Privacy Policy - Visu Shop

Privacy Statement – VISUfarma

Updated July 2022

1. General information

VISUfarma B.V. and VISUfarma UK Ltd. (‘VISUfarma’) are committed to protecting the privacy of our website visitors, (contact persons of) customers, suppliers and other business partners. The VISUfarma Privacy Statement (‘Statement’) is designed to provide transparency into VISUfarma’s privacy practices and principles. When we talk about ‘we’, ‘our’, ‘us’ or the ‘Company’ we mean VISUfarma as a whole or one of the group companies.

We want to be clear about how we use some words in this Statement. It may seem obvious, but in this Statement you will be referred to as ‘you’.

The scope of this Statement is limited to processing activities of visitors of VISUfarma’s websites (visufarma.com, dryeyeandme.co.uk, visufarma-shop.co.uk/index.html, visuacademy.co.uk and www.visuforum.com), (contact persons of) customer(s), (contact persons of) supplier(s) and (contact persons of) other business partners to which the privacy rules of the countries of the European Economic Area (‘EEA’) and the United Kingdom (‘UK’) apply, such as the General Data Protection Regulation (‘GDPR’) and the UK GDPR.

In case you are a VISUfarma employee or a temporary resource, contractor, consultant, agent or similar third party and you would like to know about personal data being processed by VISUfarma, we would like to refer you to our Statement for VISUfarma employees. Finally, this is a Statement about information which directly or indirectly relates to you as a person. It’s not about information about VISUfarma or another company (although sometimes the two overlap). We will use the term ‘personal data’ to refer to this information.

2. What personal data does VISUfarma process?

We can process your personal data in a few different ways. Please find directly below information about our processing of your personal data. You will find an overview of the various topics on which you can click for more detailed information about the processing of your personal data in that context.

The VISUfarma website (www.visufarma.com)

We process your personal data for providing, maintaining and improving the VISUfarma website and for our social media activities. For more specific information on the cookies and similar technologies used in this respect, please refer to our Cookie Statement.

The persons involved. People who visit the VISUfarma website (‘Website Visitors’).

The purpose of the processing. When you visit the VISUfarma website, we will process your personal data for all purposes (1 – 10) as described under paragraph 3 of this Statement.

The personal data that is processed. When you visit the VISUfarma website, we may process the following personal data about you. Please note that some of the information we collect may be collected automatically via cookies or similar techniques:
Name;
Contact and communication details;
Personal data on your visits to VISUfarma websites including, but not limited to, traffic data, location data, weblogs, content from surveys and contact forms and other communication data and the resources that you access.
IP addresses and cookies;
- We collect data about your computer, including (where available) your IP address, operating system and browser type, for system administration. This is statistical data about our users’ browsing actions and patterns, and does not identify you or any individual.
- For the same reason, we may obtain data about your general internet usage by using a cookie file, which is stored on your device. Cookies help us to improve the Website and to deliver a better and more personalized content. For more information about our use of cookies on the VISUfarma websites, please refer to our Cookie Statement.
When you contact us via the website we may process the following information:
- Name;
- Organisation;
- Telephone number;
- Email address;
- Details (your message to us);
- Enquiry type (general, business development, medical);
- The product you are contact us about; and
- Your location (country).

Social media platforms. VISUfarma uses social media, for example in the context of education about diseases and treatment options. VISUfarma is not responsible for the management of the social media platforms, but is responsible for the content of the VISUfarma website that is shared via a social media platform. For more information about how your data will be used by such social media platforms, we refer to the information already available on the websites of the suppliers of these platforms. Below we have included a link to the privacy policy of the social media platform which we could use:
The privacy policy of LinkedIn;
The privacy policy of Facebook;
The privacy policy of Twitter;
The privacy policy of Instagram;
The privacy policy of YouTube;

Testimonials

We process personal data of individuals who are involved in our testimonials in order to provide you with relevant information about our products.

The persons involved. We process personal data of individuals who are involved in the testimonials we have available.

The purpose of the processing. With regards to testimonials, we will process your personal data for the purposes as described under paragraph 3 of this Statement. More specifically we process your personal data for the purposes 1 – 7, 10 as described below in paragraph 3 of this Statement.

The personal data that is processed. When you are involved in a testimonial, we may process the following personal data about you:
Name;
Image;
Video;
Personal or professional backgrounds; and
Personal or professional testimonials.

