This data protection policy details the conditions under which Guerbet (a public limited company incorporated in the Bobigny Trade and Companies Register under number 308 491 521, and whose registered office is located at 15 Rue des Vanesses, 93420 Villepinte, France) and all its affiliates (hereinafter “we/us” or “Guerbet”), in their capacity as the data controller, carry out the processing operations described below on personal data belonging to: 

• Any person using Guerbet's websites and/or social media pages 

• Any prospect or customer of Guerbet 

• Any reporter and/or any person exposed to an adverse health event relating to Guerbet's medicinal products or medical devices  

(hereinafter “you” and/or the “data subject”).  

Guerbet processes your personal data in accordance with the principles set out in applicable personal data protection regulations, especially Regulation (EU) 2016/679 and national data protection laws (hereinafter referred to collectively as “Applicable Law”). 

In accordance with Applicable Law, the term “personal data” means any information that identifies you directly or indirectly as a natural person. Where other terms defined respectively by Applicable Law (“controller”, “processor”, “processing”, etc.) appear in this data protection policy, they will have the meanings as defined in the Applicable Law. 

 

 

1. Processing of your personal data 

 

Guerbet implements various processing operations concerning your personal data, the purposes and legal bases of which are detailed below. In accordance with Applicable Law, the personal data that we collect will only be processed for the purposes for which they were collected, and for the specified period. 

 

1 Access to Guerbet websites 

 

Sources and categories of the data processed 

When you visit Guerbet’s websites, your browser sends certain types of data to our web server: 

• IP address 

• Date and time of access 

• Time zone in relation to GMT (Greenwich Mean Time) 

• Content of the information requested (specific site) 

• Access status/http status code 

• Volume of data transferred 

• Guerbet website requesting access 

• Browser, language settings, browser version and interface 

Purposes  

Such data is sent for: 

• Technical reasons for logging personal data in the event of unauthorised access or attempted access to our servers 

• Providing you with the information that you require and/or are looking for  

Legal basis 

Processing operations are based on Guerbet’s legitimate interest.  

Storage period 

After leaving our website, your IP address will be stored for up to 90 days to detect and defend against attacks. 

 

2. Customisation and optimisation of Guerbet websites

 

Purposes 

When you visit Guerbet websites, information may be stored or retrieved from your browser in the form of files called "cookies". The information contained in these files may concern your preferences and/or your device's characteristics. They are used to enhance your browsing experience and improve the services offered by our websites.   

  

You can customise your browsing choices by either refusing or consenting to the installation of certain types of cookies. You can withdraw or change your consent at any time by clicking on the icon at the bottom left of the page. However, if you block certain types of cookies, your browsing experience and the quality of the services that we are able to provide may be affected. 

 

We make a distinction between two categories of cookies: 

• Functional cookies, without which our website could not function properly. These cookies are necessary, and their installation cannot be refused. 

• Optional cookies, which may be used to track browsing and customise the site's settings. 

Legal basis 

Processing is based on your consent for cookies to be installed on your browser. Your consent is collected via the Guerbet cookie banner when you visit our site for the first time, and your choice can be changed at any time by clicking on the pin icon at the bottom left of all the pages in our websites. 

 

Recipients, storage periods and data transfers outside the EU 

For more information, refer to the "Cookie Policy" page, which can be accessed at the bottom of the page. 

 

1. Analysis of user activity on Guerbet websites (Google Analytics) 

 

Purposes 

We use Google Analytics, a service that is provided by Google Ireland Limited (“Google”).  

 

This tool is used to analyse user interactions with our websites and improve the services that we provide using statistics and reports obtained via the tool.  

 

Sources and categories of the data processed 

Your data is collected via the Google Analytics tool only if you consent to the installation of the corresponding cookies on our website.  

 

Google Analytics collects your IP address to ensure the security of the service and provide us, as the publisher of the website, with information about the country, region or location of the user concerned. For your protection, Guerbet uses the “IP masking” function, i.e. Google shortens the last byte of IP addresses within the EU/EEA. 

