This privacy notice (the “Privacy Notice”) describes how BioArctic AB, corp. reg. no. 556601-2679, Warfvinges väg 35, SE-112 51 Stockholm, Sweden (“BioArctic” “us” or “we “), in its role as Data Controller, processes personal data about you in your capacity as a representative of a company that is either a current business partner (including customers and suppliers), or a potential future business partner of BioArctic. Additionally, BioArctic collects data from individuals who visit our websites, those involved in recruiting processes, and individuals who register on our social media platforms or sign up to receive our newsletters, press releases, or financial reports. We also collect personal data from healthcare professionals who assist us in medical studies or collaborations, and from those who request medical information, report complaints, or submit adverse events and other safety-related incidents related to a product marketed by or on behalf of BioArctic.
BioArctic has appointed a Data Protection Officer (DPO), whose role includes monitoring that the company’s processing of personal data complies with applicable laws and regulations. If you wish to contact the DPO, the easiest way is via e-mail at dpo@bioarctic.com.
What categories of personal data are collected?
BioArctic collects the following categories of personal data:
- Financial information – this includes details about your or your organization’s bank account number, related bank information, and details necessary for making or receiving payments as well as issuing invoices.
- Device information – such as your IP address, cookies or similar data.
- HCP information – data related to you in your role as a healthcare professional (HCP), such as your employer’s name and address, your position or title, and related details.
- Contact details – this includes your name, job title, postal address, e-mail address, telephone number, and similar information.
- Medical information – data related to medical inquiries, complaints, or reports of side effects you may submit.
- Recruitment data – data collected during a recruitment process, such as your CV and the contact details of your references.
- Social media activities – information about your interactions with us on social media platforms.
- Social media data – data that we can infer from your settings on social media such as your name, age, location, and similar details.
- Specific data – in certain cases, we collect data specific to a particular processing operation, which will be indicated in the relevant context.
Our processing of your personal data
BioArctic collects and stores the information needed to contact you in your capacity as a business representative. This information may be provided directly by you or by the company that you represent. The categories of personal data we collect and process, the purpose of the processing, the legal basis for the processing and the retention periods are set forth in the table below.
| Category of personal data | Purpose | Legal basis |
| Contact details
|
To enable communication with the company’s representative regarding matters such as deliveries. | The processing is necessary to fulfill the contract with the customer, i.e. the company you represent. |
| Retention period | ||
|
|
BioArctic will retain your personal data for this purpose as long as a contractual relation exists between the parties. | |
| Contact details
Economic data |
To fulfill statutory obligations, such as security requirements or accounting regulations.
|
The processing is necessary for BioArctic to comply with its legal obligations, such as the Swedish Accounting Act (1999:1078). |
| Retention period | ||
|
|
BioArctic will retain your personal data for this purpose for as long as it is a legally required. For example, invoice information must be retained for seven years according to the Swedish Accounting Act (1999:1078). | |
| Contact details
|
To enable marketing and customer analysis.
|
The processing is necessary for BioArctic’s legitimate interest in marketing its products/services to the company you represent. |
| Retention period | ||
|
|
BioArctic will retain your personal data for this purpose as long as there is a contractual relationship between the parties and for an additional 36 months thereafter. |
If we identify the company you represent as a potential customer, partner or investor of BioArctic, we may collect information about you in your capacity as a company representative. This information may be gathered from public or official sources, such as your company’s website or the official records of the Swedish Companies Registration Office. The categories of personal data we collect and process, the purposes of the processing of personal data, the legal basis for such processing, and the retention periods are set forth in the table below.
| Category of personal data | Purpose | Legal basis |
| Contact details | To enable marketing and communication with a representative of the potential customer/partner. | The processing is necessary for BioArctic’s legitimate interest in marketing its products/services to the company that you represent and to initiate contact between BioArctic and the potential customer/partner through the company representative. |
| Retention period | ||
|
|
BioArctic will retain your personal data for this purpose for a maximum of 12 months after it was collected. |
BioArctic collects and stores the information needed to contact you in your capacity as a business representative of a company we cooperate with. This information may be provided directly by you or by the company you represent when entering into a co-operation with BioArctic. The categories of personal data we collect and process, the purpose of the processing, the legal basis for such processing and the retention times are set forth in the table below.
| Category of personal data | Purpose | Legal basis |
| Contact details | To facilitate communication between BioArctic and the cooperation partner’s representative regarding their business cooperation.
