Data Protection

1. General information/introduction

Croma Nederland B.V., Parnassusweg 819, 1082 LZ Amsterdam, email: office@cromapharma.nl (hereinafter referred to as “CROMA,” “we,” or “us”) is responsible for the processing of personal data as described in detail in this privacy policy.

The protection of your privacy is very important to us. This privacy policy provides information about the purposes for which CROMA processes your personal data (hereinafter “your data”), in particular how we use your data and to whom we may transfer it. Furthermore, this privacy policy provides you with an overview of your rights in connection with our processing of your data.

We have taken appropriate technical and organizational measures to ensure that all legal requirements under data protection laws (GDPR, AVG) are observed both by us and by our service providers, whom we engage in some areas to process your data (so-called processors).

Age restriction: AVG/ GDPR in the Netherlands applies from 16 years for commercial services (instead of 14 years in the original text). AVG is the Dutch abbreviation for the GDPR. In Dutch it is called “Algemene Verordening Gegevensbescherming.” It is therefore the same regulation, just the Dutch name for the EU GDPR.

This website is intended exclusively for users who are older than 14 years of age. We would like to point out that we use the masculine form in this privacy policy for reasons of easier readability.

The ongoing technical development of the Internet and any changes to the legal framework may require adjustments to our privacy policy from time to time. We therefore reserve the right to amend this privacy policy accordingly. All changes shall apply from the time the amended privacy policy is published on our website.

2. Types of data processing

I. Use of our websites

1. What data we process about you
When you visit the websites www.cromapharma.com and www.cromaismore.com, as well as all subpages under these domains, we will collect the following data: Date and time of your visit to a page on our website, your IP address, name and version of your web browser, the website (URL) you visited before visiting this website, certain cookies (see below). When you register for the doctors' area, we also process the following data: name, email address, status as a doctor or pharmacist.

2. Purposes of data processing
We will process your data for the following purposes: If you have registered for the doctors' area, to verify your status as a doctor or pharmacist. This serves to demonstrate compliance with regulatory advertising restrictions under pharmaceutical and medical device law (see below); to make this website available to you and to further improve and develop this website; to detect, prevent, and investigate attacks on our website; and to compile usage statistics.

a) Physician area (Physician Login)
Regulatory requirements for product advertising within the scope of pharmaceutical and medical device law make it necessary to grant access to certain areas and content of our website exclusively to physicians. To access this content, you must register with your name and email address and confirm that you are a practicing physician. This data is stored in our database and serves as proof that you have provided accurate information.

b) Cookies
This website uses cookies. A cookie is a small file that can be stored on your computer when you visit a website. Cookies are used to offer additional functions on a website. For example, they can be used to make it easier for you to navigate a website, to enable you to continue using a website where you left off, and/or to save your preferences and settings when you visit the website again. Cookies cannot access, read, or change any other data on your computer. Most of the cookies on this website are so-called session cookies. They are automatically deleted when you leave our website. Persistent cookies, on the other hand, remain on your computer until you manually delete them in your browser. We use such persistent cookies to recognize you when you visit our website again. If you want to control cookies on your computer, you can set your browser settings so that you receive a notification when a website wants to store cookies. You can also block or delete cookies if they have already been stored on your computer. If you would like to know more about how to do this, please use the “Help” function in your browser. Please note that blocking or deleting cookies may affect your online experience and prevent you from fully using this website.

c) Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses cookies that enable an analysis of your use of the website. We process your data on the basis of our overriding legitimate interest in creating easy-to-use website access statistics in a cost-efficient manner (Art. 6 (1) (f) General Data Protection Regulation). The information generated by the cookie about your use of this website (including your IP address and the URLs of the websites you visit) is transmitted to Google servers in the USA and stored there. We do not store any of your data collected in connection with Google Analytics. This website uses the IP anonymization feature provided by Google Analytics. Your IP address will therefore be truncated/anonymized by Google as soon as Google receives your IP address. On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide us with other services related to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data by Google. You can prevent the storage of cookies by adjusting your browser software settings accordingly. However, we would like to point out that in this case you may not be able to use all the functions of this website to their full extent. You can also prevent Google from collecting your data in connection with Google Analytics by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de. For more information about Google's terms of use and Google's privacy policy, please visit http://www.google.com/analytics/terms/de.html or https://www.google.at/intl/at/policies/.

3. Legal basis for processing
The legal basis for processing your data is

when using our website, our overriding legitimate interest (in accordance with Art. 6 (1) (f) GDPR) in achieving the purposes listed above in point 2 (b)-(d);
when registering and using the doctors' area, our legal obligation to restrict the advertising of our medicinal products and medical devices to laypersons and to be able to provide verifiable evidence of this restriction (Art. 6 (1) (c) & (f) GDPR).

4. Storage period
Usage data is generally stored for two (2) months. Data is only stored for longer if this is necessary to investigate detected attacks on our website. With regard to the physician area, we process your data for at least one year after the physician area of the website goes offline in order to be able to defend ourselves in any administrative penalty proceedings pursuant to Sections 111(42) in conjunction with 104(1), (2) MPG (statute of limitations for prosecution Section 31(1) VStG).

