EPHMRA's Privacy Policy
EPHMRA: Privacy Notice and Policy - updated 14.3.22
Thank you for taking the time to read our privacy notice. This explains how EPHMRA collects and processes your personal data when you visit our website, or use our services as a member, customer or a member of the public.
It is important that you read this privacy notice carefully. If you have any questions you can contact us on the details given at the end of this Policy.
- IMPORTANT INFORMATION ABOUT WHO WE ARE AND WHAT WE DO
EPHMRA is a global association for research and insight in the pharmaceutical and healthcare sector.
EPHMRA is a Swiss company registered in Basel with a registration number: PersID 585040 / UID CHE 113.450.376 and subject to the Federal Data Protection Act and pertaining Ordinances [Federal Act of 19 June 1992 on Data Protection (FADP); Ordinance of 14 June 1993 to the Federal Act on Data Protection (OFADP)].
EPHMRA’s main aims are to inspire and empower members to influence decision through expert advice and insights to help drive business performance and gain competitive advantage.
- EPHMRA is the hub for excellence to empower members to become the business partner of choice in providing insights and expert advice.
- Creating a Healthcare ‘Market Research and Analytics’ Community that defines, develops and shares best practice.
- Continuously developing and strengthening the core competencies that allow Members to achieve excellence as business partners and expert advisers.
- Excellence means that EPHMRA sets the ‘Gold-standard’ in healthcare ‘market research and analytics’ and continues building excellence by focussing on core competencies that relate to the strategic components of market research, data and analytics and business insights. This includes primary and secondary market research, forecasting, data analysis, competitive monitoring, KPI performance specialists etc.
- Furthermore EPHMRA will provide expert guidance to its members on healthcare ‘market research and analytics’ standards and ethics.
EPHMRA is the data controller and responsible for your personal data.
We have registered our activities with the Federal Data Protection and Information in Switzerland, which is where EPHMRA is located.
If you have any questions about this privacy notice or our data protection practices
please contact the EPHMRA General Manager on generalmanager@ephmra.org
CONTACT DETAILS
Our full details are:
Organisation: European Pharmaceutical Market Research Association known as EPHMRA
An association entitled the European Pharmaceutical Market Research Association (Association Européenne des Etudes du Marché Pharmaceutique, Europäische Vereinigung für Pharmazeutische Marktforschung, Associazione Europea per lo Studio del Mercato Farmaceutico) exists within the meaning of Art. 60 ff. of the Swiss Civil Code. The Association is established without limit of time. The registered office of the Association is in Basel.
Name: European Pharmaceutical Market Research Association known as EPHMRA
Email address: generalmanager@ephmra.org
Phone: Tel + 44 (0) 3333 661024
- INFORMATION ABOUT THE DATA WE COLLECT ABOUT YOU
Personal data means any information about an individual from which that person can be identified, or any information about an identifiable individual. It does not include data which cannot be connected to an identifiable individual (anonymous data).
There are different types of personal data about you which we might collect use, store or transfer. In addition to these specific categories of data, we might in relation to any interaction collect a range of other data about data subjects, for the purposes outlined below. We have grouped these together as follows, and provided some illustrations of the type of personal data which might fall into each grouping:
- Identity Data could include your first name, maiden name, last name, username or similar
identifier, marital status, title, date of birth or gender.
- Contact Data could include your home or work address, email address, telephone numbers or another unique identifier for use with electronic communication.
- Financial Data could include bank account and payment card details.
- Transaction Data could include details about payments to and from you and other details
of services you have purchased from us.
- Technical Data could include your internet protocol (IP) address, your login data, browser type and version, operating system and platform, and information about other technology on the devices you use to access this website, EPHMRA events and webinars, etc.
- Profile Data could include your membership interests, preferences, feedback and survey responses.
- Usage Data could include information about how you came to and leave our website, and how you use our website, products and services.
- Communications Data could include what information you want to receive from us and how you would prefer it to be delivered.
- Aggregated Data such as statistical, research, survey or demographic data for any purpose. Aggregated Data could be derived from your personal data but this data will not directly or indirectly link to you as an identifiable individual. For example, we may aggregate survey data to report on the evaluation of an EphMRA event. However, if we combine or connect Aggregated Data with your personal data so that it can be linked directly or indirectly to you, we treat the combined data as personal data which will only be used in accordance with this privacy notice.
- Special category data is not routinely collected except for dietary information (i.e. health data) which is required to supply refreshments for EphMRA events. Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions. If we need such information we will ensure that we have a lawful basis for our processing of it.
- WHY COLLECT YOUR PERSONAL DATA
Where we need to collect personal data by law, or under the terms of a contract we have with you (such as to fulfil the terms of EPHMRA subscriptions or the purchase of EPHMRA products and services), and if you decide not to provide that data when requested, we may not be able to carry out our business functions, perform the contract we have or are trying to enter into with you (for example, to provide you with association membership or goods or services), or proceed with some other activity. In this case, we will inform you of the consequences at the time, but these may include being unable to complete any commercial or contractual activity that you may have asked us to undertake.
