We appreciate your visit to our website, which is operated by Swixx Biopharma AG, UID: CHE-147.465.430, with its seat at Neuhofstrasse 5A, CH-6340 Baar, Switzerland (hereinafter “Swixx AG”).
This Privacy Notice aims to provide you with general information about personal data that Swixx AG and/or the legal entities belonging to the same ownership and/or governance structure and listed at: https://www.swixxbiopharma.com/en/countries/ (hereinafter the “Company”, or collectively the “Swixx Biopharma Group of Companies”) may collect about you, for what purposes, and how such personal data may be lawfully processed. “We”, “us” and “our” mean the relevant legal entity or entities.
Please note that more specific information about personal data processing may be provided in a separate privacy notice developed for a particular situation and provided to you. In such a case, the specific privacy notice shall prevail.
We are committed to protecting and respecting your privacy. Our privacy policy, including this notice, is regularly updated to reflect recent regulatory developments as well as data protection best practices; any updates to this notice will be published on our website. We encourage you to review this notice occasionally to ensure that you remain up to date with our privacy practices. However, we will also notify you where required to do so by applicable law. Notwithstanding any changes to this notice, we will continue to process your personal data in accordance with your rights and our legal obligations.
Please note that we do not collect any personal data, e.g. IP address, through the website. If you wish to learn more about the cookies used on the website, please read the Cookie Policy available at https://www.swixxbiopharma.com/en/cookie_policy/.
Swixx AG is a company registered under Swiss law. For the purposes of applicable data protection laws, the Company providing you with this Privacy Notice is the controller of your personal data that you share with us or that are processed as a result of any other interaction with the Company, unless stated otherwise. We process your personal data only on lawful bases provided for by applicable data protection laws.
In general, the purposes of processing your personal data are determined by the nature of our interaction with you as further specified.
We process your personal data in particular if you are: (i) an employee working for us or for another legal entity or person with whom we interact; (ii) interested in receiving information about us; (iii) a healthcare professional seeking professional or educational information, providing us with services, informing us about experience with the use of a product we distribute, or otherwise interacting with us in a professional capacity; (iv) a candidate interested in employment with our Company; (v) a participant in an event or meeting; (vi) a person with whom the Company interacts for purposes not related to adverse event or product complaint reporting, medical information requests, direct marketing or recruitment; (vii) a subject of a disease awareness, patient story or similar project; (viii) an ultimate beneficial owner of a legal entity, including the Company; (ix) a targeted participant in a survey; (x) a person who represents a healthcare service provider or is a treating physician of a patient for whom a healthcare service provider has applied for access to a particular product that the Company distributes and/or represents.
If you wish to learn about personal data processing related to pharmacovigilance activities, quality complaints and medical information requests, please consult the information available at: https://www.swixxbiopharma.com/en/privacy_notice_pharmacovigilance_medical_information_request_quality_complaints/.
You may be a person named in a contract concluded with you or with the organization you represent; in such case, we process your personal data in order to conclude and perform the contract, for example, to pay remuneration, arrange flight tickets, hotel accommodation and registration for an international event, or to record and publish a lecture, or to comply with a legal obligation as further regulated in applicable national and/or international legislation establishing which identification data must be indicated in contracts for them to be treated as concluded, or based on our legitimate interest, namely for the establishment, exercise and defense of legal claims, including the storage of communication or correspondence, or for the performance of due diligence under our legitimate interest in order to ensure ethical, transparent and legally compliant interactions, while protecting both the Company’s and the data subjects’ interests, including reputation, proprietary information and fair treatment. If you are a healthcare specialist who receives a transfer of value from us, we may process and disclose your personal data as part of the reporting of transferred values under a legal obligation as further established in applicable national law or, where such legal obligation does not exist, based on your consent.
DATA PROCESSED:
Your name, address and contact details (such as email address, telephone number, workplace, professional area, job title and organizational contact details), signature, bank account details (if you are a vendor of the Company), identification data required for contract conclusion and performance and for tax calculation, declaration and payment, your image and/or voice, membership in professional or other organizations, interests in companies or organizations doing business with the government or providing products or services, and other information provided in conflict-of-interest or due diligence forms and in communication/correspondence.
