Source: https://heidelberg-pharma.com/en/privacy-policy
Timestamp: 2019-04-19 10:21:20+00:00

Document:
Our focus is on oncology and our mission is to research and develop drugs for cancer patients enabling them to receive a targeted and tailor-made course of treatment that is both highly effective and as well-tolerated as possible.
As a general rule, we collect and use the personal data of our users only to the extent that doing so is necessary for processing contact requests submitted by e-mail. In doing so, we process only personal data made available to us by users by e-mail through the contact request. As a rule, we collect and use personal data of our users only with the consent given by the user.
As far as we obtain the data subject’s consent for processing personal data, Art. 6 (1) (a) of the EU General Data Protection Regulation (GDPR) is the legal basis.
For processing personal data required for the fulfilment of a contract to which the data subject is party, Art. 6 (1) (b) of the GDPR is the legal basis. This also applies to processing operations required for steps prior to entering into a contract.
Where processing personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 (1) (c) of the GDPR is the legal basis.
If processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party and the data subject’s interests, fundamental rights and freedoms do not override said legitimate interests, Art. 6 (1) (f) of the GDPR is the legal basis for processing.
The data subject’s personal data is erased or blocked as soon as the purpose for storing it no longer exists. Data may be stored longer if such storage is provided for by the European or national legislator in EU regulations, laws or other regulations to which the controller is subject. Data is also blocked or erased when a retention obligation established by said regulations has expired, except where entering into a contract or the performance of a contract requires the continued retention of the data.
Every time our website is accessed, our system automatically records data and certain items of information from the computer system accessing the website.
The data is stored in our system’s log files. This does not include the IP addresses of the user or other data that allow the data to be attributed to a user. This data is not stored together with any of the user’s personal data.
Once the data is no longer required to achieve the purpose for which it was collected, it is erased. Where data is recorded for the purpose of providing the website, data is erased when the respective session has ended.
It is absolutely necessary to record data in order to provide the website, and it is absolutely necessary to store the data in log files to ensure the operation of the website. As a result, users do not have an opt-out option if they visit the website.
Our website uses a session ID cookie.
Cookies are generally text files that are stored in the Internet browser or by the Internet browser on the user's computer system.
The cookie does not store any of the user's personal data.
Technically required cookies are used in order to simplify the use of websites for users. Some features of our website cannot be provided without using cookies. These features require that the browser is recognized even after changing webpages of our homepage.
We can be contacted by using the e-mail addresses provided on our website. In this case, the user’s personal data communicated with the e-mail will be saved.
In this context, this data will not be shared with third parties. The data is used solely to process the conversation.
The legal basis for processing the data, that is transferred when sending an e-mail, is Art. 6 (1) (f) of the GDPR. If the e-mail contact is aimed at entering into a contract, Art. 6 (1) (b) is also a legal basis for the processing.
We process personal data contained in the e-mails solely to respond to your contact request. This constitutes a required, legitimate interest in processing the data.
Once the data is no longer required to achieve the purpose for which it was collected, it is deleted. For the personal data sent via e-mail, this is the case once the respective conversation with the user has ended. The conversation has ended once it can be determined based on the circumstances that the issue in question has been settled in its entirety.
Users contacting us by e-mail can object to the storage of their personal data at any time. In such case, the conversation cannot be continued.
All personal data that has been stored in connection with establishing contact will be erased immediately in this case and will no longer be processed unless the controller can demonstrate compelling legitimate grounds for the processing which override the user’s interests, rights and freedoms or unless the processing serves the establishment, exercise or defense of legal claims.
You can request that the controller provides you with confirmation as to whether personal data concerning yourself is processed by us.
(8) the existence of automated decision-making, including profiling, referred to in Art. 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Additionally, you have the right to request information as to whether your personal data will be transmitted to a non-EU country or international organization. In this connection, you may request that you will be informed of the appropriate safeguards associated with the transmission pursuant to Art. 46 of the GDPR.
Where the processed personal data concerning yourself is incorrect or incomplete, you have the right vis-à-vis the controller to have this data rectified and/or completed. The controller shall make the correction without undue delay.
(2) You withdraw your consent on which the processing is based according to Art. 6 (1) (a) or Art. 9 (2) (a), and there is no other legal ground for the processing.
Where you have asserted vis-à-vis the controller the right of rectification or erasure, the controller has the obligation to notify all recipients to whom personal data concerning you has been disclosed of such rectification or erasure of data, unless this proves impossible or involves disproportionate effort.
You have the right vis-à-vis the controller to be notified of those recipients.
You have the right to withdraw your consent granted under data privacy law at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent performed before its withdrawal. After receipt of the withdrawal, the controller will erase the personal data concerning you and will no longer process it unless the controller can demonstrate compelling, legitimate grounds for the processing that override your interests, rights and freedoms or unless processing serves the establishment, exercise, or defense of legal claims.
Any further administrative or judicial remedies notwithstanding, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of personal data concerning yourself infringes the GDPR.
The supervisory authority with which the complaint has been lodged will inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 of the GDPR.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 22
 Art. 46
 Art. 6
 Art. 9
 Art. 78