Data Privacy

Data controller:
Orphazyme A/S
Ole Maaloes Vej 3
DK-2200 Copenhagen N Denmark
DataPrivacy@Orphazyme.com
(“Orphazyme”)

The protection of personal data is of utmost importance to Orphazyme and we are committed to protecting your rights when processing your personal data.

Orphazyme will only process personal data with a specific purpose. We appropriately retain and use the personal data to the extend necessary to run our business and we have implemented the necessary security measure considering the nature, scope and context of the processing.

We continuously strive to monitor our security measures and make improvements when needed in order to protect your personal data from unauthorized access, destruction or loss.

When you are asked to provide personal data, you may decline. But if you choose not to provide personal data that is necessary to for us to provide the requested services, we may not be able to provide you those services.

If you submit any personal data relating to another individual to us, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Statement.

On these pages we will explain how Orphazyme process your personal data and explain your rights in relation to the personal data processed by us.

Minors under the age of 18 are not intended to use this website.

If you have any questions or requests concerning your personal data processed by Orphazyme, please contact us on the address stated above.

Read more about our:

 

Use of website and contact e-mails

This Privacy Statement explains how Orphazyme process your personal data in our administration of our corporate website; Orphazyme.com.

  1. DATA CONTROLLER

Data controller: Orphazyme A/S Ole Maaloes Vej 3
DK-2200 Copenhagen N Denmark DataPrivacy@Orphazyme.com

2. USE OF PERSONAL DATA

We may use your personal data for the following purposes:

3. CATEGORIES OF PERSONAL DATA
We may collect the following categories of personal data about you:
Name, address, email address, telephone number, IP-addresses and other personal data you provide in your e-mail.

4. SOURCES

We collect the personal data that you provide in the e-mail directly from you and we may collect personal data by the cookies we place on your device.

5. LEGAL BASIS
We process your personal data on the following legal basis:
Art. 6 (1)(f) of the GDPR – Legitimate interest. This means that the processing of your personal data is necessary for the purposes of the legitimate interests pursued by us when making our website functionalities available to you and in order for us to be able to provide you with the answers requested and needed when using our website.

6. SHARING OF YOUR PERSONAL DATA
We may share your personal data with our affiliates.

7. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA
Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead we have provided appropriate safeguards as required by GDPR art. 49
(1) through EU standard contractual clauses.
You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@Orphazyme.com

8. RETENTION OF YOUR PERSONAL DATA
We will retain your personal data according to the specific purpose depending on your
request and your use of our website. However, we’ll never keep your personal data longer
than required by applicable law.
To prevent unauthorized access, maintain data accuracy, and ensure the correct use of information, we have put in place appropriate physical, electronic, and managerial procedures to safeguard and secure the information we collect online.

9. YOUR RIGHTS
In general, you have the following rights:

You may exercise these rights by contacting us as stated above.

 

Engagements with Healthcare Professionals and Healthcare Organization (“HCPs”)

This Privacy Statement explains how Orphazyme process your personal data when you have an engagement with us.

  1. DATA CONTROLLER

Data controller: Orphazyme A/S Ole Maaloes Vej 3
DK-2200 Copenhagen N Denmark DataPrivacy@Orphazyme.com

2. USE OF PERSONAL DATA
We may use your personal data for the following purposes:

3. CATEGORIES OF PERSONAL DATA
We may collect the following categories of personal data about you:
Name, address, email address, telephone number, employer, CV, title, occupation, affiliation, professional qualifications and scientific activities (such as previous clinical trial experience, and participation in past or pending research studies with Orphazyme and other companies), transfer of value, professional license information and contract information including billing information.

4. SOURCES

We may collect your personal data from various sources such as:

5. LEGAL BASIS

We process your data on the following legal basis:

Art. 6 (1)(f) of the GDPR – Legitimate interest. This means that the processing of your personal data is necessary for the purposes of the legitimate interests pursued by us when assessing the activity/services and legitimate business need, adherence to local law and industry standards, and assessing fair market value.

Art. 6(1)(b) of the GDPR – Performance of Contract. If you have a working relationship with us such relationship is confirmed in writing and personal data will be collected to perform the contract.

