Privacy Policy

1. Who we are and how you can contact us

“UCB” or “we” means UCB Biopharma SRL, a Belgian company with registered office at 60, Allée de la recherche, 1070 Anderlecht.

As data controller we respect your right to privacy. We will only process your personal data as described in this Policy and in accordance with the relevant data protection legislation, including the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or “GDPR”).

At UCB we have a data protection officer (DPO), who can be contacted by any of the following means for any privacy-related questions, including regarding how we collect, store and use your personal data:

Customer data / Personal information

In 2019, no substantiated customer data privacy complaints were identified through internal monitoring and audit activities.

Several data breaches were notified by UCB as data controller to the Belgian Data Protection Authority, as required by the article 33 of the GDPR. However, none of the incidents involving personal data reported to the supervisory authority resulted in high risk to the rights and freedoms of the data subjects concerned.

Binding Corporate Rules

To complement the UCB data privacy policy, UCB has adopted binding corporate rules (BCRs), a mechanism provided by EU law governing international transfers of personal data across all affiliates.

You will find below a summary and a full version of UCB's BCRs.

• Summary August- 2018
• Full version January- 2021

2. The reason behind this Privacy Policy

The UCB.com Privacy Policy (the “Policy”) governs the collection, use and retention by UCB of personal data relating to your use of the UCB.com website (the “Website”).

This Policy applies to all Website users. In addition, more specific terms apply to different groups of users, such as e.g. healthcare professionals (HCPs) and patients. Please be sure to also read the specific terms relating to your Website user profile.

This Policy does not govern the collection nor processing of personal data from job candidates through Careers.ucb.com.

For more information on how UCB processes personal data through Careers.ucb.com, we refer to the privacy policy for that web-portal.

The Policy consists of five main components and informs you about: 

1. Who we are and how you can contact us;

2. The reason behind this Policy;
3. The purposes for which we process your personal data and the related legal basis under the General Data Protection Regulation (GDPR);
4. What your rights are in relation to the personal data we hold about you and how you can exercise them; and
5. Further details on how we process (including share and retain) your personal data.

This Policy may be updated periodically to reflect changes in our personal data processing practices. In that case we will post a notice on the Website to inform you of any significant changes.

3. THE PURPOSES FOR WHICH WE PROCESS YOUR PERSONAL DATA AND APPLICABLE LEGAL BASIS

3.A. Purposes that apply to all Website users and related legal basis for processing:/span>

UCB collects and processes your personal data through the Website for the purposes mentioned below.

At the end of each purpose you will also find the legal basis for processing, required under GDPR, such as processing needed for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, processing needed as per our legal obligations, processing in the pursuit of UCB’s legitimate interests or processing based on your consent, etc.

i. To make the Website and its content available to you; Processing necessary for performance of a contract

ii. To respond to your online queries and to provide you with services you may request, such as for instance subscription to our press releases and/or UCB Stories; Processing necessary for performance of a contract

iii. To handle or respond to any comments you submit to us in relation to content or articles (e.g. UCB Stories) featured on the Website; Processing necessary for performance of a contract + processing based on your consent for those comments that would subsequently be posted online by UCB;

iv. To allow UCB to comply with applicable laws and regulations, including but not limited to pharmacovigilance (e.g adverse event reporting) related legislation and industry guidelines; Processing as per our legal obligations. For more information on the processing of personal data by UCB within the framework of adverse event reporting, please check UCB’s Patient Safety Reporting Privacy Notice;

v. To support Website functionality: we use cookies to support and improve Website functionality and to better understand usage patterns relating to our Website, including by retaining and evaluating information on recent use you made of our Website and how you access different features of our Website for analytics purposes so that we can make the Website more intuitive; Processing necessary for the purpose of the legitimate interests pursued by UCB (for certain session and functional cookies) to conduct its business and to further improve upon its product and service offering. To this end, UCB strives to maintain a fair balance between our need to process your personal data and the preservation of your rights and freedoms, including the protection of your privacy. For more information or if you have any questions regarding how we assess this balance, please contact us through any one of the channels set out above under section 1 “Who we are and how you can contact us. + Processing based on your consent (for analytics and tracking cookies) For more information, please check our Cookie Policy, accessible here.

vi. To maintain Website security: we deploy log files to monitor access to and traffic on the Website in order to detect and prevent malicious activity or invalid traffic; Processing necessary for the purpose of the legitimate interests pursued by UCB to maintain the security of its business. For more information or if you have any questions regarding how we assess this balance between our legitimate interest, please contact us through any one of the channels set out above under section 1 “Who we are and how you can contact us”. For more information, please check our Cookie Policy, accessible here.
close

3.B. Purposes that apply to HCP’s only and related legal basis for processing:

In addition to the more general purposes set out in section 3.A above and which apply to all Website users, UCB collects and processes personal data from HCP’s through the Website for the following purposes:

i. To allow HCPs to create and manage a log-in on our Website; Processing necessary for performance of a contract

ii. To allow HCPs to access and receive content intended for HCPs only (e.g. scientific webinars); Processing necessary for performance of a contract.

