NextPharma Group Privacy Notices

We would like to inform you about the processing of your personal data that is collected about you within the NextPharma Group ("NextPharma"). In addition, we will explain the purpose of the data processing, as well as your rights in this context. Please choose a privacy notice that corresponds to your case.

Controller according to art. 4(7) GDPR

Depending on the processing, the relevant company (e.g. company where you applied or worked or which is or was a business partner of yours or of the company where you work) of our group is the data controller for the purposes of Art. 4 (7) GDPR. In some cases, several companies in the group are joint data controllers for the processing.

In any case, you can contact us regarding the processing at the following address

NextPharma Germany BidCo GmbH
Hildebrandstr. 12, 37081 Göttingen, Deutschland

Tel.: +49 551 382-0
Fax: +49 551 382-470
E-Mail: Dataprotection(at)nextpharma.com

Or at the address of the relevant company. However, in some cases NextPharma GmbH and its affiliates are joint data controllers, or an affiliate is the only data controller for the processing.

Here is the list of all companies of the NextPharma Group:

Bowtie Germany BidCo GmbH
Hildebrandstr. 12, 37081 Göttingen, Germany

NextPharma Germany BidCo GmbH
Hildebrandstr. 12, 37081 Göttingen, Germany

allphamed Pharbil Arzneimittel GmbH
Hildebrandstr. 12, 37081 Göttingen, Germany

PenCef Pharma GmbH
Hildebrandstr. 12, 37081 Göttingen, Germany

Pharbil Waltrop GmbH,
Im Wirrigen 25, 45731 Waltrop, Germany

NextPharma Logistics GmbH,
Stieghorster Straße 60, 33605 Bielefeld, Germany

PHARBIL Pharma GmbH
Reichenberger Straße 43, 33605 Bielefeld, Germany

NextPharma Oy
Niittyhaankatu 20, 33720 Tampere, Finland

NextPharma SAS
17 route de Meulan, B.P. 45, F-78520 Limay, France

NextPharma Ploërmel
ZI de Camagnon B.P. 320, 56800 Ploërmel CEDEX, France

NextPharma Technologies Holding Ltd
Suite 612/613, 83 Victoria Street, London SW1H 0HW, United Kingdom

MW Encap Ltd
Suite 612/613, 83 Victoria Street, London SW1H 0HW, United Kingdom

Data Protection Officer

The NextPharma Group has appointed a Data Protection Officer for the companies based in Germany. He can be reached as follows:

TÜV SÜD Akademie GmbH
Westendstraße 160, 80339 München, Deutschland
E-Mail: Datenschutzbeauftragter(at)nextpharma.com

In case if you have Data Privacy associated questions regarding any of our companies, feel free to contact us using the following contact details:

NextPharma Group
Hildebrandstr. 12, 37081 Göttingen, Deutschland
E-Mail: dataprotection(at)nextpharma.com

Your Rights

In regard to processing of your personal data, you have the following rights:

Access your personal data processed by NextPharma (Art. 15 GDPR)
Request correction of inaccurate personal data (Art. 16 GDPR)
Request erasure of personal data if this is legally permitted (Art. 17 GDPR)
Request restriction of processing (Art. 18 GDPR)
Receive personal data in a structured, commonly used and machine-readable format (Art. 20 GDPR)
Object to processing (Art. 21 GDPR)
Lodge a claim with the supervising data protection authority (Art. 77 GDPR)

Certain data processing is performed on the basis of your consent (e.g., processing of job applications for a longer period than 6 months, getting in contact with you upon receiving a query per our website contact form). In these cases, you have the right to withdraw your consent with effect for the future. This will not affect the lawfulness of the processing prior to the withdrawal of consent.

If you consider that the processing of your personal data infringes the GDPR, you have - without prejudice to any other administrative or judicial remedy - the right to lodge a complaint with a supervisory authority, in the EU Member State of your residence, workplace or the place of the alleged infringement. An overview list of data protection supervisory authorities can be found, for example, here: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html

You can contact us at any time by emailing dataprotection(at)nextpharma.com if you have any questions about your data protection rights or wish to exercise any of aforementioned rights.

Changes to this privacy policy

We reserve the right to amend this data protection declaration if necessary, so that it always complies with the current legal requirements or in order to implement changes to our services in the data protection declaration, e.g., when introducing new services. The new privacy notice will then apply to your next visit. These privacy notices were last updated on December 8, 2022.

Privacy Notice for Individuals who are not connected with our Business Partners

This privacy notice provides information to individuals who are not connected with our business partners (B2B) and contact us by phone, post, email or fax.

Personal data

You decide yourself which information you wish to provide us to enable us to answer your inquiry:

Name
Contact information (Email address, phone number)
Other data, which you provide us voluntarily

If you are under 16 years old please do not send us your personal data (for example, your name, address and email address). If you wish to ask NextPharma a question please get your parent or guardian to do so on your behalf.

Purpose of the processing

answering your queries

Legal basis

Art. 6(1)(a) GDPR - your explicit informed consent

You have the right to withdraw your consent at any time by email addressed to dataprotection@nextpharma.com. This will not affect the validity of the processing prior to the withdrawal of consent.

Recipients of data

Internal Departments engaged in processing your inquiry

Retention period

The data remains with the responsible internal departments until you request us to delete it, revoke your consent to store it or the purpose for storing the data no longer applies (e.g. after processing your enquiry has been completed). Mandatory legal provisions - in particular retention periods - remain unaffected.

