The following data protection statement applies to www.solupharm.com, www.solupharm.de, www.solupharm-karriere.com  (hereinafter collectively referred to as “Website”).

We take data protection very seriously. Your personal data will be recorded and stored in accordance with the currently applicable legislation, in particular the EU General Data Protection Regulation (GDPR). We collect and process the following personal data in order to provide you with the internet platforms stated above: This statement describes how and for what purpose your data will be recorded and used, and the choices open to you in connection with your personal data.

By using the website, you agree to the collection and use of information in accordance with this data protection statement.

1        Data controller

The responsible data controller for the collection, processing and use of your personal information within the meaning of the EU General Data Protection Regulation (GDPR) is

Responsible managing director: Herr Friedemann Seitz
Solupharm Pharmazeutische Erzeugnisse GmbH
Industriestraße 3
34212 Melsungen

If you wish to object to our collection, processing or use of your data in accordance with these data protection statement as a whole or for individual measures, you may submit your objection to the controller stated above.

You may store and print this data protection statement at any time.

2        General Use of Website

2.1       Access Data

We collect information about you when you use this website. We automatically register information about your usage behaviour and your interaction with us and register data regarding your computer and mobile device. We record, store and use data every time you access our online service (so-called server log files). These access data include the name of the requested website, file, date and time of access, amount of data transferred, notification of successful retrieval (HTTP response code), browser type and version, the operating system of the user, referrer URL (e.g. website previously visited), IP address, and the requesting provider.

We use this protocol data, without assigning them to your person or creating other profiles, for the purpose of management, security and optimization of our online service.
On the basis of this information we are able to provide personalized and person-related contents, analyse data traffic, seek and eliminate errors and improve our services. We reserve the right to examine log data if there is concrete evidence giving rise to reasonable suspicion of unlawful use. We will store IP addresses for a limited period of time in the log files if this should be necessary for security purposes. We will also store IP addresses if we have concrete suspicion of a criminal act in connection with the use of our website.

2.2       E-Mail contact

If you contact us (e.g. by contact form or by e-mail), your information is saved for the purpose of processing your request and in the event that follow-up questions arise. We will only save and use further personal data with your consent, or if this is legally permitted without special consent.

2.3       Legal basis and storage period

The legal basis for this data processing is Article 6 Paragraph 1 Letter f) GDPR. Our legitimate interests in processing data are, in particular, guaranteeing operational safety and website security, researching how visitors use our website, and simplifying website use.

Unless specifically stated, we will store personal date only for as long as necessary for the fulfilment of the aims pursued.

3        Your rights as a data subject

According to the applicable law you have various rights regarding your personal data. If you want to exercise these rights, please submit your request to the address stated under Item 1 by e-mail or by post, including clear identification of your person.

You will find an overview of your rights below.

3.1       The right to confirmation and information

You have the right to request confirmation from us whether personal data concerning you are processed. If this is the case you have the right to obtain information on the personal data stored by us plus a copy of these data free of charge. You also have the right to the following information:

1. the processing purposes;
2. the categories of personal data being processed:
3. the recipients or categories of recipients to whom the personal data have been or are still being disclosed, in particular recipients in third countries or international organisations;
4. if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this period;
5. the existence of a right of rectification or erasure of personal data concerning you or of a restriction on processing by the person responsible or of a right to object to such processing;
6. the existence of a right of appeal to a supervisory authority;
7. where the personal data are not collected from the data subject, all available information as to their source;
8. the existence of automated decision-making, including profiling, referred to in Article 22 Paragraphs 1 and 4 of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for you as the data subject.

If personal data are transferred to a third country or to an international organisation, you have the right to be informed about suitable guarantees pursuant to Article 46 GDPR in connection with the data transfer.

3.2       Right to rectification

You have the right to request the immediate rectification of your incorrect personal data. You also have the right, taking into account the purposes of the processing, to request the completion of incomplete personal data, including by means of a supplementary declaration.

3.3       Right to erasure (“Right to be forgotten”)

You have the right to obtain from us the erasure of personal data concerning you without undue delay and we are obliged to erase personal data without undue delay where one of the following grounds applies:

1. The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
2. You withdraw your consent on which processing is based according to Article 6 Paragraph 1 of the GDPR, or Article 9 Paragraph 2 of the GDPR, and where there is no other legal ground for processing your data.
3. You submit an objection according to Article 21 Paragraph 1 GDPR and there are no prevailing legitimate reasons for processing, or you submit an objection to the processing of your data according to Article 21 Paragraph 2 GDPR.
4. The personal data were processed unlawfully.
5. Erasure of personal data is required for the fulfilment of legal obligations under EU law or the law of the Member States, which is mandatory for us.
6. The personal data were recorded in connection with the services of the information society offered pursuant to Article 8 Paragraph 1 GDPR.

