Protection Officer, Allée de la recherche 60, 1070 Anderlecht or to the attention of the local UCB Data Protection Officer at the postal address of the UCB affiliate in your jurisdiction. For more information, please visit https://www.ucb.com/worldwide and select your country.

THE REASON BEHIND THIS PRIVACY POLICY

The Policy governs the collection, use and retention by UCB of personal data relating to your use of the Website. This Policy applies to all Website users.

The Policy consists of five main components and informs you about:

Who we are and how you can contact us;
The reason behind this Policy;
The purposes for which we process your personal data, the related legal basis under the GDPR and applicable retention periods;
What your rights are in relation to the personal data we hold about you and how you can exercise them; and
Further details on how we process (including transfer) your personal data.

This Policy may be updated periodically to reflect changes in our personal data processing activities. In that case, we will inform you of any significant changes via an appropriate channel, in the same manner as we have informed you before, e.g. by posting a prominent notice on the Website.

THE PURPOSES FOR WHICH WE PROCESS YOUR PERSONAL DATA AND APPLICABLE LEGAL BASIS

At UCB we have a UCB General Privacy Policy for HCPs (or UGPPH), accessible at https://www.ucb.com/_up/ucb_com_home/documents/HCP_General_Privacy_Policy_22_10_2020.pdf. The UGPPH describes the personal data processing activities which generally apply (i) to all healthcare professionals (HCPs) we have a professional relationship with; as well as (ii) to HCPs acting as a representative or contact person for a healthcare organisation we have a professional relationship with. In addition to the processing activities explained in the UGPPH, UCB collects and processes the following personal data regarding you within the framework of your use of the Website.

In other words, please carefully read through both the UGPPH and this Policy to understand how we collect and process personal data concerning you. The table below indicates per purpose (i) the categories of personal data we collect and process concerning you, (ii) the source, (iii) how long we retain your personal data, (iv) who we share it with, and (v) the relevant legal basis.