Customer Relationship Management (CRM) system

We process personal data in our CRM system to manage our customer contacts and to provide you with the best possible service.

The persons involved. We process personal data of (contact persons of) our customers (including health care professionals) in our CRM system.

The purpose of the processing. With regards to our CRM system, we will process your personal data for the purposes as described under paragraph 3 of this Statement. More specifically we process your personal data for the purposes 1 – 7, 10 as described below in paragraph 3 of this Statement.

The personal data that is processed. If you are a (contact person of) a customer of VISUfarma, we may process the following personal data about you in our CRM system:
Name;
Employer;
Job title and role;
(Work) contact and communication details;
Gender;
Bank details (if applicable);
Purchase history; and
Email correspondence.

Suppliers, health care professionals and other business partners

We process personal data of (contact persons of) our suppliers to maintain a relationship with our suppliers and other business partners or health care professionals :

The persons involved. We process personal data of (contact persons of) our suppliers, health care professionals and other business partners.

The purpose of the processing. With regards to (contact persons of) suppliers, health care professionals and other business partners, we will process your personal data for the purposes as described under paragraph 3 of this Statement. More specifically we process your personal data for the purposes 1 – 7, 10 as described below in paragraph 3 of this Statement.

The data that is processed. If you are a (contact persons of) suppliers, health care professionals and other business partners, we may process the following information about you:
Name;
Employer;
Job title and role;
(Work) contact and communication details;
Gender;
Bank details;
Purchase history; and
Email correspondence.

VISUfarma web shop(s)

We process personal data of (contact persons of) our customers who place an order in the online web shop(s):

The persons involved. (Contact persons of) our customers who order products via our web shop(s).

The purpose of the processing. With regards to customers who order products via our web shop(s), we will process your personal data for the purposes as described under paragraph 3 of this Statement. More specifically we process your personal data for the purposes 1 – 7, 10 as described below in paragraph 3 of this Statement.

The data that is processed. When you shop via our web shop, we may process the following information about you:
Salutation;
First and last name;
Company*;
Address details;
Phone number;
E-mail Address;
Credit/debit card details and payment method;

* Not mandatory.

** Please note that VISUfarma processes your financial details to complete your order and does not store these financial details for other purposes.

We furthermore automatically collect:

IP address (automatically collected);
Web browser type and version (automatically collected);
Operating system (automatically collected);
List of URLs starting with a referring site, your activity on Our Site, and the site you exit to (automatically collected).

3. For what purposes do we use your personal data?

VISUfarma collects and processes your personal data for the following purposes:

To provide you or the company you are working for with the services you expect us to, like offering you or your employer with requested goods and services;
For the purposes of managing our relationships with business partners, health care professionals, customers and suppliers, including communicating with those parties, keeping records of those communications and promoting our products and services;
With your prior consent we may also use your contact data for;
1. direct marketing for example via e-mail, messaging or telephone;
2. conducting research and development of products and services (for example to carry out clinical trials, medical and pharmaceutical researches, develop drugs, medical devices and other products or services);
3. improving our products and services (e.g. conduct surveys or questionnaires, to carry out market researches);
4. providing health care professionals with medical or pharmaceutical information (for example to provide information regarding proper use of drug and medical device, quality, safety and effectiveness of drug and research and study in medical or pharmaceutical field; and to hold events).
To share data with third parties (as detailed in paragraph 7 below);
Where necessary, to comply with any legal obligation;
To best tailor content and resources according to your preferences;
To respond to your request or questions when you contact us;
To ensure that the content provided through the VISUfarma websites is presented in the most effective manner for you and for your device;
To further develop and improve the VISUfarma websites and systems to better serve you; and/or
We may also process your personal data to:
1. Promote the security and protection of people, premises, systems and assets;
2. Monitor compliance with internal policies and procedures;
3. Administer communications and other systems used by VISUfarma (including internal contact databases);
4. Investigate or respond to incidents and complaints;
5. Comply with obligations and rights and cooperate with investigations carried out by the police, government or regulators; and/or
6. Participate in any potential or actual purchase or sale, or joint venture, of all or part of a business or company, that any member of VISUfarma wishes to participate in.