Privacy notice for individuals who are associated with our Business Partners

This privacy notice provides information to individuals who work for or on behalf of our business partners (B2B), such as contract givers, customers, suppliers, investors.

Personal data

private contact information (such as name, title, postal or email address) only if necessary
business contact information (such as job title, department, telephone and fax number, name and address of company)

Purpose of the processing

business execution (concluding and executing of agreements, customer service, management of products and materials)
organisation and management of the business (such as financial management, management reporting)
legal and/or regulatory compliance (such as litigation and defense of claims)

Legal basis

Art. 6 (1)(b) GDPR – performance of a contract/pre-contractual steps
Art. 6 (1)(f) GDPR - legitimate interests of the controller

Sources of Data

the individual himself
another person or unit within/connected with the individual’s company

Recipients of data

The personal data covered by this Privacy Notice is exclusively processed for the purposes referred to above and will be shared only

within the NextPharma Group companies which are located inside the Economic European Area

Consequences if personal data is not provided

negative influence on our ability to communicate with our business partners
negative influence on our ability to enter into and perform contracts with our counterparts

Retention period

during the duration of the business relationship

Privacy Notice for Persons submitting a Data Subject Request

Personal Data

Data Subject identifier (name, e-mail address or other information provided by the Data Subject to verify identity)
Communication with the Data Subject (associated with handling of the request)
Data associated to the request of the Data Subject

Purpose of processing

To enable the Data Subject to exercise one’s rights in regard to the processing
To comply with the obligation of accountability art. 5 (2) in regard to handling Data Subject requests

Legal Basis

Necessity for compliance with a legal obligation to which the controller is subject as per art. 6 (1) (c) GDPR.

Recipients of data

Data Privacy Specialist
Data Protection Officer
IT department employee if participation is necessary to process the request
HR department employee if participation is necessary to process the request
The recipients for the Data are Employees of NextPharma Group companies who handle the request.

Consequences if personal data are not provided

Inability to verify that the request is submitted by the Data Subject
Inability to process the request

Retention period

The records about the Data Subject Request and its handling shall be retained for 3 years. Afterwards the records shall be anonymized and stored in anonymized state for 7 more years.

Privacy Notices for job applicants

This privacy notice provides information about personal data processed in relation to individuals who apply for work with NextPharma.

Personal data

applications for employment, results of interviews
personal data in applications, which job applicants provide us
documents containing personal data which job applicants provide us
personal contact details which job applicants provide us

Purpose of processing

deciding upon job application
acknowledgment of availability of a potential applicant for other positions (in case if you have consented to keeping your profile in the talent pool)

Legal Basis

Art. 6 (1) GDPR
a) your consent (e.g. for retention of application documents for more than 6 months;
b) contract: the processing is necessary for entering into an employment contract.

Recipients of data

The personal data covered by this Privacy Notice is exclusively processed for the purposes referred to above and will be shared only

within the NextPharma group of companies which are located inside the Economic European Area

Consequences if personal data are not provided

Personal data requested and provided by Applicants are required in order to fulfil legal requirements and/or for entering into a contract with them. Failure to provide us with the information requested which is limited to that required for these purposes may:

negatively affect your chances of being selected for employment
make the entering into contract with you not be possible

Retention period

data of successful candidates: according to the Privacy Notice - Employees below;
data of unsuccessful applicants: 6 months after closure of the application process for the position.

In all cases information may be held for a) a longer period of time where there is a legal or regulatory reason to do so (in which case it will be deleted once no longer required for the legal or regulatory purpose) or b) a shorter period where the individual objects to the processing of their personal data and there is no longer a legitimate purpose to retain it or c) a longer period where the individual consents to the processing (in which case the individual has the right to withdraw their consent with effect for the future.

Privacy Notice for Current or Former Employees of NextPharma

This privacy notice provides information about personal data processed by NextPharma in relation to individuals who are or were employees.

Personal Data

Title
Name, name abbreviation
Marital status
Personal contact information
Date of birth
Social security data
Tax data
Pay roll data and bank account
Wage and benefits information including beneficiary
Education information
Working time, absence, absence reason
Employment agreement
Job application data
Photo (in case you provided voluntarily photo with your job application or otherwise)

We also process sensitive personal data such as data relating to individual’s health only where it is necessary for complying with employment and social security law.

Purpose of processing

to fulfill our obligations to comply with relevant laws and regulations
to enter into/execute/terminate employment agreements

Legal basis

Art. 6 (1) GDPR:
(a) your explicit consent
(b) contract: the processing is necessary for conclusion and performance of the employment contract
(c) legal obligation: the processing is necessary for you to comply with the law
(d) vital interests: the processing is necessary to protect someone’s life
(f) legitimate interests: the processing is necessary to protect NextPharma’s or an third party’s legitimate interest, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests
Relevant national laws

Recepients of data

Health Insurance/Pension insurance/Tax Authorities/Employment Agency (only legally required transfer of data)
authorized payroll service provider

Retention period

Information contained in your personal file is held for no longer than 10 years once your employment has terminated

Consequences if personal data are not provided

The processing of personal data is necessary for the performance of the employment relationship. Processing of certain data (tax data, social security data, work permits) is legally required.

Failure to provide us with the information requested which is limited to that required for these purposes may

lead to violation of law
make the entering into contract with you not being possible