Data Protection

Last updated: September 2023

We welcome your interest in Fresenius Kabi SwissBioSim GmbH (“Fresenius Kabi”) and more specifically the Expression Days campaign and the Figure Art Project by Fresenius Kabi.

Protecting the personal data of our patients, healthcare professionals, suppliers, customers and other business contacts is important to us. As a global healthcare company in the digital age, data forms a cornerstone and enabler of our worldwide business. With data being one of our key assets we need to ensure that it is appropriately handled and protected.

This site explains how our organization incorporates data protection into its operations. We also explain how your data is used in our processes. Furthermore, you will find information on how to obtain insight and execute your rights.

How We Take Care of Your Data

Our Data Protection Organization

Fresenius Kabi operates a central data protection center of competence. This center has set up a data protection management framework in alignment with ISO 29100 (privacy framework for the protection of personally identifiable information). The competence center aims to implement a harmonized and consistent way of processing personal data across all Fresenius Kabi entities. It sets the policies, procedures and standards for data protection and provides tools and processes for the employees as well as training and awareness material. Furthermore, this center provides expertise on all data protection topics.

Our local data privacy advisors at the various Fresenius Kabi legal entities support local management in their compliance efforts. They do this by executing risk and compliance assessments for the different data processing activities. With these assessments we aim to integrate data protection requirements into the design of our processes and IT systems.

Our internal IT service provider, Fresenius Digital Technology, has implemented a certified management system for information security according to ISO 27001 to provide high security standards for data centers. Our Global Cybersecurity Emergency Response Team (CERT) identifies, evaluates and responds to security incidents and acts as a central contact point for security-related topics.

The monitoring of our data protection compliance efforts is overseen by our data protection officer.

Our Data Protection Policy

The Fresenius Kabi Group has adopted Binding Corporate Rules on the protection of personal data. These rules have been approved by the European Data Protection Authorities and describe the principles for protecting personal data and determine how we apply them when collecting and processing personal data.

The Fresenius Binding Corporate Rules and associated security policies and procedures aim to create a global adequate and uniform level of data protection across our group. They also set the rules for the internal data transfers between Fresenius Kabi companies and our internal service provider worldwide.

Transparency on Our Data Processing Activities

If you interact with us, as a healthcare professional, business contact, or website user, also if you report an adverse event or submit a data subject request, we collect and use your personal data. In the data protection statements below, we explain how we collect and use your data in these different contexts.

Expression Days and Figure Art Project Participants

As our Expression Days and Figure Art Project participants, we process your personal data to carry out the Expression Days campaign and in order to prepare, fulfill or perform the participation agreement with you for the provision of the expected deliverable mentioned in the agreement on Participation in the Expression Days campaign.

In the section Privacy Statement for Expression Days and Figure Art Project Participants Data below you will find further details on the processing of your personal data.

Business contacts (vendors, clients, interested business contacts)

As our business contact, we mostly collect and use your personal data in order to prepare, fulfill or perform an agreement or contract with you or with your organization for the provision of products and services. This includes:

• the evaluation of our relationship with the company you work for (business partner evaluation), and
• the fulfillment of compliance requirements such as business partner due diligence, sanction list screening and money laundering laws.

In our data protection statement for business contacts you will find further details.

Healthcare professionals

If you are a healthcare professional we mostly collect and use your data to send you product and service-related information and to assess whether you are a suitable contact for specific business needs, e.g., when we look for an expert in a certain field or for a specific product.

In our data protection statement for healthcare professionals you will find further details.

Website users

If you are using our website, we also collect data about you. How and why we do that is stated in our data protection statement for website visitors.

Reporters of adverse reactions or events

We collect, use and report personal data of patients using our products and of reporters of adverse reactions or events. In the data protection statement for vigilance, we explain why and how we do that.

Individuals submitting a data subject request

If you contact us with a request regarding your rights as a data subject, we will handle those requests. You can find how we do that in our data protection statement for data subject requests.

