Menu
Close
General Personal Data Processing Privacy Policy of JSC Olpha shall be applied to personal data that JSC Olpha (hereinafter – We or the Company) processes about the natural persons, who contact, cooperate or otherwise interact with us within the framework of the commercial activity performed by us. The purpose of it is to provide valuable information about what personal data do we collect and how we use them, as well as inform persons about their rights in relation to personal data processing, thus ensuring honest, lawful and transparent personal data processing in the Company.
The volume, purpose, legal basis of processed personal data and other issues related to processing directly depend from the type of our interaction or cooperation. You can find out more about the personal data processing performed by us, its purpose and legal basis in Chapter 3 of the Privacy Policy by selecting the category relevant for you:
Who is responsible for personal data processing
The company JSC Olpha shall be responsible for performance of the personal data processing described in this Privacy Policy, which shall determine the purposes and means of personal data processing as well as implement relevant technical and organisational events as a personal data controller in order to ensure compliance of data processing with the requirements of the General Data Protection Regulation (hereinafter – the Regulation).
Contact information of the Controller:
JSC Olpha
Registered office: 5 Rūpnīcu Street, Olaine, Olaine Municipality, LV-2114;
E-mail address: olpha@olpha.eu
Phone No..+371 67013708
Contact information of the personal data officer:
How and for what purposes do we process your personal data?
Purposes, for which we process your personal data, directly depend on the type of our cooperation or interaction, for example:
Please, consider that in case if we cooperation or interact in several statuses, then personal data shall be processed within the framework of each such status, for example, if you are a representative of the cooperation partner, who implements the conclusion of the agreement with the Company and you visit the territory of the Company, then personal data shall be processed in the form specified in both, Clause 3.3 about representatives of the Cooperation Partner (for conclusion and fulfilment of the agreement) as well as in Clause 3.2 about visitors (video-surveillance and provision of pass regime). In order to find our more precisely, what personal data, for what purposes we process about you, please, assess the form in which we cooperate and become acquainted with the sections of the Privacy Policy relevant for you.
Processing of data of applicants for a position
The Company shall process personal data of the applicants for a position for provision of recruitment processes of the staff for the purpose to perform and assessment of applicants for a position and selection of suitable candidates for establishment of legal employment relations. In order to determine the suitability of the applicant with the position and select the most suitable candidates for establishment of legal employment relations, competitions of personnel recruitment shall be organized, announcing a vacant position to the particular position, application documents of applicants (such as application letter, Curriculum Vitae, motivation letter) shall be assessed and stored, as well as communication with applicants shall take place, interviews shall be organized and feedbacks shall be obtained, if the applicant has specified the feedback provider and his/her contact details.
The Company shall basically obtain the personal data from the applicant himself/herself – from the application documents submitted by the applicant to the Company (or recruitment service provider, who acts on behalf of the Company), the information provided by the applicant during the interview. The Company shall invite, in particular, the applicants not to provide personal data that are not required for assessment of the application for a position in the Company, for example, a photography, information about age information disclosing the racial or ethnical belonging, political opinion, religious or philosophical belief or membership in trade unions, data on the sexual life or sexual orientation of a natural person or information about health status.
Within the framework of the personnel recruitment process data may be obtained also from third parties, such as the feedback provider specified by the applicant; from the data base of the personnel company, if the applicant is registered with it; from social networks, if the applicant has made the information publicly available by himself/herself.
Processed data
Name, surname, phone number, e-mail address of the applicant for a position, information about education (information specified in the documents confirming education and qualification), information about work experience, skills, professional and personal features, as well as other information that the applicant has specified in the application documents
(such as application letter, Curriculum Vitae, motivation letter), feedback of the former or current employer of the applicant about the applicant, decision and opinion of the Company about the applicant, personal data of the applicant, which were acquired when communicating with the applicant, during the interview with the applicant.
Name, surname, place of work, position, contact information – phone number and/or e-mail of the feedback provider, the feedback provided.
Legal basis
Consent of the data subject (Article 6(1)(a) of the Regulation) – the applicant applies and submits his/her application documents for application in the personnel recruitment competition;
Legitimate interests of the Controller (Article 6(1)(f) of the Regulation) – assessment of applicants, evaluation of feedbacks, selection of suitable applicants for establishment of legal employment relations, protection of legal interests of the Company;
In certain cases of compliance with a legal obligation (Article 6(1)(c) of the Regulation) – if regulatory enactments determine mandatory requirements for the specific position
Transfer to processor and / or third parties
The Company uses the personal data processor, who ensure publication of work announcements on its website www.cv.lv on behalf and on the assignment of the Company, on the basis of the instructions of the Company and receipt, storage of the application documents of applicants and transfer to the Company.
