Privacy Policy PROTEON PHARMACEUTICALS S.A.

Information clause – Article 13 GDPR – CUSTOMER

When using our services / purchasing our products, pursuant to article 13 section 1 and section 2 of the General Data Protection Regulation (GDPR) of 27 April 2016, the Company informs that:

1.The Administrator of personal data is Proteon Pharmaceuticals S.A. with its registered office in Łódź, ul. Tylna 3a, 90-364 Łódź, entered into the register of entrepreneurs of the National Court Register under the number 0000377342, registration files are in the District Court for Łódź Śródmieście in Łódź, XX Commercial Division of the National Court Register, NIP: 7282570596, with share capital of PLN 766,194.50 (fully paid), e-mail address: rodo@proteonpharma.com.

2. Purpose, basis and period of data processing:

The processing of personal data takes place solely for the purpose of:

  1. conclusion and performance of the contract, i.e. pursuant to article 6 section 1 point b) GDPR – for the duration of a contract and after its termination until expiration of the claims arising from the conclusion and performance of the contract, or pursuing claims;
  2. fulfillment of binding legal obligations, pursuant to article 6 section 1 point c) GDPR, e.g. issuing and storing invoices and accounting documents, lodge a complaint claim under the warranty or guarantee for the period of performance of obligations and for the period in which the regulations require the storage of data (e.g. tax regulations), as well as the period in which the Administrator has the appropriate privileges;
  3. implementation of the legitimate legal interest of the Administrator, pursuant to article 6 section 1 point f) GDPR, e.g. direct marketing for the duration of the contract, improving the quality of services, extending the scope of services and adapting them to the needs of customers, establishing, pursuing and defending against claims, data analysis, managing relationships with Customers and Suppliers.
3. Rights:

In connection with the processing of personal data, you have certain rights:

  1. the right to access your personal data (Article 15 of the GDPR),
  2. the right to rectify (update) data (Article 16 of the GDPR),
  3. the right to supplement the data (Article 16 of the GDPR),
  4. the right to limit their processing, with the exception of the cases indicated in article 18 section 2 GDPR, among others this right will not apply to the extent that the processing of personal data will be necessary to assert any claims,
  5. the right of objection (Article 21 of the GDPR) for reasons related to a special situation –to the processing of data pursuant to article 6 section 1 point f) or to processing for direct marketing purposes – at any time, regardless of the specific situation of the data subject,
  6. the right to delete, provided that it is limited only to data that is not necessary to achieve the purposes indicated in article 17 section 3 point b), d) and e) of the GDPR, i.e. to fulfill the legal obligation requiring data processing, to establish, assert and defend claims, or for archival purposes,
  7. the right to lodge a complaint to the President of the Data Protection Office, ul. Stawki 2, 000-193 Warsaw, tel. 22 531 03 00, if you feel that the processing of your personal data violates the provisions of the GDPR.
4. Data storage period:

Personal data will be stored for the duration of the contract, as well as for the period of limitation of claims under the contract, or relatively for the period necessary to pursue claims arising from the contract.

5. Voluntary data provision:

Providing personal data is voluntary, but necessary for the conclusion and performance of the contract, and the consequence of not providing personal data, will be the inability to conclude and perform the contract.

6. Data recipients:

Your personal data may be shared with:

  1. processing entities such as:
    1. IT services provider in the field of software;
    2. IT software producer;
    3. an entity providing software service;
    4. an entity providing HR and accounting services for the Administrator;
  2. other administrators, such as:
    1. an entity cooperating in handling legal matters – to the extent that it will become the data controller;
    2. the competent authority of the Tax Administration.
7. Transfer of personal data to a third country / international organization:

Personal data may be transferred to a third country with regard to the use of IT systems and cloud services by the Administrator, however, the entity providing the abovementioned services is recognized by the European Commission as an entity providing an adequate level of protection, and in the case of transferring cloud services by the entity to a third country that does not have an adequate level of protection – entity ensures adequate and appropriate safeguards.

8. Automated decision-making, profiling:

Personal data will not be processed automatically and will not be profiled.