Art. 6(1)(a) of the GDPR – Consent. In certain situations, we also ask for your consent to process your personal data, e.g. for disclosure of transfer of value, if such disclosure is not a legal obligation.

Art. 6(1)(c) of the GDPR – Legal Obligation. For clinical trials we may also process your personal data in relation to adverse event reporting to live up to a legal obligation.

6. SHARING OF YOUR PERSONAL DATA

We may share your personal data with:
Our affiliates, collaborative partners, authorities, and other HCPs.

7. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead we have provided appropriate safeguards as required by GDPR art. 49
(1) through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@Orphazyme.com

8. RETENTION OF YOUR PERSONAL DATA

We retain personal data where we have an ongoing legitimate business need to do so (e.g., to maintain our engagement with you).

When we have no ongoing legitimate business need to process your personal data, we will either delete or anonymize it or, if this is not possible (e.g., because your personal data has been stored in back-up archives), we will securely store your personal data and isolate it from any further processing until deletion is possible.

9. YOUR RIGHTS

In general, you have the following rights:

You may exercise these rights by contacting us as stated above.

 

Clinical trials

The protection of personal data is of utmost importance to Orphazyme and we are committed to protecting your rights as a study subject when processing your personal data as the sponsor of clinical trials.
In our Informed Consent Form we provide study subjects participating in our clinical trials with relevant information about our use and processing of their personal data.

1. DATA CONTROLLER

Data controller: Orphazyme A/S Ole Maaloes Vej 3
DK-2200 Copenhagen N Denmark DataPrivacy@Orphazyme.com

2. USE OF PERSONAL DATA
We collect and use your personal data to conduct our clinical trials to investigate efficacy, safety etc. of our compound. If you are a participant in one of our clinical trials, you will be able to read more about the purpose of that specific clinical trial in the Informed Consent Form.

3. CATEGORIES OF PERSONAL DATA
We may collect the following categories of personal data about you:

As the sponsor of the clinical trial we will not know your name. A unique ID will be assigned to you and all personal data processed by us will be linked to that ID, i.e. we will only receive your personal data in pseudonymous form. Only the investigator of the clinical trial will know your name.

4. SOURCES

We receive your pseudonymized personal data from the investigator as part of the clinical trial.

5. LEGAL BASIS

We may process your personal data on the following legal basis:

Art. 9 (2)(i) cf. Art 6(1)(f) of the GDPR. We have a legitimate purpose in collecting and using your personal data for scientific research purposes as described above.
Art. 9(2)(i) cf. Art. (6)(1)(c) of the GDPR. The processing of your personal data is necessary for us to comply with a legal obligation to collect and report safety incidents to regulatory authorities.

Art. 9(2)(i) cf. Art. 6(1)(a) of the GDPR – Consent. In certain situations, we also ask for your consent to process your personal data, e.g. for disclosure to your general practitioner or for future use of your personal data.

6. SHARING OF YOUR PERSONAL DATA

We may share your personal data with other companies and organizations commissioned by us to conduct the clinical trial. These companies and organizations may only use your personal data for the purposes described in the Informed Consent Form and this Privacy Policy.

Furthermore, your personal data stored at the investigator may be accessed by our monitors and auditors and authorized employees of the regulatory authorities of your country of residence and other countries in order to verify that the clinical trial is being conducted correctly and to analyze the personal data collected during the clinical trial. All third parties are obligated to observe the rules of professional confidentiality and will only use your personal data as described in the Informed Consent Form.

We may also share your personal data with third parties to the extent required by law, for example if we are obligated to disclose your personal data in order to comply with any legal obligation or to establish, exercise or defend our legal rights. Your general practitioner may be informed of your participation in one of our clinical trials if you consent to such disclosure.

7. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@Orphazyme.com

8. RETENTION OF YOUR PERSONAL DATA

Your personal data will be retained in accordance with regulatory requirements for clinical trials, i.e., up to 2 years after the last marketing application which may be more than 25 years from collection of your personal data.