4. YOUR RIGHTS AND HOW YOU CAN EXERCISE THEM

4.A. Your rights

Right of access

You have the right to obtain confirmation from us as to whether or not we process personal data about you, and where this is the case, access to your personal data.

You have the right (as far as this does not adversely affects the rights and freedoms of others) to obtain a copy of your personal data from us. For more information on how to exercise this right, please check section 3.B “How to exercise your rights”.

Right to rectification

You have the right to ask us to rectify without undue delay any inaccurate personal data concerning you.

You can also ask us to complete incomplete personal data regarding you by providing us with a supplementary statement containing such additional information. For more information on how to exercise this right, please check section 4.B “How to exercise your rights”.

Right to erasure

You have the right to ask us to erase without undue delay personal data concerning you, where one of the following grounds apply:

• Your personal data are no longer necessary in relation to the purposes for which they were processed;
• You have withdrawn your consent - for those processing activities based on your consent – and we have no other legal ground for such processing;
• You object to the processing of your personal data (for more information on the right to object, see further below) and there are no overriding legitimate grounds for such processing;
• Your personal data have been unlawfully processed;
• Your personal data must be erased for compliance with a European or European Member State legal obligation to which UCB is subject.

Please note that your right to erasure will not apply to the extent that processing is necessary for:

• exercising the right of freedom of expression and information;
• compliance with a European or European Member State Law to which UCB is subject;
• reasons of public interest in the area of public health in accordance with article 9(2)(h) and (i) GDPR as well as article 9(3) GDPR;
• archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with the relevant provisions of the GDPR;
• the establishment, exercise or defense of legal claims.

For more information on how to exercise this right, please check section 4.B “How to exercise your rights”.

Right to restriction on processing

You have the right to obtain from UCB restriction of processing by UCB of your personal data where one of the following applies:

• You contest - in good faith - the accuracy of personal data regarding you and held by us, in that case the restriction of processing will apply for a period enabling us to verify the accuracy of your personal data;
• The processing is unlawful and you oppose the erasure of your personal data and request restriction of their use instead;
• We no longer need your personal data, but you require them for the establishment, exercise or defense of legal claims;
• You have objected to the processing of your personal data by UCB in accordance with the relevant GDPR provision, in that case the restriction of processing will apply for a period enabling us to verify if our legitimate grounds override yours.

Please note that notwithstanding the above, we are still allowed to continue storing your personal data (throughout the period of restriction) or to process your personal data for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person.

If you have requested restriction of processing, we will inform you before the restriction of processing is lifted. For more information on how to exercise this right, please check section 4.B “How to exercise your rights”.

Right to data portability

You have the right (insofar this does not adversely affects the rights and freedoms of others) to receive the personal data concerning you, that you have provided to UCB, in a structured, commonly used and machine-readable format and to transmit those data to another controller, without hindrance from UCB, where the processing is:

• based on your consent or on a contract; and
• carried out by automated means

For more information on how to exercise this right, please check section 4.B “How to exercise your rights”.

Right to objection to processing

You have the right to object at any time, on grounds relating to your specific situation, to the processing of your personal data by UCB which is based on UCB’s pursuit of its legitimate interests as a controller. In that case UCB will no longer process your personal data, unless:

• UCB demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms; or
• For the establishment, exercise or defense of legal claims.

You have the right to object at any time to the processing of your personal data for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing. If you sign up to any of our alerts or newsletters, you will also have the opportunity to directly un-subscribe from this service by clicking on the unsubscribe link in the relevant alert or newsletter.

For more information on how to exercise this right, please check section 4.B “How to exercise your rights”.

Right to withdraw consent

Where the processing is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on your consent before its withdrawal. For more information on how to exercise this right, please check section 4.B “How to exercise your rights”.