 

Legal basis 

The legal basis for processing is your consent. Your consent can be withdrawn at any time using the cookie banner on Guerbet's sites, which can be found at the bottom left of Guerbet's sites (pin icon). You can also install the Google browser add-on, which can be accessed via the following link: https://tools.google.com/dlpage/gaoptout?hl=en. This module is used to disable Google Analytics on users’ browsers. 

 

Storage duration 

Your data (unless you withdraw your consent) is stored for a maximum period of 14 months.  

 

Recipients and transfers outside the EU 

Your data can be accessed by Guerbet’s Marketing and Communication departments. Google acts as a data processor, and we have entered into a data protection agreement containing standard contractual clauses with Google. Your data may be sent to a Google server in the United States. We wish to inform you that Google is part of the Data Privacy Framework as validated by the European Commission in a decision dated 10 July 2023.  

 

For more information about the scope of services provided by Google Analytics, please refer to the Terms of Service | Google Analytics – Google. Google provides information on data processing when using Google Analytics via the following link: Safeguarding your data - Analytics Help (google.com). General information on data processing, which also applies to Google Analytics, can be found in Google’s privacy policy at: Privacy Policy – Privacy & Terms – Google. 

 

 

1. Analysis of user activity on Guerbet websites (Salesforce) 

 

Purposes 

We use Account Engagement’s tracking and analysis tool provided by salesforce.com Inc., located at Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA. 

 

This tool is used to analyse user interactions with our websites and improve the services that we provide using statistics and reports obtained via the tool.  

 

Sources and categories of the data processed 

Your data is collected via the Salesforce tool only if you consent to the installation of the corresponding cookies on our website.  

 

The Salesforce tracking tool records user data, such as the IP address, the time spent on the Guerbet website, and any queries submitted.  

Legal basis, storage duration 

The legal basis for processing is your consent. Your consent can be withdrawn at any time from the cookie banner on Guerbet's sites, which can be found at the bottom left of Guerbet's sites (pin icon).  

 

Your data (unless you withdraw your consent) is stored for a maximum period of one year.  

 

Recipients and transfers outside the EU 

Your data can be accessed by Guerbet’s Sales and Marketing departments. Salesforce (provider of the tool) acts as a data processor, and we have entered into a data protection agreement containing standard contractual clauses with Salesforce. Your data is hosted on a server based in Europe. In addition, we would like to inform you that Salesforce has approved Binding Corporate Rules that ensure a level of data protection compliant with applicable law, and is a member of the Data Privacy Framework. 

 

For more information on data processing, please refer to the Salesforce.com Inc. privacy policy: Salesforce Privacy Policy. 

 

1. Integration of YouTube videos on our Website 

Purposes 

For the sole purpose of providing you with news about our activities, we have integrated YouTube videos into our online offering, which are stored on YouTube.com, a service operated by Google Inc., and can be played directly from our Website.  

No data about you as a user are sent to YouTube if you do not play the videos. The data referred to below will only be sent when you play the videos.  

YouTube stores your data as user profiles and uses it for advertising, market research and/or website design purposes as required. Such an assessment is carried out (even for users who are not logged in) with the aim of providing needs-based advertising and informing other social media users of your activities on our website. If you wish to exercise your right to object to the creation of these user profiles, we would advise you to contact YouTube. 

Legal basis 

The legal basis for playing YouTube videos is your consent to such playback. 

Sources and categories of the data processed 

By clicking on a YouTube video, your IP address and time stamp are sent to Google, whether or not you are logged into your user account.  

If you are logged into Google, your data will be assigned directly to your account. If you do not wish to be associated with your YouTube profile, you must log out before activating the button.  

Transfers outside the EU 

The information collected is stored on Google's servers, including in the United States. We wish to inform you that Google is a member of the Data Privacy Framework, and that we have also agreed on standard contractual clauses with Google with the objective of maintaining an adequate level of data protection in the third country. 

Further information about the personal data processing activities can be found in the privacy policy provided by YouTube regarding the collection and storage of your personal data, as well as the type and purpose of use by the platform at: https://policies.google.com/privacy?hl=en-GB&gl=de. You can change the settings in your Google account to limit the processing of your data. For more information, see: https://www.google.com/account/about/?hl=en  and under “Managing, reviewing, and updating your data” at https://policies.google.com/privacy?hl=en&gl=de 

 

3. Social media

 

Purposes 

To provide you with the latest news about our activities, some of our websites contain links and content generated by Guerbet to/on the following social media pages: Instagram, LinkedIn and X (formerly Twitter), acting in this context as data controllers.  

