SUBSTIPHARM

Rules for processing personal data applicable to quality complaints

At Substipharm, we need to collect your personal data when you make a complaint about the quality of our products; we look carefully at each complaint so we can improve our products. We need to collect and process your personal data in order to deal with the quality complaint.

The legal basis for this, required under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter also referred to as “GDPR“), is the legal obligation of Substipharm to process the quality complaint in accordance with Directive 2011/62/EU and Article R. 5124-55 of the French Public Health Code. Under no circumstances may the information collected be used for any purpose other than that provided for herein.

I) Data Collected and Purpose of Processing

In accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and the Act of 6 January 1978 as amended, certain personal information is collected by Substipharm when a quality complaint is made.

The purpose of the data processing is to manage and monitor complaints and the quality of our products as well as to communicate with the person who has submitted the complaint, as detailed below (hereinafter referred to as the “Purpose“).

At Substipharm, we only collect and store data that is relevant and meets the Purpose of the processing. The data that may be collected by Substipharm and the details of its Purpose are as follows:

II) Who do we share your personal data with?

1) Within the European Economic Area

Within the Substipharm company or Group, we may share your personal data with the following recipients:

• Substipharm’s Quality department;
• other Substipharm departments involved in processing the data;
• other Substipharm Group entities within the European Economic Area.

We may also share your data with service providers and subcontractors acting on behalf of Substipharm for the Purposes of processing. The latter will be considered “processors“ under the GDPR.

All these recipients have access to personal data only insofar as they need it for the aforementioned Purpose of the processing.

The data is disclosed or transmitted in accordance with the security requirements of the GDPR.

2) Transfers outside the European Economic Area:

The data collected by Substipharm is processed, stored and archived in the European Economic Area. However, by way of exception, data may be transferred outside the European Economic Area if this is necessary to process a quality complaint. This happens when:

• the request comes from a foreign national health authority or agency or an international one;
• or if the manufacturing site of the product to which the complaint relates is located outside the European Economic Area.

In these two cases, the data is only transferred to countries recognised by the European Union as providing an adequate level of protection, or by implementing measures to control the transfer and guarantee the level of protection required by the GDPR.

III) How long personal data is kept ?

The length of time data is kept is determined by the Purpose of collecting the data and processing the quality complaints.

The personal data collected and processed as well as the history of quality complaints are kept for up to 10 years from the date of receipt of the complaint.

IV) Your rights

When you make a quality complaint and we process your personal data, you have the following rights:

• Right of access: i.e. the right to access the data about you that Substipharm processes;
• Right of rectification: i.e. the right to rectify any data about you that is inaccurate or incomplete;
• Right to limitation: i.e. the temporary freezing of your data for the time needed to carry out checks, should you dispute the accuracy of the data;
• Right to object to the processing of all or part of your personal data when it has been collected and processed on the basis of Substipharm’s legitimate interests (subject to you providing justification for your particular situation);
• Right to limit the processing of your personal data;
• Right to give instructions relating to the storage, deletion and disclosure of your personal data after your death.

Insofar as the legal basis for the processing of complaints is one of legal obligation, data subjects do not have the right to have their personal data deleted, ported or transferred.

V) Contacting us

If you want to contact Substipharm about your personal data, you can write:

By post to:

Substipharm

24 rue Erlanger

75016 Paris, France

By e-mail to: dataprivacy@substipharm.com

Substipharm will send you a reply within one month of receipt of your request in accordance with Article 12 of the GDPR. If Substipharm has complex requests to deal with or a very large number of requests, the period within which it sends you a reply may be extended by a further two months. If this is the case, you will be informed within one month of receipt of your request.

You may also lodge a complaint with the supervisory authority in your Member State (CNIL in France) at any time.

The Commission Nationale de l’Informatique et des Libertés (3 place de Fontenoy – TSA 80715 -75334 Paris Cedex 07, Tel. +33 (0)1 53 73 22 22 / www.cnil.fr).