Privacy notice

Information regarding processing of your personal data

The purpose of this privacy notice is to provide information on how Camurus (“we”) may process your personal data.

We respect your privacy and duly protect the personal data we process about you. All processing of personal data is carried out in accordance with applicable privacy laws, including the European Union’s General Data Protection Regulation (the “GDPR”) and the California Consumer Privacy Act (the “CCPA”). The following describes how we collect, process and share your personal data. In Part I of this privacy notice, you find specific information applicable to different categories of data subjects. In Part II, you find information applicable to all categories of data subjects, such as your rights as a data subject.

PART I

1. WEBSITE VISITORS

What personal data may be processed?

We may collect and process personal data that your web browser makes available when you visit this website, which may include Internet Protocol (IP) address, browser language, geographical location data, date and time, cookies, and information about accessed pages.

If you:

• provide your email address in order to download logos and images from this website;
• subscribe for our financial reports and/or press releases; or
• otherwise contact us through this website;
• we will also process your name and email address that you submit to us, and any other information you may share with us when contacting us.

For more information about cookies, please read our Cookie Policy here

Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. Our website is not currently designed to recognize these signals.

What are the purposes and legal grounds for processing your personal data?

We process your personal data to make the website and the features of the website available to you and to improve, develop, and enhance the usability of the website.

The processing of your personal data for the purposes described above is based on our legitimate interest, as we wish to make the website and its features available to you. The processed personal data is of simple nature and the processing is limited and does not affect personal integrity to a large extent. Furthermore, we believe there is a mutual interest in the purpose described. Based on these factors, we have performed a balance of interest assessment and have concluded that our legitimate interest to make the website and its features available to you outweighs your potential interest in not having your personal data processed for these purposes. However, you are always entitled to object to our assessments. You can read further about your rights in Part II below.

For how long is your personal data stored?

Your personal data will only be processed as long as the purpose for which it is processed exists and as long as permitted or required under applicable laws and regulations, and will be securely deleted or destroyed after expiry of the retention period. You may always request that we delete your personal data sooner, read more about your rights in Part II below.

2. BUSINESS REPRESENTATIVES AND OTHERS

What personal data will be processed?

If you act as a representative or point of contact of a company or organization with whom Camurus has a business relationship (e.g. a customer, collaboration partner, manufacturer, distributor, CRO), or otherwise interact with us (e.g. correspond with Camurus through email), we may collect and process the following personal data about you:

1. contact information (name, email and telephone number);
2. position and company/organization, if you represent a company/organization;
3. any personal data you may provide us in your role as a business representative; and
4. CVs and information on work experiences, if applicable; and
5. any other personal data you provide to us

The personal data listed above will be collected directly from you or from the organisation/company that you represent. We may also collect your personal data from publicly available sources, if applicable.

What are the purposes and legal grounds for processing your personal data?

We process your personal data:

1. to manage our business relationship and administer our interactions;
2. for the purpose of ensuring high standards of our business partners and people we collaborate with and to comply with obligations applicable to Camurus as a public company

The processing of your personal data for purpose (a) stated above is based on our legitimate interest to manage our (actual or potential) business relationship and interact with you. The personal data which is processed is of simple nature and the processing is limited and does not affect personal integrity to a large extent. Furthermore, the processing is necessary for us to conduct our business. Based on these factors, we have performed a balance of interest assessment and have concluded that our legitimate interest to manage our (actual or potential) business relationship and interact with you, outweighs your potential interest in not having your personal data processed for these purposes.

The processing of your personal data for purpose (b) stated above is based either on our legitimate interest to ensure high standards for our business partners and people we collaborate with, or on our legal obligations as a public company operating within the pharmaceutical industry.

You are always entitled to object to our assessments. You can read further about your rights in Part II below.

For how long is your personal data stored?