In order to make the Website and its content available to you, UCB:
Collects the following personal data about you:	1. *Electronic identification data: IP address; 2. Information collected through cookies. Failure to provide the personal data with an () may result in (some features of) the Website not being accessible.
Obtains this personal data from:	- You (through the device you use to access the Website).
Retains () your personal data for:**	- IP addresses are deleted after 6 hours; - For cookies, see our Cookie Policy for more information.
Shares your personal data with:	- UCB affiliates and third party processors (as detailed in section 5.A).
Relies on the following GDPR legal basis:	- Processing necessary for the performance of a contract with you ; - For cookies, processing based on your consent except for functional cookies (see our Cookie Policy for more information).
2. In order to maintain our Website security, we deploy cookies and log files to monitor access to and traffic on our Website in order to detect and prevent malicious activity or invalid traffic. In this context, UCB:
Collects the following personal data about you:	1. *Electronic identification data: IP address; 2. Information collected through cookies. Failure to provide the personal data with an () may result in (some features of) the Website not being accessible.
Obtains this personal data from:	- You (through the device you use to access the Website).
Retains () your personal data for:**	- IP addresses are deleted after 6 hours; - For cookies, see our Cookie Policy for more information.
Shares your personal data with:	- UCB affiliates and third party processors (as detailed in section 5.A).
Relies on the following GDPR legal basis:	- Processing necessary for the purpose of the legitimate interests pursued by UCB to protect its IT infrastructure and the data it holds. To this end, UCB strives to maintain a fair balance between its need to process your personal data and the preservation of your rights and freedoms, including the protection of your privacy. For more information or if you have any questions regarding how we assess this balance, please contact us through any one of the channels set out under Section 1 above (“Who we are and how you can contact us”). - For cookies, processing based on your consent except for functional cookies (see our Cookie Policy for more information).
3. In order to improve our Website functionality, we use cookies to support and improve the Website and to better understand usage patterns relating to our Website, including by retaining and evaluating information on recent use you made of our Website and how you access different features of our Website for analytics purposes so that we can make our Website more intuitive. In that context, UCB:
Collects the following personal data about you:	1. *Electronic identification data: IP address; 2. Information collected through cookies. Failure to provide the personal data with an () may result in (some features of) the Website not being accessible.
Obtains this personal data from:	- You (through the device you use to access the Website).
Retains () your personal data for:**	- IP addresses are deleted after 6 hours. - For cookies, see our Cookie Policy for more information.
Shares your personal data with:	- Google Analytics; - UCB affiliates and third party processors (as detailed in section 5.A).
Relies on the following GDPR legal basis:	- Processing necessary for the purpose of the legitimate interests pursued by UCB to conduct its business and to improve upon its services and products. To this end, UCB strives to maintain a fair balance between its need to process your personal data and the preservation of your rights and freedoms, including the protection of your privacy. For more information or if you have any questions regarding how we assess this balance, please contact us through any one of the channels set out under Section 1 above (“Who we are and how you can contact us”). - For cookies, processing based on your consent except for functional cookies (see our Cookie Policy for more information).
4. In order to enable UCB to respond to your online queries and to provide you with services you may request, UCB:
Collects the following personal data about you:	1. Your contact details: your first name (), last name (), e-mail address (), phone number; 2. Your professional background: your organization, your profile (e.g. journalist, investor, analyst, other) 3. Free text field: information you choose to disclose to UCB Failure to provide the personal data with an (), will lead to your request for subscription being denied or will prevent UCB from adequately responding to your query or request.
Obtains this data from:	- Directly from you
Retains () your personal data for:**	- For the duration of the service delivery
Shares your personal data with:	- UCB affiliates and third party processors (as detailed in section 5.A)
Relies on the following GDPR legal basis:	- Processing necessary for the performance of a contract with you
7. In order to enable UCB to handle or respond to any comments you submit to us on the Website, UCB:
Collects the following personal data about you:	1. Your contact details: your first name (), last name (), e-mail address (), phone number; 2. Your background/user profile (): (e.g. HCP, patient, carer, academic, candidate supplier, etc.); 3. Subject matter ();* 4. Your request or query (); 5. Any other information you submit in the free text field Failure to provide the personal data with an (), prevents UCB from adequately responding to your query or request.
Obtains this personal data from:	- Directly from you.
Retains () your personal data for:**	- 1 year.
Shares your personal data with:	- UCB affiliates and third party processors (as detailed in section 5.A).
Relies on the following GDPR legal basis:	- Processing necessary for the performance of a contract; - Processing based on your consent for those comments that would subsequently be posted online by UCB.
8. In order to enable HCPs to create and manage a log-in on our Website, UCB:
Collects the following personal data about you:	1. Your contact details: your first name (), last name (), e-mail address (), your country of residence () salutation; 2. Your professional background: your (job) title, your speciality/area of expertise () 3. Your log-in details: Log-in and password (); 4. Personal details/identification data: your birthdate, gender. Failure to provide the personal data with an (), will lead to your log-in creation request being denied.*
Obtains this personal data from:	- Directly from you.
Retains () your personal data for:**	- For the duration of service delivery.
Shares your personal data with:	- UCB affiliates and third party processors (as detailed in section 5.A).
Relies on the following GDPR legal basis:	- Processing necessary for the performance of a contract.
9. In order to enable you to create a log-in, to authenticate and manage your profile and consent to receiving emails containing information about UCB and its products via our Website, UCB:
Collects the following personal data about you:	1. Title;* 2. First and last names;* 3. Work postcode;* 4. Credentials for login (email address and password);* 5. Confirmation that you are an HCP;* 6. Your opt-in to receive emails relating UCB branded products. Failure to provide the personal data with an () will prevent you from creating a personal account and therefore being able to access the dedicated parts of the Website.*
Obtains this personal data from:	- Directly from you.
Retains () your personal data for:**	- For the duration of our professional relationship with you. In relation to HCP retirement or cessation of professional activities: for a maximum of 36 months after we are informed of your retirement / cessation of professional activities.
Shares your personal data with:	- UCB affiliates and third party processors (as detailed in section 5.A).
Relies on the following GDPR legal basis:	- Processing necessary for the performance of a contract.
10. In order to invite you to attend and permit your attendance to academic, scientific and promotional meetings, events, conferences (sponsored by us) linked to your medical expertise, UCB:
Collects the following personal data about you:	General and identification details: including your full name, title, language, a unique identifier assigned to you by and in our databases 1. Your contact details: postal address, phone number(s), e-mail address ()* 2. Your professional details: including your job title, your area(s) of expertise 3. Country specific identifiers (including your local registration number as an HCP in relation to the local healthcare system) ()* Activity data (i.e. data related to our professional interaction with you - other than clinical activities - and related to your attendance to said meetings, events and conferences): 4. Information about events/ conferences in which you participated/which you attend 5. Information about topics that were discussed, key messages from you, product information shared with you 6. Travel details and logistics, dietary preferences (as applicable), as well as any other information required to enable your attendance to UCB sponsored or organized conferences, meetings or events, for which you signed up. Failure to provide the personal data with an () will prevent you from creating a personal account and therefore being able to access the dedicated parts of the Website.*
Obtains this personal data from:	- Directly from you.
Retains () your personal data for:**	- General and identification details: for the duration of our professional relationship with you. In relation to HCP retirement or cessation of professional activities: for a maximum of 36 months after we are informed of your retirement / cessation of professional activities - Activity data: this data is kept for 60 months after the relevant activity took place (e.g. an event, a congress, a visit, a call) - Consent management data: this data is kept for 120 months following receipt of your consent
Shares your personal data with:	- UCB affiliates and third party processors (as detailed in section 5.A); - Delegates of such academic, scientific and promotional meetings, events, conferences where your General and identification details are shared as part of a delegate attendance list.
Relies on the following GDPR legal basis:	- Processing based on your consent for information related to the sending and receipt of any communications regarding UCB sponsored academic, scientific and promotional meetings, events, conferences
11. In order to enable UCB to (i) comply with it’s EU/EU Member State legal obligations (including but not limited to pharmacovigilance, archiving and record keeping, transparency laws, etc), (ii) perform regulatory audits, and (iii) respond to requests from EU/EU memver state, regulatory or judicial authorities, UCB:
Collects the following personal data about you:	1. Your identification details: including your full name, function/ title, initials; 2. Your contact details: including your e-mail address, telephone number, postal mail address; 3. Your professional details: including your job title 4. Any other information required as per our legal obligations (e.g. in relation to adverse event reporting, further information on the adverse event and your involvement therein; in relation to transparency reporting, information on transfer of value, etc.) The provision of this information is a statutory requirement. Failure to provide it will prevent UCB from fulfilling its legal obligations.
Obtains this personal data from:	- Directly from you; - (To the extent applicable) the HCO you work for/with - Our third party processors (as detailed in section 5.A).
Retains () your personal data for:**	- For as long as required as per our legal obligations. E.g. in relation to adverse event related information for a period of 10 years following the end of the marketing authorisation for the relevant product
Shares your personal data with:	- Competent regulatory and government agencies/authorities - UCB affiliates and third party processors (as detailed in section 5.A) - The general public in relation to transparency disclosures.
Relies on the following GDPR legal basis:	- Processing necessary for compliance with our legal obligations (including but not limited to pharmacovigilance laws, transparency laws etc.)
12.In order to enable UCB to comply with industry guidelines relating to transparency (as opposed to mandatory law which is described above), UCB:
Collects the following personal data about you:	1. Your identification details: including your full name, function/ title, initials 2. Your contact details: including your e-mail address, telephone number, postal mail address; 3. Your professional details: including your job title 4. Transfer of value (including expenses and certain other financial information, e.g. amounts paid to you) 5. Consent to receive emails related to transfer of value disclosure (pre-disclosure) 6. Any other information which may be required as per industry guidelines. Failure to provide the abovementioned information prevents UCB from complying with applicable industry guidelines
Obtains this personal data from:	- Directly from you; - (To the extent applicable) the HCO you work for/with - Our third party processors (as detailed in section 5.A).
Retains () your personal data for:**	- For as long as required per the applicable industry guidelines
Shares your personal data with:	- Competent regulatory and government agencies - UCB affiliates and third party processors (as detailed in section 5.A) - The general public.
Relies on the following GDPR legal basis:	- Processing based on your consent for information related to the sending and receipt of any communications regarding transfer of value disclosure (pre-disclosure). - Processing necessary for the purpose of the legitimate interests pursued by UCB to comply with industry requirements/guidelines and to conduct its business in a transparent manner. To this end, UCB strives to maintain a fair balance between its need to process your personal data and the preservation of your rights and freedoms, including the protection of your privacy (**).
13. In order to safeguard UCB’s business interests, including against legal claims and in legal proceedings and in order to provide evidence of transactions, UCB:
Collects the following personal data about you:	Your personal data (including as set out in this policy), to the extent relevant to the legal claim, legal proceedings or transaction at hand.
Obtains this personal data from:	- Directly from you; - (To the extent applicable) the HCO you work for/with - Our third party processors (as detailed in section 5.A).
Retains () your personal data for:**	- For the duration of the exercise or defence of the relevant legal claim, legal proceedings or transaction
Shares your personal data with:	- Competent regulatory and government agencies - UCB affiliates and third party processors (as detailed in section 5.A) - The general public.
Relies on the following GDPR legal basis:	- Processing necessary for the purpose of the legitimate interests pursued by UCB, which include to conduct its business and defend its interests against legal claims and in legal proceedings. To this end, UCB strives to maintain a fair balance between its need to process your personal data and the preservation of your rights and freedoms, including the protection of your privacy (**).
14. In order to perform audits based on non- European laws, (ii) comply with non- European laws and regulations and (iii) handle requests from non- European judicial or regulatory authorities, UCB:
Collects the following personal data about you:	Your personal data as set out in this privacy policy, to the extent relevant to the audit, compliance with legal requirement or regulatory request.
Obtains this personal data from:	- Directly from you; - (To the extent applicable) the HCO you work for/with - (To the extent applicable) our third party processors.
Retains () your personal data for:**	For as long as required as per our legal obligations.
Shares your personal data with:	- Competent regulatory and government agencies - UCB affiliates and third party processors (as detailed in section 5.A).
Relies on the following GDPR legal basis:	- Processing necessary for the purpose of the legitimate interests pursued by UCB, which include to conduct its business and comply with the laws and regulations that govern its business. To this end, UCB strives to maintain a fair balance between its need to process your personal data and the preservation of your rights and freedoms, including the protection of your privacy (**).