9. YOUR RIGHTS
In general, you have the following rights:

Your participation in our clinical trial is voluntary. Your choice of participation will not affect your present or future treatment.

 

Early Access Program / Compassionate Use

The protection of personal data is of utmost importance to Orphazyme and we are committed to protecting your rights when processing your personal data as part of our early access program.
When you or your physician apply for access to our investigational drug outside of a clinical trial you are provided with relevant information about the use and processing of your personal data.

  1. DATA CONTROLLER

Data controller: Orphazyme A/S Ole Maaloes Vej 3
DK-2200 Copenhagen N Denmark DataPrivacy@Orphazyme.com

2. USE OF PERSONAL DATA
We collect and use your personal data to provide access to our investigational drug outside of a clinical trial, to track your progress and to live up to our safety reporting obligations.

3. CATEGORIES OF PERSONAL DATA
We may collect the following categories of personal data about you:

4. SOURCES

We receive your pseudonymized personal data from the third-party provider that administer our early access program.

5. LEGAL BASIS

We may process your personal data on the following legal basis:
Art. 9(2)(i) cf. Art. (6)(1)(c) of the GDPR. The processing of your personal data is necessary for us to comply with a legal obligation to collect and report safety incidents to regulatory authorities.

Art. 9(2)(i) cf. Art. 6(1)(a) of the GDPR – Consent. Your participation is based on your consent given to your physician.

6. SHARING OF YOUR PERSONAL DATA

We may share your personal data with our affiliates, public authorities and other companies and organizations commissioned by us to administer the early access program. These companies and organizations may only use your personal data for the purposes described in this Privacy Statement.

We may also share your personal data with third parties to the extent required by law, for example if we are obligated to disclose your personal data in order to comply with any legal obligation or to establish, exercise or defend our legal rights.

7. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@Orphazyme.com

8. RETENTION OF YOUR PERSONAL DATA

Personal data will be retained for as long as necessary in accordance with legal requirements to retain such personal data.

9. YOUR RIGHTS
In general, you have the following rights:

Your participation in our early access program is voluntary. Your choice of participation will not affect your present or future treatment.

 

Safety Reporting / Pharmacovigilance

The protection of personal data is of utmost importance to Orphazyme and we are committed to protecting your rights as a study subject when processing your personal data as the marketing authorization holder.

  1. DATA CONTROLLER

Data controller:
Orphazyme A/S
Ole Maaloes Vej 3
DK-2200 Copenhagen N
Denmark
DataPrivacy@Orphazyme.com

  1. USE OF PERSONAL DATA

We collect and use your personal data to report safety and pharmacovigilance incidents to local and international authorities in accordance with applicable legislation. We may ask for your permission to contact your general practitioner.

  1. CATEGORIES OF PERSONAL DATA

We may collect the following categories of personal data about you:

  1. SOURCES

We receive your personal data directly from you, your caregiver, physician, or other reporter.

  1. LEGAL BASIS

We may process your personal data on the following legal basis:

Art. 9(2)(i) cf. Art. (6)(1)(c) of the GDPR. The processing of your personal data is necessary for us to comply with a legal obligation to collect and report safety incidents to regulatory authorities.

Art. 9(2)(i) cf. Art. 6(1)(a) of the GDPR – Consent. In certain situations, we also ask for your consent to process your personal data, e.g., for disclosure to your general practitioner or for future use of your personal data.

  1. SHARING OF YOUR PERSONAL DATA

We may share your personal data with our affiliates, other companies and organizations commissioned by us to collect and report the data. These companies and organizations may only use your personal data for the purposes described above. We will share your personal data with local and international authorities to the extent required by law.

  1. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead, we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@Orphazyme.com

  1. RETENTION OF YOUR PERSONAL DATA

Your personal data will be retained indefinitely in accordance with regulatory requirements.

  1. YOUR RIGHTS

In general, you have the following rights:

 

Corporate Governance

This Privacy Statement explains how Orphazyme process your personal data for our corporate governance.