Your personal data will only be stored as long as the purpose for which it is kept exists and as long as permitted or required under applicable laws and regulations and will be securely deleted or destroyed after expiry of the retention period. This means that personal data processed in order to manage our business relationship and to interact with you will be deleted without undue delay once we believe we no longer have a relationship with you, or without undue delay after we have been informed that you have left the company or organization with whom we have a business relationship. You may always request that we delete your personal data sooner, please see Part II below.

We have legal obligations to store data related to Camurus’ medicinal products (such as data related to clinical trials and pharmacovigilance data) for certain time periods. If you are an investigator, business representative or other whose personal data we process in relation to our medicinal products, your personal data may therefore be saved for the applicable time period.

3. INVESTORS AND ANALYSTS

What personal data will be processed?

If you are an investor, shareholder or an analyst, we may collect and process the following personal data about you:

1. contact information (name, email and telephone number);
2. position and company/organization, if you represent a company/organization;
3. any personal data you may provide us.

The personal data listed above will be collected directly from you or from the organization/company that you represent. We may also collect your personal data from publicly available sources, if applicable.

If you are an analyst following Camurus, we will publish your name on our website for the purpose of complying with industry codes and standards applicable to public companies.

What are the purposes and legal grounds for processing your personal data?

We will process your personal data:

1. to interact with you; and
2. comply with obligations applicable to Camurus as a public company.

We will process the information above based on Camurus’ legitimate interest to comply with obligations applicable to public companies or, in some cases, based on our legal obligations. The personal data which is processed is of simple nature and the processing is limited and does not affect personal integrity to a large extent. Furthermore, the processing is necessary for us to conduct our business. Based on these factors, we have performed a balance of interest assessment and have concluded that our legitimate interest to comply with obligations applicable to public companies and interact with you, outweighs your potential interest in not having your personal data processed for these purposes.

You are always entitled to object to our assessments. You can read further about your rights in Part II below.

For how long is your personal data stored?

Your personal data will only be stored as long as the purpose for which it is kept exists and as long as permitted or required under applicable laws and regulations and will be securely deleted or destroyed after expiry of the retention period.

4. HEALTHCARE PROFESSIONALS

What personal data will be processed?

If you are a healthcare professional (HCP) interacting with Camurus, we may collect and process the following personal data about you:

• contact information (name, email and telephone number);
• position and organization/company;
• remuneration paid for services performed for or on behalf of Camurus; and
• any other information provided to us.

The personal data listed above will mainly be collected directly from you or from the organization/company that you represent. However, we may also receive your personal data from external parties who organize and host conferences or events where you have participated. We may also collect your information from publicly available sources, if applicable.

What are the purposes and legal grounds of processing your personal data?

We process your personal data in order to

(a) to provide you with information on our products and our business;
(b) to invite you to events, etc.;
(c) to engage you to perform services for or on behalf of Camurus or otherwise manage our relationship;
(d) to respond to or otherwise handle any requests or questions you may send us, or otherwise interact with you when you send us an email or contact us by phone; and
(e) to comply with our legal obligations, such as maintaining our pharmacovigilance system, scientific service system and ensure product safety, as applicable.

The processing of your personal data for the purposes stated in (a) to (d) above is based on our legitimate interest to manage our relationship with you. In some cases, it may also be based on the performance of a contract we have signed with you. The personal data which is processed is of simple nature, limited to your professional role and the processing does not affect personal integrity to a large extent. Furthermore, the processing is necessary for us to conduct our business. Based on these factors, we have performed a balance of interest assessment and have concluded that our legitimate interest to manage our relationship and interact with you, outweighs your potential interest in not having your personal data processed for these purposes. You are always entitled to object to this assessment, please see Part II below.

The processing of your personal data for the purpose stated in (e) above is based on our legal obligations, especially those relating to pharmacovigilance, product safety and product liability.

For how long is your personal data stored?