Sources and categories of the data processed 

If you create a profile, visit or interact with a profile on a social media site, your personal data may be processed by the operator in question. We would like to draw your attention to the fact that your data may be processed by operators for market research and advertising purposes. In particular, user profiles may be created based on the user’s behaviour and interests. User profiles can subsequently be used, for example, to place advertisements inside and outside social media platforms that match users' interests.  

 

For these purposes, cookies are generally stored on the users' computers, in which the user's behaviour and interests are stored. Data can also be stored in user profiles, regardless of the user's device.  

We would like to draw your attention to the fact that user data may be processed and/or transferred outside the European Union by social media operators. 

We have no influence on the type and extent of the data processed by social media platforms or the disclosure of these data to third parties. For a detailed description of the respective forms of processing and the possibilities for opting out, please refer to the data protection policies of the social media platforms:  

• Instagram:  https://www.facebook.com/help/instagram/155833707900388 

• LinkedIn: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy 

• X (formerly Twitter): https://twitter.com/en/privacy 

 

Legal basis, storage period, recipients, transfers outside the EU 

For a detailed description of the respective forms of processing and the possibilities for opting out, refer to the privacy policies and information provided by the respective network operators:  

1. Instagram 

For the purposes specified above, we use the Instagram platform, provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter referred to as Meta).  

When you visit our Instagram page, Meta collects your IP address and other information available on your PC in the form of cookies. This information is used to provide us with statistical information about the use of our Instagram page. However, it cannot be assigned to individual accounts/users. 

The data collected about you in this context will be processed by Meta and may be transferred to countries outside the European Union. Meta describes the data that it receives and how they are processed in its Privacy Policy. You will also find information on how to contact Meta and configure ads. The privacy policy is available at https://help.instagram.com/519522125107875. Note that Meta is a member of the Data Privacy Framework. 

When you are logged into Instagram, a cookie containing your Instagram ID is stored on your device. This allows Instagram to track your visits to the pages and adapt the content or advertising according to your needs. To avoid this, log out of Instagram or disable the “stay connected” function, delete the cookies and restart your browser. In doing so, your Instagram ID will not be revealed when using our Instagram page. 

For more information on how to manage your data, visit the Instagram Help Center.  To find out how to manage or delete your information, visit the Instagram Help Center at https://help.instagram.com/811572406418223/?helpref=hc_fnav  

 

1. LinkedIn 

When you visit our LinkedIn page, if you are located in the EU or EEA as well as in Switzerland, LinkedIn Ireland Unlimited Company (Ireland/EU – “LinkedIn”) located at Wilton Plaza, Wilton Place, Dublin 2, is generally the sole controller of your personal data. If you are located outside the aforementioned area, LinkedIn Corporation located at 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA is generally the sole controller of your personal data.  

When you visit, follow or interact with our LinkedIn page, LinkedIn processes personal data to provide us with statistics and information  on the types of actions that users perform on our LinkedIn page. For this purpose, LinkedIn specifically processes data that you have already provided to LinkedIn via your profile information (for example, data about your job, country, sector of activity, length of service, size of your company and professional status).  

In addition, LinkedIn will process information relating to your interactions with our LinkedIn corporate page, for example if you subscribe to our LinkedIn corporate page.  

We have entered into a joint processing agreement with LinkedIn that defines how the data protection obligations are divided between us and LinkedIn. The agreement is available at: https://legal.linkedin.com/pages-joint-controller-addendum 

With regard to this data processing activity, you can exercise your rights as a data subject (see "Your rights") with LinkedIn. Further information on this subject can be found in LinkedIn’s privacy policy at: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy and https://www.linkedin.com/help/linkedin/ask/PPQ?lang=en 

Note that in accordance with LinkedIn's privacy policy, personal data will also be processed by LinkedIn in the United States or other third countries. As such, we wish to inform you that LinkedIn is a member of the Data Privacy Framework. 

