Privacy Policy
“UCB” or “we” means UCB Pharma Limited, a company with registered office at 208 Bath Road, Slough, SL1 3WE United Kingdom.
As the controller, i.e. the legal entity that decides on the why and how information relating to you (“personal data”) is collected and processed in the context of this https://www.ucbcares.co.uk website (the “Website”). This Privacy Policy applies to all webpages which form part of the Website including but not limited to UCBCares. We respect your right to privacy. We will only process your personal data as described in this https://www.ucbcares.co.uk Privacy Policy (the “Policy”) and in accordance with the relevant data protection legislation, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or “GDPR”).
At UCB we have a data protection officer (DPO), who can be contacted by any of the following means for any privacy-related questions, including regarding how we collect, store and use your personal data:
The Policy governs the collection, use and retention by UCB of personal data relating to your use of the Website. This Policy applies to all Website users.
The Policy consists of five main components and informs you about:
Who we are and how you can contact us;
The reason behind this Policy
The purposes for which we process your personal data and the related legal basis under the GDPR;
What your rights are in relation to the personal data we hold about you and how you can exercise them; and
Further details on how we process (including share) your personal data.
This Policy may be updated periodically to reflect changes in our personal data processing practices. In that case we will post a prominent notice on the Website to inform you of any significant changes.
The table below indicates per purpose the categories of personal data we collect and process about you, the source from which we obtained such information, on what legal basis, how long we retain it and who we share your personal data with.
| 1. In order to make the Website and its content available to you, UCB: | |
|---|---|
| Collects the following personal data about you: | 1. Electronic identification data (†). 2. Information collected through cookies (†). Failure to provide the personal data with an (†) may result in (some features of) the Website not being accessible |
| Receives this personal data from: | You, through the device(s) you use to access the Website |
| Retains (**) your personal data for: | See our Cookie Policy |
| Shares your personal data with: | UCB subsidiaries / affiliates and third-party processors (as detailed in Section 5.A) |
| Relies on the following GDPR legal basis: | (i) Processing necessary for performance of a contract with you. (ii) For those cookies that require your consent, processing based on your consent (see Cookie Policy for more information) |
| 2. In order to support and improve Website functionality (including making it more intuitive) and to better understand usage patterns, we use cookies that allow us to evaluate - on an aggregate level - use made of our Website and how users (including yourself) access different features of our Website. In that context, UCB: | |
|---|---|
| Collects the following personal data about you: | 1. Electronic identification data (†). 2. Information collected through cookies (†). Failure to provide the personal data with an (†) may result in (some features of) the Website not being accessible |
| Receives this personal data from: | You, through the device(s) you use to access the Website |
| Retains (**) your personal data for: | See our Cookie Policy |
| Shares your personal data with: | UCB subsidiaries / affiliates and third-party processors (as detailed in Section 5.A) |
| Relies on the following GDPR legal basis: | For those cookies that require your consent, processing based on your consent (see Cookie Policy for more information). Otherwise, processing necessary for the purpose of the legitimate interests pursued by UCB to conduct its business and to improve its product and service offering. To this end, UCB strives to maintain a fair balance between its need to process your personal data and the preservation of your rights and freedoms, including the protection of your privacy. For more information or if you have any questions regarding how we assess this balance, please contact us through any one of the channels set out under Section 1 - “Who we are and how you can contact us” |
| 3. In order to maintain Website security (including the detection and prevention of malicious activities or invalid traffic on the Website), UCB: | |
|---|---|
| Collects the following personal data about you: | 1. Electronic identification data (†). 2. Information collected through cookies (†). Failure to provide the personal data with an (†) may result in (some features of) the Website not being accessible |
| Receives this personal data from: | You, through the device(s) you use to access the Website |
| Retains (**) your personal data for: | See our Cookie Policy |
| Shares your personal data with: | UCB subsidiaries / affiliates and third-party processors (as detailed in Section 5.A) |
| Relies on the following GDPR legal basis: | For those cookies that require your consent, processing based on your consent (see Cookie Policy for more information). Otherwise, processing necessary for the purpose of the legitimate interests pursued by UCB to protect its IT infrastructure and maintain the security of its business assets. To this end, UCB strives to maintain a fair balance between its need to process your personal data and the preservation of your rights and freedoms, including the protection of your privacy. For more information or if you have any questions regarding how we assess this balance, please contact us through any one of the channels set out under Section 1 - “Who we are and how you can contact us” |
