Privacy Notice for Clinical Research Site, Investigator and Partner on recruitment activities
Who we are?
We are Comac Medical Ltd., a full-service privately owned boutique CRO/SMO with more than 290 full-time employees, operating in several European countries covering population of over 390 mln: Bulgaria, Romania, Spain, Italy, Serbia, Macedonia, Croatia, Bosnia and Herzegovina, Montenegro, Moldova, Georgia (South-Eastern Europe), Lithuania, Latvia, Estonia (Baltic region), Belarus, Poland, Hungary, Slovenia, Kosovo, Albania, Cyprus, Greece, Kazakhstan, United Kingdom, Czech Republic, Turkey and USA.
Our details as a corporate entity and as a data controller are:
Comac Medical Ltd., UIC 103174683, having our registered address in Sofia, Bulgaria, 131 Odrin str., 5th floor, and correspondence address:
69 Bulgaria Blvd.,
Tower B, 7 Floor
1404 Sofia, Bulgaria
Tel: +359 2 892 10 00
Fax: +359 2 892 10 01
Data Protection officer: privacy@comac-medical.com.
If you are only visitor to our website, we do not process any particular personal data except for the basic information about IP address, location, device, cookies as stated below and in our Cookies Notice.
These application forms aim to declare your interest and to be included in our database of prospective Clinical research sites, investigators, and partners on recruitment activities (referring physicians (in short – referrals)). The database is intended to be used as a pool where we may search for site, investigators and/or referrals to be included in clinical trial conducted by us as a Contract Research Organization acting on behalf of the Sponsor. Entering into the database does not guarantee that you will be selected and/or offered to become an investigator, research site, partner on recruitment activities to any particular clinical research or trial.
By way of providing the relevant information with regard to the personal data processing, it is vitally important to read this Privacy Notice before giving your consent. Should you have any questions and concerns in this regard, feel free to contact our Privacy Team at privacy@comac-medical.com.
- What kind of personal data do we collect and process?
In order to register the interest of being included in our Clinical Research Site, Investigator or Partner on recruitment activities Data Base, we need to collect and to process a specific set of information, including personal data.
For Clinical Research Site we process information of the name or the primary contact persons, email addresses, phone numbers. The rest of information provided in the registration form might not be considered as personal, because it is only related to the staffing number, the experience of the site, knowledge, organization, equipment and other organizational information. The latter is not related to any identified or identifiable person.
For investigators we may process CV, names, date of birth, location, contact information, professional experience, education including copy of your diploma/degree if required, membership in professional organization, medical certificate, name and address of clinic where you are currently working, if required.
If a contract is proposed, we`ll process financial data for payments.
In case you enter into agreement with the sponsor, we may generate some data which constitute personal data such as log data, content of correspondence and other related to the clinical trial data.
When/if you visit our premises, there is a CCTV installed and your image will be recorded and your details as visitor (name) will be logged into our visitor log.
We do not process information revealing ethnic origin, criminal records, health information, disability status, religious views and other, if not required by specific law or the GCP.
For partners on recruitment activities (referrals) form, we collect and process information about your name, title, phone number, e-mail, affiliation or membership to professional organization or workplace including their address. In addition, we collect and further process information on your professional qualification, specialty.
For all groups of users and website visitors, we may process information related to your location, IP address, your web preferences as it is stated in our Cookies Policy, the way you navigate and interact with this website. The purpose is to improve the functionalities of our website and our services.
Sometimes we may conduct remarketing campaigns for the purpose of enhancing the visibility and the transparency of our activity and our services.
- How do we obtain personal data?
For the purpose of maintaining the database described herein, we obtain your data directly from you. In some cases, we may validate the data you provided using external public information sources.
By way of using this web site and its forms, we may automatically collect information about your IP address, approximate location, device (type of device – mobile or PC) log data, usage information, and cookies.
The information about the location is not specifically tracked, but provides information about the geographic area where your device interacts with our web site as indicated by the IP address of another similar identifier.