 

1. X (formerly Twitter) 

We use the X (formerly Twitter) social media platform. This platform is operated by the following entities in their capacity as data controllers (hereinafter “X”): 

• X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA for users located outside the EU/EEA/UK.  

• Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland for users located within the EU/EEA/UK. 

X processes data that you have voluntarily entered, such as your name and username, email address, phone number or contacts in your address book when you sync them. In addition, X evaluates the content that you share to determine topics of interest to you, stores and processes confidential messages that you send directly to other users, and can determine your geographic location or IP address in order to send you advertising or other content.  

When you use X, your personal information may be transferred to and/or stored in the United States, Ireland or any other country in which X operates, regardless of your country of residence. 

We have no influence over the extent of the data processed by X, the type of processing operations and use, or the disclosure of these data to third parties. We do not have any effective control options in this regard. However, we wish to inform you that X is a member of the Data Privacy Framework. 

You can restrict the processing of your data in the "general settings" of your X account and under "Confidentiality and security". In addition, on mobile devices (smartphones and tablets), you can restrict X's access to contact and calendar data, photos, location data, and so on, in the settings. However, this depends on the operating system used. 

 

Further information about the data processed by X and the purposes for which they are used can be found in X’s Privacy Policy at https://twitter.com/en/privacy 

 

More information is available on the following Twitter support page:  

https://help.twitter.com/en/privacy#Rules-and-policies 

 

Information about personalisation and data protection settings can be found here: https://help.twitter.com/en/personalization-data-settings 

 

1. Processing of user data via our social media pages 

 

Purposes 

We process the information that you have provided via our corporate pages, which are accessible on our social media pages for the purpose of responding to your request. 

Sources and categories of the data processed 

This information may include data that you have provided to the relevant social media site, such as the username, the contact details or the content of the message sent to us. For the sole purpose of processing your request, we may collect additional personal data about you. If applicable, these data is collected from you directly. 

Legal basis, storage duration 

The legal basis for this processing operation is Guerbet’s legitimate interest in responding to your request. 

The deletion of your data on the different social media channels depends on each provider. If we use your data for other purposes, such as taking part in an event, we will inform you separately.  

 

4. Promotional information and direct marketing

 

Purposes 

If you are a Guerbet customer or prospective customer, your personal data may be processed by Guerbet for the purpose of sending you electronic or telephone communications. 

Our communication campaigns cover the following topics: 

• Institutional, educational, promotional, medical or scientific communications relating to our products and services. 

• Invitations and/or information relating to events organised or sponsored by Guerbet, such as congresses, webinars and educational events. 

• Invitations to participate in surveys. 

 

Legal basis 

The legal basis for processing is your consent, collected via our contact, registration or event participation forms. Where applicable, an information notice on how your data is processed by Guerbet is provided separately. 

In the event that your data is collected by a third party and transmitted to Guerbet, the data will be under its responsibility. 

 

Sources and categories of the data processed 

Your data may be collected: 

• Directly from you (when we are in direct contact with you), or via our direct marketing tool. The receipt, rejection and opening rates of each email, as well as click-through rates on available links, can be measured using our direct marketing tool. 

• indirectly from third-party sites or sources, such as professional event organisers. 

 

These may include: 

• Your surname and first name 

• Your profession (including your speciality if you are a healthcare professional) 

• The name of your organisation and the postal and email addresses used for business purposes 

• Your telephone numbers 

 

We invite you to provide us with the postal, telephone and electronic contact details that you use for business purposes and to inform us if your contact details have changed. 

 

Storage duration 

Your data is stored for the period during which you carry out your professional activity or until you object to their processing. 

You can withdraw your consent at any time by using the "Unsubscribe" link in the footer of emails sent by Guerbet.  

 

Recipients and transfers outside the EU 

Your personal data can be accessed by Guerbet’s Communication and Commercial Excellence departments, by other Guerbet entities, as well as by our customer-prospect relationship management tool provider (Salesforce) for sending communications by email. We have entered into a data protection agreement with Salesforce, which is acting here as a data processor. Your data stored on our customer-prospect relationship management tool is hosted in Europe. 