|
The processing is necessary to fulfill the contract with the cooperation partner, i.e. the company that you represent. |
| Retention period | ||
|
|
BioArctic will retain your personal data for this purpose as long as a contractual relationship exists with the cooperation partner. | |
| Contact details | To fulfill statutory obligations, such as security requirements.
|
The processing is necessary for BioArctic to fulfill its legal obligations. |
| Retention period | ||
|
|
BioArctic will retain your personal data for this purpose for as long as legally required. |
When you visit our website, BioArctic collects information necessary to improve, streamline, simplify and develop the website. The categories of personal data we collect about you, the purposes for processing, the legal basis for each processing activity and the retention period are set forth in the table below.
| Category of personal data | Purpose | Legal basis |
| Device information | To develop and improve our website (http://www.bioarctic.com) and adapt it based on user behaviour.
|
The processing is necessary for BioArctic’s legitimate interest to improve, stream, simplify, and develop its website, as well as attract and retain customers and partners. |
| Retention period | ||
|
|
BioArctic will retain your personal data for this purpose in accordance with the duration specified for each cookie or similar technology. For more information on this, please see BioArctic’s Cookie Policy. |
BioArctic processes the data you provide when using platforms such as Facebook, Instagram, Threads, X (formerly Twitter) and YouTube. We handle personal data by reading, replying to, hiding and occasionally deleting comments and posts on these platforms. The categories of personal data we collect, the purposes for processing, the legal basis for each processing activity, and the retention periods are set forth in the table below.
| Category of personal data | Purpose | Legal basis | ||
| Social media tasks | Interaction, information sharing, and accessibility for the interested public. | The processing is necessary to enable interaction with individuals on social media where BioArctic has accounts. | ||
| Retention period
BioArctic will retain your personal data for this purpose for a maximum of 12 months after it is collected. |
||||
| Category of personal data | Purpose | Legal basis | ||
| Social media tasks
Social media activities |
Enable marketing and customer analysis.
|
The processing is necessary for the purposes of BioArctic’s legitimate interest in marketing its products and services to persons interested in its activities | ||
| Retention period
BioArctic will retain your personal data for this purpose for a maximum of 12 months after it is collected. |
||||
BioArctic collects information about you, either directly from you or from third parties, to identify and recruit suitable candidates for positions with BioArctic. The categories of personal data we collect, the purposes for processing, the legal basis for each processing activity and the retention period are set forth in the table below.
| Category of personal data | Purpose | Legal basis |
| Contact details
Recruitment data |
To select the most suitable candidate for a position and to verify that the candidate has the required qualifications.
|
The processing is necessary for BioArctic’s legitimate interest in hiring qualified personnel and ensuring that only employees with relevant skills work for BioArctic. |
| Retention period | ||
|
|
BioArctic will retain your personal data for the duration of the recruitment process and for an additional 24 months after its completion to address potential legal claims, such as discrimination or similar proceedings. |
BioArctic collects information necessary to send you newsletters, press releases, and financial reports. The categories of personal data we collect, the purposes for processing, the legal basis for each processing activity and the retention periods are forth in the table below.
| Category of personal data | Purpose | Legal basis |
| Contact details
|
To send you our newsletters.
|
The processing is based on your consent. Please note that you may withdraw your consent at any time.
|
| Retention period | ||
|
|
BioArctic will retain your personal data for this purpose as long as we have your consent. | |
| Contact details | To send you our press releases and financial reports. | The processing is necessary for BioArctic’s legitimate interest in informing you about the development of BioArctic and its products/services. |
| Retention period | ||
|
|
BioArctic will retain your personal data for this purpose either as long as you interact with us or for a maximum of 12 months after the data was collected. |
When reporting adverse reactions and other safety-related events, information about you may be provided directly by you, either as the reporter of the suspected adverse reaction/event and/or as the patient who experienced it. The categories of personal data we collect, the purposes for processing, the legal basis for each processing activity and the retention periods are set forth in the table below.
| Category of personal data | Purpose | Legal basis |
| Contact details
Medical information
|
To respond to your request for medical information.
|
The processing is necessary for BioArctic’s legitimate interest in responding to medical information requests.
