Privacy Policy
Protecting your personal data is important to us, Orpha Trade GmbH, Storchengasse 1, 1150 Vienna (“Orpha Trade”, “we”, “us”). Accordingly, we naturally comply with applicable data protection law, in particular the General Data Protection Regulation (“GDPR”), the Austrian Data Protection Act (“DSG”), and the Austrian Telecommunications Act (“TKG”).
This privacy policy informs you about the nature, scope, and purposes of the collection and processing of your personal data in connection with your visit to and use of our website.
1. Contact details of the controller and the data protection officer:
a) Controller
The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
Name: Orpha Trade GmbH
Address: Storchengasse 1, 1150 Vienna
Phone number: +43 1 992 96 52
E-mail address: office@orphatrade.com
b) Data protection officer
For all inquiries regarding data protection and to exercise your rights as a data subject (see point 7), you may contact our data protection officer at any time. You can reach them at:
E-mail: dpo@orphatrade.com
Post: address as above, marked “Attn: Data Protection Officer”
2. What is personal data?
Personal data is any information relating to an identified or identifiable natural person – i.e. a person whose identity is determined or at least determinable. This includes, for example, name, date of birth, e-mail address, social security number, IP address, etc.
3. Data processing on and in connection with our website
a) General contact
If you contact us using the contact details listed above or the contact information on our website, we process your personal data (name, e-mail address, phone number, postal address, as well as your inquiry and any documents, images, and materials contained therein) for the purpose of processing and responding to your inquiry.
The legal basis for this is the performance of our (pre-)contractual obligations pursuant to Art 6(1)(b) GDPR, or our legitimate interests pursuant to Art 6(1)(f) GDPR in promptly handling the inquiry and responding to any follow-up questions.
We store your personal data in connection with contact inquiries for a period of six months so that we can respond appropriately to follow-up questions. A longer retention period only applies if a business relationship subsequently develops, due to statutory retention obligations, or in order to assert or defend our legal claims.
b) Reporting adverse drug reactions
Our website allows you to report adverse drug reactions (side effects).
Please note: Orpha Trade GmbH does not itself place any medicinal products on the market. Pharmacovigilance for the group’s products (including the receipt, processing and assessment of adverse drug reaction reports and their reporting to the competent authorities) is carried out by our subsidiary Complex Pharmaceuticals GmbH, which holds the necessary regulatory authorizations and operates the corresponding pharmacovigilance quality management system. Any report you submit via this website is therefore forwarded to and processed by Complex Pharmaceuticals GmbH, which acts as the controller for that processing.
In this case, Complex Pharmaceuticals GmbH will process the personal data that you provide, which is required for documentation purposes, to fulfil pharmacovigilance obligations, and to report the adverse drug reaction to the competent authority.
Contact point for reporting adverse drug reactions via our subsidiary Complex Pharmaceuticals GmbH:
24/7 hotline: +43 676 4299112
E-mail: pv@complex-pharma.com
If you are the reporting person, this concerns in particular your name and contact details, your profession, and your relationship to the person affected by the suspected side effect.
If you are the person who is said to have experienced the side effect (patient), we process in particular information about your state of health, demographic data such as date of birth, age group, weight, height and gender, data on your ethnicity (where relevant to the drug reaction), as well as information about the medicinal product said to have caused the side effect (including dosage, indication and concomitant medications) and relevant details of your medical history.
Where we are obliged to do so under statutory pharmacovigilance obligations, in particular Section 75g of the Austrian Medicines Act (AMG) and the Pharmacovigilance Regulation, or under regulatory requirements, Complex Pharmaceuticals GmbH will forward the information contained in your report (including personal data, where necessary) to the competent authority without delay; the competent authority in Austria is the Austrian Federal Office for Safety in Health Care (BASG).
The legal basis for this data processing is, on the one hand, the fulfilment of our statutory obligations pursuant to Art 6(1)(c) GDPR (for reporting persons) and Art 9(2)(i) GDPR (for patients) arising from our pharmacovigilance obligations under Directive 2001/83/EC on the Community code relating to medicinal products for human use, as well as Implementing Regulation (EU) No 520/2012 on the performance of pharmacovigilance activities. For reports of serious adverse events and product defects (medical devices), our monitoring and reporting obligations are governed by Regulation (EU) 2017/745 on medical devices. In addition, the data processing is based on grounds of public interest in the area of public health, in order to ensure high standards of quality and safety for medicinal products and medical devices pursuant to Art 6(1)(e) and Art 9(2)(i) GDPR.
