ALRISE Biosystems GmbH, Competence in Drug Delivery

Note: The English translation of our data protection declaration is for convenience only and does not claim to be legally binding. In case of doubt the German version prevails.

The following presentation serves to inform both those persons who only visit the website of ALRISE Biosystems GmbH, Robert-Rössle-Straße 10, 13125 Berlin ("ALRISE") ("Users"), and those persons who - with and without visiting the website - conclude or plan to conclude a contract with ALRISE (hereinafter "Business Partners") and those persons who - with and without visiting the website - apply to ALRISE (hereinafter "Applicants").

The terms used are based on formulations used by the European legislator when adopting the General Data Protection Regulation (hereinafter referred to as the "GDPR").

1. Whose Personal Data is Being Processed?

Persons affected by the processing of personal data are users, business partners and applicants. Users, business partners and applicants are hereinafter also referred to in summary as "data subject".

2. Data Processing - Website

2.1 Which data is automatically processed when I visit the ALRISE website?

When accessing the ALRISE website, the ALRISE servers automatically store various data about the accessing system ("access data").

The access data includes:

IP-Address
Browser type and browser version
Operating system used
Referrer URL
Host name of the accessing computer
Time of the server request

ALRISE uses this access data in order to make the website accessible, to detect and correct any technical problems that may occur, and to prevent and, if necessary, to prosecute misuse of the ALRISE website.

In addition, ALRISE reserves the right to use the access data in anonymous form; i.e. without the possibility of identifying the user for statistical purposes and to improve the website.

2.2 Which Data Are Processed When Using the E-Mail Function on the Website?

Via this website ALRISE offers the possibility to contact ALRISE by e-mail and to write messages. In addition to the disclosure of the pure e-mail address of the sender, these e-mails may contain, at the user's discretion, personal data (e.g. first and last name, title, address, telephone number, e-mail text, factual context of the inquiry).

ALRISE processes the personal data transmitted in connection with e-mails exclusively for processing the respective e-mail request.

2.3 Are Cookies Used?

The ALRISE website does not use cookies.

3. Data Processing - Initiation / Establishment of a Contractual Relationship

3.1 Is the Business Partner Obliged to Provide Personal Data?

The establishment and implementation of a contractual relationship between ALRISE and the business partner requires that the business partner provides ALRISE with the personal data required for the establishment, implementation and fulfilment of the associated contractual obligations or which ALRISE is legally obliged to collect (e.g. under money laundering laws, tax laws). Without this data, ALRISE will generally have to refuse to establish a contractual relationship or fulfil an existing contract and may have to terminate the contractual relationship.

3.2 Purpose of Processing

When entering into and executing a contractual relationship with the business partner, ALRISE processes personal data of the business partner for the following purposes:

Communication with business partners to make inquiries to the business partners to establish a contractual relationship or to obtain offers or to check and process business partners' contract offers;
Communication with business partners to establish, execute and process contractual relationships. Relevant contractual relationships are in particular purchase and work contracts, bank contracts, agency and service contracts;
Compliance with legal requirements (e.g. tax and commercial law storage obligations);
Enforcement of existing contracts and assertion, exercise and defence of legal claims.

3.3 Categories of Data

Which personal data of the business partners are processed in detail depends largely on the respective contractually agreed services. However, for the purposes mentioned above, ALRISE processes the following categories of personal data of business partners:

Contact information, such as first and last name, address, telephone number, mobile phone number, fax number, and e-mail address of the business partner;
Bank and payment data (information required for processing payment transactions);
Information from publicly available sources (e.g. websites, land registers, registers of commerce and associations), information databases or from credit agencies;
Information required for processing the contractual relationship between the business partner and ALRISE or voluntarily provided by the business partner.

4. Data Processing - Job Applications

In the case of applications - whether digital, by post or in any other form - the data submitted by the applicant will be collected and processed by ALRISE for handling the application procedure.

4.1 Is the Applicant Obliged to Provide Personal Data?

The precondition for consideration of an application is that the applicant provides ALRISE with the personal data necessary for communication with the applicant and verification of the applicant's qualifications. Without this data ALRISE will normally not establish a contractual relationship with the applicant.