  1. DATA CONTROLLER

Data controller: Orphazyme A/S Ole Maaloes Vej 3
DK-2200 Copenhagen N Denmark DataPrivacy@Orphazyme.com

2. USE OF PERSONAL DATA
We may use your personal data for the following purposes:

3. CATEGORIES OF PERSONAL DATA
We may collect the following categories of personal data about you:

4. SOURCES
We collect the personal data directly from you.

5. LEGAL BASIS

Art. 6(1)(c) - Legal obligation – we are obliged to collect and provide the personal data to authorities.

Art. 6 (1)(f) - Legitimate interests - this means that the processing of your personal data is necessary for the purposes of the legitimate interests pursued by us in relation to corporate governance matters, including communicating with you and the relevant authorities.

6. SHARING OF YOUR PERSONAL DATA
We may share your personal data with our affiliates, public authorities, suppliers and vendors that assist our company, i.e. service providers, technical support, supply services, and financial institutions.

7. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@Orphazyme.com

8. RETENTION OF YOUR PERSONAL DATA

Personal data will be retained for as long as necessary in accordance with legal requirements to retain such personal data. In general, we will not keep your data for more than current year plus five years after the expiry of the business relationship.

9. YOUR RIGHTS
In general, you have the following rights:

You may exercise these rights by contacting us as stated above.

 

Vendor Management

This Privacy Statement explains how Orphazyme process your personal data in administration of our contracts.

1. DATA CONTROLLER

Data controller: Orphazyme A/S Ole Maaloes Vej 3
DK-2200 Copenhagen N Denmark DataPrivacy@Orphazyme.com

2. USE OF PERSONAL DATA

We may use your personal data for the following purpose:
To maintain a working relationship with you and/or your employer.

3. CATEGORIES OF PERSONAL DATA

We may collect the following categories of personal data about you:
Name, contact information, CV, employer, title, job role, billing information, TAX ID, contract terms, training certificates, etc.

4. SOURCES

We collect the information directly from your employer, you or from the contracts we enter into with your employer or with you.

5. LEGAL BASIS

Art. 6(1)(b) of the GDPR – Performance of Contract. Personal data will be collected to perform the contract.

Art. 6 (1)(f) - Legitimate interests - this means that the processing of your personal data is necessary for the purposes of the legitimate interests pursued by us in relation to our on- going business relation and this is not to perform the contract.

6. SHARING OF YOUR PERSONAL DATA

We may share your personal data with our affiliates, public authorities, suppliers and vendors that assist our company.

7. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared
to the EEA. Instead we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@Orphazyme.com

8. RETENTION OF YOUR PERSONAL DATA

Personal data will be retained for as long as necessary. We may keep your personal data for up to 30 years to fulfil legal requirements, such as bookkeeping, GxP documentation, etc.

9. YOUR RIGHTS
In general, you have the following rights:

You may exercise these rights by contacting us as stated above.

 

Job applicant

This Privacy Statement explains how Orphazyme process your personal data in connection with the recruitment process, including the receipt of unsolicited applications for future job opportunities.

1. DATA CONTROLLER

Data controller: Orphazyme A/S Ole Maaloes Vej 3
DK-2200 Copenhagen N Denmark DataPrivacy@Orphazyme.com

2. USE OF PERSONAL DATA
We may use your personal data for the following purposes:

3. CATEGORIES OF PERSONAL DATA
When applying, you decide which personal data to share with us. We may process the following personal data about you as an applicant:

You should only include information relevant for the review of your application. You should not include information about your race or ethnic origin, religion or belief, political opinion, sexual orientation or union membership. Please do not provide your personal identification number (CPR number) and/or copies of identification papers together with your application, unless we expressly ask for this.

4. SOURCES

We collect the personal data directly from you, from your references, from recruitment agencies and if you apply through LinkedIn, we also collect personal data from LinkedIn.

5. LEGAL BASIS
Art. 6 (1)(f) of the GDPR – Legitimate interest. This means that the processing of your personal data is necessary for the purposes of the legitimate interests pursued by us when assessing your application for a job opportunity.
Art. 6(1)(b) of the GDPR – Performance of Contract. If you have a working relationship with us such relationship is confirmed in writing and personal data will be collected to perform the contract.