Invitations and organization, including registration for events or meetings that we organize or sponsor; in such cases, we process your personal data in order to facilitate your participation in such events or meetings based on your consent and/or for contract performance, as well as to keep records of participants due to medicinal product promotion and fiscal requirements in order to comply with legal obligations as further established in applicable legislation or pursuant to a legitimate interest in ensuring transparency of the hospitality provided during meetings or events and ensuring accountability for the reasonable use of the Company’s financial resources. In cases where we ask participants about nutritional requirements that may reveal health-related information, such personal data are processed based on your consent, which is deemed to be given when you provide information about special nutritional requirements. If we intend to take photos and/or videos during an event or meeting at which you may be recorded, for the purpose of presenting our activities internally and externally or sending memories of the event or meeting to participants, we will request your prior consent, unless applicable legislation allows taking pictures or videos without specific consent. In such cases, we process personal data based on a legitimate interest in presenting and publicizing our Company and its activities.
DATA PROCESSED:
Your name, address and contact details (such as email address, telephone number, workplace, professional area, job title and organizational contact details), signature and other information related to participation in the event, for example, your photo, dietary requirements and information about hospitality provided during a particular event or meeting.
Your request for information about the Company, in order to allow us to communicate with you by electronic means or through face-to-face interactions on topics of your interest. We process such personal data based on your consent.
DATA PROCESSED:
Your name, address and contact information (such as e-mail address, telephone number, your place of work, professional area, and organization contact information).
Information provided by a healthcare service provider about the patient and the treating physician in connection with an application for early access to a particular product is processed under the legitimate interest of the marketing authorization holder/manufacturer, namely to make a decision on the feasibility of granting such early access to the product. Please note that we process such information as a data processor. For more information on how your personal data are processed by the data controller, please visit the website of the marketing authorization holder/manufacturer of the product for which early access is requested.
DATA PROCESSED:
Full name, contact details (phone number, email address), workplace, specialization and title of the treating physician and/or representative of the healthcare service provider, as well as anonymized or pseudonymized information about the patient who requires a particular medicinal product (including, but not limited to, age, gender, disease and required volume of the medicinal product).
Information related to you in your job application, such as your CV, references, education and other professional certificates. This personal data processing is based on your consent given when applying for a vacant position or on our legitimate interest in selecting the most competent person for a vacant position and in defending Swixx against claims related to the recruitment process.
DATA PROCESSED:
Your name, address and contact details (such as email address, telephone number, workplace, professional area, job title and organizational contact details), education and experience, references and other information collected during the recruitment process, including the position for which you applied.
Personal data required for providing a response to a query received from a subject involved in communication or correspondence, or for the preparation of an inquiry or other type of document for a subject in connection with the exercise of the Company’s legitimate interests in the establishment, exercise and defense of legal claims, including the need to store communication or correspondence.
DATA PROCESSED:
Full name, address and contact details (email address and phone number), as well as other identification details, such as date of birth or unique personal identification number.
Personal data related to the development of disease awareness, patient stories or similar projects, processed based on your consent and/or for the conclusion and performance of a contract, for example, to prepare a contract, produce a video and publish it, etc.
DATA PROCESSED:
Full name, address, email address, phone number, status of the person (patient, caregiver, relative or healthcare professional), health-related information (type of disease, symptoms and challenges, etc.), image, voice and photograph.
Information required for the purposes of sanctions compliance, registration and disclosure of the ultimate beneficial owners of the Company, and for the performance of “Know Your Client” procedures, in order to comply with legal obligations established in national and/or international laws and to assess whether a vendor, including its beneficial owners, directors, managers and other key personnel, has a good reputation under our legitimate interest in ensuring that business relationships with legal entities, their beneficial owners, directors, managers or other key individuals do not pose legal, financial or reputational risks, thereby protecting our transparency, compliance and reliability in our operations. Some information may also be processed based on your consent where applicable legislation provides that certain data may be processed only with the consent of the data subject.
