Privacy and data protection policy

Introduction

Viso Farmacéutica S.L., with registered office at C/ Retama, 7 – 7ª pl. (28045) Madrid, Spain (in this Privacy Policy, “Viso”, “we”, “us” or “our”), is the data controller. Viso is part of the Glenmark Group.

Viso respects your privacy and undertakes to protect your personal data. As a result, we would like you to familiarise yourself with the way in which we collect, use and transfer your personal data. In this Privacy Policy, we will explain how we handle the personal data that we or our service providers process during your interactions with us or them, including through the use of our website or similar environments such as websites or smartphone apps that we operate and maintain, and via which you can access this Privacy Policy (together, the “Website”).

It is important for the personal data that we keep with regard to you to be accurate and up-to-date. We therefore ask you to keep us informed of any change in your personal data during the course of your commercial relationship with us.

Data Protection Officer

Viso has appointed Dr Karsten Kinast, of KINAST Rechtsanwaltsgesellschaft mbH, as Data Protection Officer (DPO).

Viso has also appointed a Data Protection Coordinator for the Viso entities listed in Annex 1 below, who will work in close and direct cooperation with the DPO as necessary and will act as a point of contact within Viso. To contact the Data Protection Coordinators, please write to dpo.glenmark@glenmarkpharma.com.

Personal Data Processing Principles and Objectives

Personal data are information relating to an identified or identifiable natural person. This can include information such as name, age, address, telephone number, date of birth, email address, IP address or personal habits. It does not include anonymised (or anonymous) data.

We use your personal data to:

• respond to your queries and requests; for example, to send you information that you ask for.
• send you important information about our commercial relationship with you, about our commercial terms and terms of use and/or to send you information relating to the processing of your data.
• further our commercial interests, including through data analysis, verifications, development of new products and services, improvement of our interactions with you, improvement of the Website, personalisation of your use of the Website by showing you personalised products and offers, and identification of the effectiveness of our advertising campaigns. We adhere strictly to the law in this regard and we use anonymised data that prevents the inference of information about you as an individual as much as possible. The law may establish independent pre-requisites for individual uses of data.
• process online information based on use. You can find more information in this respect under the section on cookies.

We will only use your personal data when permitted by law.

• How your data are collected

We collect data about you or obtained from in various ways:

• Direct interactions: You can provide us with your data when filling in forms, when applying for jobs at our company or when communicating with us by postal mail, email or otherwise. This may also include the personal data that you supply when you purchase or use our products, subscribe to our services or publications, request the dispatch of leaflets, participate in a competition, promotion or survey, or send us your comments.
• Automatic technology or interactions:, We automatically collect technical data on your computer and browsing habits and patterns during your use of the Website. These personal data are collected through the use of cookies or similar technology. For additional information, consult our section on cookies included below in this Privacy Policy.
• Third parties or public sources: We may receive personal data about you from various third-party or public sources.

Lawful basis for the use of your data

We must have a valid basis to use your personal information, and we cannot collect, store or use information in any way that is not described in this policy. There are four purposes that provide us with a lawful basis for the use of your personal information:

• Performance of a contract: The information that we collect concerning you may be necessary to enable us to perform or enter into a contract with you
• Consent: You may provide your consent for us to contact you or for us to collect your information, for example, by agreeing to the use of cookies on the Website. If you have provided your consent to our use of your personal information, you will have the right to withdraw that consent at any time.
• Legitimate interest: We may also have a legitimate interest in the use of your personal information, such as ensuring that the content of the Website is presented to you and your computer as effectively as possible. If this is the reason for our use of your personal information, we must make sure that our interests do not take priority over yours, and you can object to our using your personal information in this way.
• Legal obligation: Finally, we may have a legal obligation to use your personal information in certain ways, or to protect your interests. For example, we may exchange information with other companies and organisations for the purposes of fraud prevention and reducing credit risk.

Data retention

We will only store your personal data during the time necessary to achieve the purposes for which we have collected it, including for purposes of complying with any legal, accounting or reporting requirements.

In order to determine the appropriate personal data retention period, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from the unauthorised use or disclosure of your personal data, the purposes for which we are processing your personal data and whether we can achieve them in any other way, and applicable legal requirements.

Website cookies.