4.2 Purpose of Processing

ALRISE processes personal data of the applicant in accordance with the applicable legal provisions for the protection of personal data and data security. As part of an application process, ALRISE processes personal data of applicants for the following purposes:

Communication with the applicant in the context of filling the vacancy;
Examination of the applicant's suitability for the vacancy to be filled;
If necessary, contacting of indicated references for the procurement of information;
Preservation of evidence for any proceedings under the German General Law on Equal Treatment (AGG);
Enforcement, exercise and defence of legal claims.

4.3 Categories of Data

Which personal data of the applicant are processed in detail depends largely on the circumstances of the individual case. For the above purposes ALRISE processes the following categories of personal data of applicants:

Contact information provided by the applicant, such as first and surname, address, telephone number, mobile phone number, fax number and e-mail address of the applicant;
Information the processing of which is required to examine the application or which is provided voluntarily by the applicant.

5. Legal Bases under Data Protection Law

The processing of the personal data of the data subject is based on the following legal bases:

5.1 Data Processing Website

The data collected via the website are processed in order to safeguard legitimate interests (Art. 6 para. 1 letter f) GDPR). ALRISE has a legitimate interest in providing the service in a technically error-free and optimized manner and in carrying out the electronic communication process or in providing certain functions requested by the business partner.

5.2 Data Processing - Initiation / Establishment of a Contractual Relationship

Fulfilment of a contract concluded with the business partner or for the implementation of pre-contractual measures (Art. 6 para. 1 letter b) GDPR).
Data processing in order to safeguard legitimate interests (Art. 6 para. 1 letter f) GDPR). In addition to the actual performance of the contract, ALRISE processes personal data of business partners to protect the legitimate interests of ALRISE or third parties. The processing takes place in particular to assert legal claims and defence in the event of legal disputes as well as in the course of other measures for directly addressing the business partners. The processing of personal data for the protection of legitimate interests is always omitted if ALRISE can see indications that the business partner's overriding interests worthy of protection are in conflict with the processing. Before any processing of personal data to protect legitimate interests, we therefore check whether there is any conflict of interests worthy of protection within the framework of an objectified consideration.
Fulfilment of a legal obligation (Art. 6 Para. 1 Letter c) GDPR) e.g. according to the Money Laundering Act, commercial and tax laws, regulatory requirements.
Consent of the business partner to data processing (Art. 6 para. 1 letter a) GDPR). Insofar as the business partner has given ALRISE permission to process his personal data for specific purposes, the legality of such processing is given on the basis of the permission. In the event of revocation of consent, ALRISE may only process the personal data to the extent that ALRISE can base the processing on another legal basis.

5.3 Data Processing - Job Applications

The legal basis for data processing is the applicant's consent to data processing (Art. 6 para. 1 letter a) GDPR). The transmission of application documents constitutes the applicant's consent to the processing of his or her personal data for the purpose of ALRISE's examination of the application. Thus the legality of this processing is given on the basis of consent.
In the event of revocation of consent, ALRISE may only process the personal data to the extent that ALRISE can base the processing on another legal basis. Such other legal basis for data processing is the protection of legitimate interests (Art. 6 para. 1 letter f) GDPR). Such processing by ALRISE takes place in particular to assert legal claims and to defend against legal disputes. The processing of personal data for the protection of legitimate interests is always omitted if ALRISE can see indications that the applicant's overriding interests worthy of protection are in conflict with the processing. Before any processing of personal data to protect legitimate interests, we therefore check whether there is any conflict of interests worthy of protection within the framework of an objectified consideration.

6. Transmission and Passing-On of Personal Data to Third Parties

ALRISE only transmits personal data to other third parties (e.g. courts, authorities, law firms) if this is necessary to fulfil the aforementioned purposes or if the transmission is necessary to assert, exercise or defend own legal claims. ALRISE has also commissioned tax consultants/auditors to provide tax advice to ALRISE and to this extent has also outsourced the accounting to the commissioned tax consultancy firm.

ALRISE cooperates with technical service providers (so-called contract processors), such as service providers for EDP/IT applications, data destruction, marketing and website management. These service providers only act in accordance with ALRISE's instructions and are contractually obliged to comply with the applicable data protection requirements.

Data is only transferred to countries outside the EU or the EEA (so-called third countries) if this is necessary for the fulfilment of the contract with the business partner in individual cases or required by law. ALRISE does not cooperate with service providers in third countries.