Information clause – article 13 GDPR – CONTRACTORS / PARTNERS PROVIDING
SERVICES FOR THE COMPANY / SUPPLIERS

With regard to the conclusion of the agreement,  Proteon Pharmaceuticals S.A. with its registered office in Łódź, ul. Tylna 3a, 90-364 Łódź, entered into the register of entrepreneurs of the National Court Register under the number 0000377342, registration files are in the District Court for Łódź Śródmieście in Łódź, XX Commercial Division of the National Court Register, NIP: 7282570596, with share capital of PLN 766,194.50 (fully paid), e-mail address: rodo@proteonpharma.com, becomes the administrator of personal data.

1. Purpose, basis and period of data processing:

The processing of personal data takes place solely for the purpose of:

  1. conclusion and performance of the contract, i.e. pursuant to article 6 section 1 point b) GDPR – for the duration of a contract and after its termination until expiration of the claims arising from the conclusion and performance of the contract, or pursuing claims;
  2. fulfillment of binding legal obligations, pursuant to article 6 section 1 point c) GDPR, e.g. for the period in which the regulations require the storage of data (e.g. tax regulations), as well as the period in which the Administrator has the appropriate privileges;
  3. legitimate legal interest, pursuant to article 6 section 1 point f) GDPR, e.g. for the purpose of managing the business, establishing, pursuing and defending against claims.
2. Rights:

In connection with the processing of personal data, you have certain rights:

  1. the right to access your personal data (Article 15 of the GDPR),
  2. the right to rectify (update) data (Article 16 of the GDPR),
  3. the right to supplement the data (Article 16 of the GDPR),
  4. the right to limit their processing, with the exception of the cases indicated in article 18 section 2 GDPR, among others this right will not apply to the extent that the processing of personal data will be necessary to assert any claims,
  5. the right of objection (Article 21 of the GDPR) for reasons related to a special situation – to the processing of data pursuant to article 6 section 1 point f),
  6. the right to delete, provided that, this right is limited only to data that is not necessary to achieve the purposes indicated in article 17 section 3 point b), d) and e) of the GDPR, i.e. to fulfill a legal obligation requiring data processing, to establish, assert and defend claims, or for archival purposes;
  7. the right to lodge a complaint to the President of the Data Protection Office, ul. Stawki 2, 000-193 Warsaw, tel. 22 531 03 00, if you feel that the processing of your personal data violates the provisions of the GDPR.
3. The period of data storage:

Personal data will be stored for the duration of the contract, as well as for the period resulting from legal provisions (e.g. accounting obligations) or for the period of limitation of claims under the contract, or relatively for the period necessary to pursue claims arising from this contract.

4. Voluntary data provision:

Providing personal data is voluntary, but necessary for the conclusion and performance of the contract, and the consequence of not providing personal data, will be the inability to conclude and perform the contract.

5. Data recipients:

Your personal data may be shared with:

  1. processing entities such as:
    1. IT services provider in the field of software;
    2. IT software producer;
    3. an entity providing software service;
    4. an entity providing HR and accounting services for the Administrator;
  2. other administrators, such as:
    1. an entity conducting payment activity (banks, payment institutions) – in order to make payment of remuneration;
    2. an entity cooperating in handling legal matters – to the extent that it will become the data controller;
    3. the competent authority of the Tax Administration, the competent branch of the Social Insurance Institution, the National Health Fund (if the Administrator, in connection with the conclusion of the contract, is a tax payer, payer of contributions, or also for accounting / tax purposes).
6. Transfer of personal data to a third country / international organization:

Personal data may be transferred to a third country with regard to the use of IT systems and cloud services by the Administrator, however, the entity providing the abovementioned services is recognized by the European Commission as an entity providing an adequate level of protection, and in the case of transferring cloud services by the entity to a third country that does not have an adequate level of protection – entity ensures adequate and appropriate safeguards.

7. Automated decision-making, profiling:

Personal data will not be processed automatically and will not be profiled.

Information clause – article 13 GDPR – MARKETING CONSENT

Upon giving marketing consent, pursuant to article 13 section 1 and section 2 of the General Data Protection Regulation (GDPR) of 27 April 2016, the Company informs that:

1. The administrator of personal data is Proteon Pharmaceuticals S.A. with its registered office in Łódź, ul. Tylna 3a, 90-364 Łódź, entered into the register of entrepreneurs of the National Court Register under the number 0000377342, registration files are in the District Court for Łódź Śródmieście in Łódź, XX Commercial Division of the National Court Register, NIP: 7282570596, with share capital of PLN 766,194.50 (fully paid), e-mail address: rodo@proteonpharma.com.