If the applicant has specified contact details of the feedback provider in order to obtain feedbacks, the Company may transfer the information on the fact that the relevant applicant applies for a position in the Company to the feedback provider.
Data may be transferred to the supervisory and law enforcement authorities, if a reasonable request is received or if it is necessary for protection of legal interests of the Company.
Duration of storage
Data will be stored until closure of the recruitment proceeding and 6 months after completion of the recruitment procedure, in order to prove correct course of the recruitment procedure, reply to claims and complaints and settle the arising complaints in a legal way. Personal data may be stored also for a longer period of time if the relevant legal basis is provided (consent of the data subject) for use of the collected data in other recruitment competitions.
Data processing of visitors of the territory
Provision of pass regime
The territory of the production facility of the Company is the object of increased danger (hereinafter – the Object) and it is visited by a large number of visitors. Certain measures for provision of safety, including limited access, shall be provided with regard to the Object, in accordance with the requirements of regulatory enactments. Therefore, it is important to ensure effective and proportional measures with regard to safety and access to the Object, performing data processing for the following purposes:
In order to achieve the specified purposes, persons may stay in the territory of the production site of the Company, only with receipt of a relevant permit in accordance with the Regulation on Pass Regime at JSC Olpha. Personal data processing is performed at the Company by issuing the relevant passes (single-time permit or terminated permit) and controlling the compliance with the set pass regime – arrival of the person to the territory of the Object and leaving of the territory. When entering and departing from the territory of the Company, the licence plates of cars crossing the pass points are registered
Processed data
About the recipient of the single-time pass: name, surname, name of the represented company, number of the single-time pass, name of the visited company, information about the date and time, when the person arrived at and left the Object, and the following information in the case if the vehicle is used for entry and exit from the Object – mark of the vehicle and licence plate, number of the single-time vehicle pass, information about the date and time, when the vehicle entered and exited the Object.
The following personal data shall be processed in addition to the specified data volume about the recipient of the terminated pass: personal identity number, photograph, position in the represented company, validity period of the terminated pass, parking lot, where it is permitted to park the vehicle.
Legal basis
The Company requires the pass regime for fulfilment of duties determined by regulatory enactments and fulfilment of assignments for public interest – provision of safety of the Object and persons present therein, life, health protection, prevention of a regional disaster, provision of certain order at the Object (thus, the ground follows from Article 6(a)(c) and (e) of the Regulation).
The pass regime is necessary also for compliance with legitimate interests of the controller and third parties – the Company and other persons, who legally stay in the Object, protection of rights and property against criminal offence, provision of set order at the Object (ground includes legitimate interest of the Company – Article 6(1)(f) of the Regulation).
Transfer to processor and / or third parties
Security merchant, providing security of the Object and operating on behalf and in the name of the Company as the processor of the Company.
A merchant, providing data processing and storage in the system.
Duration of storage
3 (three) months from the day of last visit. Period of storage may be extended, if examination is commenced, and information about the pass and its use is required for implementation and completion of the examination.
Video surveillance for the purpose of prevention of safety threat and protection of the property
Video surveillance is performed in the territory and premises of the Company for the following purposes:
Video surveillance cameras are placed in the territory of the Company and certain premises of the building, for example, halls, pass control point. In case of incidents and emergencies, video cameras attached to clothing shall be used. Video surveillance is not performed in the work rooms, kitchens/leisure time rooms of officials/ employees, showers, wardrobes, toilet facilities, medical point and other premises of similar type. The video recording shall be made without sound record (except video cameras to be attached to clothing in case of incidents and emergencies).
Processed data
Appearance (image) of the person entering the video surveillance area, behaviour (activities), place of time of location
Legal basis
Processing is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) of the Regulation – provision of safety of the object of increased danger and life, health protection of persons available therein, prevention of a regional accident;
Legitimate interests of the controller (Article 6(1)(f) of the Regulation) – the Company has legitimate interest to limit stay of unauthorised persons at the object of increased danger, to timely establish or prevent industrial accident, to prevent the danger of vitally important interests (life, health) of persons staying in the territory, as well as to prevent, establish and record illegal activity in relation to protection of property or life and health danger of other persons and to identify the offender in order to call to justice.
Transfer to processor and / or third parties
The following data processors shall have access to personal data:
Duration of storage
Up to 30 days from the day of making an entry. The storage period may be extended, if it is required for achievement of the above-mentioned video surveillance purposes, for example, an examination has been commenced and video surveillance record is required as an evidence for implementation and completion of the examination.