| 4. In order to enable UCB to comply with its legal (including but not limited to pharmacovigilance) obligations, UCB: | |
|---|---|
| Collects the following personal data about you: | Any legally required information (†). Failure to provide the personal data with an (†) may prevent UCB from complying with its obligations in accordance with applicable laws |
| Receives this personal data from: | You |
| Retains (**) your personal data for: | For as long as is legally required |
| Shares your personal data with: | (i) Relevant regulatory and government agencies. (ii) UCB subsidiaries/ affiliated companies and third party processors (as detailed in Section 5.A) |
| Relies on the following GDPR legal basis: | Compliance with our legal obligations. For more information on the processing of personal data by UCB within the framework of adverse event reporting, please check UCB’s Patient Safety Reporting Privacy Notice |
| 5. In order to enable UCB to respond to your online queries submitted via the UCBCares digital webform: | |
|---|---|
| Collects the following personal data about you: | 1. Personal details you provide (as relevant for the country specific webform you are completing): (a) Your first name (†) (b) Last name (†) (c) email address (in case requested by email) (†) (d) Phone number (in case answer requested by phone/fax) (†) (e) Fax number (in case answer requested by fax) (†) (f) Home address (in case answer requested by post) (†) (g) City (†) (h) Country (†) (i) Postal code (†) (j) Gender (†) (k) Preferred contact time for responding to your query by phone (e.g. day of the week, morning/afternoon/evening); (†) 2. The subject of your query as selected from a drop down menu; 3. Your background/user profile as selected from a drop down menu (†): (e.g. HCP, patient, carer, or other types of website user etc.); 4. If you are taking a UCB product, the product you are taking as selected from a drop down menu (†); 5. Any other information you submit in free text field. Failure to provide, where required, the personal data with an (†) may prevent UCB from adequately responding to your query or request |
| Receives this personal data from: | You |
| Retains (**) your personal data for: | 1. Information stored in our Medical Information System as a result: (i) of your consent, for a maximum duration of five (5) years; or (ii) to meet our legal obligations, for as long as is legally required. 2. Otherwise, for the time it takes to respond to your query and no more than twenty eight (28) days thereafter |
| Shares your personal data with: | (i) For adverse event reporting, relevant regulatory and government agencies. (ii) UCB subsidiaries/ affiliated companies and third party processors (as detailed in Section 5.A) |
| Relies on the following GDPR legal basis: | (i) Processing necessary for performance of a contract with you. (ii) Processing based on your consent for any health-related data you provide. (iii) Compliance with our legal obligations for an adverse event information you provide. For more information on the processing of personal data by UCB within the framework of adverse event reporting, please check UCB’s Patient Safety Reporting Privacy Notice |
| 6. In order to enable UCB to respond to your online queries submitted via the UCBCares email address: | |
|---|---|
| Collects the following personal data about you: | 1. Email address. 2. Any other information you include in the email (†). Failure to provide, where required, the personal data with an (†) may prevent UCB from adequately responding to your query or request |
| Receives this personal data from: | You |
| Retains (**) your personal data for: | A maximum duration of one year |
| Shares your personal data with: | UCB subsidiaries / affiliated companies and third-party processors (as detailed in Section 5.A) |
| Relies on the following GDPR legal basis: | (i) Processing necessary for performance of a contract with you. (ii) Processing based on your consent for any health-related data you provide (iii) Compliance with our legal obligations for an adverse event information you provide. For more information on the processing of personal data by UCB within the framework of adverse event reporting, please check UCB’s Patient Safety Reporting Privacy Notice |
(**) We will retain your personal data in accordance with the retention periods set out in the table above. These retention periods, included in our data retention policy, are dictated by:
We will delete your personal data once the abovementioned retention periods will have expired or if you object to or withdraw your consent to our processing of your personal data (to the extent such processing is based on your consent), except where we need to hold on to such data for the establishment, exercise or defense of legal claims, for the protection of the rights of another natural or legal person, for compliance with a European or European Member State legal obligation which requires such further processing or where we need to prove or enforce a transaction or contract or enforce our policies.
4.A. YOUR RIGHTS
Right to access
You have the right to obtain confirmation from us as to whether or not we process personal data concerning you, and if so, the right (as far as this does not adversely affects the rights and freedoms of others) to obtain a copy of your personal data from us. For more information, please check Section 4.B “How to exercise your rights”.
Right to rectification
You have the right to ask us to rectify without undue delay any inaccurate personal data concerning you. You can also ask us to complete incomplete personal data regarding you by providing us with a supplementary statement containing such additional information. For more information, please check Section 4.B “How to exercise your rights”.