1. Scope and purpose of processing

Cookies: In some areas of the Website, we use what are known as cookies. We do this, for example, to identify visitor preferences so that we can design the Website. This facilitates browsing and makes the Website user-friendly. Cookies can also help us to identify particularly popular parts of the Website. Cookies are small files that are saved on the visitor’s hard drive, which permit information to be stored for a certain period of time and the identification of the visitor’s computer. We use permanent cookies to improve user orientation and the presentation of individual services. We also use “session cookies”, which are automatically deleted when the browser is closed. Your browser can be configured to decline all cookies or some kinds of cookies, or to report on the placement of cookies. If you do this, you will always know about the use of cookies.

Important: If you completely decline the use of cookies, you may not be able to use certain functionalities of the Website. We use the following four categories of cookies on the Website:

• Necessary cookies
• Performance cookies
• Functionality/personalisation cookies
• Targeting cookies

We explain below the type and function of the various kinds of cookies that we use on the Website:

2. Cookie category

Necessary cookies: These cookies are necessary for you to move around the Website and use its functions, such as when accessing password-protected areas. Without these cookies, we cannot provide you with certain services that you have requested. We use cookies solely to identify registered users, so that we can recognise you during your time on the Website and when you return to it.

Performance cookies: These cookies collect information on how visitors use the Website, such as the most frequently-visited pages, or whether visitors receive error messages. These cookies do not collect information that can be used to identify visitors. All information that is collected using these cookies is anonymous and is solely used to improve the functionality and service of the Website. As a result, we use performance cookies to produce statistics on how the Website is used and to calculate the effectiveness of our advertising campaigns.

Functionality/personalisation cookies: These cookies allow websites to remember previous visitor information (such as selected username, language or region) to offer you optimised and personalised services. For example, a website can store your location in a cookie to provide you with up-to-date information about your region. These cookies are also used to remember options that you select for the Website (such as font, text size and other options that can be customised by the user). They are also used to provide the services that you request, such as watching a video. These cookies cannot track your browsing activity on other websites. Nor do they collect information on you that can be used for advertising purposes or track the pages you have visited online outside of the Website. As a result, we use functionality/personalisation cookies to identify you when you next visit the Website and to personalise content and store your configuration choices (such as your preferred region).

Targeting cookies: These cookies are used to make advertising more personally relevant to you and your interests. They are also used to limit the number of times you see an advertisement, to measure the effectiveness of an advertising campaign and to understand user behaviour after seeing an advertisement. Targeting cookies are generally placed by advertising networks with the website operator’s permission. They remember that a user has visited a website and send this information to other companies, such as advertisers. They are often linked to the functionality of the Website provided by this company. Therefore, we use targeting cookies to link with social networks that can use the information on your visit to personalise advertising on other websites and to provide the advertising networks that we use with information on your visit, so that they can then present you wish advertising that may be of interest to you based on your browsing behaviour.

Browser settings

Although browsers are already programmed to accept cookies in a pre-determined manner, browser configuration settings can be adjusted to only accept some cookies, or none at all. However, you should be aware that if all cookies are deactivated, you may not be able to use all the functions of the Website.

You can also use your browser settings to delete cookies that are already installed. Additionally, you can configure your browser to inform you before it stores cookies. As different browsers can offer various functions, you should use the relevant browser help menu to programme these options.

We recommend that you install specially developed plugins if you want a full report on all third-party access to your web browser.

Passive processing via the Website, such as tracking tools (where appropriate)

If you use this Website, your specific personal data may be passively processed via the use of various technologies without you having expressly provided them. This passive information-gathering is carried out in the following cases and for the following data:

Browser information: Browsers typically process certain specific information and pass it on automatically, such as your MAC address (exclusive hardware identifier), screen resolution, operating system (Windows, Apple, Android), operating system version, and also the type and version of your web browser.

Your IP address: Your IP address is a combination of figures automatically assigned by your Internet service provider to the computer that you are using. Every time a user visits the Website, their IP address is automatically processed in our web server’s log files. Communication between the web server and the visitor’s computer is not possible without the IP address. If we log and store the time of visits to the Website by using an IP address, this IP address is anonymised to ensure that we cannot link it to you.

Information about your device: You should be aware that in certain circumstances and in the case of smartphones, we process the International Mobile Equipment Identity (IMEI) number, as well as the MAC address for computers. However, this processing only takes place when necessary in order to provide you with the corresponding service that you have requested.

Website analysis: We use website analytics tools on the Website. This technology stores and processes data for marketing and optimisation purposes. The personal data required for this are also processed using cookies. Please consult the information provided above on cookies in relation to this issue.