II. Newsletter

1. What data we process about you
Email address

2. Purposes and legal basis for processing
Our newsletter provides information about Croma's entire product portfolio and upcoming events. You can unsubscribe from our newsletter at any time.

Legal basis:

For new customers, the legal basis is the consent you have previously given (Art. 6 (1) (a) GDPR).
For existing customers, the legal basis is our legitimate interest in providing you, as our customer, with information and advertising for Croma services or products, other events, and other news from the industries in which Croma operates (Art. 6 (1) (f) GDPR).

3. Storage period
We store your data until revocation (consent) or objection (legitimate interest) within the framework of the statutory provisions only for as long as is necessary to fulfill the purposes for which it was transmitted.

III. Applications

1. What data we process about you
When you apply for a job, we typically receive your name, contact details (email, phone number, address), your resume and the information it contains, and possibly your training and employment certificates.

2. Purposes and legal basis for processing

Before deciding on your application: Upon receipt of your application, we process your data for the purpose of initiating a contract in accordance with Art. 6 (1) (b) GDPR.
After deciding on your application: If you are accepted, the data will be processed within the framework of the employment relationship and you will be informed of this in detail separately at the latest when you start work. From the time of rejection, we process your data based on our legitimate interest in defending ourselves in any proceedings based on the Equal Treatment Act (GlBG) that may follow our rejection (Art. 6 (1) (f) GDPR). If you have given us your consent for the purpose of keeping your application on file, we will process your data from the time of rejection on the basis of this consent (Art. 6 (1) (a) GDPR).

4. Storage period
If you are hired, your data will be processed within the scope of this contractual relationship and you will be informed of this separately at the latest when you start work. If your application is rejected, the usual storage period is eight (8) months. This is calculated as follows: The six-month period for asserting claims under the GlBG begins at the time of rejection. Added to this is the fictitious postal delivery time for a lawsuit that was only filed in court towards the end of the period. This typically does not exceed two months. Thus, the purpose of processing your data based on our legitimate interest described above is expected to end 8 months after rejection, provided that we have not become aware of the initiation of such proceedings by that time. In accordance with Art. 17 (3) (e) GDPR, you are not entitled to erasure under Art. 17 (1) GDPR until then. Processing for record-keeping purposes based on your consent will continue until you revoke your consent, but no later than one (1) year after receipt.

IV. Contractual relationship with customers

1. What data we process about you
Name, age, gender, title/job title, department, address, email address, telephone number, fax number, website, ordering behavior (services; products; workshops), bank details

2. Purposes and legal basis for processing
a) Contract management (Art. 6 (1) (b) GDPR)
b) CRM: Insofar as the processing of your data in the course of a customer relationship management system does not already fall under the legal basis of contract processing (Art. 6 (1) (b) GDPR), we process your data on the basis of our overriding legitimate interest in using such a CRM to manage contracts more efficiently (Art. 6 (1) (f) GDPR).
c) Croma for Creators/Bonus Program: Contract and bonus system processing (Art. 6 (1) (b) GDPR). We also process your data for marketing purposes based on our legitimate interest (Art. 6 (1) (f) GDPR) in providing you, as our customer, with information and advertising for similar Croma services or products, other events, and other news from the respective product industry (including electronically).
d) Croma Is More: Processing of the continuing education program (Art. 6 (1) (b) GDPR). Furthermore, we process your data for marketing purposes based on our legitimate interest (Art. 6 (1) (f) GDPR) in sending you, as our customer, information and advertising for similar Croma services or products, other events, and other news from the respective product industry (including electronically).
e) Marketing: Our legitimate interest in conducting sales analyses in order to develop and/or improve new services, products, seminars, workshops, etc. (Art. 6 (1) (f) GDPR).

3. Storage period
We store your data, which is processed for contract execution, for at least seven (7) years in accordance with the statutory retention periods. For other processing purposes, we store your data until revoked (consent) or legitimate objection (legitimate interest) within the framework of other legal provisions only as long as it is necessary to fulfill the purposes for which it was transmitted. Once all purposes of use have ceased (e.g., if the product group for which you were our customer is discontinued), your data will be deleted immediately and completely.

V. Contractual relationship with advisors, consultants, suppliers

1. What data we process about you: Name, date of birth, address, telephone number, email address; bank details.
2. Purposes and legal basis: Contract processing (Art. 6 (1) (b) GDPR).
3. Storage period: In accordance with legal provisions, for at least seven (7) years.

VI. Clinical trials

2. Purposes and legal basis of processing
As a manufacturer of medical devices and medicinal products, we are required by regulatory requirements to commission clinical trials/studies as a sponsor for the product registration of medical devices and medicinal products in order to comply with high quality and safety standards. The personal data collected in this process is processed in compliance with the GDPR. The legal basis for this is the consent of the trial participant (Art. 9 (2) (a) in conjunction with Art. 6 (1) (a) GDPR) and our legal obligations to demonstrate the quality and safety standards of medical devices and medicinal products (Art. 9 (2) (i) in conjunction with Art. 6 (1) (c) GDPR). Croma also processes test center staff data in order to comply with the legal requirements of the MPG and the AMG (in their currently valid versions). The transfer of this data to ethics committees and to competent authorities for the purpose of obtaining approvals is permitted in accordance with Art. 6 (1) (c) GDPR.