- HOW WE COLLECT YOUR PERSONAL DATA
We use different methods to collect data from and about you including through:
Direct. You may give us your identity, contact and financial data by filling in membership, product or event forms or by corresponding with us via the EphMRA website, by post, phone, email or other means. This includes personal data you provide when you or an organisation you work for:
- ask for information about EPHMRA’s services or subscribe to them;
- agree to become a member or customer of EPHMRA;
- respond to a survey that we are running;
- request communications to be sent to you; or
- give us feedback or contact us.
Automated technologies or interactions. As you interact with the EphMRA website, our digital systems will automatically collect technical data and usage data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our cookie policy for further details.
User Generated Data. We may generate transaction, usage, marketing and communications data about you, by way of records of the direct and automated interactions that you have with us or our website.
Third parties. We will receive personal data about you from various third parties as set out below:(
- analytics providers e.g. Google Analytics;
- content management system providers;
- social media – Facebook, LinkedIn or Twitter
- HOW WE USE YOUR PERSONAL DATA
We will only use your personal data for the purpose for which we collected it. The list of purposes that EphMRA uses, the type of data used and the lawful basis, as defined in legislation, is detailed in Table 1.
Table 1: How EphMRA uses your personal data analysed by purpose, type of data and lawful bases
|
Purpose for using the data |
Type of data used for purpose (see list of data types in section 2 of this policy) |
Lawful basis for processing |
|
To identify potential members who may benefit from joining EphMRA or to process EphMRA member applications |
|
|
|
To deliver EphMRA services as an association and service provider representing research and insight within the pharmaceutical and healthcare sector:
|
|
|
|
To manage our relationship with you which may include:
|
|
|
|
To satisfy external audit and/or legal requirements and standards |
|
|
|
To administer and protect EPHMRA as an organisation including website and digital infrastructure e.g. testing and checking systems, maintenance of the website, etc. |
|
|
|
To deliver relevant website content including information about EPHMRA’s services, events, conferences, training courses and other activities |
|
|
|
To use data analytics to measure and improve EPHMRA’s website performance and customer communications |
|
|
|
To issue communications such as newsletters and email marketing communications |
|
|
|
To make suggestions to further engagement with you as a member and/or customer of EPHMRA |
|
|
- HOW WE SHARE YOUR PERSONAL DATA
We may share your personal data with the parties set out below for the purposes set out in the table above.
Internal Third Parties, including:
- service suppliers we have appointed to ensure that the services we provide and the events that we organise are run smoothly and safely and that your personal needs are met;
- experts who are appointed by us to deliver services;
- external professionals appointed to provide advice and recommendations on areas connected with their expertise;
External Third Parties, which might include:
- credit reference agencies such as Experian (if we need to carry out credit checks);
- providers of our IT infrastructure, such as Microsoft, Google or Amazon;
- governmental or other investigatory bodies (where required by law).
We will only share personal data with a third party to the minimum extent necessary for the lawful purposes. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes, to the minimum extent necessary and in accordance with our instructions.
- WHAT INTERNATIONAL TRANSFERS WE UNDERTAKE AND HOW THESE ARE MANAGED
EPHMRA is based in Switzerland and its main service providers are based abroad which requires EPHMRA to frequently process and transfer data between other countries. These transfers are based upon are covered by the cross-border disclosures regulated by Art 6 FADP and Art. 7 OFADP.
EPHMRA uses a number of suppliers in the UK and in the EU. Both destinations are covered by the so called “Adequacy Decisions”, which means that they both provide a level of legislative protection deemed adequate.
On occasion it might also be necessary for EPHMRA to make a transfer of your personal data to a country which are not covered by an Adequacy Decision, such as the US. In those circumstances (including the limited circumstances identified above) we ensure that adequate safeguards are in place which will be appropriately documented in a formal agreement using appropriate safeguards which are the Standard Contractual Clauses approved by the European Commission.
- DATA SECURITY FOR YOUR PERSONAL DATA
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those EPHMRA Board and Committee members, service suppliers and other third parties who have a reason for needing your personal data e.g. to deliver an EPHMRA service to you. They will only process your personal data on EPHMRA’s instructions and they are subject to a duty of confidentiality.
The data security measures that we have in place include:
- Password protected CRM which is hosted in the UK
- On-going support from a specialist IT company ensuring EPHMRA’s security is up-to-date
- Encrypting and protecting our documents and servers
- Having effective clear desk policy and subsequent secure destruction of confidential waste paper
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach, in a timely manner, where we are legally required to do so. We will endeavour to work with you and them to minimise the impact of the breach.
- RETAINING YOUR DATA
We will only keep your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period if we reasonably believe there is a specific need, e.g. prospect of litigation, in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the data minimisation principle and balance the need for retention and the need for minimisation. This balance is determined by the amount, nature and sensitivity of the personal data we have processed about you, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and other requirements such as applicable legal, regulatory, tax or accounting purposes.
The actual retention periods for the different types of personal information that we hold is detailed in Table 2.
