You are now in an EthicsPoint Secure Area | Ask a question

WHISTLEBLOWING PRIVACY NOTICE

USE OF YOUR DATA WHEN YOU FILE A COMPLAINT

At the PHARMATHEN Group we take personal data protection seriously and only process data to the extent that processing is absolutely necessary and in full compliance with the applicable data protection legal framework, including the EU General Data Protection Regulation (GDPR).

We are sharing this Privacy Notice with you, to provide you with information regarding the processing of your personal data when you submit a report using the present platform. The hotline is located outside of Pharmathen’s IT environment and is hosted by an independent company, NAVEX on its secured server EthicsPoint. The same applies to the telephone hotline which is also made available by such third-party.

  1. Personal Data that we collect

    Pharmathen S.A., acting as a Data Controller, shall only collect the data you choose to submit via our hotline platform or by phone.

    More specifically:

    • your name/surname (only if you choose to proceed in a report that is not anonymous);
    • the Pharmathen Group company you work for;
    • details about the reported incident as disclosed by you, including the names of involved personnel (if disclosed);
    • the pin (code) automatically generated by NAVEX for report follow-ups and updates.

  2. Why we process your data

    We will process your personal data for the following purposes:

    • to comply with our legal obligation a. to provide you with a reporting channel satisfying applicable European and national laws and b. to protect our employees and ensure a safe and healthy work environment;
    • within the frame of our legitimate interest, to ensure that our internal policies and codes of conduct are upheld.

    Should you choose to submit special categories of personal data (ex. health data or data related to religious beliefs/race etc.) via our hotline (ex. in the incident description box) the processing of said data will take place solely within the scope and to the extent necessary for the purposes of carrying out obligations in the field of employment and social protection law.

  3. Recipients of your data

    The data submitted within the frame of the reporting process will be accessed by the respective Report Investigations Committee responsible for handling your report, the Officer responsible for the Receipt and Monitoring of reports, EthicsPoint administrators, the respective board of directors or other ethics committee, Pharmathen’s CEO and any other Pharmathen personnel indicated in Pharmathen’s Standard operating procedure on complaints handling and non-retaliation.

    Data which is necessary for the purposes of each processing activity may also be transferred to the following entities:

    • to national or international regulatory, tax or other authorities or public bodies, or courts, when required by law or regulation or upon court order;
    • to third parties providing services to Pharmathen, such as NAVEX which provides the EthicsPoint platform and phone numbers used for the reporting process;
    • to third parties who carry out audits to ensure Pharmathen’s compliance with regulatory obligations or comply with obligations under applicable law.

    The NAVEX servers hosting your data are located within the EU hence no data transfers outside the EU will be taking place for the purposes of providing this whistleblowing tool. We may transfer personal data collected through the whistleblowing hotline platform to other countries, including countries outside the European Economic Area (EEA) to the extent necessary for investigation purposes or for the defense against claims. Any such potential transfers will be conducted in compliance with applicable data protection laws, including the implementation of appropriate safeguards, such as standard contractual clauses or relying on adequacy decisions.

  4. Data Retention

    Your personal data will be retained by PHARMATHEN for as long as necessary to fulfill the purposes outlined in this data protection notice, unless a longer retention period is required by law or to establish, exercise, or defend legal claims. In such cases the data will be retained for a period of 20 years after the case report closure (investigation completion and issuance of final decision), unless otherwise required in compliance with applicable legislation. Your data shall be stored with safety in digital form and/or in hard copy at Pharmathen’s premises and/or the EthicsPoint servers.

  5. Your rights

    You have the right to:

    • request access to your personal data and information on the data we process, the purposes of processing, the recipients and the duration of processing;
    • request the rectification of your personal data if it is inaccurate or incomplete;
    • request the deletion of your personal data, unless their processing is necessary for exercising the legal rights of Pharmathen or of third parties, for the fulfillment of a legal obligation, for public interest reasons or for defending our legal rights before judicial or other Authorities;
    • request the restriction of processing of your personal data only for specific purposes;
    • request the portability of your data, that is to receive the data you have provided in a structured, commonly used format, and the right to request that we send it to a third party designated by you.
    • object to the processing of your personal data, at any time, on grounds related to your particular situation.

    If you have any request or question regarding this privacy statement, you may contact our Data Protection Officer, using our contact details set out below.

    PHARMATHEN S.A.
    ATT: DPO
    44, Kifissias Avenue
    151 25, Marousi
    Athens-Greece
    Email: dpo@pharmathen.com

    If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

    We may update this data protection notice from time to time to reflect changes in our practices or legal requirements. Any updates will be made available on this website or through other appropriate communication channels.