Privacy Policies

Privacy Policy for www.tillotts.com

Last updated on: 26 July 2024

1. General

With this Privacy Policy we, the Tillotts Group[1] (hereinafter together Tillotts, we or us) explain how we collect and further process your personal data. This Privacy Policy applies only to personal data we collect via this website (“Website”) as described in Section 3 below. It is possible that other Privacy Policies are applicable to specific circumstances (e.g. our privacy policy for Business Contacts).

The term “personal data” in this Privacy Policy means any information that identifies or could reasonably be used to identify any person.

If you provide us with personal data of other persons (such as family members, work colleagues), please make sure the respective persons are aware of this Privacy Policy and only provide us with their data if you are allowed to do so and such personal data is correct.

This Privacy Notice is aligned with the EU General Data Protection Regulation («GDPR»), the Swiss Data Protection Act («DPA»). However, the application of these laws depends on each individual case.

2. Controller of Personal Data

The “controller” of data processing as described in this Privacy Policy (i.e. the responsible person) is Tillotts Pharma AG. You can notify us of any data protection related concerns, irrespective of the concerned affiliate company of the Tillotts Group, using the following contact details: Tillotts Pharma AG, Baslerstrasse 15, 4310 Rheinfelden, Switzerland (dataprivacy@tillotts.com). If possible, please specify which affiliated company of the Tillotts Group you refer to.

Our representative in the EEA according to Art. 27 GDPR (if required) is:

Tillotts Pharma GmbH
Kurfürstendamm 170
DE-10707 Berlin
Germany
Phone: +49 30 991 948 300
tpgmbh@tillotts.com

3. Processing of Personal Data and Legal Grounds

The personal data we collect about you broadly falls into the following categories:

If we ask you to provide additional personal data not already described above, we will inform you about the intended purpose at the time of collection.

We primarily use the collected data in order to provide our Website, which is in our legitimate business interest.

In addition, in line with applicable law and where appropriate, we may process your personal data and personal data of third parties for the following purposes, which are in our (or, as the case may be, any third parties’) legitimate interest, such as:

• communication with yourself and or third parties and processing of requests (e.g., job applications, media inquiries, adverse effect reporting, medical inquiries);
• developing and improving our websites, review and optimization of procedures regarding needs assessment for the purpose developing our products and business strategies;
• prevention and investigation of criminal offences and other misconduct (e.g. conducting internal investigations, data analysis to combat fraud);
• ensuring our operation, including our IT, our websites, apps and other appliances;
• measures for business management and compliance with legal and regulatory obligations as well as internal regulations of Tillotts.

If you have given us your consent to process your personal data for certain purposes (for example when registering to receive newsletters or carrying out a background check), we will process your personal data within the scope of and based on this consent, unless we have another legal basis, provided that we require one. Consent given can be withdrawn at any time, but this does not affect data processed prior to withdrawal.

4. Data Transfer and Transfer of Data Abroad

In the context of our business activities and in line with the purposes of the data processing set out in Section 3, we may transfer data to third parties, insofar as such a transfer is permitted and we deem it appropriate, in order for them to process data for us or, as the case may be, their own purposes. In particular, the following categories of recipients may be concerned:

• our service providers (within the Tillotts group or externally, such as e.g. consultants), including processors (such as e.g. IT providers);
• subcontractors and other business partners;
• domestic and foreign authorities or courts or other law enforcement authorities;
• competitors, industry organizations, associations, organizations and other bodies;
• other parties in possible or pending legal or administrative proceedings;
• affiliates of the Tillotts Group;

The majority of the Recipients will be within the European Economic Area, the United Kingdom and/or Switzerland but they may be located in any country worldwide. In particular, you must anticipate your data to be transmitted to any country in which the Tillotts Group is represented by affiliates, branches or other offices (see https://www.tillotts.com/) as well as to other countries in Europe and the USA where our service providers are located (such as Microsoft).

If a recipient is located in a country without adequate statutory data protection, we require the recipient to undertake to comply with data protection (for this purpose, we use the revised European Commission’s standard contractual clauses, which can be accessed here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?), unless the recipient is subject to a legally accepted set of rules to ensure data protection and unless we cannot rely on an exception. An exception may apply for example in case of legal proceedings abroad, but also in cases of overriding public interest or if the performance of a contract requires disclosure, if you have consented or if data has been made available generally by you and you have not objected against the processing.

