Last updated: September 2023
We welcome your interest in Fresenius Kabi SwissBioSim GmbH (“Fresenius Kabi”) and more specifically the Expression Days campaign and the Figure Art Project by Fresenius Kabi.
Protecting the personal data of our patients, healthcare professionals, suppliers, customers and other business contacts is important to us. As a global healthcare company in the digital age, data forms a cornerstone and enabler of our worldwide business. With data being one of our key assets we need to ensure that it is appropriately handled and protected.
This site explains how our organization incorporates data protection into its operations. We also explain how your data is used in our processes. Furthermore, you will find information on how to obtain insight and execute your rights.
Our Data Protection Organization
Fresenius Kabi operates a central data protection center of competence. This center has set up a data protection management framework in alignment with ISO 29100 (privacy framework for the protection of personally identifiable information). The competence center aims to implement a harmonized and consistent way of processing personal data across all Fresenius Kabi entities. It sets the policies, procedures and standards for data protection and provides tools and processes for the employees as well as training and awareness material. Furthermore, this center provides expertise on all data protection topics.
Our local data privacy advisors at the various Fresenius Kabi legal entities support local management in their compliance efforts. They do this by executing risk and compliance assessments for the different data processing activities. With these assessments we aim to integrate data protection requirements into the design of our processes and IT systems.
Our internal IT service provider, Fresenius Digital Technology, has implemented a certified management system for information security according to ISO 27001 to provide high security standards for data centers. Our Global Cybersecurity Emergency Response Team (CERT) identifies, evaluates and responds to security incidents and acts as a central contact point for security-related topics.
The monitoring of our data protection compliance efforts is overseen by our data protection officer.
Our Data Protection Policy
The Fresenius Kabi Group has adopted Binding Corporate Rules on the protection of personal data. These rules have been approved by the European Data Protection Authorities and describe the principles for protecting personal data and determine how we apply them when collecting and processing personal data.
The Fresenius Binding Corporate Rules and associated security policies and procedures aim to create a global adequate and uniform level of data protection across our group. They also set the rules for the internal data transfers between Fresenius Kabi companies and our internal service provider worldwide.
If you interact with us, as a healthcare professional, business contact, or website user, also if you report an adverse event or submit a data subject request, we collect and use your personal data. In the data protection statements below, we explain how we collect and use your data in these different contexts.
Expression Days and Figure Art Project Participants
As our Expression Days and Figure Art Project participants, we process your personal data to carry out the Expression Days campaign and in order to prepare, fulfill or perform the participation agreement with you for the provision of the expected deliverable mentioned in the agreement on Participation in the Expression Days campaign.
In the section Privacy Statement for Expression Days and Figure Art Project Participants Data below you will find further details on the processing of your personal data.
Business contacts (vendors, clients, interested business contacts)
As our business contact, we mostly collect and use your personal data in order to prepare, fulfill or perform an agreement or contract with you or with your organization for the provision of products and services. This includes:
In our data protection statement for business contacts you will find further details.
If you are a healthcare professional we mostly collect and use your data to send you product and service-related information and to assess whether you are a suitable contact for specific business needs, e.g., when we look for an expert in a certain field or for a specific product.
In our data protection statement for healthcare professionals you will find further details.
If you are using our website, we also collect data about you. How and why we do that is stated in our data protection statement for website visitors.
Reporters of adverse reactions or events
We collect, use and report personal data of patients using our products and of reporters of adverse reactions or events. In the data protection statement for vigilance, we explain why and how we do that.
Individuals submitting a data subject request
If you contact us with a request regarding your rights as a data subject, we will handle those requests. You can find how we do that in our data protection statement for data subject requests.
By using our data protection contact form you can request information regarding the processing of your personal data including but not limited to the origin and recipients of your data and the purposes of the processing. You can also request to have access to your data or to object to the processing of your data. If your personal data are incorrect, incomplete or not processed in compliance with applicable law, you have the right to have this data rectified, deleted or blocked. Furthermore, you can in certain cases, also ask to directly transfer them to another organization (data portability).