Obtain Insight and Execute Your Rights

By using our data protection contact form you can request information regarding the processing of your personal data including but not limited to the origin and recipients of your data and the purposes of the processing. You can also request to have access to your data or to object to the processing of your data. If your personal data are incorrect, incomplete or not processed in compliance with applicable law, you have the right to have this data rectified, deleted or blocked. Furthermore, you can in certain cases, also ask to directly transfer them to another organization (data portability).

If you submit a request, our data protection organization may contact you for additional information to confirm your identity and to ensure rapid clarification of your question. We provide information free of charge unless requests are manifestly unfounded or excessive. In that case we may charge a fee. We aspire to answer your request within four weeks. We reserve the right to extend the period within the scope of the admissibility by law and will inform you if this is the case. Please do not inquire about your processing status.

You have the right to file a complaint about the way we manage your personal data with our data protection officer or with the data protection authority.

Expression Days and Figure Art Project Participants

Last updated September 2023, previous version

As a valued participant in the Expression Days campaign, Fresenius Kabi SwissBioSim GmbH (“we”) will collect and use certain personal data from you. Protecting your privacy is important to us and we would like to inform you on how we collect personal data, what type of information we collect and explain to you how that information is used. Processing of personal data by us is governed by the General Data Protection Regulation of the European Union and other applicable data protection laws.

This data protection statement informs you about the processing of personal data in connection with your relationship with us as Participants in Expression Days and Figure Art Project.

Please be aware that we also may process your personal data in other contexts, e.g. when you visit our website or if you submit a data subject request. Please see the specific information on the processing of your personal data in such situations.

Why we collect and use the data

We collect and use these data for the purposes mentioned in the agreement on the project participation.

• To allow us to contact you with regards to your artwork submission and/or questionnaire
• To create a short story from the material you provided, which will enable recipients to learn more about you as the source portrayed within the art on the figure and to understand what it is like living with a disease such as yours;
• To display and make publicly accessible the short story together with the created figure to visitors of the various events/exhibitions until the end of 2025 across the European Union where Fresenius Kabi’s Expression Days takes place
• To use the short story together, with the created figure in media coverage activities of Fresenius Kabi’s Figure Art Project in this year and until the end of 2024 in Fresenius Kabi’s intranet and on Fresenius Kabi’s websites www.fresenius-kabi.com/ and https://biosimilars.fresenius-kabi.com/ (both including its country subsites)
• To contact you via email with regular updates on the campaign, if provided consent via the subscription box on the homepage of the website

We process your personal data on one of the following legal bases:

• The processing of your personal data is necessary in order to carry out the contract concluded between you and us (Art. 6.1 b GDPR).
• The processing of your personal data is necessary for us in order to comply with a legal obligation we are subject to e.g. laws on anti-money laundering, customs and export, secure supply chain requirements, product tracing requirements, statutory disclosure and notification requirements or similar compliance requirements that might require us to process certain of your personal data (Art. 6.1 c GDPR).
• Processing is necessary for purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data (Art. 6.1 f GDPR). These legitimate interests are:
  • Fulfilling our contract with the company you are working for, including the enforcement of any rights we may have under such contract;
  • Gather information on knowledge management related to internal processes, products and services;
  • Development, optimisation and improvement of our products and services;
  • Optimisation of internal communication;
  • Optimisation of administration;
  • Carrying out research work;
  • Organisational management;
  • Risk Management: safeguarding against e.g. financial / reputational risks;
  • Maintenance of the IT infrastructure, IT security, guarantee of IT support and the detection and correction of errors; and
  • Complying with legal requirements outside the EEA.
  • Establishment, exercise or defense of legal claims
• Where we have requested your consent for processing of your personal data, your consent (Art. 6.1 a and Art. 9.2 a GDPR).

You can withdraw your consent at any time. You can withdraw your consent to all processing or for individual purposes of your choice. The withdrawal of consent will not affect the lawfulness of processing based on your consent before the withdrawal. You can withdraw your consent by sending an email to dataprotectionofficer@fresenius-kabi.com.

What data we collect and how we do that

We collect your personal data when you provide this to us through inputting your details and uploading of your artwork through the submission form on the Expression Days website.