7. Deletion Periods

7.1 Website

Access data (cf. Section 2.1) will be deleted if their knowledge is no longer required for the purposes described in this data protection statement, unless legal provisions prescribe longer storage. Access data are stored regularly for a period of 30 days.
The data collected using ALRISE's e-mail function (cf. Section 2.2) will be deleted as soon as it is no longer necessary to fulfil the purpose of the processing, i.e. regularly when the e-mail enquiry has been finally processed.

7.2 Initiation / Establishment of a Contractual Relationship

Personal data of the business partner are deleted as far as they are no longer necessary for the fulfilment of the purpose of the processing, unless their - limited - further processing is necessary for the following purposes:

Compliance with commercial and tax storage periods (in particular in accordance with the German Commercial Code, Fiscal Code, Money Laundering Act). The periods for storage and documentation specified there are up to 10 years.
Preservation of evidence under the statute of limitations. According to §§ 195 et sqq. of the German Civil Code (BGB), these limitation periods may be up to 30 years, whereby the regular limitation period is three years and begins to be effective at the end of the year in which the claim arose.

If personal data of the business partner are processed on the basis of the business partner's consent, the business partner has the right to revoke the consent given at any time with effect for the future pursuant to Art. 7 para. 3 GDPR. After revocation, data processing may only be continued if (future) processing can be based on a legal basis other than consent (see section 5.2 above).

7.3 Job Applications

With regard to the application data collected by ALRISE (see section 4.3), ALRISE proceeds as follows.

If ALRISE does not conclude an employment contract with an applicant, the application documents will be automatically deleted six months after notification of the rejection decision, provided that there are no other legitimate interests of ALRISE in the way of deletion.
Other legitimate interest in this sense is, for example, a burden of proof in proceedings under the German General Equal Treatment Act (AGG).
If the applicant has given ALRISE further consent for further use in the event of a new position being filled, the deletion will take place at the latest after expiry of the period stated in the declaration of consent in each case or a new enquiry of the consent will be made. If personal data of the applicant are processed on the basis of the applicant's consent, the applicant has the right to revoke the consent given at any time with effect for the future pursuant to Art. 7 para. 3 GDPR. After revocation, data processing may only be continued if (future) processing can be based on a legal basis other than consent (cf. section 7 above).
If an employment contract is concluded with the applicant, the applicant's personal data will be further processed - to the extent necessary for this - in order to fulfil the contract to be concluded (Art. 6 para. 1 letter b) GDPR). In this case, the applicant will be separately informed about the processing of his personal data within the scope of the employment relationship at the time of conclusion of the contract.

8. Rights of the Data Subject

The data subject has the following rights and/or claims. Their assertion will be processed immediately and does not lead to any disadvantages for the data subject.

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right of object (Art. 21 GDPR)
Right of erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 et sq. GDPR)
Right to data portability (Art. 20 GDPR)

The data subject also has the right to lodge a complaint with a data protection authority if he or she considers that ALRISE's processing of personal data concerning him or her is in breach of the GDPR. In addition to the data protection authority responsible for ALRISE (cf. section 9 below), the supervisory authorities of the place of habitual residence of the data subject, the place of employment of the data subject and the place of presumed infringement are responsible for this. Further rules on the appeal procedure can be found under Art. 77 GDPR.

9. Responsibilities

Responsible for the legitimacy of data processing is:

ALRISE Biosystems GmbH
Robert-Rössle-Straße 10
13125 Berlin
Deutschland
Phone: +49 (0) 30 94 89 24 83
Fax: +49 (0) 30 94 89 24 82
E-Mail: info@ALRISE.de

The rights mentioned in section 8 can also be asserted by using the aforementioned contact data.

The Berlin Commissioner for Data Protection and Freedom of Information supervises compliance with data protection law in the non-public sector in Berlin. The contact details are:

The Berlin Commissioner for Data Protection and Freedom of Information

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219
10969 Berlin
Phone: +49 (0)30 13889-0
Fax: +49 (0)30 2155050
E-Mail: mailbox@datenschutz-berlin.de

10. Changes to the Data Protection Statement

ALRISE reserves the right to adapt this data protection statement to changed factual or legal conditions if necessary.

Status: May 2018

Data Protection Statement ofALRISE Biosystems GmbH