The data controller is

DiaMed Beratungsgesellschaft für pharmazeutische Unternehmen mbH
Am Mittelhafen 20
48155 Münster

Phone: +49-(0)251-60 93 90
E-mail: info@diamed.org

Contact data of the Data Protection Officer:
E-Mail: datenschutz@floss-consult.de

We process data that we obtain exclusively from our business relationship with you. We receive this data directly from you.

Specifically, we process the following data:

• Contact information (first and last name, address, telephone number, mobile number, fax number and email address). In the B2B context, this refers to business contact details.
• Company and, if applicable, your position within the company
• Information on any existing contractual relationship
• Payment data (bank details, tax number/VAT ID, credit card information, card verification number, creditworthiness data)

We process your personal data in compliance with the relevant data protection provisions of the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and all other applicable laws.

a. To fulfil contractual obligations (Art. 6 (1) (b) GDPR)

We process your data to perform our contracts with you and to carry out pre-contractual measures at your request. The specific purposes of the data processing depend on the contractual basis.

b. Legitimate interests (Art. 6 (1) (f) GDPR)

We may also process the personal data you have provided to us on the basis of our legitimate interests. These include, amongst others:

• Credit checks carried out via credit reference agencies upon conclusion of a contract to assess creditworthiness
• Defence against threats and liability claims and avoidance of legal risks
• Assertion of legal claims and avoidance of legal disadvantages (e.g. in the event of insolvency
• Inclusion of your contact details on a block list, provided you have withdrawn your consent to or objected to a marketing campaign.

c. Your consent (Art. 6 (1) (a) GDPR)

Where you have given us your consent to the processing of personal data, that consent forms the legal basis for the processing specified therein.

You may withdraw your consent at any time with effect for the future. The withdrawal only applies prospectively and does not affect the lawfulness of the data processed up to the point of withdrawal.

d. Legal requirements (Art. 6 (1) (c) GDPR)

In individual cases, the purposes of data processing may also arise from legal requirements. These legal obligations include, amongst others:

• Compliance with record-keeping and identification obligations
• Requirements relating to the prevention of money laundering, tax control and reporting obligations, and data processing in response to requests from public authorities.

Within our organisation, your personal data is only disclosed to those individuals and departments who require it to fulfil our contractual and legal obligations.

In addition, the following parties may receive your data:

• Public authorities and institutions where there is a legal or regulatory obligation (e.g. tax authorities)
• Data processors to whom we transfer your personal data depending on the purpose (e.g. support/maintenance of IT systems, data destruction, payment transactions, accounting)
• Other parties for whom you may have given us your consent to transfer your data

We will delete your personal data as soon as it is no longer required for the fulfilment of our contractual relationship.

Where necessary, we process your personal data for the duration of our business relationships, which also includes the initiation and execution of a contract.

In addition, we are subject to various retention and documentation obligations (e.g. the German Banking Act (HBG), the German Civil Code (BGB), etc.). The retention and documentation periods specified therein are up to ten years, but in certain cases may extend to up to thirty years.

As a general rule, your personal data is not transferred to third countries. Where a data transfer is necessary, it takes place solely on the basis of the aforementioned purposes and legal grounds. Furthermore, a transfer will only take place if an adequacy decision by the Commission exists for the third country in question, we have concluded standard contractual clauses with the service provider, or other suitable safeguards in accordance with Articles 44 et seq. of the GDPR are in place. Where we use the EU Standard Contractual Clauses, we also carry out the necessary data protection impact assessments and reviews of supplementary safeguards.

Within the framework of our business relationship, you must provide the personal data necessary for the establishment and performance of a business relationship and the fulfilment of the associated contractual obligations, or which we are legally obliged to collect.

Without this data, we will generally have to refuse to conclude the contract or carry out the order, or we will no longer be able to fulfil an existing contract and may have to terminate it.

You have the option of contacting our Data Protection Officer or a data protection supervisory authority. The data protection supervisory authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen

Kavalleriestraße 2-4

40213 Düsseldorf

Phone : 0211 / 38424-0

Fax: 0211 / 38424-999

E-mail: poststelle@ldi.nrw.de

You have the following rights regarding the processing of your personal data: the right to access, rectification, erasure, restriction of processing, data portability and the right to object to processing. You also have the right to receive the data you have provided in a structured, commonly used and machine-readable format.

Where our data processing is based on a legitimate interest and you have grounds, arising from your particular personal circumstances to object to the processing of your personal data, you have the right to object to such processing. In such a case, we will only process your data if our legitimate interest prevails following a balancing test.

Furthermore, where our processing is based on your consent, you have the right to withdraw your consent.