Processing of personal data of cooperation partners, their employees, contact persons, representatives and other involved persons
Within the framework of the performed commercial activity, the Company needs to process the personal data of its cooperation partners, their employees, contact persons and representatives, in order to ensure preparation, conclusion, high-quality fulfilment and management of the cooperation (purchase, supply, service, author’s or contractor’s and other kind) agreement to comply with the requirements of regulatory enactments, as well as to implement the obligations and lawful interests of the Company attributable to the agreement (for example, to make sure about the economic safety of the cooperation partner and whether there is no relation with any of employees of the Company).
E-mail correspondence of the Company is supervised and in certain cases calls may be recorded by calling to phone numbers of the Company. Data processing does not take place with a purpose to regularly control the communication processes, but the data obtained as a result of processing may be used if the Company has reasonable suspicions on unethical or illegal activities. In such a case personal data may be transferred to the authorised employees of the Company, legal service providers as well as law enforcement authorities.
The Company obtains personal data mostly from the Cooperation Partner, when it provides to the Company, for example, its data or the date of its employee, contractor or official, when entering into the agreement or later during the course of fulfilment of the agreement. The Company obtains personal data from the Register of Enterprises of the Republic of Latvia by checking the information about the board members of the partner of the Company, as well as from state, municipal and other legal entities that provide personal data to the Company in accordance with regulatory enactments. Besides, the Company in certain cases may retrieve personal data from the e-mail surveillance system and/or from records of phone calls
Processed data
About cooperation partner (natural person): name, surname, personal identity number, position, address, phone connection number, e-mail address, current account number, signature, amount to be paid and grounds;
About the representative/authorised person of the cooperation partner: name, surname, personal identity number (or date of birth), position, information justifying representation, signature;
About contact person and/or employee of the cooperation partner: name, surname, position, phone connection number, e-mail address;
Other personal data in certain cases: e-mail correspondence content, phone call content;
Additional personal data the processing of which arises from fulfilment of the contract, such as author’s contracts – information about speciality of the author, experience, material of the presentation, video and audio record of the presentation; purchase agreements – information about card drivers of cooperation partners (buyers) – vehicle number and passport data at the issue of the product, in order to identify and prove to whom the product is issued.
Legal basis
Conclusion and fulfilment of the agreement with data subject (Article 6(1)(b) of the Regulation), if the agreement is concluded with the cooperation partner who is a natural person;
Fulfilment of the legal obligation (Article 6(1)(c) of the Regulation), for example fulfilment of requirements of the Accounting Law with regard to preparation and storage of source documents;
Provision of legitimate interests of the controller (Article 6(1)(f) of the Regulation), the Company has legitimate interest to ensure conclusion, fulfilment of agreements and cooperation within the framework of any agreement; to maintain evidence for protection of its legal interests about the transaction taken place; to process data for more convenient organization of work by using agreement management system; before conclusion of the agreement to make sure on the economic safety of the cooperation partner and whether there is no relation with any employee of the Company; to prevent or detect unethical or illegal activity and ensure evidence for investigation of any such activity.
Transfer to processor and / or third parties
Duration of storage
As long as the contact information is updated or as long the agreement is in force, or until the time, when certain obligations are fulfilled (for example, when receiving a confirmation from the buyer about receipt of product, the information about the driver, to whom the product was issued for transportation, is deleted). If persona data are included in the agreement, they will stored during the whole period of validity of the agreement, as well as in accordance with the existing periods of limitation for bringing of claims (3 to 10 years) after expiry of the validity period, in order to save evidence for protection of their legal interests about the cooperation taken place in case of any claims, as well as for fulfilment of accounting requirements. In order to prove unethical or illegal activity, the acquired information may be processed until the moment of execution of legal interest.
We process personal data for the purposes of identification, study and monitoring of cooperation partners, in order to eliminate involvement of the Company in money laundering, financing of terrorism and mass destruction, violation, avoidance of the Law on International Sanctions and National Sanctions of the Republic of Latvia or attempt to avoid fulfilment of sanctions, as well as in order to ensure going concern of the operations of the Company, effective and timely management of reputation risks (for example, by avoiding freezing of payments and funds due to the risks of Sanctions of Money Laundering and Terrorism and Proliferation Financing, which has been identified by the credit institution, where the Company makes and receives payments). Within the framework of such processing We obtain necessary information and documentation (questionnaires, declarations, statements), implement examination of cooperation partners and related persons (owner, beneficial owner, official, board member), as well as perform monitoring by using solutions provided by third parties.