5. Cookies and similar tracking technology

We use cookies and similar tracking technology (collectively, “Cookies”) to collect and use personal information about you. For further information about the types of Cookies we use, why, and how you can control Cookies, please see our Cookie Policy.

6. Data Security

We use appropriate technical and organisational measures to protect the personal data that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal data.

7. Data retention

We process and retain your personal data as long as required for purpose for which your personal data was collected and processed as well as beyond this duration in accordance with legal retention and documentation obligations. Personal data may be retained for the period during which claims can be asserted against our company or insofar as we are otherwise legally obliged to do so or if legitimate business interests require further retention (e.g., for evidence and documentation purposes). As soon as your personal data are no longer required for the above-mentioned purposes, they will be deleted or anonymized, to the extent possible. In general, shorter retention periods of no more than twelve months apply for operational data (e.g., system logs).

8. Obligation to Provide Personal Data to Us

As a rule, there is no statutory requirement to provide us with personal data. However, you must provide us certain information to enable the data traffic (e.g. IP address) in order to use our Website.

9. Your Rights

In accordance with and as far as provided by applicable law (as is the case where the GDPR is applicable), you have the right to access, rectification and erasure of your personal data, the right to restriction of processing or to object to our data processing, in particular for direct marketing purposes, for profiling carried out for direct marketing purposes and for other legitimate interests in processing in addition to right to receive certain personal data for transfer to another controller (data portability).

Please note, however, that we reserve the right to enforce statutory restrictions on our part, for example if we are obliged to retain or process certain data, have an overriding interest (insofar as we may invoke such interests) or need the data for asserting claims. If exercising certain rights will incur costs on you, we will notify you thereof in advance. We have already informed you of the possibility to withdraw consent in Section 3 above.

In general, exercising these rights requires that you are able to prove your identity (e.g., by a copy of identification documents where your identity is not evident otherwise or can be verified in another way). In order to assert these rights, please contact us at the addresses provided in Section 2 above.

In addition, every data subject has the right to enforce his/her rights in court or to lodge a complaint with the competent data protection authority. The competent data protection authority of Switzerland is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).

10. Links to other websites

This Privacy Policy applies only to this Website, and not to websites owned by third parties. We may provide links to other websites which we believe may be of interest to you. Due to the nature of the internet, we cannot guarantee the privacy standards of websites to which we link or be responsible for the contents of sites other than this one, and this Privacy Policy is not intended to be applicable to any linked, non-Zeria Group/Tillotts website.

11. Amendments of this Privacy Policy

We may amend this Privacy Policy at any time without prior notice. The current version published on our website shall apply. If the Privacy Policy is part of an agreement with you, we will notify you by e-mail or other appropriate means in case of an amendment.

[1] Affiliates include: Tillotts Pharma AB (Sweden), Tillotts Pharma GmbH (Germany). Tillotts Pharma France S.A.S., Tillotts Pharma Spain S.L.U., Tillotts Pharma UK Ltd., Tillotts Pharma Limited (Ireland), Tillotts Pharma Czech s.r.o.

1. Last updated: 16 May 2018 
   1. Background

   Tillotts Pharma AG and its wholly-owned affiliates[1] (“Tillotts”, “Tillotts Group”, or “we”) respects your right to privacy. This privacy notice (“Notice”) explains how we collect, share and use personal data about you, and how you can exercise your privacy rights. We are therefore providing you with this Notice as part of our commitment to processing personal data in line with applicable data protection laws, in particular the EU General Data Protection Regulation (EU Regulation 2016/679) (“GDPR”). If you have any questions or concerns about our use of your personal data, you may contact us using the contact details provided at the bottom of this Notice.