Your data in electronic format (emails and contact forms) are hosted on Guerbet’s IT servers located in the European Union.  

 

5. Management of customer-supplier relations

 

Purposes 

Your personal data may be processed by Guerbet for the purpose of managing your business relationship with Guerbet: 

• Management (tracking, delivery and payment) of your order for medicinal products, medical devices and other goods and services marketed by Guerbet.  

• Management (tracking, delivery and payment) of a Guerbet order for goods and/or services from you.  

This applies if you are a: 

• Supplier of Guerbet, and that on this occasion, you have provided your personal data. 

• Customer of Guerbet, as a natural person.  

 

Legal basis 

The legal basis for processing is the performance of a contract. 

Sources and categories of the data processed 

Your data is collected directly from you and are limited to the purpose of managing your order. These may include: 

• Your surname and first name 

• Your delivery and invoicing addresses 

• Your bank details 

Recipients and transfers outside the EU  

Your data is only accessible to authorised Guerbet departments (sales, accounting, logistics, etc.), as well as to our customer billing management tool provider. Your data is hosted in the European Union. 

 

6. Management of adverse health events

 

Purposes 

Your personal data may be processed by Guerbet for pharmacovigilance and medical device vigilance purposes, i.e. for monitoring adverse health events occurring with one of our medicines or medical devices. An adverse health event may be an adverse effect or a special situation (e.g. off-label use, medication error, exposure during breastfeeding, etc.). 

This applies to you if, for any of our medicines or devices:  

• You report an adverse health event (you are the “notifier”)  

• You have an adverse health event (you are the “person exposed”)  

• You are a healthcare professional who can provide additional useful information  

• You mention an adverse health event (in a scientific publication, during a market research study, on a blog or forum, etc.) 

This section does not apply to pharmacovigilance in clinical trials.  

Legal basis  

Processing is necessary for compliance with a legal obligation. 

Categories of data processed  

For each case of adverse health event that we receive, we may collect the following data relating to the person exposed:  

• Initials or identification number (code) 

• Identifying information (age or age group, year or date of birth, gender, weight, height) 

• Health data such as treatments administered, test results, nature of side effects, personal or family history, related diseases or events, risk factors 

• Data relating to professional life, life habits and behaviours, lifestyle, genetic data, sex life, ethnic origin 

Only adequate, relevant and limited data relating to the analysis of the adverse health event are collected.  

In addition, to monitor the health vigilance case, we may collect from the notifier his/her surname and first name, postal and email address and his/her position, if he/she is a healthcare professional.  

Data source  

Your data may be collected: 

• Directly from you, when you are the person exposed  

• Indirectly, from the notifiers and/or service providers responsible for carrying out surveys or market research, when you are a healthcare professional or a patient participating in such studies or surveys and you report an adverse health event in this context. 

Finally, we are required to collect adverse effects that may be published in the literature or mentioned on a website or online application managed by Guerbet. 

Recipients and transfers outside the EU  

Your data is accessible to the departments of Guerbet and other entities of the Guerbet Group in charge of health vigilance, to related service providers acting on behalf of Guerbet for the provision of a centralised health vigilance database or for the management of notifications, to healthcare professionals able to provide useful additional information, and to health authorities.  

Some data may also be sent to Guerbet departments in charge of medical information if your notification is associated with a medical information request, or quality assurance if your notification is associated with a quality complaint or in case of a quality audit. 

When the notification concerns a Guerbet affiliate or subcontractor, the notification is recorded by Guerbet and transmitted to the entity concerned.  

As part of the management of health vigilance cases, the transfer of your data between Guerbet and its subsidiaries, whether or not located outside the European Union, is governed by a specific agreement.  

Your data is hosted in Europe. 

 

Storage duration  

Your data will be stored for a maximum period of 70 years following the end of the marketing authorisation for the medicinal product or medical device associated with the notification of the health vigilance case.  

 

7. Management of requests for scientific information

 

Purposes  

Your personal data may be processed by Guerbet for medical information purposes, i.e. to respond to medical (or pharmaceutical) requests or questions relating to the use of Guerbet products.  

Legal basis  

Processing is necessary for compliance with a legal obligation binding on Guerbet. 

