Protecting the Privacy of Personal Data

1.    Introduction

In connection with your use of our website (https://www.lundbeck.com/uk),
Lundbeck Limited (referred to as “Lundbeck”, “we”, “us”, “our”) may collect
and hold personal data about you. 

This policy explains how and why we collect personal data via the Lundbeck UK website as well as other legal information regarding our practices for this. Lundbeck is firmly committed to protecting the personal data we may collect from our online visitors and users of our products or services.

Where we engage with you in your role as a healthcare professional, we may collect and process further information about you. Please see our Privacy Notice: Healthcare Professionals here for further information. Links to specific social media privacy notices can also be found on our website by clicking here: Privacy Notice: LinkedIn and Privacy Notice: Twitter, or on our relevant social media pages or channels. If our website or these links are unavailable for any reason, please contact us using the details at the end of this policy and we can provide you with copies.

Lundbeck Limited (company number 01040798) is the data controller in relation to the processing activities described below. This means that we decide why and how your personal data is processed.

In processing your personal data, Lundbeck will always comply with applicable data protection laws, including the Data Protection Act 2018 and the UK General Data Protection Regulation (“UK GDPR”).

2.    What personal data do we process?

The categories of personal data we may collect about you and the way in which we collect it are as follows:

Personal data you give to us: This is information that you voluntarily give to us via our Lundbeck UK website and/or by correspondence with us by phone, email, or otherwise. This includes information provided when contacting us in relation to the services or products we provide or making an enquiry about our services or products, posting material or requesting further services or products, managing your account, and/or engage in correspondence with us by email or otherwise.

We may also ask you for information when you report a problem with our website. 

The categories of personal data that may be collected voluntarily includes: name, email address, job title or status, location, address, contact telephone number, professional registration number (GMC, GNC etc) if applicable, enquiry details, legal information relating to claims made by you, information relating to the sale of our products or services, or information contained in our correspondence or other communications with you about business (including responses to any surveys), and your marketing preferences.

In case you report an adverse event, side-effect, or any product issue via our website, we will collect your name, location, health related information, and contact information such as a phone number or email address in order to report to our Pharmacovigilance Department and the relevant health authorities in accordance with applicable laws.

As part of an adverse event report, Lundbeck may also process sensitive personal data about you where it is proportional and necessary to do to in order to comply with our reporting obligations or where required under law. This includes certain medical or health information in connection with a supply of a particular medicinal product. We will always seek to anonymise any specific named users of our products when holding or processing any sensitive personal data and request your explicit consent where required.

Personal data we collect about you: We may automatically collect the following information: details of transactions you carry out through our website, and your visits to our website, including, but not limited to, traffic data, location data, weblogs and other communication data, the resources you access, and the length, number and frequency of your visits. We may also automatically collect technical information, including anonymous data collected by the hosting server for statistical purposes, the Internet protocol (IP) address used to connect your computer or device to the Internet, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.

Please see our Cookies Policy for more information.

Personal data we may receive from other sources: We obtain certain personal data about you from sources outside of our business which may include from your healthcare professional if you have used our medicinal products and an adverse event occurs. This may include your initials, name, gender, age, date of birth, and medicinal product supplied.

3.    How we use your personal data?

The purposes for which we collect and use your personal data and the legal basis under data
protection laws on which we rely on do this are explained below.

• Legitimate interests or that of a third party for the following purposes:    
• for analysis to inform our business strategy, to help us understand how our website is used and by whom, to research users’ demographics, interests, and behaviour, and to assist, enhance and personalise user experience (including with customised services and to make improvements to our services, products and site);
• to ensure the safety of any users of our products, improve our services, and carry out investigations following an event or query; 
• to monitor the quality of our support to the public and your communications with us, and to assess and improve our service where necessary;
• using ‘list-based’ targeting tools via social media platforms to display to you, and other like-minded individuals, information about Lundbeck and our services for marketing purposes;
• to correspond or communicate with you;
• for business administration, including statistical analysis;
• for network and information security in order for us to take steps to protect you information against loss or damage, theft or unauthorised access;
• to comply with a request from you in connection with the exercise of your rights;
• for the management of enquiries, queries, complaints, or claims;
• for prevention of fraud and other criminal activities; and
• for the establishment and defence of our legal rights.

• Consent. We may use and process your sensitive personal data (including medical
  or health related information) where you have consented for us to do so, including in connection with our reporting obligations or to follow up on any query or advert event reported by you. You have the right to withdraw your consent at any time. Please see Your rights for further details on how you can do this.