3. Transfer of your data
Croma is jointly responsible for data processing with the respective trial center (Art. 26 GDPR). The trial site will only transmit the personal data of trial participants to Croma in pseudonymized form. For the purposes of conducting the clinical study/trial, Croma commissions contract research organizations (CROs) and other service providers (processors) in accordance with Article 28 of the GDPR. Within the framework of the clinical study/trial, data may be transferred to countries outside the EU/EEA only if the specific requirements for transfer to a third country pursuant to Art. 44 et seq. GDPR are met.

4. Storage period
In accordance with legal and regulatory retention periods, the data collected will be stored for at least 20 years. If you, as a test participant, revoke your consent, this revocation shall have no effect on activities based on your consent that were already carried out prior to your revocation. In this respect, you also have no right to erasure under Art. 17 GDPR.

3. Transfer of data to third parties

Croma generally stores your data on Croma's servers in Austria. For the purposes mentioned above, we may transfer your data to the following recipients:

Members of the Croma-Pharma Group: Croma-Pharma GmbH (AT), Croma GmbH (AT), Croma Pharma Produtos Medicos Ltda (BRA), Croma Schweiz GmbH (CH), Croma Deutschland GmbH (DE), Laboratorios Croma Estetica, SL (ESP), Croma France SASU (FR), Croma Italia Srl (IT), Croma Nederland B.V. (NL), Croma-Pharma Sp. Z o.o. (PL), CROMA PORTUGAL (PT), Croma Pharma Romania SRL (RO), Croma USA Inc. (USA), and Croma-Pharma Limited (UK).
External service providers (processors), in particular in the areas of debt collection, IT, legal, or tax.
Government authorities and notified bodies worldwide where necessary for regulatory reasons.

The Croma Pharma Group consists of the following companies:

Croma-Pharma GmbH (AT), Croma GmbH (AT), Croma Pharma Produtos Medicos Ltda (BRA), Croma Schweiz GmbH (CH), Croma Deutschland GmbH (DE), Laboratorios Croma Estetica, SL (ESP), Croma France SASU (FR), Croma Italia Srl (IT), Croma Nederland B.V. (NL), Croma-Pharma Sp. Z o.o. (PL), CROMA PORTUGAL – Comércio de Produtos Farmacêuticos, Unipessoal, Lda. (PT), Croma Pharma Romania SRL (RO), Croma USA Inc. (USA), and Croma-Pharma Limited (UK).

If Croma uses external service providers/processors to process your data, we have concluded the necessary agreements in accordance with Art. 28 GDPR in order to ensure compliance with our data protection obligations.

Some of the above recipients are located outside the European Union or process your data there. The level of data protection in non-EU countries may not be the same as in your country. We therefore only transfer your data to countries for which the EU Commission has issued an adequacy decision (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) and thus decided that they have an adequate level of data protection.

Subject to a legal obligation or an official or court order, we will not disclose your data to third parties unless we have obtained your express consent or are legally obliged to do so.

4. Information on rights

You have the right to obtain information about your data free of charge at any time and, if necessary, to have it corrected, deleted, or restricted, provided that this does not conflict with any legal retention obligations or other legal interests of Croma.
You have the right to object, to the extent permitted by law, to any processing that we base on our legitimate interest (Art. 6 (1) (f) GDPR).
If the data processing is based on your consent (Art. 6 (1) (a) GDPR), you can revoke this consent at any time without affecting the lawfulness of the processing carried out until the revocation.
Furthermore, under the legal requirements of Art. 19 GDPR, you have the right to receive your data in a common, machine-readable format.
In addition, you have the right to lodge a complaint against our processing of your data with the competent Austrian data protection authority.
The correct collection of your data is always of particular concern to us. Please contact our data protection officer to update your data (see contact details below).

5. Contact

Please address any data protection inquiries, complaints, or suggestions to Croma's data protection officer, either by email to dataprotection@croma.at or by post to:

Croma Nederland B.V.,

Attn: Data Protection Officer,

Parnassusweg 819,

1082 LZ Amsterdam,

Nederland.

6. Disclaimer

The content of external websites to which we refer directly or indirectly on our website (via “hyperlinks” or “deep links”) is beyond our control and responsibility and is not endorsed by us. However, we can declare that at the time the links were created, we assumed that there was no illegal content on the linked websites. We have no influence whatsoever on the current and future design or content of the linked pages or on the copyright authorization relating to them. We therefore expressly distance ourselves rom all content on all linked websites that has been changed since the link was created. This statement applies to all links and references within our website. The provider of the page to which reference is made is solely liable for illegal, incorrect, or incomplete content and in particular for damage resulting from the use of the information available on the linked websites. If we become aware of illegal, unlawful, or incorrect content on websites to which we link, we will remove the link.