DATA PROCESSED:
Full name, date of birth, citizenship, country of residence and address, and relevant evidence such as invoices or similar documents to demonstrate the connection, a copy of a personal identification document, percentage of ownership and/or number of owned shares, type of shares, date and number of shares acquired and/or transferred, and other data provided by you when completing questionnaires or responding to our request to provide data required pursuant to legal regulations or “Know Your Client” requirements.
Personal information required for the conclusion and performance of an employment contract, for example, the preparation of an employment contract, salary calculation and payment, provision of benefits or assets, and the performance of the employer’s legal obligations related to employment, occupational safety, occupational health or benefits or assets, as further specified in applicable legislation governing employment, occupational health and safety and fiscal obligations, as well as for conflict-of-interest purposes constituting a legitimate interest of the Company in ensuring employees’ independence, integrity and impartiality when performing activities within the scope of their functions, protecting the Company’s proprietary information from use for purposes other than the Company’s interests, and ensuring compliance with fair competition rules in the relevant markets, as part of training management constituting a legitimate interest in ensuring that required training is provided on time and to the appropriate personnel. The Company may process your personal data for the purpose of presenting its employees internally and externally and promoting the Company’s activities based on your consent.
DATA PROCESSED:
Full name, address and contact details (phone number and email address), job title and workplace, date of birth, unique personal identification number, social security number, bank account details, trade union membership, health-related information (e.g. pregnancy, absence from work due to sick leave, the healthcare provider that issued the occupational health certificate and the information indicated in such certificate), information about your interests in other legal entities provided in a conflict-of-interest form, your photograph or recorded image, information on what training you have completed and when, benefits or assets provided to you, and other personal data related to your employment.
Personal data related to the carrying out of surveys pursuant to our legitimate interest in making improvements to work and/or the organization of events, activities and operations in order to better reflect expectations and enhance individual experience in any type of interaction with the Company, unless such personal data are processed based on the data subject’s consent, in which case such data are processed only with your consent.
DATA PROCESSED:
Full name, country of residence, contact details (phone number and email address), status of the person involved in the survey (e.g. employee, event participant, etc.), expressed feedback on survey questions (e.g. years of working with the Company, what the data subject likes and dislikes in relation to the operation or circumstances in scope, recommendations for further improvement and similar). Please note that the Company usually conducts anonymous surveys and may be aware of the audience involved in a survey, but not of individual responses to survey questions.
We may receive your personal data directly from you or from other parties, for example, your employer, representative, marketing authorization holder or manufacturer of the product, recruitment agency, etc.
Companies within the Swixx Biopharma Group of Companies provide certain services to other legal entities belonging to the Swixx Biopharma Group of Companies, including, but not limited to, financial, HR, legal, compliance and IT services, as permitted by law. In such cases, the Company that provides a particular service to another Company usually acts as a processor of personal data related to those services. In other instances, personal data may be processed for the purposes of managing the Swixx Biopharma Group of Companies, i.e. tasks related to the management of the Group’s financial, HR and corporate matters, the preparation of consolidated financial statements and other similar activities; in such cases, Swixx AG or another Company acts as an independent personal data controller.
Furthermore, as the Company provides certain services related to pharmacovigilance, quality assurance, medical information management and medicine access program management to marketing authorization holders or manufacturers listed at https://www.swixxbiopharma.com/en/partnering/, Swixx AG acts as the data processor and the local Company acts as the data sub-processor. Where Swixx AG or the local Company is the marketing authorization holder of a particular product, Swixx AG and the local Company are recognized as joint controllers.
If relevant and necessary, we may share your data with some of our partners who provide us with various services as our (i) agents, contractors and suppliers, including companies that provide us with technology services (e.g. data analysis, hosting and technical support), as well as companies engaged in marketing and distributing our products, companies involved in our recruitment process or other types of service providers; or (ii) our professional advisers, auditors and investors. When we share your information with other organizations or data processors, we require that they use your data only for the purposes for which it is shared and that they follow our instructions while complying with appropriate security measures. We may also provide pharmacovigilance, quality and medical information data to marketing authorization holders or manufacturers or their representatives.
