Data Controller (also “we”) is the Company of the Menarini Group that distributes the non-pharma product to which your request refers. The contact details of the Data Controller can be found inside the packaging of such product. The data protection officer (“DPO”) can be reached at the following address: dpo@menarini.com
The Data you supply –including health information- are processed by the Data Controller in line with the EU regulation 679/2016 (“Regulation”) to clear the requirements connected to adverse event vigilance. Once the data have been collected, the Controller is bound to process them to pursue a legal obligation and/or to pursue a public interest (ensuring a high level of safety of its products), which constitute the legal basis of the processing in accordance with art. 9.2 of the Regulation.
We hereby inform you that whenever you supply personal data of third parties, you warrant you have duly been authorised to do so in line with the applicable law.
In order to fulfil the above legal obligations, data shall be retained at least as long as prescribed by the applicable laws and/or to fulfil the public interests for which they were collected –considering that adverse events could occur many years after using a company product, data will be retained for up to 10 years after the last batch of the product -to which the report refers- has ceased to be marketed. Data is accessible to the Authorities in charge of overseeing adverse events and to the competent health authorities as required by the applicable laws, to Menarini Group Companies and their staff authorised to process personal data; to the Companies from which the product in question has been in-licensed (or on whose behalf we are distributing it) or to which it has been out-licensed (or that are distributing it on our behalf); service providers which support the Companies with Adverse Event fulfilments as well as to other legitimate recipients as prescribed by the applicable law. The Company may also use the data to establish, exercise or defend legal claims in court.
As for potential transfers of your data to non-EU countries, including countries that may not afford the same level of protection as EU data protection laws, please be informed that the transfer will take place according to one of the methods or in the circumstances set out by the Regulation, such as, for example, the adoption of Standard Contractual Clauses approved by the EU Commission or the selection of entities enrolled in programs for the free movement of data or operating in countries considered as safe by the EU Commission. Be informed that You may request a copy of the Standard Contractual Clauses or other relevant guarantees by making a request to the contact details above. However, please be advised that if your data shall be transferred to public health authorities based in a non-EU country, it may not be possible to enter into the aforementioned Standard Contractual Clauses with them; in such cases, your data will be processed in accordance with the laws applicable in the country of destination strictly for purposes of public interest in the field of public health, internationally recognized and prescribed also by the European Law (ensuring a high level of product quality. In any case, where possible, your data will normally be transferred without your first and last name.
By addressing a request to the Data Controller or the DPO at the above addresses you may receive the list of recipients of your data are, of Data Processors and/or exercise the applicable rights afforded by arts. 15-22 of the Regulation, including, by way of example, obtain confirmation about whether we are processing your data, verify their content, origin, exactness, location, obtain a copy, procure that your data are supplemented, updated, rectified, anonymised, etc. Lastly, we inform you have the right to lodge a complaint with the Data Protection Authority.