2. Purpose, basis and period of data processing:

The processing of personal data takes place only for the purpose of sending marketing messages based on the consent granted pursuant to article 6 section 1 point a) GDPR.

3. Rights:

In connection with the processing of personal data, you have certain rights:

  1. the right to access your personal data (Article 15 of the GDPR),
  2. the right to rectify (update) data (Article 16 of the GDPR),
  3. the right to supplement the data (Article 16 of the GDPR),
  4. the right to limit their processing,
  5. the right to delete data,
  6. the right to withdraw consent at any time,
  7. the right to lodge a complaint to the President of the Personal Data Protection Office, ul. Stawki 2, 000-193 Warsaw, tel. 22 531 03 00, if you feel that the processing of your personal data violates the provisions of the GDPR.
4. The period of data storage:

Until the withdrawal of the consent, which may take place at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

5. Voluntary data provision:

Personal data submission and giving a consent is fully voluntary, and refusing consent does not cause any negative consequences.

6. Recipients of data:

Personal data may be shared with:

  1. IT service providers in the field of software;
  2. IT software producers;
  3. entities providing software maintenance services;
  4. entities providing advisory, consulting, auditing services, tax assistance and legal assistance.
7. Transfer of personal data to a third country / international organization:

Personal data may be transferred to a third country with regard to the use of IT systems and cloud services by the Administrator, however, the entity providing the abovementioned services is recognized by the European Commission as an entity providing an adequate level of protection, and in the case of transferring cloud services by the entity to a third country that does not have an adequate level of protection, entity ensures adequate and appropriate safeguards.

8. Automated decision-making, profiling:

Personal data will not be processed automatically and will not be profiled.

Information clause – article 13 GDPR – PERSONS MAKING INQUIRIES

Upon sending an inquiry / contacting one of our employees, pursuant to article 13 section 1 and section 2 of the General Data Protection Regulation (GDPR) of 27 April 2016, the Company informs that:

1. The administrator of personal data is Proteon Pharmaceuticals S.A. with its registered office in Łódź, ul. Tylna 3a, 90-364 Łódź, entered into the register of entrepreneurs of the National Court Register under the number 0000377342, registration files are in the District Court for Łódź Śródmieście in Łódź, XX Commercial Division of the National Court Register, NIP: 7282570596, with share capital of PLN 766,194.50 (fully paid), e-mail address: rodo@proteonpharma.com.

2. Purpose, basis and period of data processing:

The processing of personal data takes place only for the purpose of answering the question / reaction to making contact, based on article 6 section 1 point f) GDPR – legitimate interest of the Administrator.

3. Rights:

In connection with the processing of personal data, you have certain rights:

  1. the right to access your personal data (Article 15 of the GDPR),
  2. the right to rectify (update) data (Article 16 of the GDPR),
  3. the right to supplement the data (Article 16 of the GDPR),
  4. the right to limit their processing, with the exception of the cases indicated in article 18 section 2 GDPR, among others this right will not apply to the extent that the processing of personal data will be necessary to assert any claims,
  5. the right of objection (Article 21 of the GDPR) for reasons related to a special situation – to the processing of data pursuant to article 6 section 1 point f) or to processing for direct marketing purposes – at any time, regardless of the specific situation of the data subject,
  6. the right to delete, provided that it is limited only to data that is not necessary to achieve the purposes indicated in article 17 section 3 point b), d) and e) of the GDPR, i.e. to fulfill the legal obligation requiring data processing, to establish, assert and defend claims, or for archival purposes,
  7. the right to lodge a complaint to the President of the Data Protection Office, ul. Stawki 2, 000-193 Warsaw, tel. 22 531 03 00, if you feel that the processing of your personal data violates the provisions of the GDPR.
4. The period of data storage:

Personal data will be stored until the case that is the subject of the inquiry is completed or until an objection to the processing of personal data is raised. After the expiry of the indicated periods, the Administrator will store personal data, if it is obliged to do so under the law, for the period provided in these provisions or to pursue legitimate interests – for the period of limitation of claims.

5. Voluntary data provision:

Providing personal data is voluntary, but necessary to answer the inquiry, handling the case, and the consequence of not providing personal data will be the inability to answer the inquiry / handling the case.