Processed data
Name, surname, personal identity number (if there is no such – date, month, year of birth, number of the personal identification documents and date of issue, country and authority of issue); nationality; country of habitual residence;
the form in which the control is implemented over the capital company (1. through a status in the legal entity (if the BO is the direct owner or directly controls the legal entity) – as a shareholder or stockholder; 2. as a separate person, who controls (if the beneficial owner is an indirect owner or indirectly controls the capital company) – on the basis of the authorisation agreement, on the basis of property rights (for example, if the beneficial owner is the owner of the member or shareholder of the capital company – legal entity), through legal arrangement as a founder, through a legal arrangement as an authorised person, through a legal arrangement as a manager or on the basis of business relations; 3. other);
Information about the person, through whom the control is implemented (for a natural person name, surname, personal identity number, if the person does not have a personal identity number – date, month and year of birth), other information obtained from completed questionnaires, declarations, statements or information search and as a result of monitoring by using the services offered by third parties
Legal basis
Data processing carried out in the public interest (Article 6(1)(e) of the Regulation and when processing personal data of special categories – Article 9(2)(g) of the Regulation).
Provision of the legitimate interests of the controller (Article 6(1)(f) of the Regulation), the Company has legitimate interest to ensure going concern of its operation, effective and timely management of reputation risks (for example, by preventing freezing of payments and funds due to the risks of Sanctions or Money Laundering and Terrorism and Proliferation Financing that would be identified by the credit institution, where the Company makes and receives payments)
Transfer to processor and / or third parties
Supervisory and tax authorities, law enforcement authorities – for performance of their functions in necessary scope; Auditors, financial and legal advisors, as well as other service providers – if it is necessary within the framework of the provided services; companies of Olpha Group – within the framework of provision of mutual services; providers of information systems and data bases (for example, providers of commercial registers and sanction supervision platforms, search service providers)
Duration of storage
Personal data collected for the purpose of customer identification and study will be stored during the whole validity period of transactions, as well as 5 (five) years after termination of legal relations
In certain cases, when the service to be provided by the cooperation partner includes fulfilment of the work of certain type in the territory managed by the Company, We will need to process the personal data of the performer of work, within the framework of Our legitimate interests and ensuring fulfilment of requirements of regulatory enactments in the field of environment and labour protection – in order to perform introductory instructions in labour protection, instructions at the place of work, target instructions, fire fighting instructions, instructions on environment protection, as well as give instructions for performance of dangerous work (fire hazards, under power lines, working with human lifts, etc.).
Processed data
For introduction with instructions: name, surname, personal identity number, position, company name, signature on becoming acquainted with the instruction;
For performance of assignments on dangerous work: name, surname, work to be performed, position, company name, signature, time/period of performance of works, supervisory period
Legal basis
Performance of a legal duty (Article 6(1)(c)) and relevant Cabinet Regulations (No. 749 “Regulations Regarding Training in Labour Protection Matters”, No. 238 “Fire Safety Regulations” etc.);
Provision of legitimate interests of a controller (Article 6(1)(f) of the Regulation) – to ensure fulfilment of the standard 14 001 ISO, in order all performers of work would be informed about the environment policy, aspects.
Transfer to processor and / or third parties
SLI, SP, SFRS as well as other supervisory and law enforcement authorities, if a reasonable request in writing is received
Duration of storage
Information about becoming acquainted with instructions: 3 years;
Assignment data: 3 days after completion of works.
Processing of data of health care professionals
The Company is interested in communicating with health care specialists (hereinafter referred to as – Specialists) in person, in the form of a phone call or electronic correspondence, through individual communication with a specific Specialist. As part of this communication, with the aim of promoting the products and promoting the education of Specialists, information is provided about the products of the Company, as well as the companies of the group of the Company (including use, packaging, dosage, additions, changes in the description, instructions for use); about seminars and other events organized for Specialists; about scientific research, scientific developments, new methods in the field of pharmacology; about opportunities to participate in research, to provide a professional opinion; about other current affairs of the Company and its group companies.
In order to implement the legal process of communication described above, the Company obtains the consent of the Specialists and, upon using the information system provided by a third party, registers and stores data about the Specialists, manages the consents given, not given or withdrawn by the Specialists, uses the possibilities provided by the information system to send the communication in electronic format, as well as to record the communication made and management.
Processed data
About health care specialist: name, surname, e-mail address and/or phone number, address (in order to meet in presence), speciality, place of work, position, country of professional activity, date/-s of meeting, status of consent: “Consent is received” and date of receipt of the consent; “Consent with restrictions” and a comment on the communication form or other restriction, for example, “wishes to communicate only in the form of personal visits”, “only via e-mail”, “only via phone”; or “Consent is requested” or “Consent is declined/revoked” and date of revocation of the consent.