   2. What types of personal data are collected and why?

   The personal data that we may collect about you broadly falls into the following categories:

   • Information that you provide voluntarily

   We ask you to provide certain information voluntarily. The types of information we ask you to provide, and the reasons why we ask you to provide it, include:

   Types of personal data	Why we collect it
   Identification and contact details (name, address, telephone number and email address)	To establish and manage our relationship with you
   Financial information (bank account details, payment card)
   Employment details  (employer, job title)

   In addition, you may provide certain personal data when you correspond with us in the ordinary course of business, such as to schedule meetings and calls.

   If we ask you to provide any other personal data not described above, we will clarify the reasons why we ask you to provide such personal data at the point we collect it. 

   • Information that we obtain from third party sources

   From time to time, we may collect personal data about you from publicly available sources, or we receive your personal data from third party sources (including other suppliers, partners and our distributors); these third parties either have your consent or are otherwise legally permitted or required to disclose your personal data to us under applicable data protection laws.

   The types of information we collect from third parties include contact details of you, and we use the information we receive from these third parties to manage our relationship and to make relevant arrangements.

   3. Who do we share your personal data with?

   We may disclose your personal data to the following categories of recipients:

   • within the Tillotts Group, and to third party services providers and partners that assist us in providing our services and process personal data in this context, or who otherwise process personal data for purposes that are described in this Notice or notified to you when we collect your personal data;
   • to any competent law enforcement authorities, regulatory authorities, governmental bodies courts and other third parties whenever disclosure is required (i) pursuant to applicable laws, regulations, or industry codes; (ii) to exercise, establish or defend our legal rights; or (iii) to protect your vital interests or those of any other individual;
   • to an actual or potential buyer (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal data only for the purposes disclosed in this Notice;
   • to any other person with your consent to the disclosure.
     
   4. What is the legal basis for the processing of your personal data?

   Our legal basis for collecting and using the personal data described above will depend on the type of personal data and the specific context in which we collect it.

   However, we will normally collect personal data from you only (i) where we need the personal data to perform a contract with you, (ii) where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms, or (iii) where we have your consent to do so. In some cases, we may also have a legal obligation to collect personal data from you or may otherwise need the personal data to protect your vital interests or those of another person.

   If we collect and use your personal data in reliance on our legitimate interests, this interest will normally be (i) to receive services/products from you, (ii) to collaborate with you, or (iii) to manage our interactions with you.

   If you have any concerns about the processing of your personal data based on our legitimate business interests, you have the right to object to such processing. For more information on your corresponding rights, please see the “What are your data protection rights” heading below.

   If we collect and use your personal data in reliance on anything other than our legitimate business interests, we will make this clear to you at the relevant time. For example, if we ask you to provide personal data to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal data is mandatory or not (as well as of the possible consequences if you do not provide your personal data).

   If you have questions about or need further information concerning the legal basis on which we collect and use your personal data, you may contact us using the contact details provided under the “How to contact us” heading below.

   5. How do we ensure the security of your personal data?

   We use appropriate technical and organisational measures to protect your personal data. The measures we use are designed to provide a level of security commensurate with the risks related to the processing your personal data. 

   6. Do we transfer your personal data abroad?

   Your personal data may be transferred to, and processed in, countries other than the country in which you are a resident. These countries may have data protection laws that are different to the laws of your country of residence.

   Our servers are located in Switzerland, a country that that the European Commission has decided provides an adequate level of data protection, and our parent company and some of our third party service providers and partners operate in countries like Japan and the USA. This means that when we collect your personal data, we may process it in any of these countries.

   In cases where your personal data is transferred to a country outside the EU/European Economic Area (“EEA”) which is not covered by a decision of the European Commission that the country concerned ensures an adequate level of protection, we will take such measures as are necessary to ensure the transfer is in compliance with the applicable data protection laws, including the GDPR. Such measures may include (without limitation) transferring your personal data to a recipient that has achieved binding corporate rules authorisation in accordance with applicable data protection laws, or to a recipient that has executed standard contractual clauses adopted or approved by the European Commission. In addition, data transfers to recipients in the USA may be protected by an EU-U.S. / Swiss-U.S. Privacy Shield certification.

   7. Which data retention periods apply?

   We retain your personal data for as long as we have an ongoing legitimate business interest to do so (for example, to receive services from you or to comply with applicable legal, tax or accounting requirements).