|
| Retention period | ||
|
|
BioArctic will retain your personal data for this purpose for a maximum of 24 months after it is collected. | |
| Category of personal data | Purpose | Legal basis |
| Contact details
Information related to your complaint/grievance. |
To investigate your complaint/grievance and keep you updated on the investigation. | The processing is necessary to fulfill BioArctic’s legal obligations to address and evaluate any quality issues. |
| Retention period | ||
|
|
BioArctic will retain your personal data for this purpose for as long as there is a legal requirement to do so. | |
| Category of personal data | Purpose | Legal basis |
| Contact details
Details of the adverse reaction/event related to the reported product Information about you or the person who experienced the side effect/event including age, gender and health status. |
To detect, understand, evaluate and prevent side effects and other safety-related issues with medicines. | The processing is necessary to fulfill BioArctic’s legal obligations to monitor and report adverse events. |
| Retention period | ||
|
|
BioArctic will retain your personal data for this purpose as long as there is a legal requirement to do so. |
BioArctic collects information about you as a healthcare professional (HCP) when conducting medical studies or other types of medical collaborations, such as in-depth interviews related to our products or research areas. We may also use your information to ensure that neither we nor our partners contact you unnecessarily.
The categories of personal data we collect, the purposes for processing this data and the legal basis for each processing activity are set forth in the table below.
| Category of personal data | Purpose | Legal basis | ||
| Contact details
HCP information |
To conduct medical studies | The processing is necessary for the legitimate interests of BioArctic in conducting the study. | ||
| Retention period
BioArctic will retain personal data for this purpose for the duration of the study. |
||||
| Category of personal data | Purpose | Legal basis | ||
| Contact details
HCP information
|
To conduct studies related to medical trials or BioArctic’s products
|
The processing is necessary for the legitimate interest of BioArctic to conduct the medical trial or study its products. | ||
| Retention period
BioArctic will retain personal data for this purpose for the duration of the study. |
||||
| Category of personal data | Purpose | Legal basis | ||
| Contact details
HCP information |
To fulfill regulatory requirements, such as demonstrating study accuracy or meeting safety requirements. | The processing is necessary for the fulfillment of BioArctic’s legal obligations. | ||
| Retention period
BioArctic will retain your personal data for this purpose as long as it is legally required.
|
||||
| Category of personal data | Purpose | Legal basis | ||
| Contact details
HCP information |
To comply with industry practices, such as publishing value transfers in accordance with the EFPIA Code of Ethics. | The processing is necessary for the legitimate interest of the Company to comply with industry standards. | ||
| Retention period
BioArctic will retain personal data for this purpose for three years after publication. |
||||
| Category of personal data | Purpose | Legal basis | ||
| Contact details
HCP information Any information on what we have discussed and concluded during our interactions |
To ensure that communication concerning a study/collaboration is carried out in the best possible way. | The processing is necessary for the legitimate interest of the Company to communicate about a study or a collaboration. | ||
| Retention period
BioArctic will retain your personal data for this purpose for the duration of the study or co-operation. |
||||
| Category of personal data | Purpose | Legal basis | ||
| Contact details
HCP information Food preferences |
To be able to ensure that your dietary preferences can be accommodated at our trainings/events | The processing is necessary for the legitimate interest of the Company to ensure that your preferences are met when organising a training/event. | ||
| Retention period
BioArctic will retain personal data for this purpose until the training/event is completed. |
||||
Who do we share your personal data with?
We may disclose personal data to a third party as set forth in the table below.
| Third party | Reason to disclose personal data to third party |
| Cloud service provider | The company stores its information in a cloud service, Your personal data may therefore be disclosed to the provider of the cloud service. |
| Marketing authorisation holders | Personal data may be transferred to the company that holds the marketing authorisation for the product that you have reported adverse reactions to and/or other safety-related issues when required to comply with legal obligations. |
| Authorities | Personal data may be transferred to public authorities where necessary to fulfill legal obligations. |
| Trade/industry association | Personal data may be transferred to a trade association for the purpose of complying with the ethical rules of the relevant market. |
Transfer of personal data to third countries
BioArctic strives to process your personal data within the European Union (EU) or the European Economic Area (EEA). Except for the situations described below, BioArctic will not transfer your personal data to any country outside of the EU/EEA. If personal data is transferred to any country outside of the EU/EEA, BioArctic will ensure that such data is stored and handled in a secure manner. Furthermore, BioArctic will comply will all requirements that apply to transfers of personal data to countries outside of the EU/EEA pursuant to the applicable data protection legislation.
