Privacy policy

This privacy statement applies to CHDR’s processing of personal data in the context of its establishment in the EEA. This privacy statement describes how we collect and use your personal data in connection with:

· Your use of our website(s) or apps (Online Visitor);

· Our employee recruitment processes (Applicant);

· Procurement and potential procurement matters (Vendor).

· Establishing and maintaining a customer relationship (Customer/Business contact).

This Privacy Statement does not apply to personal information that we may collect in the context of your employment or other working relationship with CHDR.

Please refer to our Privacy Statement on proefpersoon.nl for information on how we collect and use your personal data in connection with:

· Your registration of interest, through our website, in participating in one of our future clinical research studies (Potential Participant);

· Your participation in one of our clinical research studies (Participant);

· Your participation in the past in one of our clinical research studies which has been finalised (Former Participant).

This privacy statement is provided on behalf of CHDR as data controller. Depending on the clinical research study, other entities may act as joint data controller in relation to your personal data. On that occasion we will provide you with the name of the joint data controller when we collect your personal information, and we will supply you with an adequate privacy notice.
When acting in the capacity of data controller, CHDR will take the principles of personal data processing, as described, into account. When acting in the capacity of data processor, CHDR will apply these principles in line with the instructions provided by the Controller. CHDR shall inform the Controller if CHDR is of the opinion that any instruction from the Controller is in conflict with the principles described above.

We may collect your personal data. “Personal data” means any information relating to an identified or identifiable natural person. Depending on the nature of your contact with CHDR, personal data may include:

· Contact information, such as name, address, phone number or email address;

· Financial information, such as bank account number or billing address;

· Demographic information, such as postcode;

· Recruitment information, such as CV, employment history and qualifications;

· Online identifiers, such as IP address;

· Information to confirm your identity, such as a passport or identity card if we are obliged to do so by local law;

· Health data, if you participate in one of our clinical studies;

· Biometric data, if you participate in one of our clinical studies;

· Genetic data, if you participate in one of our clinical studies;

· Image information, if you participate in one of our clinical studies, or when you visit our premises where we use closed-circuit television (CCTV); and

· Any other information that you provide to us that can be used to identify you.

We collect personal data via:

· Your direct interaction with us, when you volunteer to participate in one of our clinical research studies;

· Cookies and automated technologies, such as when you visit our websites;

· Security systems, such as when you visit our premises we may obtain CCTV footage; and

· Social media, such as our use of Facebook, Instagram and other social media to market our services/products. Generally, we will not use your personal data for such purposes, but if we do so, we will only share names, email addresses and in some cases mobile phone numbers with such parties (audience targeting).

Any other purposes for which we wish to use your personal data that are not listed above, or any changes we propose to make to the existing purposes, will be notified by amending this privacy statement in accordance with the section titled ‘Changes to this Privacy Statement’.

We may share personal data:

· with governmental bodies if required to do so by law and/or regulations;

· with the third parties stated in the Informed Consent Form you signed, such as the sponsor of the study you are a participant in, or medical institutions;

· with service providers that carry out functions or services on our behalf that enable our operations. This includes our IT applications and systems, website analytics and search engine providers. This also includes the protection and securing of our systems and services.

We do not sell your personal data to anyone.

You have the following rights with regard to your Personal Data:

· Right to access information about how we process your personal data, including the categories of personal data we process, recipients of your Personal Data, and purposes for our processing.

· Right to rectification of inaccurate Personal Data concerning you, as well as, taking into account the purposes of the processing, the right to have incomplete Personal Data completed.

· Right to erasure (deletion) of Personal Data concerning you where: (a) the Personal Data is no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) you withdraw your consent and there are no other legal grounds for the processing; (c) you exercise your right to object (see below) and there are no compelling legitimate grounds for the processing; (d) the Personal Information has been unlawfully processed; or (e) the Personal Data have to be erased for compliance with a legal obligation applicable to us.
Please note that the obligations of clinical trials legislation may impede the exercise of certain rights in order, for example, to maintain the integrity of clinical trial data.

· Right to restriction of processing (i.e., data will be blocked from normal processing but not erased) where: (a) you contest the accuracy of the Personal Data, for a period enabling us to verify the accuracy; (b) the processing is unlawful and you oppose the erasure of the Personal Data and requests the restriction of their use instead; (c) we no longer need the Personal Data for the purposes of the processing but they are required by you for the establishment, exercise or defence of legal claims; (d) you exercise your right to object (see below) pending the verification of whether our legitimate grounds override yours.

· Where processing is based on your consent, the right to withdraw consent at any time, without affecting the lawfulness of the processing prior to such withdrawal. Please note that even after you have chosen to withdraw your consent we may be able to continue to process your Personal Data in some limited circumstances.
Please note that the obligations of clinical trials legislation may impede the exercise of certain rights, for example, in order to maintain the integrity of clinical trial data. If you are or have been a participant in a clinical trial, you have been provided with additional, study-specific information by CHDR.

· Where processing is based on your consent, or on a contract, the right to data portability, i.e. the right to obtain a copy of the data concerning you in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from us.

· Right to object to the processing of Personal Data based on our legitimate interests, provided that there are no compelling legitimate grounds for the processing that would override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

If you wish to exercise any of your rights above, please contact us using the information in the section ‘How To Contact Us’ at the end of this Privacy Statement.
Again please note that the obligations of clinical trial legislation may impede the exercise of certain rights, for example, in order to maintain the integrity of clinical trial data. If you are or have been a participant in a clinical trial, you have been provided with additional, study-specific information by CHDR.

We may charge you a reasonable fee in the case that you request additional copies of your Personal Data or make excessive requests. If we are unable to honour your request, or before we charge a fee, we will inform you of the reasons why. Insofar as is practicable and required under law, we will notify third parties with whom we have shared your Personal Data of any request for correction, deletion, and/or restriction to the processing of your Personal Data. Please note that we cannot guarantee third parties will follow up on our notification and we encourage you to contact those third parties directly.

CHDR performs research in collaboration with partners located in different parts of the world. CHDR may also contract service providers outside the EEA. CHDR is committed to complying with this privacy statement and with European Data Protection Laws regarding information transferred outside the EEA. The laws in countries outside the EEA may not be as strict as the laws in within the EEA. In light of this, CHDR has taken measures to protect your privacy and fundamental rights when your personal data is transferred outside the EEA and to other countries where no adequacy decisions of the European Commission apply.
This includes the use of appropriate safeguards such as standard contractual clauses and safe transfer protocols to ensure adequate protection.

When personal information collected by CHDR is transferred outside the EEA, detailed information can be found in the Informed Consent Form that you will be or have been provided with. 

If you have any questions about our privacy statement, if you wish to exercise your rights or if you wish to lodge a complaint, please contact us.

By email: DPO-gegevensbescherming@chdr.nl

By post:

    Centre for Human Drug Research

    Attn.: Data Protection Officer

    Zernikedreef 8

    2333 CL Leiden

    The Netherlands

You can always contact our Data Protection Officer by phone: +31 (0)71 524 64 39

You always have the right to lodge a complaint with your local Data Protection Authority.

The Effective Date of this Privacy Statement is set forth at the bottom of this statement. In case of material changes to the way we treat your personal data, we will notify you by posting a notice on our website. The most recent version of our Privacy Statement can always be found on our website.

Effective: May 2024