Your personal data will only be stored for as long as the purpose for which it is kept exists and for as long as permitted or required under applicable laws and regulations and will be securely deleted or destroyed after expiry of the retention period. This means that certain personal data which is processed to provide requested information to you, invite you to events or to otherwise manage our relationship will be deleted without undue delay when we no longer have a relationship. You may always request that we delete your personal data sooner. Personal data stored for Camurus’ compliance with applicable laws and regulations will be stored as long as required under those laws and regulations.

5. PATIENTS, PATIENT ORGANIZATIONS AND OTHERS

What personal data will be processed?

If you are a patient using a Camurus product, a person otherwise interested in Camurus’ products or business, or if you represent a patient organization, we may collect and process the following personal data about you:

• contact information (name, email and telephone number); and
• other information you provide us.

The personal data listed above will be collected from you.

What are the purposes and legal grounds of processing your personal data?

We process your personal data in order to:

(a) to provide you with information on our products or our business, if requested by you; and
(b) to handle any requests or questions you may send us, or otherwise interact with you when you send us an email or otherwise contact us; and
(c) to comply with our legal obligations, such as maintaining our pharmacovigilance system, scientific service system and ensure product safety, as applicable

The processing of your personal data for the purposes stated above is based on our legitimate interest to provide information to as, if requested, and handle other requests and questions. In some cases, it may also be based on our legal obligations. If any personal data processed is sensitive data, e.g. related to your health, we will always ensure there is additional legal grounds for such processing. Please read more about your rights under Part II below.

For how long is your personal data stored?

Your personal data will only be stored for as long as the purpose for which it is kept exists and for as long as permitted or required under applicable laws and regulations and will be securely deleted or destroyed after expiry of the retention period. Personal data stored for Camurus’ compliance with applicable laws and regulations will be stored as long as required under those laws and regulations

6. CONSULTANTS

What personal data will be processed?

If you are a consultant engaged to perform services for Camurus, we may collect and process the following personal data:

• Contact information (e.g. name, address, email and telephone number);
• Position with the company you represent;
• Bank account details or other financial information as may be necessary to make payments to you as a consultant or the company you represent;
• Information about your physical location when using our entrance system (e.g. information regarding entrances and exits to office premises) if you have been provided an access tag to Camurus’ facilities;
• IT-related information (e.g. possibly stored information concerning data and telephone traffic and information regarding access to IT-systems, log files etc.) if you are provided access to Camurus’ IT system;
• If applicable for your engagement as a consultant, information (name, position, total remuneration for services) regarding the value of your contract with Camurus; 
• Any other personal data that Camurus needs to process for the purpose of engaging you to perform the agreed services and as may be required for the purpose of Camurus’ compliance with legal obligations. 

What are the purposes and legal grounds of processing your personal data?

We process your personal data to:

1. to enter into an agreement with you or the company you represent regarding the services to be provided;
2. to pay invoices for services performed or otherwise compensate you for the consulting services;
3. to administrate your access to IT systems and office sites necessary for the conduct of the services;
4. to comply with our legal obligations, including accounting laws and relevant industry regulations; and
5. fulfil and comply with our obligations under the European Federation of Pharmaceutical Industries and Associations' ("EFPIA").

The processing of your personal data for the purpose stated in (a)-(c) above is necessary for the performance of a contract or, if you are not a party to the agreement regarding your consulting services, the processing is based on our legitimate interest as we have a business legitimate interest to engage you as a consultant.  This is of mutual interest, and we have conducted a balancing interest test with the result that our legitimate interest overweighs your interest in not having your personal data processed for this purpose. You are always entitled to object to this assessment, please see Part II below.

The processing of your personal data for the purpose stated in (d) above is necessary for us to comply with our legal obligation to process certain personal data.

The processing of your personal data for the purpose stated in (e) above is necessary for our legitimate interest as we have a business legitimate interest to adhere to the relevant codes and/or practices in line with the industry standard guidance.

For how long is your personal data stored?

Your personal data will only be stored for as long as the purpose for which it is kept exists and for as long as permitted or required under applicable laws and regulations and will be securely deleted or destroyed after expiry of the retention period.