Legal basis
Consent of the data subject (Article 6(1)(a) of the Regulation) for communication (in person, in the form of phone call or electronic correspondence) about:
Provision of legitimate interests of the controller (Article 6(1)(f) of the Regulation):
Transfer to processor and / or third parties
Personal data is transferred to the processor (Proxima Research s.r.o., Slovakia) – a service provider that provides technical storage of data, management in the system and sending of communication in electronic format. As part of data storage and technical support, data may be transferred to sub-processors located outside the EU/EEA by concluding a contract that includes standard data protection clauses approved by the European Commission.
Data may be transferred to supervisory and legal protection authorities if a justified request is received in writing.
Duration of storage
Until the person withdraws his/her consent, expresses a request to stop communication or requests to stop the processing of personal data or delete or destroy the processed personal data, unless there is another purpose and legal basis for the processing of personal data. For example, if a person withdraws his/her consent, the Company, based on legitimate interests, will retain personal data for another 5 (five) years after the withdrawal of consent to ensure that a specific person is no longer asked to give consent, as well as to provide evidence of the legality of the processing until to withdrawal of the consent in the event of any claims or complaints.
The Company has established and ensures the operation of the training portal “Open Olpha” (hereinafter – Portal), provided for health care specialists (hereinafter – Specialists). The possibility is provided for registered users of the Portal to acquire current courses in the e-training system and to become acquainted with the current information about the products of JSC Olpha. The Company shall perform personal data processing, in order to:
Processed data
About health care specialist: name, surname; e-mail address, phone number; name and password of the user for access to the Portal; information about the speciality; information about the place of work; information about Events, where he/she participates, has participated or plans to participate (registered for); acquired further education points as a result of attendance of Events; information included in the communication of the health care specialist and Company, which takes place on the Portal, during Events or by using e-mail, phone number; video and audio record of the course of events, including online Events, that the Company plans to perform in order to make the record of the course of Events available to other health specialists for the purpose of education (therefore the information about participation of the health care specialist in Events, about questions asked, other activities during the Events may be processed; information about activities of the health care specialist on the Portal (for example, information, when the account was established, when the connection to and disconnection from the account was performed, from what IP address the account was used, information on how long time was spent on the Portal).
Legal basis
Provision of legitimate interests of the controller (Article 6(1)(f) of the Regulation), the Company has legitimate interests to ensure performance of the commercial activity; to ensure education possibility of Specialists; to develop, analyze and plan commercial activity of the Company; to promote the image, products and events of the Company and its group companies to the Specialists; to acquire information from Specialists about the products of the Company, its group companies, in order in case of need to make improvements, changes; to establish positive cooperation and communication with Specialists; to manage legal and other type of risks (for example, risks in the field of information security).
Consent of the data subject (Article 6(1)(a) of the Regulation) to contact the Specialist by e-mail, telephone or to come to the specified address in person and provide information about other current Events of the Company and its group companies and products distributed by the Company and its group companies (including the use of products, packaging, dosage, additions, changes in the description, usage instructions).
Transfer to processor and / or third parties
Personal data is transferred to the processor in order to ensure the storage of personal data, the sending of information determined by the Company to the recipient determined by the Company. Data may be transferred outside the EU/EEA by entering into an agreement that includes standard data protection clauses approved by the European Commission.
Data may be transferred to supervisory and legal protection authorities if a justified request is received in writing.
For the purpose of education of Specialists, the recording of events can be placed on the Company’s website or on the website of the cooperation partner of the Company (including another controller).
Duration of storage
As long as the user of the Portal is active, as well as additional 5 (five) years from the day, when the activity is terminated. If the processing is based on the consent given by the data subject, then the data is stored for the entire validity period of the consent, as well as for 5 (five) years after the withdrawal of consent, in order to ensure that a specific person is no longer asked to give consent, as well as to provide evidence of the legal course of the processing until withdrawal of consent in case of any claims or complaints.
The record of the events may be saved and made available to Specialists until the educational information provided within the framework of Events is no longer relevant. The Company shall regularly assess the topicality of the record of Events.
The drug by-effect report submitted by a patient may include personal data of the health care specialist or such a report may be submitted by the health care specialist. Read more about the personal data processing performed by the Company upon receipt of the drug by-effect report in Clause 3.5 of this Privacy Policy.
Personal data processing of the submitters of drug by-effect report or information specified in the drug by-effect report
The Company shall process the personal data included in the drug by-effect report (hereinafter – the Report) in order to fulfil the duties determined for the Company by regulatory enactments – to acquire, collect, analyze and consider the information about the observed by-effects of drugs. Within the framework of performance of these duties, the Company shall assess the Report, analyze the information included therein, in case of need contact with the submitter of the Report or, if a patient has provided consent, contact with the doctor of the patient in order to obtain additional information. Drug by-effect reports may be received also during phone conversation, accordingly records of phone calls are made and, if the report is given via phone, then the voice audio record is retrieved, in order to properly ensure recording of the received Report, assessment of information and saving of evidence about the received Report. All received and processed information is required to help to minimize and eliminate the possible risk related to the use of medicinal products, as well as to promote safe use of medicinal products.
