Data Protection Notice (“Notice”)
The Confidential Reporting Website ‘EthicsPoint’ (“EthicsPoint”) is provided by Otsuka. The website through which you may make a report is operated by GCS Compliance Services Europe Unlimited Company trading as NAVEX (“NAVEX”), Otsuka’s data processor. This Notice applies to reporting persons and to those who are affected by the report, such as witnesses and third parties whose personal data are processed as part of the investigation (“you”).
EthicsPoint may generally be used to provide a safe, secure and anonymous helpline enabling staff and other persons to report misconduct.
The controller of the processing of your personal data is the Otsuka company that handles the report (“Otsuka”, “we” or “us”). Some Otsuka companies have appointed a data protection officer. You can find the contact details of Otsuka companies and their data protection officers in section 7.
In this Notice, when we talk about personal data, we mean any information that relates to an identified or identifiable person – in this case, you or any other individual whose personal data is processed as part of a report submitted through EthicsPoint, including witnesses and third parties whose personal data are processed as part of the investigation.
You should read this Notice, so you know what personal data we collect about you, what we do with it and how you can exercise your rights in connection with it. You should also read any other privacy notices that we give you, that might apply to our use of your personal data in specific circumstances from time to time.
-
What personal data does Otsuka collect and why?
Otsuka may collect and use some or all of the following information for the purpose(s) described below:
- Personal details, such as your name, title and contact details;2
- Personal details, such as names, titles and contact details related to individuals named in the report;3
- A description of the alleged misconduct, as well as the circumstances involved (including the dates and locations involved).4
Otsuka will process the above information, including personal data, for the purposes of ensuring compliance with applicable legislation and internal policies, for the defence of legal claims and ensuring the well-being of Otsuka personnel.
1Please note the subjects that may be reported through EthicsPoint vary by country.
2Use of EthicsPoint is entirely voluntary. Reports are anonymous by default, unless you provide your explicit consent to be identified. We encourage you to identify yourself in order for us to follow up with questions we may have, but this is at your discretion and anonymous reports will also be accepted (unless not possible under local law).
3In some countries, the categories of persons who can be reported may be limited to persons in key positions or managerial roles in a company. Otsuka aims to inform each person included in a report within an appropriate period but will not seek to disclose your identity (regardless of whether you have provided your identity or not). Individuals will have the right to react to the information reported by you.
4Please be aware that the information you supply about yourself, your colleagues, or any aspect of Otsuka’s operations may result in decisions that affect others. Therefore, we ask that you only provide information that you believe is true and accurate. In addition, unless it is strictly required in order to make a report, please do not share any special categories of personal data through EthicsPoint. This includes data such as racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, data concerning health or data concerning a natural person’s sex life or sexual orientation. You will not be subject to retaliation from Otsuka for any report that is made in good faith, even if it later turns out to be factually incorrect. Please be aware, however, that knowingly providing false or misleading information will not be tolerated.
In addition, we may require your personal data to comply with our regulatory monitoring and reporting obligations, including those related to adverse events, product complaints and patient safety.
We collect personal data from you directly, for example, when you voluntary communicate with and report to us, i.e. use EthicsPoint and explicitly consent to be identified. You can provide your personal data voluntary to us. For more details, you can also contact us via the contact details stated under section 7 below.
Sometimes, we also collect personal data from other sources than you, in particular from other individuals involved in the investigation, other Otsuka group companies, third party providers and business partners, government authorities (for example, law enforcement authorities in charge of investigations), or other third parties, such as providers of publicly accessible sources (for example, public websites, media, social media profiles, registers, records or databases), counterparties including their service providers (for example, in litigation), or other companies or individuals at your direction.
-
Legal basis for processing personal data
We process your personal data described above in accordance with applicable data protection laws, if you have given your consent, or it is necessary to ensure compliance with a legal obligation to which we are subject. In some cases, we may also process personal data because we have a legitimate interest to investigate the submission of reports or establish, exercise or defend legal claims.
In circumstances where special categories of personal data are deemed relevant for inclusion and are required to be submitted, this will be processed on the basis of a substantial public interest or for the establishment, exercise or defence of legal claims.
-
Who does Otsuka share my personal data with?
The information provided by you will be treated confidentially and only shared on a strict need-to- know basis. Personal data submitted as part of a report may be processed by the relevant personnel of Otsuka, including authorised recipients and, depending on the nature of the report, members of Human Resources, Finance, Audit, Legal and Ethics and Compliance. Personal data may also be shared with data processors (for example, NAVEX) in order to provide EthicsPoint, other Otsuka group companies involved in the management of the report and third parties such as external advisors (for example, law firms or other experts) to assist with the investigation of any report submitted.
In addition, we may also share your personal data with competent law enforcement bodies, regulatory and trade associations, government agencies, courts or other third parties where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person.
-
International data transfers
We may transfer your personal data outside of the United Kingdom (“UK”), the European Economic Area (“EEA”) and/or Switzerland. For example, in limited circumstances, to provide administrative services and for the purpose of translation by NAVEX.
The transfers between the EEA, the UK and Switzerland are based on mutual adequacy decisions of these jurisdictions.
The transfers to other countries are based on adequacy decisions or appropriate safeguards such as standard contractual clauses. You can receive a copy of these safeguards upon request.
We may also transfer your personal data if the transfer falls under a derogation specified in the data protection legislation, such as a transfer necessary for the establishment, exercise or defence of legal claims.
-
How long will your information be kept?