Data is only collected upon your consent provided by a ticking the relevant checkbox in the participation agreement when you submit your artwork through the submission form on the Expression Days website.

Such personal data - including health data - via the submission form includes

• your full name,
• your email address,
• your full address,
• your condition,
• where you live,
• age when you were first diagnosed,
• age at submission,
• what you love to do in your spare time,
• how you feel about your condition,
• which symptoms affect you the most,
• what it is like to live with the symptoms every day,
• which part of your body is most affected by your symptoms and how this affects you,
• the colour you would like emphasised on a figure, your preferred art technique.

We share your data

We share your data with other entities within the Fresenius Group for performing the campaign across the European Union where Fresenius Kabi’s Expression Days takes place. These entities can be around the world in countries where the Fresenius Kabi group is active (Please refer to the overview of the locations at: https://www.fresenius-kabi.com/entities). The data will be shared only on a need-to-know basis.

We make use of other organisations, such as commissioned service providers that support us with the performance of the campaign, such as to make the Expression Days website available to you. In some cases, these organisations have access to parts or all your data to perform the tasks they are contracted to do so. The organisations that support us are:

- prior to November 25, 2020: emotive (Agency) Ltd., 57 Rathbone Place, Holden House, London, W1T 1JU, United Kingdom, and since November 25, 2020: Medicom Group Limited, aka Havas Life Medicom, Havas House Hermitage Court, Hermitage Lane, Maidstone, Kent, England, ME16 9NT (“Havas”). Havas makes use of Vivid Atom Limited located at The Old School House, Bridge Road, Hunton Bridge, Kings Langley, WD4 8SZ. This organisation provides the hosting of the website.

As Havas and Vivid Atom have their place of business in the United Kingdom, i.e. outside the European Union (EU) / European Economic Area (EEA) / the appropriate safeguards were ensured by means of the Standard Contractual Clauses that have been issued by the European Commission, set up between Fresenius Kabi (data controller) and Havas (data processor outside the EU). Furthermore, the European Commission adopted a decision confirming an adequate level of protection in place in the United Kingdom, that matches the level of data protection within the European Union.

We do not share the information with other organisations, unless legally required to do so.

International data transfers

We may send your personal data in parts or as a whole to Fresenius Group recipients, our service providers or other international organizations in countries, which are neither member states of the European Union nor Switzerland, for the purposes listed above. Please refer to the overview of the locations in which Fresenius Kabi Group companies are active. We may send data to the following countries for which the European Commission / Swiss Federal Data Protection and Information Commissioner (FDPIC) has determined an adequate level of data protection to be in place that matches the level of data protection within the European Union / Switzerland in which Fresenius entities are established: Argentina, Canada, Japan, New Zealand, Switzerland, United Kingdom or Uruguay.

With regards to such international data transfers to third countries, for which the European Commission / FDPIC has not decided that an adequate level of data protection exists, we have provided appropriate safeguards in order to secure your personal data to a degree that equals the level of data protection in the European Union. Safeguards used are:

• For the exchange of data within our company: our Binding Corporate Rules for Controllers
• For the exchange of data with our service providers and other international organizations: Standard Contractual Clauses that have been issued by the European Commission and recognized by FDPIC.

You can obtain a copy of these Standard Contractual Clauses and our Binding Corporate Rules online, or upon request.

How long do we retain the data?

Generally, we store your personal data for as long as its storage is required for the achievement of the purposes for which it was collected, i.e. the performance of the Expression Day campaign, which includes the exhibition of your submissions until the end of 2025 on the Expression Days website, as well as for the duration of the statutory retention periods, if the law dictates longer retention periods. Afterwards, your personal data will be deleted. The personal data related to your interactions with us will be deleted ten years after the completion of the last interaction with you, unless we are legally required or contractually allowed to retain the data.

Requests, inquiries and complaints

Depending on the situation, you have the following rights with respect to your personal data:

Right of access

You have the right to request at any time information on which personal data about you we process.

Right to rectification of incorrect data

If your personal data are inaccurate, you have the right to get them corrected without undue delay.

