Privacy Policy

1. General information, controller & data protection officer

We treat personal data confidentially and in accordance with applicable data protection law, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The controller is Pharma-Zentrale GmbH, Loerfeldstr. 20, 58313 Herdecke, Germany, email: office@pharma-zentrale.de.

You can contact our data protection officer at arbeitgeber ruhr GmbH, Mr Dirk Grützner, Königsallee 67, 44789 Bochum, Germany, email: gruetzner@datenschutzbeauftragter.ruhr, phone: +49 234 58877-26.

2. Website provision, hosting & server logs

The website origin services and form functions are provided through Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (AWS), in the Frankfurt region (eu-central-1). AWS processes data on our behalf under Art. 28 GDPR; the AWS Data Processing Addendum forms part of the AWS Service Terms.

We use Amazon CloudFront for fast and secure delivery. The distribution currently uses Price Class 100, with edge locations primarily in Europe and North America. This does not restrict processing to the EU: technically necessary delivery through other locations and required support access may also involve third countries. IP addresses and technical connection data are processed for this purpose. Section 8 explains the transfer mechanisms.

Editorial content is managed with Storyblok, whose platform operator is Storyblok GmbH, Peter-Behrens-Platz 2, 4020 Linz, Austria. Published texts are retrieved through our website backend. Images and other media may, however, be loaded directly from the Storyblok CDN, which receives in particular your IP address and technical browser connection data. Contact and application form data is not transmitted to Storyblok. Providing editorial content and media is based on Art. 6(1)(f) GDPR and our legitimate interest in reliable and secure website operation. Where Storyblok processes data on our behalf, its data processing agreement under Art. 28 GDPR applies. Sub-processor and transfer information is available at www.storyblok.com/legal/dpa.

When a page is requested, technically required data may be processed, including IP address, date and time, requested page or file, transferred data volume, HTTP status, referrer, browser, operating system and device. This serves website delivery, stability, security, error analysis and prevention of misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. Server logs are generally deleted after no more than 14 days unless they are required for longer to investigate a specific security incident or to pursue legal claims.

3. Local storage technologies & no tracking

For language selection, we store the preference in browser local storage under cc.language and, after an active language selection, in the pz_language cookie for up to one year. The decision to load Google Maps is stored locally under cookie-consent-given until it is changed or the website data is cleared in the browser. Technically necessary access is based on Section 25(2)(2) TDDDG; subsequent processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is a consistent language setting and a functional website.

Analytics, audience measurement, marketing and social-media tracking services are not integrated into the current public website.

4. Contact form & contact by email

When you contact us, we process in particular your name, company, email address, optional phone number, subject, message and any other information you provide voluntarily in order to handle your enquiry and communicate with you. The legal basis is Art. 6(1)(b) GDPR where pre-contractual or contractual measures are concerned and otherwise Art. 6(1)(f) GDPR. Our legitimate interest is the proper handling of incoming enquiries.

Required fields are necessary for processing. Access is limited to responsible employees and instructed technical providers, in particular AWS for hosting, storage and email delivery. Contact enquiries are generally deleted after no more than 183 days. They are retained for longer only where required by an ongoing contractual relationship, statutory retention duties or the establishment, exercise or defence of legal claims.

5. Application procedures

For an application, we process in particular your name and contact details, the desired position, qualifications, education, professional background, employment status, voluntary messages, communication data and uploaded PDF documents. Please provide special categories of personal data under Art. 9 GDPR only where they are necessary for the specific application.

Processing serves the decision on establishing an employment relationship and is based on Section 26(1), sentence 1 BDSG in conjunction with Art. 6(1)(b) GDPR. Necessary special categories of personal data are processed under Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG. Without required information, we may be unable to consider the application.

Access is limited to employees in HR and the relevant department who are involved in the procedure. Documents are processed in encrypted, non-public storage and transmitted with the form details to the designated HR recipients. We use Amazon S3, Amazon DynamoDB and Amazon Simple Email Service for this purpose. No automated decision-making or profiling takes place.

Following rejection, withdrawal or other completion of the procedure, application data and documents are generally deleted after no more than 183 days. Temporary retention to establish, exercise or defend legal claims is based on Art. 6(1)(f) GDPR. If an employment relationship is established, required data is transferred to the personnel file. Inclusion in a talent pool or longer storage for future vacancies takes place only on the basis of separate express consent, which may be withdrawn at any time with effect for the future.