We retain your personal data for as long as necessary for the purposes described above, where we have an ongoing legitimate need to do so (for example, to comply with applicable legal requirements).
Information relating to a report made via EthicsPoint will be archived or deleted based on the following criteria: when you withdraw your consent or validly object to the processing of your personal data and we cannot rely on another legal basis; we are no longer legally obliged to retain your personal data, in particular according to tax and commercial law; when we no longer need to establish, exercise or defend legal claims, i.e. the statutory limitation period is over; when the investigation has been closed and no further action is needed; when the time period for any relevant litigation has lapsed; and when our obligations for record keeping relating to investigations have lapsed.
-
Your rights
You have the following rights regarding personal data processed by Otsuka that may apply depending on the circumstances and jurisdiction:
Right What does this mean? 1. The right of access You have the right to obtain access to your personal data (if an organisation is processing it), and certain other information (similar to that provided in this Notice). 2. The right to rectification You are entitled to have your personal data corrected if it is inaccurate or incomplete. 3. The right to erasure This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there is no compelling reason for an organisation to keep using it. This is not a general right to erasure; there are exceptions (for example, where you have provided consent to processing, this applies only where you have withdrawn your consent, if we are processing in connection with performance of a contract or for compliance with law, this applies only where such data are no longer necessary and where we are relying on our legitimate interests this applies only if there are no overriding legitimate interests). 4. The right to restrict processing You have rights to ‘block’ or suppress further use of your personal data in certain circumstances. When processing is restricted, the relevant organisation can still store your personal data but may not use it further. Please note that your right to restrict processing is limited in certain situations; for example, when we are processing personal data that we collected from you with your consent, you can only request restriction on the basis of inaccuracy of data or where our processing is unlawful and you don’t want your personal data erased or you need it for a legal claim. You do not have this right where we are processing your personal data for compliance with law. 5. The right to data portability You have rights to obtain and reuse your personal data in a structured, commonly used and machine-readable format in certain circumstances, which do not include where we are processing on the basis of legitimate interests or for compliance with law. 6. The right to object You have the right to object to certain types of processing, in certain circumstances such as when we rely on our legitimate interests. Where your personal data is processed on the basis of your consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
You also have the right to lodge a complaint with a data protection authority about our processing of your personal data. This right is without prejudice to any other administrative or judicial remedy.
-
How to contact us?
Should you have any questions regarding the protection of your personal data or if you wish to exercise your legal rights, please submit your query to the Otsuka company responsible for handling the report.
Otsuka company Address Contact details of Otsuka company and its data protection officer (if applicable) Otsuka Holdings Europe GmbH Europa-Allee 52, 60427 Frankfurt am Main, Germany privacy@otsuka.eu Otsuka Pharmaceutical Europe Ltd. 2 Windsor Dials, Arthur Road, Windsor, Berkshire, SL4 1RS, UK privacy@otsuka-europe.com Otsuka Pharmaceuticals UK Ltd. 2 Windsor Dials, Arthur Road, Windsor, Berkshire, SL4 1RS, UK privacy@otsuka.co.uk Otsuka Pharma Scandinavia AB Sveavägen 151, 113 46 Stockholm, Sweden privacy@otsuka.se Otsuka Pharmaceutical, S.A. Avenida Diagonal, 615 9º planta, Barcelona 08028, Spain gdpr@otsuka.es Otsuka Pharma GmbH Europa-Allee 52, 60427 Frankfurt am Main, Germany privacy@otsuka.de Otsuka Pharmaceutical France SAS L’Atria – 6ème étage, 1-15 avenue Edouard Belin, CS 40066, 92566 Rueil Malmaison, Cedex, France privacy@otsuka.fr Otsuka Pharmaceutical Italy S.r.l. Via Fabio Filzi 29, 20124 Milan, Italy privacy@otsuka.it Otsuka Pharmaceutical (Switzerland) GmbH Sägereistrasse 20, CH-8152 Glattbrugg, Switzerland privacy@otsuka.ch Otsuka Pharmaceutical Netherlands B.V. Herikerbergweg 292, 1101 CT, Amsterdam, Netherlands privacy@otsuka.co.uk Otsuka Novel Products GmbH Erika-Mann-Straße 21, 80636 München, Germany privacy@otsuka-onpg.com Interpharma Praha, a.s. Komořanská 955/61 143 10, Praha 4 – Modřany, Czech Republic interpharma@ipp-otsuka.cz Nardobel SAS BP 106, 68, Route de Castelnaudary – 31250 Revel, France dpo.france@ns-group.com Nutrition & Sante SAS BP 106, 68, Route de Castelnaudary – 31250 Revel, France dpo.france@ns-group.com Nutrition & Sante Italia SpA Via Gioacchino Rossini 1/A, 20045 Lainate (MI), Italy privacy.consumatori@ns-group.com Nutrition & Sante Benelux S.A. Medialaan 30, 1800 Vilvoorde, Belgium dpo.benelux@ns-group.com Nutrition & Sante Iberia SL Paseo de Gracia, 11 Escalera B, planta 1°, 08007 Barcelona, Spain protecciondedatos@ns-group.com Biocentury Portugal, Unipessoal Lda. Rua Jardins dos Jacarandás Lt. 4.28.01D Lj. A, Lisboa, 1990-237 LISBOA, Portugal protecciondedatos@ns-group.com Hebron S.A. Calle Girona, 20 – 08120 La Llagosta (Barcelona), Spain gdpr@hebronsa.es
Version 1.2: January 2026