Data processed 

When you send a question or request for medical information, we process your full identity (surname, first name), your profession or speciality (only for healthcare professionals) and your contact details.  

If your request contains information related to vigilance or quality complaints that could be associated with Guerbet products, the relevant departments may need to request additional information. Only data that are adequate, relevant and limited in relation to the analysis and evaluation of vigilance data or quality complaints are collected. For more information, please refer to the section on personal data processed for vigilance purposes and quality complaints (I-6. Management of adverse health events). 

Data source  

We collect at the time of the medical information request: 

• Data personally relating to the applicant. 

• Data relating to the person exposed to the adverse health event associated with a Guerbet product or a quality complaint if applicable.  

• Data relating to any professional who may provide additional useful information, if we do not have all the information necessary to analyse the adverse health event or quality complaint if applicable. 

• Data relating to the authors of publications when the request refers to vigilance information associated with a Guerbet product reported in the literature. 

Finally, we are also required to collect the data on a website or online application managed by Guerbet, if these data is associated with a medical information request.  

Storage duration  

Your data processed as part of medical information requests will be stored for up to 10 years.  

For data relating to vigilance or quality complaints associated with medical information requests, please refer to the corresponding section (I-4. Management of adverse health events). 

Recipients and transfers outside the EU  

Your data is accessible to the relevant Guerbet medical information departments or their representatives (service providers acting on behalf of Guerbet) involved in the management and follow-up of medical information requests.  

Certain types of data may be sent to Guerbet’s departments in charge of pharmacovigilance, medical device vigilance or quality assurance if your notification is associated with an adverse effect, a particular pharmacovigilance situation, an incident or risk of an incident that could be related to a Guerbet product.  

As part of the management of medical information requests, the transfer of your data between Guerbet and its subsidiaries, whether or not located outside the European Union, is governed by a specific agreement.  

Your data in electronic format is hosted on Guerbet’s IT servers located in Europe.  

 

1. Data transfers outside the European Union 

Your personal data collected and processed for the purposes described above may be transferred to Guerbet subsidiaries and/or third party companies located in countries outside the European Union. 

In the event that your data is transferred to third countries, Guerbet ensures that the transfer of your data is regulated so that your data continue to benefit from an appropriate level of protection by one of the following means:  

➢ The receiving country provides an adequate level of personal data protection by decision of the European Commission 

➢ The transfer is governed by signing the standard contractual clauses approved by the European Commission 

➢ The transfer is governed by a Safety Data Exchange Agreement (Sections I.6 and I.7) 

 

1. Your rights  

With regard to your personal data, and depending on the legal basis of the processing operation in question, you have the following rights. 

• Right of access: you can request access to your personal data that we collect and process. If you make a request for access, we will provide you with a copy of your personal data that are in our possession as well as all legally required information. 

• Right to object: you may object at any time, for reasons relating to your particular situation, to the processing of your personal data when it is based on our legitimate interest, unless our legitimate interest prevails over your own interests, rights and freedoms, or processing is necessary for establishing, exercising or defending legal claims. You may also, at any time, object to the processing of your personal data by us when processing is carried out for marketing purposes by electronic or postal means. 

• Right to rectification: you can ask us to rectify any inaccurate or incomplete personal data about you at any time. 

• Right to erasure: you may request the erasure of your personal data under the conditions provided for by Applicable Law, unless such data must be retained to enable us to comply with legal obligations, or to enable us to exercise or defend our rights, or where necessary for the performance of the contract binding us. 

• Right to restriction of processing: you may request the restriction of processing of your personal data under the conditions provided for by Applicable Law. 

You can also withdraw your consent at any time, in cases where it has been requested. 

To exercise your rights, you can send an email to dataprotection.officer(at)guerbet.com specifying: 

• The right that you wish to exercise 

• The personal data concerned by your request  

If you feel, after contacting us in this regard, that your rights relating to your personal data is not being respected, you can lodge a complaint with the competent data protection authorities. 

 

1. Change to our privacy policy 

We may occasionally update our privacy policy. Updates will be posted on our websites.  

Therefore, we recommend that you visit our websites regularly to keep you informed of any updates. 

 

Last updated: November 2024