• Compliance with a legal obligation. We will use your personal data to comply with our legal or regulatory obligations (specifically, as required under pharmacovigilance
  law): (i) to assist any public authority or criminal investigation body; (ii) to identify you when you contact us; and/or (iii) to verify the accuracy of data we hold about you.

4.    Who may receive or have access to your data?

Access to your personal data is restricted to Lundbeck personnel to the extent necessary for processing the data for above-mentioned purposes. 

We may also disclose your information to the following third parties:

• Group companies. We may share your personal data with other companies within the
  Lundbeck group. They may use your personal data in the ways set out in How we use your personal data, in connection with data analysis, business management, and to assist in the provision of content, products and services to you. They may also process personal data on behalf of Lundbeck for the purposes of providing services to us.       

• Health Authorities. In case you report an adverse event, side-effect, or any product issue via our website, we will share your personal data in order to report to our Pharmacovigilance Department and the relevant health authorities as set out in applicable pharmacovigilance legislation. We will seek to anonymise any specific named users of our products when processing any sensitive personal data and always request your explicit consent before using any sensitive personal data about you. Please refer to our adverse event reporting policy.     

• Our suppliers and service providers. 

• We may disclose your information to our third party service providers, agents, subcontractors and other organisations for the purposes of providing services to us or directly to you on our behalf. Third parties may include cloud service providers (such as hosting and email management), IT providers, technical and professional advisors (including accountants and lawyers), advertising and marketing agencies, communication fulfilment service providers, and administrative service providers.

• When we use third party service providers, we only disclose to them any personal data that is necessary for them to provide their service and we have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.   

• Business sale or restructure. We may transfer your personal data to a third party as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation. It also includes in the event of any liquidation, dissolution, or administration.

• Legal obligation. We may also transfer your personal data if we're under a duty to disclose or share it in order to comply with any legal obligation, to detect or report a crime, to enforce or apply the terms of our contracts or to protect the rights, property or safety of our visitors and customers.

When disclosing your personal data to third parties, we will always take steps with the aim of ensuring that your privacy rights continue to be protected.

5.    Marketing and social media

We may share your information with certain third-party social media platforms for direct
marketing purposes to make our products or services more responsive to your interests and/or those of like-minded individuals. We may use your email address on ‘list-based’ targeting tools offered by social media platforms and match you on social media for the purposes of marketing our brand. For example, we may aggregate your email address together with the email addresses of other visitors to our website, hash such data, and transmit the hashed data to LinkedIn for the purposes of creating “Custom Audiences”. We may also use your email address to build “Lookalike Audiences” based on your characteristics or interests using targeting tools on social media platforms, for example, where targeted posts are displayed to people on their LinkedIn feed who have similar characteristics to people on our Custom Audience list.

You can opt-out of this use of your personal data for social media marketing at any time by
contacting us at the details in section 14 and we will take steps to remove your information from our social media marketing lists. 

6.    Where is your data stored?

All personal data you provide to us is stored on our secure servers which are located within the United Kingdom and/or the European Economic Area (EEA).

If at any time we transfer your personal data to, or store it in, countries located outside of the United Kingdom or the EEA (for example, if our hosting services provider changes) we will ensure that appropriate safeguards are in place for that transfer and storage as required by applicable law. This is because some countries do not have adequate data protection laws equivalent to those in the United Kingdom and EEA.

If your personal data is transferred to other companies in the Lundbeck Group, the transfer will be based on the Lundbeck Intra Group Agreement as applicable from time to time. The current agreement is based on the EU standard contractual clauses.

7.    How long do we store your personal data?

If we collect your personal data, the length of time we retain it is determined by a number of factors including the purpose for which we use that information and our obligations under other laws. We will only keep your personal data an identifiable format for as long in as is
reasonably necessary to achieve the respective purpose of the processing unless we believe that the law requires us to preserve it.

If you have contacted us with a complaint or enquiry, we will store your personal data for as long as is reasonably required to resolve your complaint or enquiry. We review the data
submitted to us via the “Contact Us” function on our website at three month intervals and delete any personal data that is no longer necessary for us to retain from our systems.

When it is no longer necessary to retain your personal data, we will delete the personal data that we hold about you from our systems. After that time, we may aggregate the data (from which you cannot be identified) and retain it for analytical purposes.

The exceptions to the above are where:

• we need your personal data to establish, bring or defend legal claims or to comply with a legal or regulatory requirement;

• the law requires us to hold your personal data for a longer period, or delete it sooner;

• you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law, or you exercise your right to require us to retain your personal data for a period
  longer than our stated retention period; or

• in limited cases, the law permits us to keep your personal data indefinitely provided we put certain protections in place.