4.B. How to exercise your rights

If you wish to exercise any of the rights mentioned above, please contact UCB’s Data Protection Officer by e-mail at dataprivacy@ucb.com or otherwise reach out to us by postal mail at UCB S.A., to the attention of the Data Protection Officer, Allée de la Recherche 60, BE - 1070 Brussels. Please clearly identify the right(s) you wish to exercise and include your contact details (including a valid e-mail or postal address) so that we can respond to your request. Please note that you may be asked to provide proof of your identity so that we are able to verify it indeed regards you.

When you contact us to exercise any of the rights mentioned above, we will respond to your request within one month following receipt of the request. This period may be extended by two additional months where necessary, but in that case we will inform you of any such extension within one month of receipt of your initial request together with the reasons for the delay.

Right to lodge a complaint with supervisory authority

In accordance with article 77 GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the European Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that UCB’s processing of your personal data infringes the GDPR.

Please visit the website of the relevant supervisory authority for more information on how to submit such a complaint.

5. More details on how we process your personal data

5.A. Categories of personal data we collect about you and retention periods

UCB obtains your personal data through your use of the Website (e.g. through cookies), as well as directly from you, if you choose to disclose personal data to UCB, as will be further detailed below.

(**) We will retain your personal data in accordance with UCB’s data retention policy.

The retention periods included in our data retention policy are dictated by:

Applicable statutory/legal requirements;
Industry guidelines, and

For those data categories for which no express statutory or legal requirements apply, certain other determining factors such as the need to prove or enforce a transaction or contract, enforce our policies, etc.

We will delete your personal data once the abovementioned retention periods will have expired, except where we need to hold on to such data for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person or for compliance with a European or European Member State legal obligation which requires such further processing.

5.B. Who we share your personal data with

1. Principle

We will disclose your personal data only as described in this Policy (including any updates to this Policy, as will be notified to you from time to time as set out above under “The reason behind this Privacy Policy”).

2. Subsidiaries/affiliated companies and third party processors

UCB transfers or discloses your personal data to its subsidiaries/affiliated companies and to third party service providers processing personal data on UCB’s behalf for the purposes set out above.

Third party service providers include IT services and website hosting companies, (internet) connectivity providers, provider of data analytics (Google) and tracking services, providers of press release and newsletter distribution networks (including The Rocket Science Group LLC d/b/a MailChimp), as well as service providers that provide technical and administrative support for the Website and underlying IT systems. These service providers provide their services from locations within the EU (including Germany, Malta, UK and Ireland) and outside of the EU (The Rocket Science Group LLC d/b/a MailChimp (USA) and Google (USA)).

Other third parties include regulatory and government agencies (see further below in this Policy), and potentially, third parties with whom UCB may merge or which may be acquired by UCB (see further below in this Policy).

3. Compliance with laws and legal proceedings

UCB will disclose your personal data where:

• UCB is required to do so by applicable law, by a governmental body or by a law enforcement agency.
• To establish or exercise our legal rights or defend against legal claims;
• To investigate, prevent or take actions against illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our policies or as otherwise required by law.

4. Other

If a third party acquires all (or substantially all) of our business and/or assets, we will disclose your personal data to that third party in connection with the acquisition. However, such disclosure will occur subject to and in accordance with applicable data protection laws.

5.C. International transfers

UCB will transfer your personal data to its affiliates, including our affiliates outside of the EU. In that case UCB relies on UCB's Binding Corporate Rules.

UCB will also transfer your personal data to certain third party service providers both within the EU (including Germany, Malta, UK and Ireland) and outside of the EU (USA).

The transfer of your personal data to third party service providers (as set out above under section 5.B) in countries outside of the European Economic Area that do not ensure an adequate level of (data) protection, occurs on the basis of Standard Contractual Clauses that have been executed between UCB and the relevant third party service provider. You may - by exercising your rights set out above under section 4.B (How to exercise your rights) - obtain a copy of the relevant safeguard UCB has put in place or ask UCB to redirect you to the place where they have been made available.

In the absence of the aforementioned appropriate safeguards, UCB may – to the extent permitted under and in accordance with applicable data protection laws (including the GDPR) - rely on a derogation applicable to the specific situation at hand (e.g. the data subjects’ explicit consent, the necessity for the performance of an agreement, the necessity for the establishment, exercise or defense of legal claims).

For more information on how Google processes your personal data within the framework of Google Analytics, please consult How Google uses data when you use our partners' sites or apps.

5.D. Links to third party sites

This Website contains links to other websites operated by third parties, including but not limited to certain social media sites such as Facebook, Twitter, Linkedin, YouTube, etc. This Policy does not apply to any website, other than this one. Third party websites are governed by their our own terms and conditions. You should therefore always carefully check the privacy and cookie policies of third party websites before accepting to be redirected to them.