If we have published your personal data and are obliged to erase the personal data and if we are obliged to erase the data pursuant to Article 17 GDPR, we will undertake appropriate measures under consideration of the available technology and implementation costs, also of a technical kind, to inform the persons responsible for the data processing of personal data, that you have requested the erasure of all links to these personal data, or the destruction of copies and reproductions of these personal data.

3.4       Right to limitation of processing

You have the right to demand the restriction of processing by us if one of the following conditions is met:

1. The accuracy of your personal data is contested by you for a period of time that allows us to verify the accuracy of your personal information,
2. processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
3. We no longer need the personal data for the purposes of processing, but you need it to assert, exercise or defend legal claims, or
4. You objected to the processing of the data according to Article 21 Paragraph 1 GDPR for as long as there is no confirmation whether legitimate reasons of our company outweigh your reasons.

3.5       Right to data portability

You have the right to obtain your personal data which you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transfer these data to other responsible persons without being hindered by us if

1. data processing is based on an agreement pursuant to Article 6 Paragraph 1 Letter a) GDPR or Article 9 Paragraph 2 Letter a) GDPR or a contract pursuant to Article 6 Paragraph 1 Letter b) GDPR and
2. processing is carried out using automated methods.

In exercising this right to data portability under Article 1, you also have the right to request that the personal data concerning you be transferred directly by us to another person responsible, insofar as this is technically feasible.

3.6       Right to object

Pursuant to the law, you have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you, which may be processed on the basis of Article 6 Paragraph 1 Letter e) or f) GDPR; this also applies to any profiling based on these provisions. We will no longer process the personal data that concerns you, unless we can prove compelling legitimate reasons for processing which outweigh your interests, rights and freedoms, or processing serves to assert, exercise or defend legal claims.

If the personal data that concerns you is being processed by us for direct marketing purposes, you have the right to object at any time to the processing of the personal data that concerns you for the purpose of such marketing; this also applies to profiling, insofar as it is associated with such direct marketing.

Furthermore, for reasons arising from your particular situation, you have the right to object to the processing of personal data concerning you which are used for scientific or historical research purposes or for statistical purposes pursuant to Article 89 Paragraph 1 GDPR, unless data processing is necessary to fulfil a task in the public interest.

3.7       Automated individual decision-making including profiling

You have the right not to be subject to a decision based exclusively on automated processing – including profiling – that has legal effect on you or significantly impairs you in a similar manner.

3.8       Right to withdraw data processing consent

You have the right to withdraw your consent to the processing of personal data at any time.

3.9       The right of appeal to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right of appeal to a supervisory authority, in particular in the Member State where you reside, work or where the infringement is suspected, if you believe that the processing of personal data that concerns you is unlawful.

4        Data security

We undertake all possible and reasonable measures to protect your data within the framework of the currently valid data protection law and technical possibilities.

Your personal data is transferred in encrypted form. This also applies to your orders and customer log-in. We use the coding system SSL (Security Socket Layer), but must warn you that data transmitted via the internet (e.g. via email communication) may be subject to security breaches. It is not possible to fully protect data from third-party access.

In order to protect your data, we have implemented technical and organisational measures which are kept permanently updated.

In addition, we cannot guarantee that our services will be available at certain times; faults, interruptions or failures cannot be excluded. The servers we use are carefully protected and backed up on a regular basis.

5        Automated decision-making

We do not undertake any automated decision-making on the basis of personal data recorded.

6        Transfer of data to third parties, no transfer of data to non-EU countries.

As a rule we only use your personal date within our company.

In case and to the extent that we involve third parties to fulfil contracts (e.g. logistic service providers), they will receive personal data only to the extent that the transfer is necessary for the performance of the respective service.

If we outsource certain sections of data processing (“contract processing”), the party processing the order shall be obliged by contract to use personal data only in accordance with the provisions of data protection laws and to ensure protection of the rights of the person concerned.

There is and will be no transfer of data to institutions or persons outside the EU except for the cases stated in Point 2.3.