Privacy statement for the processing of personal data for pharmacovigilance purposes
According to article 13 of Regulation (EU) 2016/279 ("GDPR
"), as implemented into Italian Legislative Decree 101/2018, we wish to inform you of the following in relation to the personal data that the company SIFI S.p.A. (hereinafter "SIFI
") collects and processes each time you report adverse reactions concerning a SIFI product:
Data Controller and Data Protection Officer
The Data Controller shall be SIFI S.p.A., having tax code 00122890874, with registered offices in Aci Sant’Antonio (CT), Via Ercole Patti n. 36, represented by its pro-tempore
The Data Controller may be contacted via certified e-mail at email@example.com
or via e-mail at firstname.lastname@example.org.
The Data Protection Officer (DPO) shall be DGN CONSULTING S.r.l., which may be contacted via e-mail at email@example.com.
Type of data being processed
Data we shall collect in relation to your reporting are:
Purposes of data processing
- Identifying information regarding the source of the report – including name, surname, company or trading name (if applicable), professional position;
- Contact details for the source of the report – including telephone number, normal and certified e-mail addresses;
- Information relating to the patient – including initials of the name and surname, height, weight, date of birth, gender, age;
- Information regarding the adverse event: medical history, the event underway, pharmacological treatment.
Your personal data shall be processed by SIFI for the sole purpose of properly managing all reports you make of adverse reactions to a SIFI medicinal product, in accordance with applicable pharmacovigilance laws and regulations.
Means of data processing
Your personal data may be processed in either paper or electronic form, using the means that are strictly necessary to achieve the purpose detailed above, in full accordance with all applicable laws and regulations.
Lawfulness of processing
SIFI shall process your personal data lawfully on the basis of a specific obligation under law (Implementing Regulation (EU) 520/2012; Regulation (EU) 1235/2012; Directive 2010/84/EU; Italian Ministerial Decree 30/04/2015).
The provision of your personal data is optional but it is necessary for the Data Controller in order to be able to reply to any requests and to comply with statutory pharmacovigilance obligations. As such, if you refuse to provide that data, SIFI will be prevented from investigating any adverse events you report.
Communication of data
Without prejudice to all communications required by applicable law and/or made further to contractual obligations, the personal data collected and processed by SIFI may be communicated in Italy and if necessary transferred abroad for the purposes listed above, to:
- Public authorities (such as the Ministry of Health, Regulatory Authorities, the European Medicines Agency, etc.);
- Other SIFI Group companies in Italy and/or abroad;
- Commercial partners of SIFI in Italy and/or abroad;
- Other recipients that are entitled by law to access your data.
In addition, the processing of your data may result in the data being acquired – only to the extent required by law and in full accordance with the guarantee measures and Regulations issued by the Italian Data Protection Authority – by employees and collaborators of SIFI or other Group companies, in Italy or abroad, in their capacity as otherwise authorised to process data as part of their tasks and duties.
Transfer and export of data
With respect to the purposes set out above, your personal data may be communicated to third parties affiliated with SIFI, including outside the European Economic Area (EEA) where the data protection laws may afford a lower level of protection than those in the EEA.
A detailed and updated list of those recipients is available at the offices of the Data Controller, in Aci S. Antonio (CT) 95025, Via Ercole Patti, 36.
Retention period for data
Your personal data shall be stored using the means and for the term established by applicable law, and in any event for at least 10 years after the expiry of the market authorisation for the medicinal product. However, documentation will be stored for longer periods if European Union or domestic legislation require otherwise.
Specific security measures are implemented in order to prevent the loss of data, its unlawful or incorrect use and unauthorised access to data.
Data Subject Rights
Anyone in the European Union who is a data subject has the following rights:
(a) Access to data
: a data subject may access his/her data, ask which data is undergoing processing, receive details of the use of its data and obtain a copy thereof.
a data subject may ask for the rectification, correction and/or the updating of data provided to the Company.
a data subject may request the erasure of personal data in possession of the Company.
(d) Revocation of consent
: a data subject may revoke the consent to personal data processing, without impacting the lawfulness of data processing conducted prior to that revocation.
(e) Restrictions on processing
: a data subject may restrict the way data is used in all cases provided for by law.
: a data subject may request to transmit personal data to another data controller and to receive a structured and easily consultable copy of it.
(g) Lodge a complaint
: a data subject may lodge a complaint in relation to the processing of his/her personal data with the competent Data Protection Authority.
(h) Opposition action:
a data subject may file an opposition at any time for reasons relating to a specific situation, concerning the processing of his/her personal data, save for cases where the lawful interests of the Controller prevail.
Automated decision making
SIFI does not use software that generates decisions based solely on automated processing, hence no legal effects are produced that concern you or could have a significant effect on you.
In the event decisions are made based only on automated processing, you shall have the right to be informed and not to be subject to said processing if it produces legal effects that concern you or have a significant effect on you.