More information about the cookies you may find in our Cookie Policy.
- For what purpose it is necessary to provide your personal information?
In order to be able to include you in our database of prospective Clinical research sites, investigators and referrals we need a set of personal data which is used to conduct a preliminary assessment of your eligibility based on legitimate interest or legal obligation. In addition, your personal data is necessary to contact you, in case further verification of your interest or additional information is needed. In case you are selected, we will invite you to participate in the respective clinical research/trial as Clinical research site, investigator. For entering into and fulfilling agreement we may process additional set of personal information which is necessary for this purpose. On that stage we might process your data if it is necessary for insurance (when applicable), accountability and compliance purposes, communication, and correspondence. When necessary, we might have legitimate interest, especially if you visit our premises or use our resources to process data for access control, CCTV, IT security.
It is possible also to see ads for our activities, services and/or products by remarketing campaigns.
We may use the personal data for statistical and archiving purposes. In this case we apply appropriate technical and organizational measures to ensure personal data protection.
We do not plan to process further your personal data for purposes other than those specifically described herein. In case of changes, we`ll notify you prior to that further processing.
- Which is the legal basis of processing and why do we need your consent with regards to the personal data processing?
To be included in our database of prospective Clinical research sites, investigators, and partners on recruitment activities (referrals) is a voluntary act based on consent. By giving your consent you declare your will to be included in our database as well as your personal data to be used in this regard. Your consent needs to be freely given, specific to the purposes described herein, informed as it is stated in this Privacy Notice and unambiguous. You will have the opportunity to withdraw your consent at any time by sending an email to privacy@comac-medical.com.
The data processed for database, feasibility and shortlisting is based on legitimate interest. In some cases, the shortlisting might be on legal obligation if we do it on behalf of a sponsor.
For archiving and statistical purposes, we rely on legitimate interest or legal obligation, depending on the relevant circumstances.
For remarketing campaigns, we rely on your consent.
- What would be the consequences in case you do not provide your consent to processing personal information?
If we do not have your valid consent for personal data processing, we cannot include you in our data base. We will exclude you and will immediately stop processing your personal data if your consent is not valid or If we have a reasonable assumption that your consent might be invalid.
- Do we share your personal information with internal organizations?
We may share your personal data with our affiliates and/or local offices in other countries, which are affiliates of Comac Medical too and we share the same pool of information and administrative resources. A few employees of “Comac Medical” Ltd.(Bulgaria)/ Comac Medical Hungary (branch of the Bulgarian Entity) / S.C. Comac Medical S.R.L.(Romania)/ Comac Medical D.O.O.(Serbia)/ Comac Medical DOOEL (Macedonia)/ UAB Comac Medical (Lithuanian)/ UAB Comac Medical Poland (branch of the Lithuanian)/ Comac Medical LLC (Georgia)/ Comac Medical D.O.O. (Bosnia and Herzegovina)/ Comac Medical D.O.O. (Croatia)/ Comac Medical SHPK (Albania)/ COMAC MEDICAL LTD BULGARISTAN ISTANBUL MERKEZ SUBESI, MC COMAC MEDICAL, International research network Ltd. and/or its affiliates may access your data only if is necessary as described above.
Your personal data might be processed for the purposes mentioned above only by Comac Medical responsible employees on a need-to-know basis and only to the extent necessary for the respective purpose or your contract fulfillment.
- Do we share your personal information with external organizations?
We may share your personal data with services providers and business partners, auditors, sponsors, monitors, hosting and cloud services, web developers, legal advisors, professional advisors, and others.
We may share your information with law enforcement agencies, courts, regulators, public authorities – if required by law or administrative act.
Your identity will be always kept confidential except to those professionals who need to collect, check, transfer and process your data in pursuance of the above objectives such as inspectors from competent authorities, monitors, auditors, tax and social security authorities, Ethics Committee may have direct access to your personal data.