We store data from adverse reaction reports for at least 10 years after the marketing authorization of the respective product expires, in accordance with Art 12 of Implementing Regulation (EU) No 520/2012. Personal data is only stored insofar as it is strictly necessary for the fulfilment of our pharmacovigilance obligations. Names and contact details of patients are anonymized as soon as direct follow-up questions are no longer to be expected.
c) Usage data
When you visit our website, we automatically process the following data:
· IP address
· Data on your end device
· Referrer URL
· Name and version of your web browser
· Session ID
· Log files
· Date and time of the website visit
All of this data is transmitted by your web browser when you access our website. We process this data solely to provide the website, for data security purposes, and to enhance technical usability. This data processing is therefore based on our legitimate interests pursuant to Art 6(1)(f) GDPR in providing and logging system use and evaluating server logs for problem analysis.
We store log data and log files for a period of 90 days to maintain IT infrastructure and IT security. A longer retention period of up to 180 days applies only to detect hacking attempts on the system.
d) Cookies
Cookies are small text files that are stored on the end device of the website visitor. Domain-related information is written to these text files, which can be read out again at a later point in time. Cookies allow us to store essential data in order to provide you with our services or to make the use of the website more user-friendly and convenient. Some cookies remain stored on your end device until you delete them or they expire (“persistent cookies”). Other cookies are deleted again after your visit to the website (“session cookies”).
There are cookies that may only be set on the basis of your voluntary consent. Other cookies may also be set without your consent, as they are strictly necessary to provide our services. We fundamentally distinguish between the following types of cookies:
· Technically necessary cookies: are used to display the website to you and to enable trouble-free use. This data processing is necessary for the purpose of data security and preventing misuse and is based on our legitimate interests pursuant to Art 6(1)(f) GDPR in conjunction with Section 165(3) TKG.
· Preference cookies: enable a website to remember certain information that affects the appearance or behavior of a website (e.g. language and region settings). This data processing is based exclusively on your explicit consent pursuant to Art 6(1)(a) GDPR.
· Analytics cookies: are used to determine the number of visitors and to observe how visitors behave on our website. They also allow us to improve how our website functions. This data processing is based exclusively on your explicit consent pursuant to Art 6(1)(a) GDPR.
· Marketing cookies: are used to track visitors across websites. This allows advertisements to be shown to the user that are relevant and appealing to them. This data processing is based exclusively on your explicit consent pursuant to Art 6(1)(a) GDPR.
We use the following cookies on our website:
| Cookie | Classification | Retention period | Purpose |
| XSRF-TOKEN | Technically necessary cookies | 2 hours | This cookie increases visitor security while browsing by preventing cross-site request forgery. |
| _session | Technically necessary cookies | Session | This cookie stores the session for logging into the content management system (backend). |
| _ga_* | Analytics cookies | 1 year / 1 month / 4 days | This cookie enables the storing and counting of page views. |
| _ga_ | Analytics cookies | 1 year / 1 month / 4 days | This cookie allows Google Analytics to recognize returning users on our website and to consolidate data from previous visits. |
| NID | Analytics cookie | 6 months | This cookie allows Google Maps to store user settings and user information. |
Google Analytics
We use Google Analytics, a web analytics service provided by Google Ireland Limited (Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland). This allows us to optimize our website as well as user-friendliness and advertising measures. When you interact with our website, Google Analytics collects in particular the following data: IP address, technical information such as browser, internet service provider, end device and screen resolution, the source of your visit, your behavior on our website, and a randomly generated user ID. The recorded data, together with the randomly generated user ID, is stored, which enables the evaluation of pseudonymized user profiles. This data processing only takes place subject to your explicit consent pursuant to Art 6(1)(a) GDPR in conjunction with Section 165(3) TKG.
The easiest way to withdraw your consent is via our consent management platform, or you can install Google’s browser add-on, which is available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.
For more detailed information on the scope of Google Analytics, see https://marketingplatform.google.com/about/analytics/terms/de/. Google provides information on the data processing involved in the use of Google Analytics at the following link: https://support.google.com/analytics/answer/6004245?hl=en.