   When we no longer have a legitimate business interest to process or retain your personal data, we will either delete or anonymise it. 

   8. What are your data protection rights?

   You have the following data protection rights:

   • You may access, correct, update or request deletion of your personal data.
   • You may object to processing of your personal data, ask us to restrict processing of your personal data or request portability of your personal data.
   • You can withdraw your consent at any time if we have collected and processed your personal data with your consent. Withdrawing your consent has no impact on the legality of the processing we performed prior to your withdrawal nor does it impact the processing of your personal data if a legal basis other than your consent exists.
   • You have the right to complain to a data protection authority about our collection and use of your personal data. For more information, please contact your local data protection authority. (Contact details for data protection authorities in the EEA are available here.)

   You may contact Tillotts at any time with a request to exercise your data protection rights, at no cost to you, by email.

   You will receive a response to your request in accordance with applicable data protection laws. 

   9. Updates to this Notice

   We may update this Notice from time to time in response to changing legal, technical or business developments. When we update our Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.

   You can see when this Notice was last updated by checking the “last updated” date displayed at the top of this Notice.

   10. How to contact us

   If you have any questions or concerns about our use of your personal data, please contact us using the following details: email.

   [1] Affiliates include: Tillotts Pharma AB (Sweden), Tillotts Pharma GmbH (Germany), Tillotts Pharma UK Ltd., Tillotts Pharma Limited (Ireland), Tillotts Pharma Spain S.L.U., Tillotts Pharma France S.A.S. Tillotts Pharma Czech s.r.o.

1. Last updated in July 2020 
   1. Background

   Tillotts Pharma AG, together with its wholly-owned affiliates^[1] (hereinafter “Tillotts”, or “we”), develops and markets prescription and over-the-counter medicines for human use (“Tillotts Products” or “Products”).

   This Privacy Notice (the “Notice”) explains how we process (e.g. collect, use, store, and share) your personal data for the purposes of drug safety and drug quality surveillance, as further outlined in section 3 (the “Purposes”). The scope of this Notice is limited to the collection and processing of your personal data in connection with the Purpose. We will process your personal data only in accordance with this Notice and in line with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), the Swiss Federal Data Protection Act, and other applicable local laws in your jurisdiction that regulate the processing of personal data (the “Data Protection Laws”).

   2. What categories of personal data do we collect?

   We may process the following categories of personal data from you in connection with the Purpose:

   Adverse Event Reports

   About a patient:

   • Name and/or initials;
   • Age and/or date of birth;
   • Gender;
   • Weight and height;
   • Details of the Product causing the adverse event;
   • The reason you have been taking or were prescribed the Product;
   • Details of other medicines or remedies you are taking or were taking at the time of the reaction;
   • The reason you have been taking the other medicines and any subsequent changes in your medicines;
   • Details of the reaction you suffered, the treatment you received for that reaction, and any long-term effects the reaction has caused to your health; and
   • Medical history considered relevant, including documents such as laboratory reports.

   About a reporter:

   • Name;
   • Contact details (which may include your address, email address, phone number or fax number);
   • Profession; and
   • Relationship with the patient who is the subject of the report.

   Medical Information Inquiries

   About a patient:

   • Name and/or initials;
   • Age and/or date of birth;
   • Gender;
   • Weight and height;
   • Details of the Product causing the adverse event;
   • The reason you have been taking or were prescribed the Product;

   About a reporter:

   • Name;
   • Contact details (which may include your address, email address, phone number or fax number);
   • Profession; and
   • Relationship with the patient who is the subject of the report.

   Product Quality Complaints

   About a reporter:

   • Name;
   • Contact details (which may include your address, email address, phone number or fax number);
   • Type of claimant (e.g., are you a patient or HCP);
   • Details of the Product causing the quality complaint; and
   • Medical treatment and disease (if you are a patient reporting the Product quality complaint).
   3. Why do we process your personal data?

   Adverse Event Reports

   Any personal data related to adverse events or other activities related to drug safety will be used solely for the detection, assessment, understanding, and prevention of adverse effects or any other Product-related problem. Your personal data will be maintained in our safety database which is regularly analysed for overall patterns. If you are a reporter, your personal data may be processed in connection with follow-up activities.