The Company shall commence the processing of personal data when the Report is submitted. The Report submitted by the patient may include personal data of the health care specialist. The Report may be submitted also by a patient himself, his representative (for example, a lawyer or a parent about a child) or health care specialist. If the Report is submitted by a representative of a patient, this person shall bear full responsibility and ensure that he/she has the right, in accordance with the Regulation, to submit the personal data of the patient to the Company, including to give a permit on behalf of the patient for the Company to contact the doctor of the patient, and the representative shall be obliged to provide the information specified in this Privacy Policy to the patient in relation to the performed personal data processing.
The Company performs pseudonymization of the received personal data, but the submission of personal data, including them in the Report, is necessary so that, if necessary, the Company can obtain additional information about the situation described in the Report and so that the Company can determine whether several reports refer to the same case or to several cases of by-effects caused by medicinal products. We recommend you to provide only the information requested in the Report Form by following the instructions provided in the Report Form.
Processed data
About the patient:
About the health care specialist and/or representative of the patient:
If the report is submitted by telephone, in addition to the personal data indicated above, a voice audio recording is also obtained to properly ensure the recording of the received Report, the evaluation of information and the preservation of evidence about the received Report.
Legal basis
Fulfillment of legal obligation (Article 6 (1)(c) of the Regulation), Pharmaceutical Law, Cabinet Regulations No. 47 “Pharmacovigilance Procedures”, adopted on 22 January 2013, Regulation (EC) No 726/2004 of the European Parliament and of the Council of 31 March 2004 laying down Community procedures for the authorisation and supervision of medicinal products for human and veterinary use and establishing a European Medicines Agency and Article 9(2)(g) and (i) of the Regulation
Transfer to processor and / or third parties
The Company uses a personal data processor, who provides technical maintenance of the storage database in the name and on behalf of the Company, based on the instructions of the Company.
If a permit of the patient is received, the Company shall be entitled to contact with the doctor of the patient, in order to obtain additional information to fulfil the duties determined by regulatory enactments.
In cases determined by regulatory enactments the personal data shall be transferred to the institution, who performs supervision of the Company – the State Agency of Medicines of the Republic of Latvia, the European Medicines Agency, the European Medicines Agency’s drug report database “Eudravigilance” in a pseudonymized form, or after receiving a justified written request – to another institution that needs the information to fulfill its duties.
Duration of storage
As long as the product is registered and another 10 years after expiry of the trade permit of specific medicines
Personal data processing of the participant of the clinical research
The Company conducts clinical studies with the aim to obtain confirmation of the safety and effectiveness of the medicinal products in the human body. These studies are an important step in the registration process of medicines, providing evidence-based facts in the benefit-risk assessment. The company annually conducts various types of clinical studies (bioequivalence, drug efficacy and safety studies) in several countries in accordance with EU and national legislation, following Good Clinical Practice (GCP) guidelines.
Processed data
Processing is necessary to fulfill a task performed in the public interest (Article 6 (1)(e) of the Regulation) and processing is necessary due to the public interest in the field of public health (Article 9(2)(i) of the Regulation), as well as Pharmaceutical Law and Cabinet Regulations No. 289 (adopted on 23.03.2010) and the data subject has given explicit consent to the processing of these personal data for one or more specific purposes (Article 9(2)(a) of the Regulation).
Legal basis
Processing is necessary to fulfill a task performed in the public interest (Article 6 (1)(e) of the Regulation) and processing is necessary due to the public interest in the field of public health (Article 9(2)(i) of the Regulation), as well as Pharmaceutical Law and Cabinet Regulations No. 289 (adopted on 23.03.2010) and the data subject has given explicit consent to the processing of these personal data for one or more specific purposes (Article 9(2)(a) of the Regulation).
Transfer to processor and / or third parties
The data are fully available to researchers and research organizations, supervisory authorities, within the framework of the implementation of the functions assigned to them.
Duration of storage
The data is stored for at least five years after the registration of the investigational product.
Basic documents are stored longer if it is stipulated by the regulatory enactments on the procedure for record-keeping of medical documentation or in the contract concluded between the sponsor and the researcher.
Medical records of persons under investigation shall be stored in accordance with the regulatory enactments on the procedure for record-keeping of medical documentation.