If you submit a request, our data protection organization may contact you for additional information to confirm your identity and to ensure rapid clarification of your question. We provide information free of charge unless requests are manifestly unfounded or excessive. In that case we may charge a fee. We aspire to answer your request within four weeks. We reserve the right to extend the period within the scope of the admissibility by law and will inform you if this is the case. Please do not inquire about your processing status.
You have the right to file a complaint about the way we manage your personal data with our data protection officer or with the data protection authority.
Last updated September 2023, previous version
As a valued participant in the Expression Days campaign, Fresenius Kabi SwissBioSim GmbH (“we”) will collect and use certain personal data from you. Protecting your privacy is important to us and we would like to inform you on how we collect personal data, what type of information we collect and explain to you how that information is used. Processing of personal data by us is governed by the General Data Protection Regulation of the European Union and other applicable data protection laws.
This data protection statement informs you about the processing of personal data in connection with your relationship with us as Participants in Expression Days and Figure Art Project.
Please be aware that we also may process your personal data in other contexts, e.g. when you visit our website or if you submit a data subject request. Please see the specific information on the processing of your personal data in such situations.
Why we collect and use the data
We collect and use these data for the purposes mentioned in the agreement on the project participation.
We process your personal data on one of the following legal bases:
You can withdraw your consent at any time. You can withdraw your consent to all processing or for individual purposes of your choice. The withdrawal of consent will not affect the lawfulness of processing based on your consent before the withdrawal. You can withdraw your consent by sending an email to email@example.com.
What data we collect and how we do that
We collect your personal data when you provide this to us through inputting your details and uploading of your artwork through the submission form on the Expression Days website.
Data is only collected upon your consent provided by a ticking the relevant checkbox in the participation agreement when you submit your artwork through the submission form on the Expression Days website.
Such personal data - including health data - via the submission form includes
We share your data
We share your data with other entities within the Fresenius Group for performing the campaign across the European Union where Fresenius Kabi’s Expression Days takes place. These entities can be around the world in countries where the Fresenius Kabi group is active (Please refer to the overview of the locations at: https://www.fresenius-kabi.com/entities). The data will be shared only on a need-to-know basis.
We make use of other organisations, such as commissioned service providers that support us with the performance of the campaign, such as to make the Expression Days website available to you. In some cases, these organisations have access to parts or all your data to perform the tasks they are contracted to do so. The organisations that support us are:
- prior to November 25, 2020: emotive (Agency) Ltd., 57 Rathbone Place, Holden House, London, W1T 1JU, United Kingdom, and since November 25, 2020: Medicom Group Limited, aka Havas Life Medicom, Havas House Hermitage Court, Hermitage Lane, Maidstone, Kent, England, ME16 9NT (“Havas”). Havas makes use of Vivid Atom Limited located at The Old School House, Bridge Road, Hunton Bridge, Kings Langley, WD4 8SZ. This organisation provides the hosting of the website.
As Havas and Vivid Atom have their place of business in the United Kingdom, i.e. outside the European Union (EU) / European Economic Area (EEA) / the appropriate safeguards were ensured by means of the Standard Contractual Clauses that have been issued by the European Commission, set up between Fresenius Kabi (data controller) and Havas (data processor outside the EU). Furthermore, the European Commission adopted a decision confirming an adequate level of protection in place in the United Kingdom, that matches the level of data protection within the European Union.
We do not share the information with other organisations, unless legally required to do so.
International data transfers
We may send your personal data in parts or as a whole to Fresenius Group recipients, our service providers or other international organizations in countries, which are neither member states of the European Union nor Switzerland, for the purposes listed above. Please refer to the overview of the locations in which Fresenius Kabi Group companies are active. We may send data to the following countries for which the European Commission / Swiss Federal Data Protection and Information Commissioner (FDPIC) has determined an adequate level of data protection to be in place that matches the level of data protection within the European Union / Switzerland in which Fresenius entities are established: Argentina, Canada, Japan, New Zealand, Switzerland, United Kingdom or Uruguay.