   Medical Information Inquiries

   Any personal data related to a medical information inquiry may be used to answer the inquiry, follow up on such requests and maintain the information in our database for reference. Where required by law, we may also report the data to regulatory authorities. 

   Quality Complaints

   Any personal data related to a Product quality complaint will be used solely for the detection, assessment, understanding, and prevention of the Product quality problem. Your personal data may be processed in connection with follow-up activities.

   4. What is the legal basis for the processing of your personal data?

   We process your personal data for the Purposes in order to comply with our legal obligations (Article 6(1)(c) GDPR) and for reasons of public interest in the area of public health (Article 9 (2)(i) GDPR). 

   5. Who do we share your personal data with?

   We may share your personal data with:

   • Health authorities;
   • Within the Tillotts Group; and
   • Partner companies that assist us (e.g. distribution partners, service providers, consultants, IT service providers, etc.).

   In any report that is shared, only the minimum data required is included, and the names, initials and contact details of patients are always removed to the extent permitted by applicable laws. 

   6. Do we transfer your personal data outside the EU/EEA?

   Our relevant safety databases are hosted in Switzerland and Germany. However, we may need to transfer your personal data to parties that are based outside of the European Economic Area (“EEA”) in a country for which the European Commission has not decided that it ensures an adequate level of data protection (“Third Country”).

   In cases where your personal data is transferred to a Third Country, we will take such measures as are required to ensure the transfer is in compliance with Data Protection Laws. Such measures may include (without limitation) transferring your personal data to a recipient that has achieved binding corporate rules authorisation in accordance with applicable Data Protection Laws, or to a recipient that has executed standard contractual clauses adopted or approved by the European Commission. In addition, data transfers to recipients in the USA may be protected by an EU-U.S. / Swiss-U.S. Privacy Shield certification.

   7. How do we ensure the security of your personal data?

   We have implemented appropriate state of the art technical and organisational measures to safeguard personal data processed for the purposes of drug safety, including procedures designed to restrict access to personal data to those employees who need it to perform their job.

   We maintain physical, electronic and procedural measures to safeguard personal data from accidental loss, destruction or damage and unauthorised access, use and disclosure.

   Whenever reasonably possible, we process personal data in key coded pseudonymised form.

   8. Which data retention periods apply?

   Your personal data will be stored in accordance with applicable laws and kept as long as needed to carry out the Purpose or as otherwise required by applicable laws.

   9. What are your data protection rights?

   Under the GDPR and any national data protection law of the EU member states, you have the right to:

   • check whether we hold personal data about you, and if so for what purposes and what kind of personal data we hold about you and to request copies of that data;
   • request rectification or erasure of your personal data that is inaccurate or processed for purposes not stated above;
   • request us to restrict the processing of your personal data;
   • in certain circumstances, object to the processing of your personal data;
   • if data processing is based on consent, you may withdraw your consent at any time, however, without affecting the lawfulness of processing based on consent before its withdrawal;
   • request information on the identities or categories of third parties to which your personal data are transferred; and
   • lodge a complaint with the data protection authority in your country.

   Please note, however, that under applicable laws, there may be limits on these rights depending on the specific circumstances of the processing activity. Please note that due to our legal obligations under pharmacovigilance legislation, Tillotts may not be able to erase or restrict processing of your personal data. Contact us as described in Section 11 with questions or requests relating to these rights.

   10. Updates to this Notice

   We may update this Notice from time to time in response to changing legal, technical or business developments. We will take appropriate measures to inform when we update our Notice, consistent with the significance of the changes we make.

   It is possible to see when this Notice was last updated by checking the “last updated” date displayed at the top of this Notice.

   11. How to contact us

   Any questions or concerns about our use of personal data can be directed to: dataprivacy@tillotts.com.

    

   [1] Affiliates include: Tillotts Pharma AB (Sweden), Tillotts Pharma GmbH (Germany), Tillotts Pharma UK Ltd., Tillotts Pharma Limited (Ireland), Tillotts Pharma Spain S.L.U., Tillotts Pharma France S.A.S., Tillotts Pharma Czech s.r.o.