Right to erasure

In certain situations, you have the right to request the erasure of your personal data. In particular, you may ask us to erase personal data, if:

• It is no longer needed for the purposes for which it was collected or otherwise processed,
• The personal data has been unlawfully processed,
• You object to the processing and there are no overriding legitimate grounds for the processing,
• The personal data has to be erased due to compliance with a legal obligation in Union or Member State law to which we are subject or
• You withdraw your consent on which the processing is based and there is no other legal ground for the processing.

Right to restriction of processing

You have the right to obtain from us restriction of processing, where one of the following applies:

• The accuracy of the personal data is contested by you, processing will be restricted for a period enabling us to verify the accuracy of the personal data,
• The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead,
• We no longer need the personal data for the purposes of the processing, but are required by you to keep them for the establishment, exercise or defense of legal claims or
• You have objected to processing and the verification whether our legitimate interests override yours is pending.

Right to data portability

According to Art. 20 GDPR and Art. 25 FADP you have the right to receive a copy the personal data about you, which you have provided to us, in a structured, commonly used and machine-readable format.

Right to object

In line with Art. 21 GDPR and Art. 32.2 FADP, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on our legitimate (overriding) interest (Art. 6.1 f GDPR, Art. 31.2 FADP). We will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the purpose of establishing, exercising or defending legal claims.

You can exercise these rights online by using the data protection contact form.

Right to lodge a complaint

You also have the right to lodge a complaint with our data protection officer or the supervisory authority.

Data Protection Officer:
Fresenius Kabi AG
Data Protection Officer
Else-Kröner-Straße 1
61352 Bad Homburg
Germany
E-mail: dataprotectionofficer@fresenius-kabi.com

Data Protection Authority in the EU:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Presse- und Öffentlichkeitsarbeit
Gustav-Stresemann-Ring 1
65189 Wiesbaden

Data Protection Authority in Switzerland:
Préposé fédéral à la protection des données et à la transparence (PFPDT)
Feldeggweg 1
CH - 3003 Berne

Requirements to provide personal data

You may need to provide your personal data to us for the purpose of participating in the Expressions Day campaign If you fail to provide your personal data, you may not be able to participate in the campaign.

Automated decision making

An automated decision making (Art. 22.1, 2 GDPR, Art. 21 and 25.2(f) FADP) occurs according to our obligation to conduct a sanction-control-procedure. This may also be necessary for participating in the Expressions Day campaign. The consequence of this can be the refusal of participation in the campaign.

Further information for specific situations and contact

We might process your personal data also in different contexts, e.g. when you visit our website. Please see the specific information on the processing of your personal data in these situations.

If you have any questions on data protection at Fresenius Kabi, please contact us at dataprotectionofficer@fresenius-kabi.com.

Controller and contact

Controller:

The controller and responsible entity for processing of personal data is:
Fresenius Kabi AG and its affiliates.
A list of Fresenius Kabi AG’s affiliates can be found on: https://www.fresenius-kabi.com/entities

In Switzerland, the controller and responsible entity for processing of personal data is:

Fresenius Kabi SwissBioSim GmbH
Terre Bonne Business Park
Route de Crassier 23 – Bâtiment A3
CH – 1262 Eysins
Téléphone : +41223076100
Courriel : biosimilars@fresenius-kabi.com
Contact: LDPA.swissbiosim@fresenius-kabi.com

Our representative in the European Union:
Fresenius Kabi Deutschland GmbH
Else-Kröner-Straße 1
61352 Bad Homburg
Germany
Contact

Data protection officer:

We have designated a group-wide Data Protection Officer. You can contact our data protection officer for all requests and questions concerning your personal data via:

Data Protection Officer:
Fresenius Kabi AG
Data Protection Officer
Else-Kröner-Straße 1
61352 Bad Homburg
Germany
E-mail: dataprotectionofficer@fresenius-kabi.com

Changes to this Data Protection Information

As our collection and processing of your data may change over time, we might also modify this Data Protection Information to always correctly reflect our data processing practices. We encourage you to review it from time to time.