This Website may use Google Analytics, a website analytics service from Google Inc. (“Google”). Google Analytics uses “cookies”, text files that are saved on your computer and facilitate analysis of your use of the Website. The personal data generated by the cookie with regard to your use of the Website are generally transmitted to Google’s US server and saved there. If IP anonymisation is activated on the Website, your IP address will be abbreviated beforehand by Google in EU Member States or in other countries that are party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the US and abbreviated there. On behalf of the operator of the Website, Google uses these personal data to analyse your use of the Website, to generate reports regarding Website activities and to provide the Website operator with additional services associated with Website and Internet use. The IP address transmitted from browsers within the scope of Google Analytics will not be combined with any other Google data. You can change the relevant settings of your browser software to prevent cookies from being saved; however, you should be aware that in this case, you may not be able to make full use of all the functions of the Website. You can prevent the collection and storage of data by Google Analytics at any time, with prospective effect. To prevent the processing of the data generated by the cookie and related with your use of the Website (including your IP address) and the processing of these data by Google, you can download and install the opt-out browser add-on from tools.google.com/dlpage/gaoptout.

Access to sections of the Website that are restricted to group professionals (if applicable).

Although you can visit some areas of the Website and use their functions as established by Viso without the need for personal registration, some areas are only open to specific groups, and therefore require registration. Viso only allows legally defined professional groups (such as doctors or pharmacists) to have access to certain information on medicines for sale subject to prescription or medical supervision. Please take into account that the information we offer on the Website via our registered user-only services is general and is not intended to offer advice on the treatment of patients in individual cases.

On this basis, we can offer the members of relevant professional groups the opportunity to register for the restricted section of the Website so that they can downloaded the above-mentioned information on our medicines. Restricted sections can be accessed by directly registering with Viso, in which case you will receive a password enabling you to visit the restricted section, or you can obtain access using a DocCheck password. You will need your DocCheck access details to do so. DocCheck is an external service supplier that offers you the chance to set up a user account at www.doccheck.com. DocCheck verifies that you are in fact a member of a stated professional group. You can also use these access details as login details on the Website (and on many other similar websites). To obtain information on how DocCheck handles your data, please consult DocCheck’s Privacy Policy. Before registering with DocCheck, make sure to carefully read its rules relating to data protection.

Third-party websites

This Privacy Policy does not apply to third-party websites, even when there is a reference or a link to these third-party websites. We do not endorse the content of said third-party websites. The same applies to graphic elements such as advertising banners or shortcuts that take you to other websites when you click on them. For these third-party websites, visit the respective provider’s websites to understand how they handle your data. We advise you to read the privacy information for each website that you visit whenever you leave our Website.

Third parties and processing of your personal data

If necessary and if permitted by law, we may provide your personal data to the following third parties:

• Any company in which Viso has a commercial interest, but only for the purposes identified in this Privacy Policy and within the scope of permitted transfers. You can find general information on the companies in which Viso has a commercial interest by visiting www.glenmarkpharma.com. However, we remain fully responsible for the handling of your personal data during this shared use.
• Our business associates, with advertising offers for shared brands and joint marketing. It is a condition of this that the transfer is permitted by law or you consent to it. Additionally, our business associates are contractually obliged to use the personal data exclusively in conformity with our specifications made prior to the transfer of these data.
• Service providers who provide services such as website hosting and moderation, processing of your product and service evaluations, the provision of call centre services, hosting of smartphone apps, data analysis, payment management, order management, infrastructure supply, IT services, customer service, email and direct advertising services, and credit card payment and audit, among others. Contractual associates are also bound by the provisions of our contract with them, and hence to comply with the provisions of data protection law.
• Third parties, in the case of restructuring, merger, sale, joint venture, transfer or other disposal relating to the entirety of our company or all of its equity or shares and/or parts thereof (for example, in cases of insolvency or similar procedures), if permitted by law.

In addition to the above, we will only pass your data to third parties if:

• you have given your express consent in accordance with Art. 6.1(a) of the General Data Protection Regulation (GDPR),
• processing is legally permitted and is necessary for the performance of a contract with you in accordance with Art. 6.1(b) of the GDPR,
• there is a legal obligation to process data in accordance with Art. 6.1(c) of the GDPR,
• disclosure is necessary in accordance with Art. 6.1(f) of the GDPR for purposes of establishing, exercising or defending legal claims and there is no reason to suppose that there is a priority interest that must be protected by the non-disclosure of the data.

Your rights as the data subject

If your personal data are processed, you are the data subject as this term is defined in the GDPR, and you have the following rights.

• In accordance with Art. 15 of the GDPR, you can ask for information on the personal data that we are processing concerning you.