6. Data recipients:

Your personal data may be shared with:

  1. processing entities such as:
    1. IT services provider in the field of software;
    2. IT software producer;
    3. an entity providing software service;
  2. other administrators, such as competent law authorities, i.e. courts, law enforcement authorities, etc.
7. Transfer of personal data to a third country / international organization:

Personal data may be transferred to a third country with regard to the use of IT systems and cloud services by the Administrator, however, the entity providing the abovementioned services is recognized by the European Commission as an entity providing an adequate level of protection, and in the case of transferring cloud services by the entity to a third country that does not have an adequate level of protection, entity ensures adequate and appropriate safeguards.

8. Automated decision-making, profiling:

Personal data will not be processed automatically and will not be profiled.

Information clause – art. 14 GDPR – PROCESSING OF DATA OBTAINED IN
CONNECTION WITH CONCLUSION OF CONTRACTS WITH ENTITIES WHO
ARE NOT NATURAL PERSONS

Performing the obligation pursuant to article 14 section 1 and 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, the Company informs, that:

1. The administrator of personal data is Proteon Pharmaceuticals S.A. with its registered office in Łódź, ul. Tylna 3a, 90-364 Łódź, entered into the register of entrepreneurs of the National Court Register under the number 0000377342, registration files are in the District Court for Łódź Śródmieście in Łódź, XX Commercial Division of the National Court Register, NIP: 7282570596, with share capital of PLN 766,194.50 (fully paid), e-mail address: rodo@proteonpharma.com.

2.The source of personal data is the entity, that provides the Administrator with personal data as part of using the Administrator’s services / purchasing products or in connection with the provision of services / products to the Administrator.

3. Personal data will be processed in order to conclude and perform the contract pursuant to article 6 section 1 point b) of the GDPR, as well as in order to implement the legitimate interests of the Administrator, although the legitimate interest pursued by the Administrator is: enabling the provision of services / sale of products, or enabling the purchase of services / products, data analysis, management of the Administrator’s activities, direct marketing.

4. Rights:

In connection with the processing of personal data, you have certain rights:

  1. the right to access your personal data (Article 15 of the GDPR),
  2. the right to rectify (update) data (Article 16 of the GDPR),
  3. the right to supplement the data (Article 16 of the GDPR),
  4. the right to limit their processing, with the exception of the cases indicated in article 18 section 2 GDPR, among others this right will not apply to the extent that the processing of personal data will be necessary to assert any claims,
  5. the right of objection (Article 21 of the GDPR) for reasons related to a special situation – to the processing of data pursuant to article 6 section 1 point f) or to processing for direct marketing purposes – at any time, regardless of the specific situation of the data subject,
  6. the right to delete, provided that it is limited only to data that is not necessary to achieve the purposes indicated in article 17 section 3 point b), d) and e) of the GDPR, i.e. to fulfill the legal obligation requiring data processing, to establish, assert and defend claims, or for archival purposes,
  7. the right to lodge a complaint to the President of the Data Protection Office, ul. Stawki 2, 000-193 Warsaw, tel. 22 531 03 00, if you feel that the processing of your personal data violates the provisions of the GDPR.
5. The period of data storage:

Personal data will be stored for the duration of the contract, as well as for the period resulting from legal provisions (e.g. accounting obligations) or for the period of limitation of claims under the contract, or relatively for the period necessary to pursue claims arising from this contract.

6. Voluntary data provision:

Providing personal data is voluntary, but necessary for the conclusion and performance of the contract, and the consequence of not providing personal data, will be the inability to conclude and perform the contract.

7. Data recipients:

Your personal data may be shared with:

  1. processing entities such as:
    1. IT services provider in the field of software;
    2. IT software producer;
    3. an entity providing software service;
    4. an entity providing HR and accounting services for the Administrator;
  2. other administrators, such as:
    1. an entity cooperating in handling legal matters – to the extent that it will become the data controller;
    2. the competent authority of the Tax Administration.
8. Transfer of personal data to a third country / international organization:

Personal data may be transferred to a third country with regard to the use of IT systems and cloud services by the Administrator, however, the entity providing the abovementioned services is recognized by the European Commission as an entity providing an adequate level of protection, and in the case of transferring cloud services by the entity to a third country that does not have an adequate level of protection, entity ensures adequate and appropriate safeguards.

9. Automated decision-making, profiling:

Personal data will not be processed automatically and will not be profiled.