General information on data processing which, according to Google, also applies to Google Analytics can be found in Google’s privacy policy at https://policies.google.com/privacy?hl=en and https://business.safety.google/privacy/.
Google Maps
Among other things, we may use Google Maps to inform you about our company location. For this purpose, we have visualized our location on Google Maps’ digital map. If you use this feature, your IP address will be forwarded to Google. However, Google Maps will only load after you have given your explicit consent to setting the corresponding analytics cookie pursuant to Art 6(1)(a) GDPR in conjunction with Section 165(3) TKG.
A complete list of the cookies we use on our website can also be found in the consent management tool (“cookie banner”). This cookie banner appears automatically the first time you visit our website. You can also access the cookie banner at any time via the floating cookie icon at the bottom left of the page.
We use the cookie banner to obtain your consent to the storage of certain cookies on your end device or to the use of certain technologies, and to document this in a manner compliant with data protection law.
You can change your individual consent at any time, e.g. via the floating cookie icon in the bottom left corner of our website. You can click “Accept All” or “Decline” to accept or decline all cookies requiring consent. You can also make individual settings by clicking “Settings” and then adjusting the sliders and clicking the “Save” button.
4. Retention period
We generally only store your personal data for as long as we need it to fulfil the purposes described above. Once we no longer need your data, it is deleted from our systems or irrevocably anonymized so that you can no longer be identified. We also store your personal data if there are indications that the data is required to assert or defend our legal claims. The retention of data is subject to the statutory limitation periods (in particular Sections 1478 et seq. of the Austrian General Civil Code (ABGB)). Further information on retention periods can be found under the respective processing activities.
5. Recipients of personal data
We naturally treat your personal data as strictly confidential and deliberately keep the group of recipients small (the “need-to-know principle”).
Your personal data is transmitted on a case-by-case basis and to the extent necessary to the following recipients, who act as independent controllers:
· Courts, authorities and other public bodies, where this is legally required (e.g. the Austrian Federal Office for Safety in Health Care (BASG) and other drug and health authorities; the data protection authority; the tax authority; state courts);
· External third parties on the basis of our legitimate interests in asserting, exercising and defending our legal claims (legal representatives and insurers, auditors, other consultants).
In addition, we also engage external service providers, e.g. IT service providers, who may have access to your personal data under certain circumstances. This is necessary in order to be able to provide the commissioned services. These external service providers are processors who are obliged to maintain confidentiality pursuant to Art 28(3)(b) GDPR and process your personal data exclusively on our behalf, on the basis of our instructions, and for the purpose of providing the commissioned services.
In the event that personal data is transmitted to recipients in third countries outside the EU for which there is no adequacy decision by the EU Commission pursuant to Art 45 GDPR, the transmission takes place on the basis of appropriate safeguards (e.g. standard contractual clauses) pursuant to Art 46 GDPR or, where applicable, on the basis of your explicit consent for specific purposes pursuant to Art 49(1)(a) GDPR, after we have informed you of the specific risks of the corresponding data transfer to the third country.
6. Data security
Data security is a matter of course for us. We have taken appropriate technical and organizational security measures in accordance with Art 32 GDPR to ensure the confidentiality and security of your personal data.
7. Data subject rights
As a data subject, you have the following rights:
· Right of access (Art 15 GDPR) to the data we process about you,
· Right to rectification (Art 16 GDPR) of inaccurate data,
· Right to erasure (Art 17 GDPR),
· Right to restriction of processing (Art 18 GDPR)
· Right to data portability (Art 20 GDPR) of the data you have provided, in a structured, commonly used and machine-readable format,
· Right to withdraw consent given (Art 7(3) GDPR)
· Right to object (Art 21 GDPR), where reasons arising from your particular situation exist. We would also like to point out that no automated decision-making, including profiling within the meaning of Art 22 GDPR, takes place.
You also have the right to lodge a complaint with the competent supervisory authority. In Austria, this is:
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
E-mail: dsb@dsb.gv.at Website: www.dsb.gv.at
Before filing a formal complaint, or if you have any questions or concerns about the processing of your personal data, please feel free to contact us. We are always happy to assist you.
Headquarters
Ochsnerpromenade 17
A-3400 Klosterneuburg
Operating Site
Storchengasse 1
A-1150 Wien