Personal data processing of the participant in medication observation
In the observations of the use of medicines, only such data are collected that the observer (doctor) obtains in his/her professional activity, based on the opinion about the patient’s health condition and treatment. Additional diagnostic and monitoring procedures are not performed on patients and epidemiological methods are used to analyze the collected data. Society organizes monitoring of the use of medicine in order to evaluate treatment options and better help people with health problems for the treatment of which the medicine to be observed are intended.
Processed data
Information that the Company processes about the patient: pseudonymized identification information, health data – medical history, results of tests and other examinations, demographic data – gender, age and other information depending on the specifics of the medicines to be observed.
Legal basis
Processing is necessary to fulfill a task performed in the public interest (Article 6 (1)(e) of the Regulation) and processing is necessary due to the public interest in the field of public health (Article 9(2)(i) of the Regulation), as well as Pharmaceutical Law and Cabinet Regulations No. 289 (adopted on 23.03.2010) and the data subject has given explicit consent to the processing of these personal data for one or more specific purposes (Article 9(2)(a) of the Regulation).
Transfer to processor and / or third parties
The data are available in full to the person performing the observation – the treating doctor, as well as to the institutions that, according to the Medical Treatment Law, have the right to familiarize themselves with information about the patient.
Duration of storage
The data is stored for at least five years after the registration of the investigational product.
Basic documents are stored longer if it is stipulated by the regulatory enactments on the procedure for record-keeping of medical documentation or in the contract concluded between the sponsor and the researcher.
Medical records of persons under investigation shall be stored in accordance with the regulatory enactments on the procedure for record-keeping of medical documentation.
Personal data processing of the visitor or participant of events organized by us
If you are a visitor or participant of events organized by the Company, your data can be processed for the purposes of organization, arrangement and description of the event. The amount of personal data processed may be different, taking into account the nature and specifics of the specific event, for example, the Company may organize and pay for a seminar, conference or excursion for its cooperation partners, their representatives and employees. The Company is interested in creating a positive public image, therefore the events organized by the Company may be photographed and/or filmed and the obtained materials may be published both on the Company’s website and in social network accounts, newspapers, magazines or other channels after selection.
Processed data
About the visitor or participant of the event:
name, surname, speciality, position, represented company and other data depending on the specifics of the event.
For publicity – data from the venue of the event is recorded in photographs or video recordings.
Legal basis
Provision of the legitimate interests of the controller (Article 6(1)(f) of the Regulation) – to organize events for their customers or cooperation partners, as well as to ensure the publicity of the organized events.
Transfer to processor and / or third parties
The data may be available to the following processors – photographers, archiving service provider, database technical maintainer, as well as other service providers who may act as processors within the scope of their services, or as third parties (independent data controllers).
Data may be transferred to supervisory and law enforcement authorities if a reasonable request has been received in the written form or if the Company has a reason to protect its legitimate interests by turning to the law enforcement authorities.
Publicity photos, videos and general information about the event will be publicly available.
Duration of storage
The data storage period is determined to take into account the needs of organizing the event, as well as to comply with the requirements of the Accounting Law.
While publicity materials will be stored without a limited storage period to ensure the creation of the historical memory of the Company.
Personal data processing of the submitter of the letter, submission, request or complaint
If you contact Us in writing, upon receiving your letter, submission, request or complaint, the Company has a legal interest to process it – register the incoming correspondence in the log, familiarize yourself with the content, hand it over to the employee responsible for the specific area for evaluation, make a decision and prepare an answer on the merits, as well as store for the purpose of proof all correspondence that occurred in connection with the specific submission, request or complaint for the purpose of resolving any future claims.
Processed data
About the submitter: name, surname, e-mail address, phone number, correspondence address; any information specified in the submission; any information obtained during the course of review of the submission
Legal basis
Provision of legitimate interests of the controller (Article 6(1)(f) of the Regulation) – to process the received submission, request, complaint, to settle it and notify about the decision made, as well as save evidence for the purpose of settlement of further complaints.
Transfer to processor and / or third parties
Data may be available to the following processors – archiving service provider, data base technical maintainer or other persons, who are related to the provision of services to the Company.
Data may be transferred to the supervisory and law enforcement authorities, if a reasonable request in the written form is received or if the Company needs to defend its legal interests.
Duration of storage
The period of data storage is determined to take into account the applicable periods of limitation (up to 10 years).
Personal data processing of the recipient of the scholarship granted by JSC Olpha
Promoting the development of the chemical and pharmaceutical industries, the Company actively cooperates with SIA Centrālā laboratorija (LLC), Latvian Association of Chemical and Pharmaceutical Entrepreneurs, as well as with Latvian universities in projects aimed at increasing the knowledge and experience of students and teaching staff in pharmaceutical and chemistry study programs. As part of this cooperation, the Company implements a student scholarship program. To apply for a scholarship, a student applying for a scholarship shall fill in the electronic application form on the Company’s website: https://starpmumsirkimija.lv . Upon receiving applications, the Company evaluates them and makes a decision on awarding scholarships to the best applicants. The Company is interested in publishing photos and general information about the winners in order to create interest in natural sciences and promote the Company as a socially responsible company.