(**) We will retain your personal data in accordance with the retention periods set out in the table above. These retention periods, included in our data retention policy, are dictated by:

applicable statutory/legal requirements;
industry guidelines; and
for those data categories for which no express statutory or legal requirements apply, certain other determining factors such as the need to prove or enforce a transaction or contract, enforce our policies, etc.

We will delete your personal data once the abovementioned retention periods will have expired or if you object to or if you withdraw your consent in relation to our processing of your personal data (to the extent such processing is based on your consent), except where we need to hold on to such data for the establishment, exercise or defense of legal claims, for the protection of the rights of another natural or legal person, for compliance with a European Union or European Union Member State legal obligation which requires such further processing or where we need to prove or enforce a transaction or contract or enforce our policies.

YOUR RIGHTS AND HOW YOU CAN EXERCISE THEM

4.A. Your rights

Right to access

You have the right to obtain confirmation from us as to whether or not we process personal data concerning you, and if so, the right (as far as this does not adversely affect the rights and freedoms of others) to obtain a copy of your personal data from us.

For more information, please check Section 4.B “How to exercise your rights”.

Right to rectification

You have the right to ask us to rectify without undue delay any inaccurate personal data concerning you. You can also ask us to complete incomplete personal data regarding you by providing us with a supplementary statement containing such additional information.

For more information, please check Section 4.B “How to exercise your rights”.

Right to erasure

You have the right to ask us to erase without undue delay personal data concerning you, where one of the following grounds applies:

your personal data are no longer necessary in relation to the purposes for which they were processed;
you have withdrawn your consent - for those processing activities based on your consent – and we have no other legal ground for such processing;
you object to the processing of your personal data (for more information on the right to object, see further below) and there are no overriding legitimate grounds for such processing;
your personal data have been unlawfully processed;
your personal data must be erased for compliance with a European Union or European Union Member State legal obligation to which UCB is subject.

Please note that your right to erasure will not apply to the extent that processing is necessary for:

exercising the right of freedom of expression and information;
compliance with a European Union or European Union Member State Law to which UCB is subject;
reasons of public interest in the area of public health in accordance with article 9(2)(h) and (i) GDPR as well as article 9(3) GDPR;
archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with the relevant provisions of the GDPR;
the establishment, exercise or defense of legal claims.

For more information, please check Section 4.B “How to exercise your rights”.

Right to restriction of processing

You have the right to obtain from UCB restriction of processing by UCB of your personal data where one of the following applies:

you contest - in good faith - the accuracy of personal data regarding you and held by us, in that case the restriction of processing will apply for a period enabling us to verify the accuracy of your personal data;
the processing is unlawful and you oppose the erasure of your personal data and request restriction of their use instead;
we no longer need your personal data, but you require them for the establishment, exercise or defense of legal claims;
you have objected to the processing of your personal data by UCB in accordance with the relevant GDPR provision, in that case the restriction of processing will apply for a period enabling us to verify if our legitimate grounds override yours.

Please note that notwithstanding the above, we are still allowed to continue storing your personal data (throughout the period of restriction) or to process your personal data for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person.

If you have requested restriction of processing, we will inform you before the restriction of processing is lifted.

For more information, please check Section 4.B “How to exercise your rights”.

Right to data portability

You have the right (insofar this does not adversely affect the rights and freedoms of others) to receive the personal data concerning you, that you have provided to UCB, in a structured, commonly used and machine-readable format and to transmit those data to another controller, without hindrance from UCB, where the processing is:

based on your consent or on a contract; and
carried out by automated means.