With regards to such international data transfers to third countries, for which the European Commission / FDPIC has not decided that an adequate level of data protection exists, we have provided appropriate safeguards in order to secure your personal data to a degree that equals the level of data protection in the European Union. Safeguards used are:
How long do we retain the data?
Generally, we store your personal data for as long as its storage is required for the achievement of the purposes for which it was collected, i.e. the performance of the Expression Day campaign, which includes the exhibition of your submissions until the end of 2025 on the Expression Days website, as well as for the duration of the statutory retention periods, if the law dictates longer retention periods. Afterwards, your personal data will be deleted. The personal data related to your interactions with us will be deleted ten years after the completion of the last interaction with you, unless we are legally required or contractually allowed to retain the data.
Requests, inquiries and complaints
Depending on the situation, you have the following rights with respect to your personal data:
Right of access
You have the right to request at any time information on which personal data about you we process.
Right to rectification of incorrect data
If your personal data are inaccurate, you have the right to get them corrected without undue delay.
Right to erasure
In certain situations, you have the right to request the erasure of your personal data. In particular, you may ask us to erase personal data, if:
Right to restriction of processing
You have the right to obtain from us restriction of processing, where one of the following applies:
Right to data portability
According to Art. 20 GDPR and Art. 25 FADP you have the right to receive a copy the personal data about you, which you have provided to us, in a structured, commonly used and machine-readable format.
Right to object
In line with Art. 21 GDPR and Art. 32.2 FADP, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on our legitimate (overriding) interest (Art. 6.1 f GDPR, Art. 31.2 FADP). We will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the purpose of establishing, exercising or defending legal claims.
You can exercise these rights online by using the data protection contact form.
Right to lodge a complaint
You also have the right to lodge a complaint with our data protection officer or the supervisory authority.
Data Protection Officer:
Fresenius Kabi AG
Data Protection Officer
61352 Bad Homburg
Data Protection Authority in the EU:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Presse- und Öffentlichkeitsarbeit
Data Protection Authority in Switzerland:
Préposé fédéral à la protection des données et à la transparence (PFPDT)
CH - 3003 Berne
Requirements to provide personal data
You may need to provide your personal data to us for the purpose of participating in the Expressions Day campaign If you fail to provide your personal data, you may not be able to participate in the campaign.
Automated decision making
An automated decision making (Art. 22.1, 2 GDPR, Art. 21 and 25.2(f) FADP) occurs according to our obligation to conduct a sanction-control-procedure. This may also be necessary for participating in the Expressions Day campaign. The consequence of this can be the refusal of participation in the campaign.
Further information for specific situations and contact
We might process your personal data also in different contexts, e.g. when you visit our website. Please see the specific information on the processing of your personal data in these situations.
If you have any questions on data protection at Fresenius Kabi, please contact us at firstname.lastname@example.org.
Controller and contact
The controller and responsible entity for processing of personal data is:
Fresenius Kabi AG and its affiliates.
A list of Fresenius Kabi AG’s affiliates can be found on: https://www.fresenius-kabi.com/entities
In Switzerland, the controller and responsible entity for processing of personal data is:
Fresenius Kabi SwissBioSim GmbH
Terre Bonne Business Park
Route de Crassier 23 – Bâtiment A3
CH – 1262 Eysins
Téléphone : +41223076100
Courriel : email@example.com
Our representative in the European Union:
Fresenius Kabi Deutschland GmbH
61352 Bad Homburg
Data protection officer:
We have designated a group-wide Data Protection Officer. You can contact our data protection officer for all requests and questions concerning your personal data via:
Data Protection Officer:
Fresenius Kabi AG
Data Protection Officer
61352 Bad Homburg
Changes to this Data Protection Information
As our collection and processing of your data may change over time, we might also modify this Data Protection Information to always correctly reflect our data processing practices. We encourage you to review it from time to time.