The information collected may be transferred to other companies or to contractors working for them. Your information may be sent to some countries outside Europe that might not have the same level of privacy as Europe. The privacy of your information will be protected as far as the law allows and will be kept supervised for as long as needed.
- For how long do we retain your personal information?
We retain your personal data for no longer than is necessary for the purposes for which the personal data are processed, or it is required from the applicable laws. We always keep personal data for limited period.
The video surveillance data is retained for up to 2 months.
If your personal data, at later stage, is included into documentation under clinical trial protocol or it is relevant to clinical trial, may be retained for 15 years under the Bulgarian legislation and at least 25 years when Clinical trials regulation becomes effective.
- Do we transfer your personal data internationally and outside the EU?
If required for the respective potential clinical research/trial, we may have sponsors, partners, other investigators, and sites these participants may be established or located in a foreign country including outside European Union. When we prepare a clinical trial/research or other related activities with international coverage, we may transfer your data to our affiliates, some of them outside EU. For certain cases, when an interaction with another Comac Medical affiliate is needed, it may be established or located in foreign country including outside European Union, therefore we may transfer your data to our affiliates, some of them outside EU/EEA.
We use interactive tools from Facebook, YouTube, LinkedIn, Google Maps and Google analytics which may transfer your IP address, web preferences as it is stated in our Cookies Policy in other countries, including outside EU.
- How do we protect your rights and freedoms in case of non-EU personal data transfer?
For several non – EU countries, the European Commission explicitly adopted a decision that these countries provide an adequate level of data protection mechanism and when your personal data is transferred to them no specific additional safeguards are needed from our side. Currently, The European Commission has so far recognized Andorra, Argentina, Canada (commercial organizations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland, Uruguay and the United States of America (limited to the Privacy Shield framework) as providing adequate protection. Potentially also United Kingdom and South Korea might be recognized.
In case we transfer your data to other countries not listed above we use standard contractual clauses to ensure the equal level of protection as in EU.
In exceptional cases, where it is not possible or appropriate to apply any of the safeguards, оccasionally, we may transfer your data if it is necessary for the performance of a contract between you and the sponsor through us or the implementation of pre-contractual measures at your request, or the contract concluded in your interest or when it is necessary for establishment of legal claims.
When there is a need to transfer personal data for important reasons of public interest such as public health, the transfer may not be occasional. In any other cases you will be asked for explicit consent.
You should be aware that in these cases there is a risk your rights related to privacy to be limited and not to be provided with the same level of data protection as in EU/EEA.
- Can you withdraw your consent on personal data processing?
You can withdraw your consent at any time by sending an email to privacy@comac-medical.com
- Do we perform automated decision – making, including profiling?
We do not execute automated decision – making, apart the analytics described in our Cookie Policy.
- How do we protect your personal data?
The connection of our web site where you fill your personal information is ensured through secured Hypertext Transfer Protocol Secure.
Comac Medical Ltd. has implemented appropriate technical and organizational measures to protect your right and freedoms concerning personal data protection including to prevent unauthorized access, disclosure, loss and/or alteration.
- What are your rights with regards to the personal data processing?
- Right of access
You have the right to request information whether we process personal data related to you and certain additional information in this regard such as for purposes of processing, categories of personal data, recipients to whom your personal data have been or will be disclosed in particular recipients in thirds countries.
- Right of rectification
You have the right to request that your personal data be corrected if any changes have been made or found to be incomplete or inaccurate.
- Right to erasure (“right to be forgotten”)
You have the right to request that your personal data to be deleted when it is no longer needed for the purposes for which it has been processed when you withdraw your consent on which the processing is based and where there is no other legal ground for the processing.
You are entitled to request the erasure of your data have been unlawfully processed; if your data need to be erased for compliance with a particular legal obligation.
After considering all the circumstances of this request, we may refuse to delete your personal data if the processing is necessary to comply with a legal obligation which is applicable to us or for reasons of a public interest in the area of public health, for archiving purposes in the public interest, scientific, statistical purposes or for establishment, exercise or defense of legal claims.