4. What are our legal grounds for processing your personal data?

We are required by law to have a ground set out in the law to process your personal data. Therefore, when you are working with VISUfarma, our processing of your personal data for the purposes listed above are based on one of the following legal grounds:

We may process your personal data for the performance of a contract to which you are a party;
Legal obligation. In general, we may process your data based on a legal obligation. This means that we will process your data for as far as we are legally obliged to do so, for instance to comply with statutory minimum retention periods;
Legitimate interest. We may also process your personal data – when this is deemed necessary – on the legitimate interests of VISUfarma. For example in exercising its and its staff fundamental rights to run a business in a way which does not unduly affect your interests or fundamental rights and freedoms (we usually base the processing of personal data on legitimate interest for the purposes described under 1, 2, 4 and 5); and/or
In some circumstances, we base the processing of your personal data on your (explicit) consent, which we obtain from you from time to time, for example when you opt-in to receive marketing communications and news via email (e.g. for the purposes describe under 3 in paragraph 3).

Legitimate interest

Sometimes we indicate that we process your data based on the legal ground “legitimate interest”. This means that a balance of interests is performed between the interests that are served by the processing on the one hand and your privacy interests on the other hand, and that the interests in favour of the processing prevail. The related legitimate interests are included below per topic. If you want more information about this, you can contact us directly via our contact details stated below.

5. How do we obtain your personal data?

We obtain your personal data in various ways:

Provided by you. Some data about you, we receive straight from you. Examples include information in your (e-mail) correspondence to us.
Obtained internally. It is possible that we obtain your data via other VISUfarma systems. An example for our customers is the data which is included in our CRM system or which is processed via our websites (e.g. when you buy products via our online web shop or when you attend one of our webinars).
Obtained from third parties. We could also obtain data about you from other persons or external parties.
Automatically obtained. Some data we obtain automatically, for example by using cookies and similar techniques. When your computer or mobile device contacts our web servers (e.g. when you visit our website), our web servers automatically collect usage information. Such usage information includes information about how our Website Visitors use and navigate the website. It can include the number and frequency of Website Visitors to each web page and the length of their stays, browser type, and referrer data that identifies the web page visited prior and subsequent to visiting the website. Further information on this is included in our Cookie Statement.
Certain data we do not receive directly, but can be derived from the information already in our possession. For example, information about your language preferences.

In principle you are under no obligation to provide any information about yourself to us. However, refusal to supply certain information could have a negative influence on, for example, your experiences on or functionality of our website. If the provision of certain personal data is a legal or contractual obligation or an essential requirement for concluding an agreement with us, we will separately provide additional information about this for as far as this is not clear in advance. In this case we will also inform you about the possible consequences if this information is not provided.

6. How long do we store your personal data?

The retention periods of your personal data depend on the respective purpose for which this data is processed. It is not possible to provide an overview of the various retention periods in this Statement in a reasonably clear format. The criteria used in determining the applicable retention period are that we will retain the personal data described in this Statement for as long as:

it is necessary for the respective purpose;
it is necessary to conduct our business relationship with you or with your employer;
you have consented to it; and/or
it is required under the retention rules laid down by law.

In general, we do not keep your data for longer than what is necessary in relation to the purposes for which we process the data. There could however be exceptions applicable to the general retention terms.

Exception: shorter retention period. If you exercise certain privacy rights, it is possible that VISUfarma will remove your data earlier than the general applicable retention period or – oppositely – retain it for a longer period of time. For more information about this, please refer to the paragraph “What are your rights?”

Exception: longer retention period. In certain situations, we process your data for a longer period of time than what is necessary for the purpose of the processing. This is for instance the case when we have to process your data for a longer period of time:

Retention obligation.To comply with a minimum retention period or other legal obligation to which we are subject based on EU law or the law of an EU member state;
Your personal data is necessary in relation to a legal procedure;
Freedom of expression. When further processing of your personal data is necessary in order to exercise the right to freedom of expression and information.

7. Do we share your personal data with third parties?

As mentioned above, it could be possible that we disclose your personal data to third parties. This is done to complete the purposes set out above. We do this only in the following circumstances:

If this is necessary for the provision of a service or the involvement of the third party. Sub-contractors, for example, will in principle only get access to the data that they require for their part of the service provision.
Third parties will be subject to contractual and other legal obligations to preserve the confidentiality of your personal data and to respect your privacy, and will only have access to the data needed to perform their functions.
If the third party is obliged to comply with the applicable regulations for the protection of personal data, for instance because we have concluded a (data protection) agreement. This includes that the party is obliged to ensure appropriate technical and organisational security measures.

