Pharm-Olam International, LLC and each affiliate and subsidiary thereof (collectively referred to as Pharm-Olam) conducts every business transaction (including without limitation, operations, negotiations and marketing) with integrity and complies with the laws and regulations of the United States, as well as the laws and regulations of each foreign country in which Pharm-Olam operates or is looking to operate. All Pharm-Olam personnel are expected to conduct Pharm-Olam business legally and ethically and with respect to maintaining privacy in communication.
Pharm-Olam values the confidence of its customers and vendors and respects individual privacy, including personal data of employees, clients, healthcare professionals, medical research subjects, clinical investigators, customers, business partners, consultants, contractors, subcontractors and investors. Not only does Pharm-Olam strive to collect use and disclose personal data in a manner consistent with the laws of the countries in which it does business, but it also has a tradition of upholding the highest ethical standards in its business practices.
Pharm-Olam intends to apply this policy to all transfers of personal data, whether in electronic, paper or verbal format, received or made by Pharm-Olam. The provisions and the uses of this policy apply to all employees, contractors, subcontractors, agents and consultants working with, or on behalf of, Pharm-Olam.
This Policy sets forth the basic principles by which the Company processes the personal data of customers, clients, vendors, business partners, employees, contractors, clinical trial investigators, site team members, clinical trial subjects and other individuals and indicates the responsibilities of its business departments and employees while processing personal data.
Questions about this policy, or requests for further information, should be directed to Pharm-Olam´s Data Protection Officer atDPO@pharm-olam.com.
For purposes of this policy, the following definitions shall apply:
Agent: Any third party that uses personal information provided to it by or on behalf of Pharm-Olam to perform tasks on behalf of and under the instructions of Pharm-Olam.
Pharm-Olam: Pharm-Olam International, LLC., together with its successors, affiliates, subsidiaries, divisions and groups in the United States and other countries worldwide.
Personal Data: Any information relating to an identified or identifiable natural person ("Data Subject") who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Special Categories of Personal Data: Personal information that reveals race, ethnic origin, political opinions, religious or philosophical beliefs, criminal records or trade union membership, or that concerns health or sexual orientation.
Data Controller: The natural or legal person, public authority, agency or any other body, which alone or jointly with others, determines the purposes and means of the processing of personal data.
Data Processor: A natural or legal person, public authority, agency or any other body which processes personal data on behalf of a Data Controller.
Processing: An operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of the data.
Basic Principles Regarding Personal Data Processing:
Pharm-Olam intends to process personal data in accordance with the data protection privacy principles of any and all applicable international laws and regulations, including but not limited to the GDPR Principles. Pharm-Olam also commits to subject to the Privacy Shield Principles all personal data received from the EU and Switzerland in reliance on the Privacy Shield.
The GDPR Principles are set forth below:
Lawfulness, Fairness and Transparency
Pharm-Olam processes personal data lawfully, fairly and in a transparent manner in relation to the data subject.
Pharm-Olam collects personal data for specified, explicit and legitimate purposes and does not further process the data in a manner that is incompatible with those purposes.
Pharm-Olam collects personal data that is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed. Pharm-Olam strives to collect the least amount of personal data possible. With the increasing number of countries restricting or disallowing the use of subjects’ initials as an identifier, Pharm-Olam will no longer collect subjects’ initials, except where the sponsor requires such and the Sponsor is compliant with the applicable national laws.
Pharm-Olam keeps personal data accurate and, where necessary, up to date and takes reasonable steps to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified in a timely manner.
Storage Period Limitation
Pharm-Olam keeps personal data for no longer than is necessary for the purposes for which the personal data are processed.
Integrity and confidentiality
Pharm-Olam uses appropriate technical or organizational measures to process personal data in a manner that ensures appropriate security of personal data, including protection against accidental or unlawful destruction, loss, alteration, unauthorized access to, or disclosure.
Building Data Protection in Business Activities
In order to demonstrate compliance with the principles of data protection, Pharm-Olam has build data protection into its business activities.
Privacy Notices to Data Subjects
When individuals are first asked to provide personal data to Pharm-Olam, or as soon as practicable thereafter and in any event before Pharm-Olam uses or discloses the information for a purpose other than for which it was originally collected, Pharm-Olam properly informs data subjects of the following: the types of personal data collected, the purposes of the processing, processing methods, the data subjects’ rights with respect to their personal data, the retention period, potential international data transfers, if data will be shared with third parties and the Company’s security measures to protect personal data. This information is provided through a Privacy Notice in clear and understandable language.
Since Pharm-Olam has multiple data processing activities, it has developed different privacy notices depending on the processing activity, the data subject and the categories of personal data collected. Pharm-Olam´s Data Protection Officer is responsible for creating and maintaining the Register of Privacy Notices. Where special categories of personal data are being collected, the Privacy Notice explicitly states the purpose for which this data is being collected.