BioArctic does not disclose personal data to third parties, except as described in this Privacy Notice or when it is required by law or in order for BioArctic to fulfill the commitments to you as a customer or business partner of BioArctic. Your personal data will not be transferred or sold to any third party for marketing purposes.
BioArctic uses Amazon Web Services to store data on servers in Ireland. Through the Company’s use of Amazon Web Services, your personal data may be transferred to the United States. The personal data that BioArctic collects about you through your use of BioArctic’s website may be transferred to Google in the United States, through Google Analytics. BioArctic has ensured that your rights are guaranteed when transferring to the United States through Google’s and Amazon Web Services’ adherence to the EU-US Data Privacy Framework. More information is available at www.dataprivacyframework.gov.
Your rights
As a data subject, you have the right to exercise your rights under the General Data Protection Regulation in certain situations. You will find these rights and instructions on how to exercise them below.
You have the right to withdraw your consent for a specific processing operation at any time, free of charge, without affecting the lawfulness of processing prior to the withdrawal. To withdraw your consent, sending an email request to dpo@bioarctic.com.
You have the right to request that the processing of your personal data be restricted to storage only in certain cases, such as when the accuracy of data is disputed, the processing is unlawful, or the data is no longer needed but required for legal claims. You can also request restrictions if you object to processing, pending verification. In these cases, your data will only be processed with your consent, for legal claims, or for public interest. You will be informed before the restriction is lifted. For example, you can unsubscribe from newsletters and other mailings by following a link in these communications or by sending a request to dpo@bioarctic.com.
You can at any time object to the processing of personal data that the Company bases on its legitimate interest. You may at any time also object to the processing of your personal data for marketing purposes. If you wish to object to this processing, please send an email to dpo@bioarctic.com.
You have the right to request confirmation from the Company about whether your personal data is being processed. If so, you can access the data and receive details such as the purpose of processing, categories of data, recipients, storage period, your rights to rectification or erasure, and the right to lodge a complaint. If applicable, you will also be informed about the source of your data and any automated decision-making involved. The information can be provided to you in an electronic or a paper format. The Company will compile information on how your personal data is processed and send it to you, typically within one month. You can do this by sending an email to dpo@bioarctic.com.
You have the right to request that the Company correct any personal data you believe to be inaccurate, and, in specific cases, to provide additional personal data if you believe that the data processed by the Company is incomplete or has misrepresented you. You can make this request by sending an email to dpo@bioarctic.com.
You have the right to request that the Company transfer your personal data from our systems to another entity including directly to you or another company, in a structured, commonly used, and machine-readable format., Please contact us via email at dpo@bioarctic.com to make this request. Please note that this right does not apply to data that we are required by law to retain.
You have the right to request that the Company erase your personal data without undue delay. We will delete personal data that is no longer necessary for the purposes it was collected or processed. However, we may retain personal data where required for legal obligations or continue processing it in cases such as when necessary to fulfill a contract with you or to comply with other legal grounds. You can make this request by sending an email to dpo@bioarctic.com.
If you believe BioArctic has acted incorrectly or is not complying with this Privacy Notice, please send an email to dpo@bioarctic.com. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten. For more information, visit the authority’s website www.imy.se.
Protection of your personal data
You should always feel secure when you provide your personal data to us. We have implemented a wide range of security measures to protect your personal data against unauthorized access, modification and deletion. We will not disclose your personal data to anyone else other than what is set out in this Privacy Notice.
Cookies
BioArctic uses cookies and similar techniques to provide certain functions at the website www.bioarctic.com,to improve our website and to deliver a better and more personal service to its website visitors. The information is stored as a file containing encrypted login- data. BioArctic uses cookies in accordance with BioArctic’s cookie policy, available at https://www.bioarctic.com/en/about-the-website/cookies/
Changes to this privacy notice
BioArctic reserves the right to amend this Privacy Notice at any time. If the amendments are substantial, BioArctic will send the amended Privacy Policy to your
e- mail, and if BioArctic does not have your e-mail, BioArctic will send it to you by other means (if possible).
Contact information
Do not hesitate to contact us if you have any questions regarding this Privacy Policy, our use of your personal data or if you want to exercise any of your rights according to this Privacy Notice.
BioArctic’s contact information:
BioArctic AB
Company reg. number: 556601-2679
Postal address: Warfvinges väg 35, SE-112 51 Stockholm, Sweden
Phone number: +468-6956930
Data Protection Officer: dpo@bioarctic.com