7. JOB APPLICANTS

What personal data will be processed?

If you apply for a position with Camurus, directly to Camurus or through any of Camurus’ third party service providers (e.g. recruitment agencies), we may collect the following personal data in connection with the recruitment process in order to evaluate if you are a suitable candidate for the position:

• contact information (e.g. name, address, email and telephone number);
• CV and application job application, and any information provided in these documents;
• information obtained during interviews or other interactions during the recruitment process; and
• any other information provided by you or obtained in connection with the recruitment process.

We collect personal data directly from you. However, we may also collect personal data about you from external parties, e.g. from recruitment agencies, background check service providers, prior employers and other business partners, and publicly accessible sources such as national tax authorities and other public agencies or authorities.

What are the purposes and legal grounds of processing your personal data?

We process your personal data in order to:

(a) to interact with you during the recruitment process;
(b) to evaluate if you are a suitable candidate for the advertised job or position you apply for and otherwise include you in the recruitment process;
(c) to carry out statistical analysis of job applicants to analyze for example the number of female/male applicants, etc.;
(d) to process potential claims relating to the recruitment process (e.g. discrimination claims, etc.); and
(e) if applicable and if your explicit consent has been obtained, to store your information if we wish to contact you for future positions.

The processing of your personal data for purposes (a) to (e) above is based on our legitimate interest, as further outline in detail below. The legitimate interest in relation to purposes (a) and (b) is to evaluate if you are a suitable candidate for the advertised position which is also to your advantage. To do so, we must review certain information regarding, for example, your prior experience. We only review and request information that is necessary for such purpose.

We also have a legitimate interest to process your personal data for purpose (c) since we would like to ensure that we attract all types of individuals in order to maintain diversity and to take appropriate actions considering the results of the analysis. The personal data collected for statistical analysis will be compiled in an aggregated form which does not enable your identification.

In case you would like to challenge our decision taken in connection with our recruitment process as described in purpose (d), it is essential that we have documented our decisions in order to be able to motivate our decision and to defend potential legal claims.

Considering the nature of Camurus’ business, legal obligations, security reasons and the importance of mitigating the risk of exposure to and potential leakage of controlled substances (such as narcotics), we have a legitimate interest to carry out drug tests and other relevant health checks in case you are offered a position with Camurus where you will be handling controlled substances or be allowed access to facilities where controlled substances are kept. Such tests and checks are only conducted if they are relevant for the position you apply for. Tests and checks will be performed by an external service provider. Camurus will only receive information whether the test was positive or negative and/or a notice of any red flags, and Camurus will not receive, or store, any other information in relation to such tests. Camurus acknowledges that information received from the external service provider may be considered sensitive data under applicable privacy laws, including the GDPR and the CCPA. If applicable, in addition to Camurus’ legitimate interest to process this information, Camurus has a legal obligation to mitigate the risk of exposure to and potential leakage of controlled substances and must therefore assess the working capacity of you as an employee as described.

Considering the nature of Camurus’ business, we may also have a legitimate interest to have an external service provider perform a screening and background check if you have applied for a position with great responsibilities or that would otherwise require Camurus to ensure that you are fit for the position. Such background check is only conducted if it is relevant for the position you are applying for. In such case, we will receive a summary report from the external party having performed the screening and background check and Camurus will not store any of this information.

Based on the above-mentioned factors, we have performed a balance of interest assessment and have concluded that our legitimate interests outweigh your potential interest in not having your personal data processed for the purposes listed herein. You are always entitled to object to this assessment.

The processing of your personal data for purpose (e) is based on your explicitly given consent to such processing, which we will ask for if applicable. You can always withdraw your consent.

You can read further about your rights in Part II below.

For how long is your personal data stored?

Your personal data will only be stored as necessary for the purpose and as long as permitted or required under applicable laws and regulations and will be securely deleted or destroyed after expiry of the retention period.