Technical intermediate copies used for online transmission are separate from the HR records: automatic deletion is configured for form data in website storage and uploaded files after 183 days from receipt or upload respectively. Execution of cloud-based deletion may be technically delayed. Emails and PDF attachments transmitted to HR are subject to the retention period following completion of the application procedure described above.

6. Google Maps, web fonts & technical form services

Google Maps is loaded only with your consent, either by selecting ‘Load Google Maps’ or on the basis of previously stored consent. Before consent and after refusal, the map is not embedded. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Loading may transmit your IP address, date and time, browser and device information, the page visited and any location data you have authorised to Google. Google may store information on your device or access existing information. Processing outside the EU or EEA is possible. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your voluntary consent for the future at any time by selecting ‘Disable Google Maps’ or ‘Disable’; the embedded map is then removed. The lawfulness of processing before withdrawal remains unaffected. Your decision is stored under cookie-consent-given. External route and map links open Google Maps only after your deliberate selection.

Google Maps may transfer data to Google LLC in the United States. According to Google's published information, Google LLC and the US subsidiaries covered by its certification participate in the EU-U.S. Data Privacy Framework. Transfers covered by this certification are subject to the adequacy decision under Art. 45 GDPR. Further information: policies.google.com/privacy and policies.google.com/privacy/frameworks.

The web fonts used by this website are served locally; loading them does not establish a connection to Google Fonts or Adobe Fonts. We use AWS services, in particular Amazon S3, Amazon DynamoDB and Amazon Simple Email Service, to process, store and transmit contact and application forms under a data processing agreement pursuant to Art. 28 GDPR.

7. Reports of side effects & quality complaints

If you wish to report side effects or quality complaints relating to medicinal products, please contact a healthcare professional, your pharmacy or the competent health authority. If you provide us directly with information on side effects, quality complaints or other medicinal-product safety events, we may process it separately to comply with legal pharmacovigilance and medicinal-product safety duties. This may include health data; supplementary privacy information will be provided where required.

8. Recipients & possible third-country transfers

Within Pharma-Zentrale GmbH, access is limited to units that require the data for the relevant purpose. Instructed service providers for hosting, IT operation, content management, storage and email delivery may also receive personal data as processors.

Primary processing of origin services and forms takes place in the AWS Frankfurt region. CloudFront, the Storyblok media CDN, sub-processors or required support access may nevertheless involve processing outside the EU or EEA. According to AWS's published information, Amazon Web Services is an entity covered by Amazon.com, Inc.'s EU-U.S. Data Privacy Framework certification. Covered transfers to the United States may rely on the adequacy decision under Art. 45 GDPR. The AWS Data Processing Addendum also includes EU Standard Contractual Clauses for transfers not covered by an adequacy decision. Further information: aws.amazon.com/compliance/eu-us-data-privacy-framework/ and aws.amazon.com/compliance/gdpr-center/.

Storyblok's data processing agreement provides for EU Standard Contractual Clauses under Art. 46(2)(c) GDPR and additional safeguards where needed for processing outside the EU or EEA. Art. 45 GDPR may apply to a recipient in a country covered by an adequacy decision. For US recipients, this applies only where the specific recipient and transfer are actually covered by a valid DPF certification; we do not claim that Storyblok itself holds a DPF certification. Provider information and the sub-processor list are available at www.storyblok.com/legal/dpa. The mechanism for Google Maps is described in the preceding section.

You may request information on the safeguards used for a specific recipient and a copy of the applicable Standard Contractual Clauses by contacting office@pharma-zentrale.de or our data protection officer. Transfers are subject to Art. 44 et seq. GDPR.

9. Your rights & right to lodge a complaint

Subject to statutory requirements, you have rights of access under Art. 15 GDPR, rectification under Art. 16 GDPR, erasure under Art. 17 GDPR, restriction under Art. 18 GDPR, data portability under Art. 20 GDPR and objection under Art. 21 GDPR. Where processing is based on consent, you may withdraw it at any time with effect for the future. You may object on grounds relating to your particular situation where processing is based on Art. 6(1)(f) GDPR.

You may lodge a complaint with a data protection supervisory authority. The authority particularly responsible for Pharma-Zentrale GmbH is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, P.O. Box 20 04 44, 40102 Düsseldorf, Germany, email: poststelle@ldi.nrw.de, www.ldi.nrw.de.

10. Privacy contact & updates

For questions or to exercise your rights, contact Pharma-Zentrale GmbH at office@pharma-zentrale.de or the data protection officer named above.

We may update this privacy policy when legal, technical or organisational circumstances change. The version published on this website applies.