We could share your data on a need-to-know basis with the parties mentioned below. In this context, “need-to-know” means that a party only gets access to your data if and insofar as this is required for the professional services provided by this party.

We may, for example, engage a supplier to carry out administrative and operational work in support of our relationship with you. The supplier(s) will be subject to contractual and other legal obligations to preserve the confidentiality of your data and to respect your privacy, and will only have access to the data they need to perform their functions; these suppliers are typically:
IT suppliers (who host or support our VISUfarma websites and IT systems, including information about you),
premises management companies (who look after physical security at our buildings, and therefore need to know about you to allow access to our buildings),
back office finance and accounting management providers;
Members of the VISUfarma group. We may share personal data which is necessary for intercompany exchange of data with the VISUfarma group. These entities are all located inside the European Economic Area and the UK (for which there is an adequacy decision, please see below in paragraph 8);
Government, police, regulators or law enforcement agencies. We will share your data with government, police, regulators or law enforcement agencies if, at our sole discretion, we consider that we are legally obliged or authorized to do so or it would be prudent to do so;
Prospective seller or buyer and their advisers as part of due diligence relating to (or implementation of) a merger, acquisition or other business transaction..

8. Do we transfer your data outside the European Economic Area (EEA) or the UK?

Normally, we won’t transfer your personal data to a country outside the EEA or the UK. In exceptional situations though, your data might be transferred outside the EEA or the UK. Parties involved with the processing of your data originating from the EEA or the UK, may be located in a different country. In case the data is processed outside the EEA, the transfer is legitimized in the manner described below. See this link for an overview of the EEA countries.

The transfer of your data to a third party outside the EEA can in the first place be legitimized based on an adequacy decision of the European Commission, in which it is decided that the (part within the) third country in question ensures an adequate level of data protection. For example, we base the transfer of your personal data from the EEA to the UK on the applicable adequacy decision for the UK. See this link for a summary of the applicable adequacy decisions.

If your personal data is transferred to a country outside the EEA for which there is no adequacy decision in place, we agree on the applicability of the relevant version of the Standard Contractual Clauses with the relevant party. This is a standard contract to safeguard the protection of your data, which is approved by the European Commission in which the parties fill out the appendices. See this link for the various versions of the Standard Contractual Clauses and this link for the UK Standard Contractual Clauses. Where appropriate, additional safeguards should be taken.

In specific situations we can also rely on the derogations from article 49 GDPR to legitimize the data transfer. This means that we may transfer your data: (i) with your explicit consent, (ii) if this is necessary for the performance of a contract that has been concluded with you or has been concluded in your interest, or (iii) if this is necessary for the establishment, exercise or defence of legal claims. Lastly, in exceptional cases we may also transfer your data if the data transfer is necessary for our compelling legitimate interests and is not overridden by your interests or rights and freedoms.

You can contact us if you want additional information about the way in which we legitimize the transfer of your data to countries outside the EEA. Our contact details are stated at the bottom of this Statement.

9. What are your rights?

Based on the GDPR and UK GDPR you have various privacy rights. To what extent you can exercise these rights may depend on the circumstances of the processing, such as the manner in which VISUfarma processes the personal data and the legal basis for the processing. Below, we included a summary of your privacy rights under the GDPR. For more information about this go to this webpage or this webpage of the European Commission.

We will respond to all requests without undue delay. If our full response will ever take more than a month due to complexity or number of requests, we will notify you of this and keep you updated. Furthermore, please note that we may request more information to confirm your identity before acting on any request.

Your privacy rights. In relation to our processing of your personal data, you have the below privacy rights.

Right to withdraw consent. In so far as our processing of your data is based on your consent, you have the right to withdraw your consent at any time via our contact details stated below. Withdrawal of consent does not influence the legitimacy of the processing before you withdrew your consent. If you withdraw your consent, VISUfarma will no longer process your data for the purpose that you consented to. It can however be possible that we still process the personal data for another purpose, such as to comply with a minimum retention period. In that case you will be informed about this.
Right of access. You have the right to request access to your data. This enables you to receive a copy of the data we hold about you (but not necessarily the documents themselves). We will then also provide you with further specifics of our processing of your personal data. For example, the purposes for which we process your data, where we got it from, and with whom we share it.
Right to rectification. You have the right to request rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected. You have this right in case we process personal data about you that: (i) is factually incorrect; (ii) is incomplete or not related to the purpose it was collected for; or (iii) is in any other way used in a manner that is in conflict with an applicable law.