Table 2: EPHMRA’s current data retention periods
|
Record Type |
Retention Period/Retention Criteria |
|
General correspondence |
2 years |
|
Emails |
8 years |
|
Membership |
|
|
Membership application forms |
10 years |
|
Membership correspondence |
5 years |
|
Lapsed member records |
5 years |
|
Perspective members |
5 years |
|
Changes in member details |
|
|
Training |
|
|
Training booking forms |
2 years |
|
In-person event |
|
|
Dietary information for in-person events |
2 years |
|
Conferences, webinars and events |
|
|
Conference, webinar and events booking forms |
8 years |
|
Dietary information for f2f events |
2 years |
|
Photographs from events |
indefinitely |
|
Recordings from webinars |
indefinitely |
|
Research and surveys |
|
|
Identifiable research responses |
Non collected – all anonymised |
|
Financial data |
|
|
Invoices |
indefinitely |
In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research, survey or statistical purposes, in which case we may retain this aggregate data for an indefinite period as the data will no longer be identifiable.
- YOUR LEGAL RIGHTS
Under certain circumstances, you have rights under data protection laws in relation to your personal data including the right to receive a copy of the personal data we hold about you. You also have the right to make a complaint at any time to the Federal Data Protection and Information, the Swiss supervisory authority for data protection issues (https://www.edoeb.admin.ch/edoeb/de/home.html).
Your legal rights include the right to:
Request access to your personal data, known as a “data subject access request”. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. You can make a data subject access request by e-mailing us at generalmanager@ephmra.org with the subject line “Data Subject Access Request” or make a request by mail or via the telephone via the following:
EPHMRA, c/o Streicher & Brotschin Treuhand AG, Gartenstrasse 101, 4052 Basel, Switzerland
Tel + 44 (0) 3333 661024
Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. You can make a data correction request by e-mailing us at generalmanager@ephmra.org with the subject line “Data Correction Request” or make a request by mail or via the telephone via the following:
EPHMRA, c/o Streicher & Brotschin Treuhand AG, Gartenstrasse 101, 4052 Basel, Switzerland
Tel + 44 (0) 3333 661024
- Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no longer a valid reason for continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. EPHMRA may not always be able to comply requests of erasure for specific legal reasons which if applicable we will inform you of with reasons for not meeting your request.
You can make a data deletion request by e-mailing us at generalmanager@ephmra.org with the subject line “Data Deletion Request” or make a request by mail or via the telephone via the following:
EPHMRA, c/o Streicher & Brotschin Treuhand AG, Gartenstrasse 101, 4052 Basel, Switzerland
Tel + 44 (0) 3333 661024
- Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and for which you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. It is possible that EPHMRA may demonstrate a compelling legitimate grounds to process your information.
You can make a objection to processing request by e-mailing us at generalmanager@ephmra.org with the subject line “Objection to processing” or make a request by mail or via the telephone via the following:
EPHMRA, c/o Streicher & Brotschin Treuhand AG, Gartenstrasse 101, 4052 Basel, Switzerland
Tel + 44 (0) 3333 661024
- Request restriction of processing of your personal data. This enables you to ask EphMRA to suspend the processing of your personal data in the following scenarios:
- If you want us to establish the data’s accuracy.
- Where our use of the data is unlawful but you do not want us to erase it.
- Where you need us to hold the data even if we no longer require it as you need it
to establish, exercise or defend legal claims.
- You have objected to our use of your data but we need to verify whether we have
overriding legitimate grounds to use it.
You can make a data restriction request by e-mailing us at generalmanager@ephmra.org with the subject line “Data Restriction Request” or make a request by mail or via the telephone via the following:
and same Basel address as before
EPHMRA, c/o Streicher & Brotschin Treuhand AG, Gartenstrasse 101, 4052 Basel, Switzerland
Tel + 44 (0) 3333 661024
- Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used format. Note that this right only applies to automated information which you initially provided consent for EphMRA to process or where we used the information to perform a contract with you.
You can make a data transfer request by e-mailing us at generalmanager@ephmra.org with the subject line “Data Transfer Request” or make a request by mail or via the telephone via the following:
EPHMRA, c/o Streicher & Brotschin Treuhand AG, Gartenstrasse 101, 4052 Basel, Switzerland
Tel + 44 (0) 3333 661024
- Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, EphMRA may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.
You can make a data withdrawal request by e-mailing us at generalmanager@ephmra.org with the subject line “Data Withdrawal Request” or make a request by mail or via the telephone via the following:
EPHMRA, c/o Streicher & Brotschin Treuhand AG, Gartenstrasse 101, 4052 Basel, Switzerland
Tel + 44 (0) 3333 661024
We will need to request specific information from you to confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We aim to respond to all legitimate requests within one month of the confirmation of the identity of the request. There may be occasions when request take EPHMRA longer to fulfil e.g. if a request is complex or involves a significant amount of data. If this applies we will notify you and keep you updated.
This privacy notice was last updated on 10 March 2022. The Privacy Notice & Policy may be updated from time to time and an updated version will be published on the EPHMRA website at: privacy Policy.