DADA Consultancy ("DADA") is responsible for the processing of personal data as shown in this privacy statement.
Contact details: DADA Consultancy B.V., Godfried Bomansstraat 31, 6543 JA Nijmegen, +31 24 373 03 09, dpo@dada.nl
Personal data that we process
Your personal data may be used by DADA in a variety of ways. We will always be as transparent as possible as to how we use your data.
Visiting DADA's website
When you access the DADA website, certain information may be exchanged between your device and our server. This may contain personal data. Data collected in this way can, for instance, be used to optimise our website. We use cookies on our website to provide you with the best possible experience. This includes data processing that helps our website to run smoothly. We also make use of analytical cookies by collecting and reporting information to understand how visitors interact with our website. No so-called third-party cookies are placed.
You can click 'Accept all' to accept all cookies, or specifically select in the 'Detailed selection' section which cookies you would like to allow.
Using DADA's services
DADA processes personal data on behalf of its clients, which are internationally established pharmaceutical companies. We process personal data in connection with the legal obligation of our clients to ensure the safety of medicines and to process adverse reactions or other reports concerning products. Therefore, DADA needs to process information about your health, which is considered to be sensitive personal data about you. We may also collect personal data with which we can demonstrably record the existence of an actual patient (on the basis of gender and country of origin) and, if necessary, your contact details in order to answer your request. Where it is necessary and/or legally required to share this information with our client or a third party, the information will be pseudonymised.
For what purpose and on what basis we process personal data
DADA Consultancy processes your personal data within the scope of the legal pharmacovigilance obligations that our clients have within the pharmaceutical industry. With this, we promote the safe and most effective possible use of medicines.
Please note that to appropriately respond to your questions, the information you share with us may be shared with our clients, affiliates, partners or regulatory authorities within the US that are subject to HIPAA. When we share such personal data, we only share the information that is considered necessary and we pseudonymise such personal data.
Automated decision-making
DADA Consultancy does not carry out automated processing, namely decisions taken by computer programs or systems without a person (for example an employee of DADA Consultancy) in between. Hence, there are no such decisions about matters that can have (significant) consequences for people.
How long we store personal data
DADA Consultancy does not store your personal data for longer than is strictly necessary to realise the purposes for which your data is collected and to comply with the respective legal pharmacovigilance obligations.
Sharing personal data with third parties
DADA Consultancy will not sell your personal data to third parties and will only provide personal data if this is necessary for the execution of our agreements with our clients or to comply with a legal obligation. With companies that process your data on our behalf, and with our clients, we conclude a data processing agreement to ensure the same level of security and confidentiality of your data.
View, modify or delete data
You have the right to view, correct or delete your personal data. You also have the right to withdraw your consent to the data processing or to object to the processing of your personal data by DADA Consultancy or its clients, and you have the right to data portability. Please be aware that due to the legal pharmacovigilance obligations of our clients, it is not always possible to exercise your full rights.
You can send a request for access, correction, deletion or transfer of your personal data, or a request to withdraw your consent or object to the processing of your personal data, to dpo@dada.nl. We respond as quickly as possible, and within four weeks, to your request. DADA Consultancy also wishes to point out that you have the opportunity to file a complaint with the national supervisory authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): https://autoriteitpersoonsgegevens.nl/nl/contact-met-de-autoriteit-persoonsgegevens/tip-ons
How we protect personal data
DADA Consultancy takes the protection of your personal data seriously and takes appropriate measures to prevent misuse, loss, unauthorised access, unwanted disclosure and unauthorised modification. If you have the impression that your data is not secure or there are indications of misuse, please contact us at office@dada.nl.
When developing, designing, selecting and using business applications, or rendering and delivering services to our clients which include the processing of personal data, we ensure that we fulfil our legal obligations with respect to the GDPR. The organisational and technical measures principally undertaken by DADA, as listed below, are continuously being evaluated and improved.
GDPR-related organisational measures
- Data Protection Impact Assessments (DPIAs) can be carried out as required and upon request, to support clients' compliance. For internal processes, DPIAs are carried out before starting any high-risk processing activities.
- Guidelines, procedures and processes are in place to handle incidents involving personal data.
- Service agreements with our clients and suppliers (subprocessors) reflect the GDPR requirements. We seek to only engage subprocessors which provide sufficient guarantees, in particular in terms of expert knowledge, reliability and resources, and require them to implement technical and organisational measures which meet the requirements of the GDPR and our clients, including for the security of processing.
- Training and awareness campaigns directed at all employees have been carried out, and all employees are required to complete the mandatory GDPR training. The training is updated on an annual basis.
GDPR-related technical and security measures
- All employees have signed confidentiality statements and are required to adhere to internal policies.
- Employees' activity on and access to IT systems and physical personal data storage facilities is secured, aligned with (multiple) authentication requirements and separable.
- Employees only perform authorised duties relevant to their respective jobs and positions.
- Employees' access rights to IT systems and storage are in line with predefined and documented business needs, and the job requirements are attached to user identities.