Cystinose

Privacy Policy

Your trust is important to us.

At Chiesi NV ("Chiesi"), we want to make sure you understand what personal data we may collect about you when you interact with Chiesi, how we use your personal data and how we keep it safe.

This Privacy Policy explains:

Who is the data controller.
What data do we collect about you.
How we use your data.
On what basis we collect and use your data.
For how long we store your data.
Whether we share your data with others and transfer it internationally.
How we protect your data.
What are your rights.
When do we revise this Policy.

1. Who is the Data controller?

The Data controller for the collection and processing of your personal data is Chiesi NV (hereafter Chiesi), with company number 0826.654.883 and with registered office at Luchthaven Brussel Nationaal 1K, B-1930 Zaventem, Belgium.

2. What data do we collect about you?

When you interact with Chiesi using this website, we collect the following types of data:

Personal data you provide us with such as your name and contact information, email exchanges with Chiesi; and
Technical information - through the use of cookies - such as your IP address, the type of browser and operating system you use, device information, including unique device identifier, hardware model, operating model version and mobile network information, access times, pages viewed, URL's clicked on and social media tracking pixels that allow platforms such as Facebook and Twitter to interact with this website and give feedback on your actions.

3. How do we use your data?

We use your data for the following reasons:

To interact with you in order to respond to your request (e.g., through the contact form) and to provide you with administrative messages.
To conduct our business, including complying with applicable laws and regulations, responding to requests from governments, courts and/or enforcement agencies, and investigating and taking action against illegal or harmful uses.
To improve our day-to-day operations, including for internal purposes such as auditing, data analysis and research to help us deliver and improve Chiesi's digital platforms, content and services, to monitor and analyze trends, usage and activities related to our products and services to understand which parts of our digital platforms and services are of most interest and to improve their design and content, to improve our products and services and our communications to you; and where applicable to ensure we have up-to-date contact information for you.

4. On what basis do we collect and use your data?

Applicable data protection legislation sets out a number of different reasons for which a company may collect and use your personal data.

We use your data for the following purposes:

For legitimate business purposes: We use your data to render our communication with you more relevant and personalized to you, and to make your experience of our products and services efficient and effective.
To comply with our legal obligations and other requests for information: It is important to us that we are able to comply with laws, regulations and guidance, as well as other demands for data. Indeed, these affect the way in which we conduct our business and help us to make our products and services as safe as we can.
You have given us your consent: At times, we may need to get your consent to allow us to use your data for one or more of the purposes set out in point (3) above.

5. For how long will we keep your data?

If the law requires the retention of your personal data, Chiesi will comply with the relevant necessary retention periods. In other cases, we keep your data:

For as long as needed to provide you with access to the services you have requested;
Where you have contacted us with a query or a request, for as long as needed in order to respond to your query or request.

6. Do we share your personal data with others and transfer it internationally?

Within Chiesi, recipients of your personal data are persons specifically authorised by Chiesi for this purpose. These persons are bounded by a confidentiality clause and other legal obligations regarding the collection and processing of personal data.

Your data may also be communicated to Chiesi's parent company, Chiesi Farmaceutici S.p.A., and its affiliate companies inside and outside the European Economic Area ("EEA"), for the purpose of internal qualitative and statistical analysis. In this respect, Chiesi has taken all the necessary legal steps to ensure that the transfer of your personal data to countries outside the EEA is secure, and performed in accordance with the provisions of the applicable legislation. It has executed the appropriate standard contractual clauses in order to secure the international transfer of data.

Similarly, your data may be accessed by service providers and suppliers and by authorised partners, in cooperation with whom Chiesi provides its products and services and with whom it has concluded relevant contracts where necessary.

7. How do we protect your personal data?

We have adopted the appropriate organisational and technical measures to ensure the security of your data and their protection against destruction, loss, alteration, leakage, unauthorised dissemination or access and any other form of illegal processing.

Please note that internet is however not a totally secure environment. When you transmit information to us using internet or a mobile phone network connection, these transmissions may not be completely secure.

As well, from time to time we may provide on our website links to other websites or mobile applications that are not owned or controlled by us. This Privacy Policy does not apply to those websites or mobile applications. Please check the privacy policies of those websites and mobile applications, before you choose to use them.

8. What are your rights?

According to the terms of the data protection legislation and regulation in force, throughout the processing of your personal data, you are entitled to enforce, where applicable, the following rights:

The right to withdraw your consent when your personal data have been processed on this legal base.
The right of access which means the right to know whether your personal data is being processed and, where applicable, have access to it.
The right to rectification and the right to erasure, which means the right to obtain the rectification of inaccurate and/or incomplete personal data, as well as the erasure of personal data when the request is legitimate.
The right to restriction of processing which means the right to request the suspension of the processing, when such request is legitimate.
The right to data portability which means the right to obtain personal data in a structured format, ordinary used and readable, as well as the right to transfer personal data to other data controllers.
The right to object which means the right to object to the processing of personal data when the request is legitimate, including when the personal data is processed for marketing or profiling, if applicable.
The right to lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be) in case of unlawful processing of personal data.

You can exercise the abovementioned rights (except for point 7) by sending an email to the attention of Karen Laevaert ([email protected]). Your request shall be processed without undue delay and in any case within 30 days of receipt of the request, except for complex cases or when a large amount of requests is received. The said period may be extended by two further months.

9. Revision

Please note that we may change this Privacy Policy from time to time. We thus encourage you to review this Policy periodically.