Data Protection

Data Protection Statement for Business Contacts

Data protection information for commercial prospects, clients, vendors, service providers, consultants/experts and interested business contacts

Last updated September 2023, previous version

As a valued commercial prospect, client, vendor, service provider, consultant/expert, interested business contact or otherwise representative of an organization we interact with (“business contact”, “you“), Fresenius Kabi SwissBioSim GmbH (“we”) will collect and use certain personal data from you.

This data protection statement informs you about the processing of personal data in connection with your relationship with us as business contact.

Please be aware that we also may process your personal data in other contexts, e.g. when you visit our website, when you interact with us in your capacity as a healthcare professional, if you report an adverse reaction or if you submit a data subject request. Please see the specific information on the processing of your personal data in such situations.

Depending on the business contact we have with you and/or the company you are working for, we collect and use your data for the following purposes:

Asses a potential business relationship and/or maintaining our business relationship with you or the company you are working for (including customer relationship management, supplier management, investor relations management)
Vendor assessment and qualification (e.g., whether you and your organization meet certain quality and certification requirements)
Procurement of products and services from you or the company you are working for
Exchange of information related to existing contracts or possible contracts with you or the company you are working for
Fulfil our contractual rights and obligations vis-à-vis the company you are working for, including the enforcement of any rights we may have under such contract
Fulfil compliance requirements related to a business transaction (e.g., conflict checks, business partner due diligence, sanction list screening, anti-money laundering laws, secure supply chain requirements, customs and export law requirements, tracing requirements for products)
Manufacture, sell, provide and deliver products and services
Marketing (e.g., informing you about products and services or related information)
Assess and categorize which specific business needs match best with your abilities (e.g. when we look for a key opinion leader in a certain field or for specific products, the extent you belong to the group of scientific input providers, based on scientific or professional experience) or if you can, in your professional capacity, influence the use, purchase, ordering, prescribing or recommendation of Fresenius Kabi products, or affect tender decisions, formulary placement, award status or other preferential or qualifying status of Fresenius Kabi products in accordance with applicable law
Collection of payments due to us including the re-financing of debts
Assess your company’s financial solvency and credit risk
Assess potential investments in Fresenius shares, a potential acquisition, divestiture or joint venture transaction with us or any Fresenius Kabi affiliate
Improve our products and services
Organize, secure and improve internal processes including communication, administration, research and IT
Facilitate mergers, acquisitions and re-organizations
Fulfil legal requirements of registration / marketing authorization submission of our products with regulatory authorities, including e.g. to provide / track record your expertise, qualification, involvement in contract research services, regulatory services, consulting services related to our product development, clinical testing, registration.

We may collect and use your personal data in the following situations:

Information you provide to us

We collect your personal data when you contact us, order our products and services or enter into a contract with us for the supply of goods and services, or when we request your curriculum vitae (CV) of your profile as expert. Such personal data can include:

First and last name
Gender (only if you show it in your CV or expert profile
Date of birth (only if you show it in your CV or expert profile)
Contact and address information, including address, e-mail address, phone number, fax number
Country of residence
Role and function in your organization
Your areas of expertise
Your profession and qualifications
Information on the kind of a relationship you have with Fresenius Kabi
Employer name and employer address
Contact preferences

Information we collect from other organizations

Furthermore, we process data that is provided to us by contracted service providers (incl. contract research organizations) and their subcontractors, clinical study sites and institutions, by competent authorities or obtained from publicly accessible trade registers or trade associations and other publicly available sources, including rating agencies, financial solvency and risk information and financial service agencies and institutions, government or supranational agencies, in particular tender authorities or procurement agencies, data brokers, websites, blogs and printed media.

Such personal data can include:

First and last name
Gender (only if you show it in your CV or expert profile
Date of birth (only if you show it in your CV or expert profile)
Contact and address information (including address, e-mail address, phone number, fax number)
Your company’s bank accounts
Your profession and qualifications
Professional identifiers
Organizational details, affiliation details of your company
Certifications and quality statements issued by your company’s officers, representatives or auditors
Percentage of shares held
Details related to public filings, trade registers and professional boards
Details related to published transactions of your company including tenders and financial arrangements
Previous interactions with Fresenius Kabi and any of our subsidiaries

Depending on the business contact we have with you and the purposes we collect and use your data, we process your personal data on one or more of the following legal bases:

The processing of your personal data is necessary for the performance of a contract (to be) concluded between you and us (Art. 6.1 b GDPR)
The processing of your personal data is necessary for us to comply with a legal obligation we are subject to (Art. 6.1 c GDPR). More specifically we are obliged to comply with laws on anti-money laundering, customs and export, secure supply chain requirements, product tracing requirements, statutory disclosure and notification requirements or similar compliance requirements that might require us to process certain of your personal data
The processing is necessary for purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data (Art. 6.1 f GDPR). These legitimate interests are:
- Investigate your interests for a potential business relationship and/or maintaining our business relationship with you or the company you are working
- Fulfilling our contract with the company you are working for, including the enforcement of any rights we may have under such contract
- Gather information on knowledge management related to internal processes, products and services
- Development, optimization and improvement of our products and services
- Optimization of internal communication
- Optimization of administration
- Carrying out research work
- Organizational management
- Risk Management: safeguarding against e.g., financial / reputational risks
- Maintenance of the IT infrastructure, IT security, guarantee of IT support and the detection and correction of errors
- Complying with legal requirements outside the EEA
- Establishment, exercise or defense of legal claims
You have given us your consent for the intended processing of your personal data (Art. 6.1 a GDPR)
If we process your data based on your consent, you can always withdraw your consent. You can withdraw your consent to all processing or for individual purposes of your choice. The withdrawal of consent will not affect the lawfulness of processing based on your consent before the withdrawal. You can withdraw your consent by sending an email to dataprotectionofficer@fresenius-kabi.com.

We collaborate with other organizations to achieve our purposes. Therefore, we may send your personal data in parts or as a whole to other entities.

Recipients can be:

Other Fresenius Group companies if such a transfer of personal data is required for the specific purpose (please refer to the overview of the locations in which Fresenius Kabi Group companies are active)
Service providers who process personal data on our behalf (such as storage/IT-service providers who host the data or provide maintenance services, contract research onganizations, clinical study sites / institutions / investigators, supply chain services providers) and have to follow our instructions on such processing. These service providers will not be allowed to use your personal data for other than our purposes
Authorities, ethic committees, courts, parties in a litigation, or their delegated bodies, in case we are required to do so to meet any applicable law, regulation, legal process or enforceable governmental request, such as tax and customs authorities, and financial market authorities
Professional advisors or auditors such as tax advisors, financial auditors, lawyers, insurers, banks and other external professional advisors in the countries we operate in
Professional data and analytics providers such as IQVIA, Veeva, CDQ and Acxiom
Another entity in the event of a change in ownership, a merger with, acquisition by, or sale of assets

International data transfers

We may send your personal data in parts or as a whole to Fresenius Group recipients, our service providers or other international organizations in countries, which are not member states of the European Union, for the purposes listed above. Please refer to the overview of the locations in which Fresenius Kabi Group companies are active.

We may send data to the following countries for which the European Commission has determined an adequate level of data protection to be in place that matches the level of data protection within the European Union for the following countries / international organizations in which Fresenius entities are located: Argentina, Canada, Japan, New Zealand, Switzerland, United Kingdom or Uruguay.

With regards to such international data transfers to third countries, for which the European Commission has not decided that an adequate level of data protection exists, we have provided appropriate safeguards in order to secure your personal data to a degree that equals the level of data protection in the European Union.

These safeguards are:

For the exchange of data within our company: our Binding Corporate Rules for Controllers
For the exchange of data with our service providers and other international organizations: Standard Contractual Clauses that have been issued by the European Commission

You can obtain a copy of these Standard Contractual Clauses and our Binding Corporate Rules, online, or upon request.

Generally, we store your personal data for one of the following periods of time:

As long as we have a duty to retain the data in line with applicable laws, e.g.

10 years after the end of processing activity or contract, where we are obliged to store the data for accounting and tax purposes (art. 730c, 958f Swiss Code of Obligation ("CO"));
at least 25 years after the clinical studay end (but subject tot he national law), where we, as study sponsor, are obliged to store the eTMF files of the regulatory submission dossiers and your CV or contact data are required to be conserved within such eTMF files (art. 58 Clinical Tirals Regulation (EU) 536/2014);
6 years from the last use, where the clinical records are solely subject to the U.S. Health Insurance Portability and Accountability Act (45 CFR 164.530 (j)).

If there is no legal retention applicable, at least for the term of the contractual relationship with you or the company you are working for
If we have a legitimate interest to process your personal data outside of such a contractual relationship, we process it for as long as we still have a legitimate interest in processing this data. The exact period depends on the company you are working for and your position in the company. It could be e.g.:

10 years to be able to defend or enforce our rights to the rights of Fresenius Kabi Grou (art. 60, 67, 127 CO);
30 years from the clinical study (for the CV) to be able to demontrate eligibility and qualifications of certain specialists (e.g. investigators, study site team members, third party vendors) for their roles attributed in the study (ICH CGP E6 R2);
unlimited period of time (e.g. contact data of the Key Opinion Leaders ("KOL") in the KOL database) to be able to propose to you (KOL) cooperation (e.g. Speaker Agreement, Advisory Board Agreement, Consulting Agreement). If you want your contact data to be deleted from the KOL database, please send your request to dataprotectionofficer@fresenius-kabi.com.

Data Protection Statement for Business Contacts

Data protection information for commercial prospects, clients, vendors, service providers, consultants/experts and interested business contacts

Information you provide to us

Information we collect from other organizations

International data transfers

Requirements to provide personal data

Automated decision making

Changes to this data protection statement