The exercise of the right of erasure may not affect the rights and freedoms of others.
- Right to restriction of processing
You have the right to request a restriction of processing while we consider your rectification request, until verifying the accuracy of your personal data.
You may also request a restriction on processing when you do not want your personal data to be deleted, including in connection with the exercise or protection of legal claims. Processing restriction may also apply if you have objected against automatic decision-making or profiling or during the pending verification whether our legitimate grounds override yours.
- Right to data portability
You have the right to receive personal data that concerns you and that you have provided to us, in a structured, widely used and machine-readable format, and you have the right to request that we transfer this data to another controller in the following cases:
- Processing is based on consent or on a contract and it is carried out automatically.
When exercising this right, the transfer can only be made by us to another controller when it is technically feasible.
This right shall not apply to the processing necessary for the performance of a public interest task.
The exercise of the right of portability may not affect the rights and freedoms of others.
- Right to object
When decisions are made against you (if any), it is only based on automated processing of your data, including profiling, that you may object.
This right may not be exercised when automated processing is necessary for the conclusion or performance of a contract between us.
When processing your data for direct marketing purposes (when such is done), you have the right to object to such processing at any time and your processing of personal data for that purpose is terminated.
Depending on your particular situation, at any time of the processing of your data on the grounds of legitimate interest, you have the right to object before us. In this case, we shall no longer process your data unless we demonstrate compelling this legitimate ground for the processing which overrides your interest, rights and freedoms or for establishment, exercise or defense of legal claims
- Right to lodge a complaint with a supervisory authority
Within the EU, you have the right to complain to a supervisory authority about how your information is handled and/or when you feel your rights and freedoms regarding personal data processing are violated.
If you have provided your consent, you may withdraw it at any time by sending an e-mail to privacy@comac-medical.com
- How to file an inquiry, complain or requests in terms of data protection?
You may file an inquiry, complain or requests in terms of data protection by sending an email to privacy@comac-medical.com .
To handle your request, we may require additional identification.
To facilitate the process, we may require also to fill specific request form to exercise your rights, especially if your request is unclear. In this case, we will provide you with the respective form.
If you act through a proxy or on behalf of someone else, you need you provide us with the valid power of attorney following the applicable law.
- Do we use cookies on our website?
For this site, sometimes we store small data files called cookies on your device, to make the website work properly. Most major websites also use this method. You can check through your browser what cookies you use; how long cookies are stored and how to manage them.
- Cookies and marketing tools integrated to this web site?
What are cookies?
Cookies are small text files that are saved to your computer or mobile device when you visit a website. They allow the website to store your actions and preferences (such as username, language, font size, and other display settings) for a specified period so you don’t have to enter them every time you visit the site or switch from page to page.
How to control cookies
You can block, disable and/or delete analytics and marketing cookies whenever you like – see https://aboutcookies.org/ for more information. In addition, you can delete any cookies already stored on your computer, and you can also set most browsers to block them. However, if you do this, you may need to manually adjust some parameters each time you visit a site, and some services and features may not work.
All modern browsers allow you to change your cookie settings. You can usually find these settings in the “options” or “preferences” menu of your browser. To be aware of these settings, the following links may help, or you can use the “Help” button in your browser menus for more details:
Cookie settings in Internet Explorer
- Linking to external web pages?
Our website contains links and may redirect you to external websites which are independent data controllers and may process your data at their legal basis. Please, when you use other websites and external systems, nevertheless you are redirected from our website, read carefully their information regarding personal data processing.
Besides, there are embedded links to LinkedIn, Facebook, Google.
- Changes in this Privacy Notice?
We reserve the right to modify or amend this Privacy Notice. For instance, it may need to change as new legislation is introduced or as it is amended. The updated Privacy Notice will be posted on this website. When it is reasonable and/or in case of significant changes we will notify the data subjects, enrolled in our database via your registered email or by posting a visible message on our website.