Where Pharm-Olam, as a data processor, receives personal data from its subsidiaries, affiliates or other entities in the EU, Switzerland and any other country, it shall use such data in accordance with all applicable laws and regulations, including the GDPR. Where Pharm-Olam, as a data controller, receives personal data from third parties, it shall provide the subjects with an appropriate Privacy Notice within a reasonable period after obtaining the personal data, at the time of the first communication or first disclosure to another recipient.
Data Subject's Choice and Consent
Whenever personal data processing is based on the data subject's consent, Pharm-Olam retains a record of such consent. Pharm-Olam provides data subjects with options to provide the consent and informs and ensures that their consent (whenever consent is used as the lawful ground for processing) can be withdrawn at any time. When requests to correct, amend or destroy personal data records, Pharm-Olam ensure that these requests are handled without undue delay and in any event within one month of receipt of the request. Pharm-Olam´s Data Protection Officer also records the requests and keeps a log of these.
Personal data is only processed for the purpose for which it was originally collected. If Pharm-Olam wants to process collected personal data for another purpose, it seeks the consent of its data subjects in clear and concise writing.
Pharm-Olam will obtain consent from all customers, employees, healthcare professionals, medical research subjects, clinical investigators, customers, business partners, contractors, subcontractors, consultants and investors, where required, for processing, use and/or distribution of any personal and/or special categories of personal data prior to the processing, use or distribution of such data.
Use, Retention and Disposal
The purposes, methods, storage limitation and retention period of personal data are consistent with the information contained in the Privacy Notice. Pharm-Olam maintains the accuracy, integrity, confidentiality and relevance of personal data based on the processing purpose. Adequate security mechanisms designed to protect personal data are used to prevent personal data from being stolen, misused, or abused and prevent personal data breaches.
Disclosure to Third Parties
Pharm-Olam may share an individual's personal data with agents, contractors, partners or vendors of Pharm-Olam in connection with services that these individuals or entities perform for, or with, Pharm-Olam. Whenever Pharm-Olam uses a third-party vendor to process personal data on its behalf, Pharm-Olam ensures that this vendor can provide security measures to safeguard personal data that are appropriate to the associated risks. For this purpose, the Processor GDPR Compliance Questionnaire is used.
Pharm-Olam contractually requires the vendor to provide the same level of data protection. The vendor must only process personal data to carry out its contractual obligations towards Pharm-Olam or upon the instructions of Pharm-Olam and not for any other purposes. Pharm-Olam explicitly specifies the respective responsibilities of the third party in the relevant contract or any other legal binding document, such as the Data Processing Agreement.
Cross-border Transfer of Personal Data
Pharm-Olam intends that all transfers of personal data comply with all applicable international laws and regulations, including the GDPR.
When transferring personal data out of the European Economic Area (EEA), adequate safeguards will be used, such as including standard contractual clauses issued by the European Commission in contracts with third parties. Specifically, for example, for transfers of personal data from Switzerland and the EU to the US, Pharm-Olam follows and complies with the EU-US Privacy Shield and the Swiss-U.S. Privacy Shield Principles published by the U.S. Department of Commerce. Pharm-Olam certifies that it adheres to the Privacy Principles of notice, choice, onward transfer, security, data integrity, access and enforcement. To learn more about the Privacy Shield please visit https://www.privacyshield.gov/list. Transfers of personal data outside of the European Union, other than to the U.S. shall be made in accordance with the data protection principals prescribed by the international law and regulations applicable in the relevant countries.
Privacy Shield Enforcement
The Federal Trade Commission has jurisdiction over Pharm-Olam’s compliance with the Privacy Shield.
In compliance with the Privacy Shield Principles, Pharm-Olamcommits to resolve complaints about our collection or use of your personal information. EU and Swiss individuals with inquiries or complaints regarding our Privacy Shield policy shouldfirstcontact Pharm-Olamat:DPO@pharm-olam.com.
Pharm-Olamhas further committed to refer unresolved Privacy Shield complaints regarding transferring personal data from EU to the US to the EU Data Protection Authorities (DPAs). For unresolved Privacy Shield complaints regarding transferring personal data from Switzerland to the US, Pharm Olam has committed to refer to the Judicial Arbitration and Mediation Services, Inc. (JAMS), an alternative dispute resolution provider located in the United States.
Pharm-Olam commits to cooperate with EU Data Protection Authorities (DPAs) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) and comply with the advice given by such authorities with regard to human resources data transferred from the EU and Switzerland in the context of the employment relationship.
Reservation of Rights
Pharm-Olam reserves the right to share individuals’ personal information as required by law or duly authorised information request of governmental authorities.