Privacy Notice of Glycostem Therapeutics B.V.
Version [28 August 2018]
Identity and contact details of controller
1. Glycostem Therapeutics B.V. is the controller of personal data that we may collect from you as our (potential) customer. This means that we are responsible for ensuring that such personal data are kept private, safe and protected against unlawful access or processing.
2. If you have any questions or concerns as to how your data is processed, you can contact:
Glycostem Therapeutics B.V at Office@Glycostem.com or you can write using the address of Glycostem Therapeutics B.V., Kloosterstraat 9, NL-5349 AB OSS, The Netherlands.
Why we collect your personal data
3. As a supplier of goods and services, we need to keep and process information about our customers, that is necessary for entering into and for the performance of orders and agreements or when that is necessary for a legitimate interest in relation thereto. We need your personal data if you like to receive our newsletters.
4. If in the future we intend to process your personal data for a purpose other than that for which it was collected we will provide you with information on that new purpose and any other relevant information.
Legal basis of the processing of your personal data
5. The legal basis that we use for the processing of your personal data will in most cases be the entering into or the performance of a contract with our customers. The information we hold and process will be used for the negotiation and performance of the agreement only. We may also process personal data if you register for our newsletter and provide us with your consent to use your personal data.
6. Alternatively, in cases where the data processing is not strictly necessary for the negotiation or performance of an agreement, but related thereto, such as in case of a quality survey, we may rely on our legitimate interest as a legal basis. In such case, we will always inform you in advance of such use and ensure that the interests of you as our customer are duly accounted for.
7. We will never process special categories of information, such as relating to your racial or ethnic origin, political opinions or religious and philosophical beliefs, without your prior explicit consent.
What type of personal data is collected
8. Much of the information we hold will have been provided to us by you, when making a request for products or services, during contract negotiations or when performing an order or agreement. Personal data may also be provided to us if you register for our newsletter.
9. The sort of information we hold includes your name, your function, your e-mail address and other business contact details and correspondence with you.
Transfer of personal data to third parties
10. We will not transfer personal data of you to third parties, including to other group companies, without your prior consent, unless another group company or third party acts as a data processor on behalf of Glycostem Therapeutics B.V.
Transfer of personal data outside of the European Economic Area
11. In limited and necessary circumstances, your information may be transferred outside of the EEA. We only transfer your data to countries that are deemed to provide an adequate level of safeguards to ensure the security of your data, based upon an assessment and adequacy decision of the European Commission.
Retention time of your personal data
12. Personal data will be stored depending on the type of personal data:
- Contracts, changes and addendums will be retained for seven years from the end of the contract;
- Contact details will be kept up to 10 years after an active business relation has been terminated or if you withdraw your consent;
- Company documents and files (such as letters and e-mail correspondence) will be kept as long as that is reasonably required for our business.
Your rights as a data subject
13. You have a number of rights with regard to your personal data:
- Access rights: you have the right to request access by us to your personal data. We will at your request provide a copy of the personal data undergoing processing, free of charge. For any further copies, we may charge a reasonable fee based on administrative costs. Where you make the request by electronic means, and unless otherwise requested by you, the information shall be provided in a commonly used electronic form. We will always verify your identity before handing over any information;
- Right to rectification: you have the right to request from us that we rectify inaccurate personal data concerning you, without undue delay;
- Right to erasure: when there is no valid basis for processing you may request the erasure of your personal data, for example, when you are not employed anymore by a company with which we do business. We may still archive the data, in accordance with our data retention policy, but we will not actively use the data;
- Right to restrict processing: in brief, instead of erasure of your personal data you may request that we restrict data processing, which means that the data are temporarily stored on a separate location, for example if you may still need the data yourself. After restriction, your personal data shall, except for storage, generally only be processed with your consent. You will be informed by us before the restriction of processing is lifted;
- Right to object: you may, on grounds relating to your particular situation, object at any time to processing of your personal data which is based on processing “for a legitimate interest” e.g. if use your data for a quality survey and we have not asked for your consent. After an objection, we will no longer process your personal data unless we can demonstrate compelling reasons to continue processing. When we intend to process your personal data on the basis of “legitimate interest”, we will explicitly bring this right to object to your attention in advance, clearly and separately from any other information;
- Right to data portability: you have the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format, where:
o the processing is based on consent or on a contract; and
o the processing is carried out by automated means.
In exercising your right to data portability, you will have the right to have your personal data transmitted directly from us as one controller to another controller, where technically feasible.
You may exercise your rights by sending a request to Glycostem Therapeutics B.V. at Office@Glycostem.com or you can write using the address of Glycostem Therapeutics B.V., Kloosterstraat 9, NL-5349 AB OSS, The Netherlands.
We will respond to any request within one month, if this deadline is not met, you will be informed as soon as possible providing reasons of the delay, and you will be informed of your right to file a complaint at the data protection authority.
Withdrawal of consent
14. If you have provided consent for the processing of your personal data, you have the right to withdraw that consent at any time, which will not affect the lawfulness of the processing before your consent was withdrawn. You can withdraw your consent by sending an e-mail to: Office@Glycostem.com
Right to lodge a complaint
15. You have the right to lodge a complaint to the Dutch Data Protection Agency if you believe that we have not complied with the requirements of the General Data Protection Regulation (“GDPR”) with regard to your personal data:
Please see, https://autoriteitpersoonsgege...
Consequences of not providing personal data
16. We need the personal data that we process to be able to perform the contracts with our customers in compliance with the law. Therefore, if you do not provide the personal data that we request from you, the consequence may be that we cannot enter into an agreement.
Automated decision making
17. We do not use any automated decision making (including profiling).