Right to erasure
You have the right to ask us to erase without undue delay personal data concerning you, where one of the following grounds applies:
Please note that your right to erasure will not apply to the extent that processing is necessary for:
For more information, please check Section 4.B “How to exercise your rights”.
Right to restriction on processing
You have the right to obtain from UCB restriction of processing by UCB of your personal data where one of the following applies:
Please note that notwithstanding the above, we are still allowed to continue storing your personal data (throughout the period of restriction) or to process your personal data for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person. If you have requested restriction of processing, we will inform you before the restriction of processing is lifted. For more information, please check Section 4.B “How to exercise your rights”.
Right to data portability
You have the right (insofar this does not adversely affects the rights and freedoms of others) to receive the personal data concerning you, that you have provided to UCB, in a structured, commonly used and machine-readable format and to transmit those data to another controller, without hindrance from UCB, where the processing is:
For more information, please check Section 4.B “How to exercise your rights”.
Right to objection to processing
You have the right to object at any time, on grounds relating to your specific situation, to the processing of your personal data by UCB which is based on UCB’s pursuit of its legitimate interests as a controller. In that case UCB will no longer process your personal data, unless:
You have the right to object at any time to the processing of your personal data for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing. For more information, please check Section 4.B “How to exercise your rights”.
Right to withdraw consent
Where the processing is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. For more information, please check Section 4.B “How to exercise your rights”.
4.B. HOW TO EXERCISE YOUR RIGHTS
If you wish to exercise any of the rights mentioned above, please contact UCB’s Data Protection Officer by email at dataprivacy@ucb.com or otherwise reach out to us by postal mail at To the Data Protection Officer, UCB Pharma Ltd, 208 Bath Road, Slough, SL1 3WE. Please clearly identify the right(s) you wish to exercise and include your contact details (including a valid e-mail or postal address) so that we can respond to your request. Please note that you may be asked to provide proof of your identity.
When you contact us to exercise any of the rights mentioned above, we will respond to your request within one month following receipt of the request. This period may be extended by two additional months where necessary, but in that case we will inform you of any such extension within one month of receipt of your initial request together with the reasons for the delay.
Right to lodge a complaint with supervisory authority
In accordance with article 77 GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the European Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that UCB’s processing of your personal data infringes the GDPR. Please visit the website of the relevant supervisory authority for more information on how to submit such a complaint.
5.A. WHO WE SHARE YOUR PERSONAL DATA WITH
Principle
We will disclose your personal data only as described in this Policy (as further detailed above), as may be updated from time-to-time.
Subsidiaries/affiliated companies and third party processors
UCB transfers or discloses your personal data to its subsidiaries/affiliated companies and to third party service providers processing personal data on UCB’s behalf for the purposes set out above.
Third party service providers including IT services and website hosting companies, (internet) connectivity providers, provider of data analytics (Google) and tracking services, , as well as service providers that provide technical and administrative support for the Website and underlying IT systems. These service providers provide their services from locations within the EU (including Germany, Malta, UK and Ireland) and outside of the EU Google (USA)).
Other third parties include regulatory and government agencies (see further below in this Policy), and potentially, third parties with whom UCB may merge or which may be acquired by UCB (see further below in this Policy).
Compliance with laws and legal proceedings
UCB will disclose your personal data where:
Other
If a third party acquires all (or substantially all) of our business and/or assets, we will disclose your personal data to that third party in connection with the acquisition. However, such disclosure will occur subject to and in accordance with applicable data protection laws, including the GDPR.
5.B. INTERNATIONAL TRANSFERS
UCB will transfer your personal data to its affiliates, including our affiliates outside of the EEA. In that case UCB relies on UCB's Binding Corporate Rules.
UCB will also transfer your personal data to certain third party service providers both within the EEA (including Germany, Malta, UK and Ireland) and outside of the EEA (USA).
The transfer of your personal data to (other) third party service providers outside of the EU (as set out above under this Section 5B) occurs on:
For more information on how Google processes your personal data within the framework of Google Analytics, please consult How Google uses data when you use our partners' sites or apps.
5.C. LINKS TO THIRD PARTY SITES
This Website may contain links to other websites operated by third parties, including but not limited to patient organization and other information resources certain social media sites such as YouTube, Vimeo etc. This Policy does not apply to any website, other than this one. Third party websites are governed by their own terms and conditions. You should therefore always carefully check the privacy and cookie policies of third party websites before accepting to be redirected to them.