In particular, you can obtain information on the purposes of the processing, the categories of personal data, the categories of recipient to whom the data have been or will be disclosed, the envisaged storage period, the existence of the right to request rectification, erasure, restriction of processing or to object to such processing, the right to lodge a complaint with a supervisory authority, the source of your data if not initially collected by us, transfer to other countries or international organisations, and the existence of automated decision-making, including profiling, as well as meaningful information about the logic involved when applicable.

• In accordance with Art. 16 of the GDPR, you can obtain without undue delay the rectification of inaccurate data or the completion of personal data that we are storing concerning you.
• In accordance with Art. 17 of the GDPR, you can ask for the personal data that we are storing concerning you to be erased, provided processing is not necessary for exercising the right of expression and information, for compliance with a legal obligation, for reasons of public interest, or to establish, exercise or defend legal claims.
• In accordance with Art. 18 of the GDPR, you have the right to obtain from the controller restriction of processing if you contest the accuracy of the personal data, the processing is unlawful or we no longer need your personal data for the purposes of the processing but you require them for the establishment, exercise or defence of legal claims. You also have the right established in accordance with Art. 18 of the GDPR if you have made an objection to the processing in accordance with Art. 21 of the GDPR.
• In accordance with Art. 20 of the GDPR, you have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit said data to another controller.
• In accordance with Art. 7.3 of the GDPR, you can withdraw your consent at any time. As a result, thereafter we will not be permitted to continue to process your data on the basis of your consent.
• In accordance with Art. 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority. In general, you can contact the supervisory authority for your habitual residence or place of work, or for the central headquarters of our company.

In order to exercise these rights, you can contact Viso as explained below.

Your right to object

When processing of your personal data is based on legitimate interests in accordance with Art. 6.1(f) of the GDPR, as mentioned previously, you have the right to object to the processing of your personal data in accordance with Art. 21 of the GDPR, provided that there are grounds resulting from your particular situation.

You must send your objection to the email address supplied below.

Cross-border transfers

Your data may be stored and processed in any country in which we maintain a presence or use service providers, such as our parent company Glenmark Pharmaceuticals Limited, in India. It is a condition of this transfer that permissibility of the transfer and receipt be guaranteed under the applicable law of the third-party recipient’s country. Standard European Commission contractual clauses are used for this purpose. As such, we have taken precautions so that when the recipient receives your data, the data protection level is in line with that required under EU law. If you wish to receive a copy of these standard contractual clauses, please write to the email address supplied below.

Data security and security measures

We undertake to protect your privacy and to handle your personal data on a confidential basis. For purposes of preventing manipulation, loss or undue use of the data that we store concerning you, we take exhaustive technical and organisational measures that we regularly check and adapt according to advances in technology.

However, we wish to emphasise that due to the structure of the Internet, it is possible that other people or institutions for whom/which we are not responsible may not observe the above-mentioned data protection rules or security measures.

In particular, third parties may read unencrypted data, such as those sent via email. We do not have technical control over this. It is the user’s responsibility to use encryption or other methods to protect the data that they supply against undue use thereof.

We have established procedures to handle any suspected personal data breach, and we will notify you and the applicable regulator of any breaches when the law so requires.

Amendments to this Privacy Policy

We may amend this Privacy Policy without prior notice. You should therefore visit this page periodically to make sure you have read the most recent Privacy Policy and are aware of what information we collect, how we use it and under what circumstances, if any, we share it with third parties.

Contact Details:

If you have any questions in relation to this Privacy Policy, please contact the Data Protection Coordinator by writing to dpo.glenmark@glenmarkpharma.com.

Legal Notice

In compliance with the provisions of Organic Law 3/2018, of 5 December, on Personal Data Protection and the securing of digital rights and of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016, we inform you that the contact details used for this communication will be included in a file owned by VISO FARMACÉUTICA S.L.U. for the purpose of facilitating its email communication with the various contacts it maintains in the course of its activities. Without prejudice thereto, you are informed that you can exercise your rights of access, rectification, cancellation and opposition, as well as the other rights established in the aforementioned regulation, for which purpose you should write to VISO FARMACÉUTICA S.L.U. located at CALLE DE LA RETAMA 7, 7ª PLANTA, 28045 MADRID, attaching a photocopy of documentation certifying your identity, or send an email to dpo.glenmark@glenmarkpharma.com. Pursuant to Law 34/2002 of 11 July on Information Society Services and Electronic Commerce, this message and its attached files may contain confidential information, for which reason you are informed that unauthorised use thereof is prohibited by law. If you have received this message in error, please immediately notify us via this email address and delete the original message together with its attached files, without reading or copying them in part or in full.