For more information, please check Section 4.B “How to exercise your rights”.

Right to objection to processing

You have the right to object at any time, on grounds relating to your specific situation, to the processing of your personal data by UCB which is based on UCB’s pursuit of its legitimate interests as a controller. In that case UCB will no longer process your personal data, unless:

UCB demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms; or
for the establishment, exercise or defense of legal claims.

You have the right to object at any time to the processing of your personal data for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing.

For more information, please check Section 4.B “How to exercise your rights”.

Right to withdraw consent

Where the processing is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

For more information, please check Section 4.B “How to exercise your rights”.

4.B. How to exercise your rights

If you wish to exercise any of the rights mentioned above, you can always contact the local UCB Data Protection Officer by e-mail at dataprivacy@ucb.com or otherwise reach out to us by postal mail at UCB Biopharma SRL To the attention of the data protection officer, Allée de la Recherche 60, 1070 Brussels, Belgium. Please clearly identify the right(s) you wish to exercise and include your contact details (including a valid e-mail or postal address) so that we can respond to your request. Please note that you may be asked to provide proof of your identity.

When you contact us to exercise any of the rights mentioned above, we will respond to your request within one month following receipt of the request. This period may be extended by two additional months where necessary, but in that case we will inform you of any such extension within one month of receipt of your initial request together with the reasons for the delay.

Right to lodge a complaint with supervisory authority

In accordance with article 77 GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the European Union Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that UCB’s processing of your personal data infringes the GDPR. Please visit the website of the relevant national supervisory authority for more information on how to submit such a complaint.

MORE DETAILS ON HOW WE PROCESS YOUR PERSONAL DATA

5.A. Who we share your personal data with.

Principle

We will disclose your personal data only as described in this Policy, as may be updated from time-to-time.

Affiliates and third party processors

UCB transfers or discloses your personal data to its personnel, affiliates and to third party service providers processing personal data on UCB’s behalf for the purposes set out above and our partners (including e.g. other pharmaceutical companies) with whom we have a collaboration agreement and who have a need to know this information.

Third party service providers include cloud service providers, IT services/ consulting/ outsourcing companies, database providers, market research suppliers, homecare delivery suppliers, event agencies and organizers, survey/quiz/poll providers, travel agencies and providers, banks and insurance companies that deliver services to us. These service providers provide their services from locations within and outside of the European Economic Area (EEA).

Other third parties include regulatory and government agencies (see further below in this Policy), our advisors and external legal counsel, our auditors, and potentially, third parties with whom UCB may merge or which may be acquired by UCB (see further below in this Policy).

Compliance with laws and legal proceedings

UCB will disclose your personal data where:

UCB is required to do so by applicable law, by a governmental body or by a law enforcement agency;
to establish or exercise our legal rights or defend against legal claims;
to investigate, prevent or take actions against illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our policies or as otherwise required by law.

Other

If a third party acquires all (or substantially all) of our business and/or assets, we will disclose your personal data to that third party in connection with the acquisition. However, such disclosure will occur subject to and in accordance with applicable data protection laws, including the GDPR.

5.B. International transfers

UCB will transfer your personal data to its affiliates, including our affiliates outside of the EEA. In that case UCB relies on UCB’s Binding Corporate Rules, which can be accessed through the following link: https://www.ucb.com/UCB_BCRs.pdf.

The transfer of your personal data to third party service providers (as set out above under section 5A) in countries outside of the EEA that do not ensure an adequate level of (data) protection, occurs on the basis of Standard Contractual Clauses that have been executed between UCB and the relevant third party service provider. You may - by exercising your rights set out above under section 4.B (How to exercise your rights) - obtain a copy of the relevant safeguard UCB has put in place or ask UCB to redirect you to the place where they have been made available.

In the absence of the aforementioned appropriate safeguards, UCB may – to the extent permitted under and in accordance with applicable data protection laws (including the GDPR) - rely on a derogation applicable to the specific situation at hand (e.g. the data subjects’ explicit consent, the necessity for the performance of an agreement, the necessity for the establishment, exercise or defense of legal claims).

5.C. Links to third party sites

This Website contains links to other websites operated by third parties, including but not limited to certain social media sites such as Facebook, Twitter, Linkedin and YouTube. This Policy does not apply to any website, other than this one. Third party websites are governed by their own terms and conditions. You should therefore always carefully check the privacy and cookie policies of third party websites before accepting to be redirected to them.