Art. 6(1)(a) of the GDPR – Consent. In certain situations, we also ask for your consent to process your personal data, e.g. if we need to process your social security no., if such information is not a legal obligation.

6. SHARING OF YOUR PERSONAL DATA

We will only share your personal data with third parties that are involved in the recruitment process (e.g. recruitment agencies) or if such third parties are needed for the preparation and issuing of your employment contract.

7. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@Orphazyme.com

8. RETENTION OF YOUR PERSONAL DATA

We store your personal data no longer than strictly necessary to achieve the objectives for which your personal data is collected. This means that personal data of applicants for a job offering will be kept until the recruitment process is completed and for further 6 months to document the fairness of the recruitment process.

If you are employed, your personal data will be transferred to your personell file as an employee of Orphazyme.
Personal data provided in connection with an unsolicited application will be kept for a period of up to 6 months from its receipt to match it with new openings. Hereinafter the personal data will be properly deleted from our systems.

9. YOUR RIGHTS
In general, you have the following rights:

You may exercise these rights by contacting us as stated above.

 

Marketing

This Privacy Statement explains how Orphazyme process your personal data for marketing related purposes.

1. DATA CONTROLLER

Data controller: Orphazyme A/S Ole Maaloes Vej 3
DK-2200 Copenhagen N Denmark DataPrivacy@Orphazyme.com

2. USE OF PERSONAL DATA

We may use your personal data for the following purposes:
Personal data will be processed for marketing-related purposes, including sending relevant information regarding our products and services (direct marketing), and for targeting our communication with you. We will not send you direct marketing, unless you have given your consent. You may revoke your consent at any time and discontinue the use of the service.

3. CATEGORIES OF PERSONAL DATA
We may collect the following categories of personal data about you:
E-mail address, name, address, telephone number, profession, workplace.

4. SOURCES

We collect the personal data directly from you.

5. LEGAL BASIS

Art. 6(1)(a) – Consent – we will ask for your explicit consent before sending you direct marketing and targeting our communication with you.

6. SHARING OF YOUR PERSONAL DATA

We may share your personal data with suppliers and vendors working for us.

7. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.
You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@Orphazyme.com

8. RETENTION OF YOUR PERSONAL DATA

Personal data will be retained for as long as necessary to provide you with the given service. If you withdraw your consent, we will delete your personal data two years after the date of your withdrawal in accordance with guidance from the Danish Consumer Ombudsman.

9. YOUR RIGHTS
In general, you have the following rights:

You may exercise these rights by contacting us as stated above.

 

Social Media

This Privacy Statement explains how Orphazyme process your personal data collected on social media pages such as LinkedIn and Twitter.

1. DATA CONTROLLER

Data controller: Orphazyme A/S Ole Maaloes Vej 3
DK-2200 Copenhagen N Denmark DataPrivacy@Orphazyme.com

2. USE OF PERSONAL DATA

We may use your personal data for the following purposes:
To administer our pages and communicate with users, including potential patients.

3. CATEGORIES OF PERSONAL DATA
We may collect the following categories of personal data about you:
Information made public by you, including your name, e-mail address, profession, workplace, interests, pages you like or follow, preferences, friends, health information in the form of adverse events, racial or ethnic origin, political opinions, etc.

4. SOURCES

We collect the personal data directly from you.

5. LEGAL BASIS

Art. 6(1)(f) - Legitimate Interest - this means that the processing of your personal data is necessary for the purposes of the legitimate interests pursued by us in relation to our communication with you.

Art. 9(2)(e) - Information manifestly made public by you.

6. SHARING OF YOUR PERSONAL DATA
We may share your personal data with our affiliates, suppliers and vendors working for us, and public authorities.

7. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@Orphazyme.com

8. RETENTION OF YOUR PERSONAL DATA

Personal data will be retained for as long as necessary for handling your requests on social media, answer your enquiries, or to undertake marketing-related initiatives on the basis of the information provided by you on social media.

9. YOUR RIGHTS
In general, you have the following rights:

You may exercise these rights by contacting us as stated above.

 

Last updated on June 3, 2021.