The right of rectification is not intended for the correction of professional opinions, findings or conclusions that you do not agree with. However, VISUfarma could in such case consider adding your opinion about this to your data.

Right to erasure. You have the right to request erasure of your personal data. This enables you to ask us to delete or remove your data where: (i) the data is no longer necessary, (ii) you have withdrawn your consent, (iii) you have objected to the processing activities, (iv) the data has been unlawfully processed, (v) the data has to be erased on the basis of a legal requirement, or (vi) where the data has been collected in relation to the offer of information society services.

However, we do not have to honour your request to the extent that the processing is necessary: (i) for exercising the right of freedom of expression and information, (ii) for compliance with a legal obligation which requires processing, (iii) for reasons of public interest in the area of public health, (iv) for archiving purposes, or (v) for the establishment, exercise or defence of legal claims.

Right to object. You have the right to object to the processing of your data where we are relying on legitimate interest as processing ground (see above). Insofar as the processing of your data takes place for direct marketing purposes, we will always honour your request. For processing for other purposes, we will also cease and desist processing, unless we have compelling legitimate grounds which override your interests, rights and freedoms or that are related to the institution, exercise or substantiation of a legal claim. If such is the case, we will inform you on our compelling grounds and the balance of interests made.
Right to restriction. The right to restriction of processing means that VISUfarma will continue to store personal data at your request but may in principle not do anything further with it. In short, you have this right when VISUfarma does not have (or no longer has) any legal grounds for the processing of your data or if this is under discussion. This right is specifically applicable in the following situations:

Unlawful processing. We may not (or no longer) process certain personal data, but you do not want us to erase the data. For example, because you still want to request the data at a later stage.

Data no longer required. VISUfarma no longer needs your data for our processing purposes, but you still require the personal data for a legal claim. For example, in case of a dispute.

Pending an appeal. You objected against the processing of your data by VISUfarma (see the right to object above). Pending the verification of your appeal we shall no longer process this personal data at your request.

Contesting the accuracy of data. You contest the accuracy of certain data that we process about you (e.g. via your right to rectification; see above). During the period in which we assess your contest we shall no longer process this personal data at your request.

Right to data portability. You have the right to request the transfer of your data to you or to a third party of your choice (right to data portability). We will provide you, or such third party, with your personal data in a structured, commonly used, machine-readable format. Please note that this right only applies if it concerns processing that is carried out by us by automated means, and only if our processing ground for such processing is your consent or the performance of a contract to which you are a party (see above).
Automated decision-making. You have the right not to be subject to a decision based solely on automated processing, which significantly impacts you (“which produces legal effects concerning you or similarly significantly affects you”). In this respect, please be informed that when processing your personal data, we do not make use of automated decision-making which significantly impacts you.
Right to complaint. In addition to the above-mentioned rights, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or where an alleged infringement took place. Please refer to this webpage for an overview of the supervisory authorities and their contact details. However, we would appreciate the chance to deal with your concerns before you approach them, so please contact us beforehand.

How to exercise your rights. You can exercise your privacy rights free of charge, by e-mail via the contact details displayed below. If requests are manifestly unfounded or excessive, in particular because of the repetitive character, we will either charge you a reasonable fee or refuse to comply with the request.

Verification of your identity. We may request specific information from you to help us confirm your identity before we further respond to your privacy request.

Follow-up of your requests. We will provide you with information about the follow-up of the request without undue delay and in principle within one month of receipt of the request. Depending on the complexity of the request and on the number of requests, this period can be extended by another two months. We will notify you of such an extension within one month of receipt of the request. The applicable (privacy) legislation may allow or require us to refuse your request. If we cannot comply with your request, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

10. How can you contact us?

If you have any questions or concerns regarding this Statement or you would like further information about how we protect your personal data, please email us at [email protected].

11. How do we handle changes to this Statement?

The terms of this Statement may change from time to time. In case we publish any material changes to this Statement, we will make sure we contact you via our regular communication channels.

12. Feedback

Feedback is a critical element of continual improvement. To provide feedback on this Statement, please send an email to [email protected].