8.    Security and links to other sites

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your information transmitted to our site and any transmission is at your own risk. Once we have received your personal data, we put in place reasonable and appropriate controls to ensure that it remains secure against accidental or unlawful destruction, loss, alteration, or unauthorised access.

Our sites may contain links to other websites run by other organisations. This policy does not apply to those other websites‚ so we encourage you to read their privacy statements. We cannot be responsible for the privacy policies and practices of other websites even if you access them using links that we provide. In addition, if you linked to our site from a third party website, we cannot be responsible for the privacy policies and practices of the operators of that third party website and recommend that you check the policy of that third party website.

9.    Data anonymisation and use of aggregated information

Your personal data may be converted into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from it. Aggregated data cannot be linked back to you as a natural person. We may use this data to share with our partners or for analytical and research purposes. This information may be collected by cookies placed on our site - please see our Cookies Policy for more information.

10.    Your rights

In the UK and EEA, you have certain rights in relation to your personal data under data protection law and these are described below. Please note that we may ask you for information to confirm your identity and, where applicable, to help us to search for your personal data.

• Right of access. You have the right to request access to the personal data Lundbeck
  processes about you. We may not be able to provide you with a copy of your personal data if this concerns other individuals or we have another lawful reason to withhold that information.

• Right to rectification. You have the right to rectification of inaccurate personal data concerning you, including completion of incomplete personal data. If you discover that any of the other information we hold is inaccurate or out of date, please let us know.

• Right to erasure or restriction of processing. Under certain circumstances, you may ask for your personal data to be removed from our systems. Unless there is a reason that the
  law allows us to use your personal data for longer, we will make reasonable
  efforts to comply with your request. You may also ask us to restrict processing
  your personal data where you believe it is unlawful for us to do so, you have
  objected to its use and our investigation is pending or you require us to keep
  it in connection with legal proceedings. 
  In these situations, we may only process your personal data whilst its
  processing is restricted if we have your consent or are legally permitted to do
  so, for example, for storage purposes or in connection with legal proceedings. 

• Right to data portability. Where processing is based on a consent or a contract and the processing is carried out by automated means, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format. You have the right to ask us to transmit this personal data to a third party and we will do so if technically possible. We may not provide you with a copy of your personal data if this concerns other individuals or we have another lawful reason to withhold that information.

• Right to object. Where we rely on your legitimate business interests as the legal basis
  for processing your personal data for any purpose(s), you may object to us using your personal data for these purposes. Except for the purposes for which we are sure we can continue to process your personal data, we will temporarily stop processing your personal data in line with your objection until we have investigated the matter. If we agree that your objection is justified in accordance with your rights under data protection laws, we will permanently stop using your data for those purposes. Otherwise we will provide you with our justification as to why we need to continue using your data.

• Withdrawing your consent. Where we rely on your consent as the legal basis for processing your personal data, you may withdraw your consent at any time. If you withdraw your consent, our use of your personal data before you withdraw is still lawful.

• Automated decisions. In certain circumstances, you may contest a decision made about you based on automated processing.

If you want to exercise any of your rights as described above, please email or write to us using the contact details at the end of this policy.

11.    Complaints

If you wish to file a complaint regarding Lundbeck's processing of your personal data, you can email or write to us using the contact details at the end of this policy.

You also have the right to complain to the relevant data protection authority, which in the UK is the Information Commissioner's Office (ICO), if you are concerned about the way that we have processed your personal data.

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone Number: 0303 123 1113

Website: https://ico.org.uk/

12.    Children

This website is not intended or designed to attract children. Lundbeck do not knowingly collect personal data from any person we know to be under the age of 18 years.

13.    Changes

We may review this policy from time to time and any changes will be notified to you posting an updated version on our website and/or contacting you by email. Any changes will take effect 7 days after the date on which we post the modified terms on our website or the date of our email, whichever is earlier. We recommend you regularly check for changes and review this policy whenever you visit our website. If you do not agree with any aspect of the updated policy, you must immediately notify us and cease using our website.

This policy was last updated on 18 June 2021.

14.    Contact

If you have any questions regarding this privacy policy or Lundbeck’s processing
of your personal data, please contact our Data Protection Officer using the details below.

• Email: Our email address for data protection queries is dataprivacy@lundbeck.com.
• Post: If you wish to write to us, please write us at Iveco House, Station Road, Watford, Hertfordshire, England, UK, WD17 1ET.
• Phone: If you would prefer to speak to us by phone, please call 01908 649 966.