As an overriding principle, we only process such personal data as is necessary to achieve the various purposes (data minimisation principle) of processing. Where possible, we make use of pseudonymisation and anonymisation of data.

The purposes for which we collect and use your personal data and the legal basis under data protection laws on which we rely on do this are explained below.

Legitimate interests or that of a third party for the following purposes:

• for analysis to inform our business strategy, to research users’ demographics, interests, and behaviour, and to assist, enhance and personalise user experience (including with customised services and to make improvements to our services, products and site);
• to carry out surveys for market research purposes;
• to monitor the quality of our support to the public and your communications with us, and to assess and improve our service where necessary;
• to correspond or communicate with you;
• for business administration, including statistical analysis;
• for network and information security in order for us to take steps to protect your information against loss or damage, theft or unauthorised access;
• to comply with a request from you in connection with the exercise of your rights;
• for the management of enquiries, queries, complaints, or claims;
• for prevention of fraud and other criminal activities;
• for the establishment and defence of our legal rights; and
• using ‘list-based’ targeting tools offered by social media platforms and match you on social media for the purposes of marketing our brand.

Consent. We may use and process your personal data to contact you where you have consented for us to do so to send you direct marketing communications or for market research purposes when launching products and developing marketing strategies. We may collect your consent to be contacted by telephone or by post in the following ways (i) if you register for an account with us and indicate that you would like to receive such marketing from us; (ii) if you sign up to our newsletter via our site or other medium where available; or (iii) when you refresh your marketing preferences when responding to a request from us to do so. You have the right to opt-out of our use of your personal data to provide marketing to you. Please see ’Your rights‘ for further details on how you can do this.

Compliance with a legal obligation. We will use your personal data to comply with our legal or regulatory obligations (specifically, as required under pharmacovigilance law): (i) to assist any public authority or criminal investigation body; (ii) to identify you when you contact us; and/or (iii) to verify the accuracy of data we hold about you.

4. WHO MAY RECEIVE OR HAVE ACCESS TO YOUR DATA?

Access to your personal data is restricted to Lundbeck personnel to the extent necessary for processing the data for above-mentioned purposes.

We may also disclose your information to the following third parties:

Group companies. We may share your personal data with other companies within the Lundbeck group. They may use your personal data in the ways set out in ’How we use your personal data‘, in connection with data analysis, business management, and to assist in the provision of content, products and services to you. They may also process personal data on behalf of Lundbeck for the purposes of providing services to us.

Our suppliers and service providers.

• Other third parties may include cloud service providers (such as hosting and email management), IT providers, technical and professional advisors (including accountants and lawyers), advertising and marketing agencies, communication fulfilment service providers, and administrative service providers.
• When we use third party service providers, we only disclose to them any personal data that is necessary for them to provide their service and we have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.

Surveys. As research and market engagement important to us, we may ask a third party research company to contact you for the sole purpose of gathering general information and specific information relating to us and our products and services.

Business sale or restructure. We may transfer your personal data to a third party as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation. It also includes in the event of any liquidation, dissolution, or administration.

Legal obligation. We may also transfer your personal data if we’re under a duty to disclose or share it in order to comply with any legal obligation, to detect or report a crime, to enforce or apply the terms of our contracts or to protect the rights, property or safety of our visitors and customers.

When disclosing your personal data to third parties, we will always take steps with the aim of ensuring that your privacy rights continue to be protected.

5. WHERE IS YOUR DATA STORED?

All personal data you provide to us is stored on our secure servers which are located within the United Kingdom and/or the European Economic Area (EEA).

If at any time we transfer your personal data to, or store it in, countries located outside of the United Kingdom or the EEA (for example, as a result of our engagement of our CRM provider or if our hosting services provider changes) we will ensure that appropriate safeguards are in place for that transfer and storage as required by applicable law. This is because some countries do not have adequate data protection laws equivalent to those in the United Kingdom and EEA.

If your personal data is transferred to other companies in the Lundbeck Group, the transfer will be based on the Lundbeck Intra Group Agreement as applicable from time to time. The current agreement is based on the EU standard contractual clauses.

6. HOW LONG DO WE STORE YOUR PERSONAL DATA?

If we collect your personal data, the length of time we retain it is determined by a number of factors including the purpose for which we use that information and our obligations under other laws. We will only keep your personal data in an identifiable format for as long as is reasonably necessary to achieve the respective purpose of the processing unless we believe that the law requires us to preserve it.

If you have contacted us with a complaint or enquiry, we will store your personal data for as long as is reasonably required to resolve your complaint or enquiry.

When it is no longer necessary to retain your personal data, we will delete the personal data that we hold about you from our systems. After that time, we may aggregate the data (from which you cannot be identified) and retain it for analytical purposes.

The exceptions to the above are where:

• we need your personal data to establish, bring or defend legal claims or to comply with a legal or regulatory requirement;
• the law requires us to hold your personal data for a longer period, or delete it sooner;
• you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law, or you exercise your right to require us to retain your personal data for a period longer than our stated retention period; or
• in limited cases, the law permits us to keep your personal data indefinitely provided we put certain protections in place.

7. SECURITY AND LINKS TO OTHER SITES

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your information transmitted to our site and any transmission is at your own risk. Once we have received your personal data, we put in place reasonable and appropriate controls to ensure that it remains secure against accidental or unlawful destruction, loss, alteration, or unauthorised access.

Our sites may contain links to other websites run by other organisations. This policy does not apply to those other websites‚ so we encourage you to read their privacy statements. We cannot be responsible for the privacy policies and practices of other websites even if you access them using links that we provide. In addition, if you linked to our site from a third party website, we cannot be responsible for the privacy policies and practices of the operators of that third party website and recommend that you check the policy of that third party website.

8. DATA ANONYMISATION AND USE OF AGGREGATED INFORMATION

Your personal data may be converted into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from it. Aggregated data cannot be linked back to you as a natural person. We may use this data to share with our partners or for analytical and research purposes. This information may be collected by cookies placed on our site – please see our Cookies Policy for more information.