We may also share your data with law enforcement agencies, regulators, courts, public authorities or emergency services if and when we are required to do so on a lawful basis.
We may also provide your data, as necessary for carrying out the business of the Swixx Biopharma Group of Companies, to our companies listed on the contact page of our website at: https://www.swixxbiopharma.com/en/countries/.
Due to the Company’s operations, your personal data may be shared outside the European Economic Area and/or Switzerland and/or your country of residence. The transfer of personal data will always comply with the GDPR and/or the Swiss Federal Act on Data Protection and the established models and measures for the transfer of personal data to third countries, in particular:
If personal data from the European Union are transferred to Andorra, Argentina, Canada (commercial organizations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom under the GDPR and the Law Enforcement Directive (LED), the United States (commercial organizations participating in the EU–US Data Privacy Framework), Uruguay, Brazil or other countries recognized as providing an adequate level of personal data protection pursuant to a relevant European Commission decision (a particular decision can be found at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en).
If personal data from Switzerland are transferred to countries belonging to the European Economic Area, Andorra, Gibraltar, Guernsey, the Isle of Man, the Faroe Islands, Jersey, Monaco, the United Kingdom, Argentina, Canada, Israel, New Zealand, Uruguay, the United States or other countries listed in the Swiss Federal Council Ordinance on Data Protection as providing an adequate level of data protection, such transfers are based on this Ordinance.
If personal data are transferred to a territory for which no adequacy decision has been issued by the European Commission and/or the Swiss Federal Data Protection and Information Commissioner and/or another equivalent mechanism under the applicable national regulation, the Standard Contractual Clauses approved by the European Commission or other safeguard measures stipulated in Chapter V of the GDPR and/or Section 3 of Chapter 2 of the Swiss Federal Act on Data Protection (as applicable) may be used for transferring personal data to third countries and/or international organizations, and/or any other appropriate legal mechanism may be used to transfer your personal data, for example, your consent or the necessity to perform a contract concluded with you.
In relation to the personal data provided to us, you have the following rights:
To be informed about the processing of personal data. We exercise this right by providing you with this Privacy Notice.
To access personal data processed.
To rectify personal data processed.
To be forgotten and to withdraw your consent at any time, without prejudice to the lawfulness of the processing of personal data based on consent prior to its withdrawal.
To restrict the processing of personal data.
To receive the personal data processed in accordance with your request (right to data portability).
To object to the processing of personal data.
To receive a copy of the appropriate or adapted safeguards and methods used for the transfer of personal data to third countries.
Please note that the exercise of certain rights may be restricted in accordance with applicable legal regulations. All of the above rights may be exercised by sending a request to us by email at data@swixxbiopharma.com or by contacting the Company with which you have or have had an interaction.
To file a complaint if your rights have been violated. You may lodge a complaint with a relevant supervisory authority, the contact details of which are available at: https://iapp.org/resources/global-privacy-directory.
The period for which we keep your personal data depends on the purpose for which your information was collected and is used. We never keep your data which are no longer required for the purpose for which they were collected. Data related to performance of a contract we keep for the duration of such contract and after its termination as long as it is required by applicable laws (for example in relation to accounting or taxes) or as long as our legitimate interest (e.g. resolution of potential legal claims lasts. Data related to job seekers we keep only until we close the respective position unless you are hired for employment and thus the personal data are made part of your personal file. Data processed on the basis of your consent we keep as long as required for the purpose for which they were collected in any case until revocation of your consent at the latest. Data processed in order to comply with legal requirements (such as pharmacovigilance data) are processed as long as required by applicable laws.
We hope this Privacy Notice has been helpful in setting out the way we handle your personal data and your rights to control it. If you have any more questions on how the Company handle your personal data or want to exercise any of the rights related to processing of your personal data outlined above, you may contact data protection officer at data@swixxbiopharma.com.