Processed data
About the applicant: name, surname; phone number and e-mail; educational institution and study programme; school results and study achievements; personal aspects – motivation, self-sacrifice, involvement in the educational process; feedbacks from educational institutions; as well as other information specified by the applicant in the application or provided during the interview; current account number of the credit institution for pay-out of the scholarship; As well as for publicity – name, surname, photo of the winners of the competition, information about the educational institution and study program, study achievements and other positive information.
Legal basis
Provision of legitimate interests of the controller (Article 6(1)(f) of the Regulation) – implementation of social responsibility measures to support young chemistry teachers and promote children’s and young people’s interest in natural sciences, especially chemistry, as well as ensuring publicity by informing about the social responsibility measures taken to support young chemistry teachers and promote children’s and young people’s interest in natural sciences. Conclusion and fulfilment of agreement with data subject (Article 6(1)(b) of the Regulation) – the agreement is concluded with winners of the competition about granting the scholarship.
Transfer to processor and / or third parties
Data may be available to the following processors – photographers, archiving service provider, data base technical maintainer or other persons, who are related to the provision of services to the Company. State authorities in cases determined by legal acts, for example, the State Revenue Service. Publicity photos and general information about the winners will be publicly available.
Duration of storage
It is planned to store data for 5 years after granting the support, in order to fulfil the requirements of the Accounting Law.
Publicity materials will be stored without a limited storage period to ensure the creation of the historical memory of the Company.
If you will ask to grant a donation
Acting in accordance with its philosophy, business strategy and course of activity, the Company may undertake certain sponsorship projects and support initiatives – grant donations. The Company provides a possibility to submit applications for sponsorship and public support projects on its website by filling out the application form on the website.
If, when submitting an application for sponsorship, the applicant submits the data of another natural person (acting in the name of or on behalf of such person), then the applicant is responsible for providing a legal basis in accordance with the General Data Protection Regulation for submitting data to the Company for the purpose of submitting an application for sponsorship, and is also responsible for informing the relevant other natural persons about ongoing data processing and introduction with this Privacy Policy. The Company recommends you not to provide data on the health of another natural person, as well as not to provide the Company with personal data that is not necessary for the evaluation of the application, such as a photograph, national or ethnic origin, family status, membership of a political party, employee union or other public organization, religious denomination , or information about religious beliefs, or documents and detailed information about your health. If specific additional information or documents will be required for the evaluation of the application, the Company will ask the applicant to submit or present them.
The Company processes the applicant’s personal data for the purpose of reviewing the submitted application to the Company, deciding on the grant of support and, in case of a positive decision, concluding a donation (gift) agreement and implementing the rights and obligations stipulated in the agreement, including ensuring the fulfillment of the request contained in the application.
Processed data
About the applicant of the donation:
to be supported;
Legal basis
Consent (Article 6(1)(a) of the Regulation) – with regard to submission of the application, as well as consent for processing of data of special categories (Article 9(2)(a) of the Regulation), if the application includes health data or other data of special categories; conclusion and fulfilment of the agreement with data subject (Article 6(1)(b) of the Regulation) – with regard to conclusion and fulfilment of the donation/gift agreement.
Transfer to processor and / or third parties
Data may be transferred to supervisory and law enforcement authorities if a reasonable request has been received in the written form or if the Company has a reason to protect its legitimate interests by turning to the law enforcement authorities.
In the case of athlete support, the data could be made public on the website, Facebook account (in this case, this aspect is stipulated in the support contract or by including a disclaimer in the e-mail about data processing for publicity purposes, e.g. marathon participants).
Duration of storage
5 years after granting of the support, in order to fulfil the requirements of the Accounting Law.
Data processing of the whistleblower’s report
The Company shall process personal data of whistleblowers in order to fulfil the duty determined in the Whistleblowing Law – to accept, review and investigate the whistleblower’s report about the violation in the Company, ensure proper protection of the whistleblower (also protection of a relative and/or related person of the whistleblower) and promote public understanding on the whistleblowing. Within the framework of this proceeding, the Company can perform processing of personal data also within the framework of implementation of its legitimate interests, in order to protect interests important for the Company – to ensure effective review of whistleblower’s report, implement the right of the Company to protection of values and reputation of the Company, protection and sustainability of economic interests of the Company, as well as to ensure disclosure of the violation of the internal regulatory enactment, prevention of a criminal offence and other illegal activity, prevention of possible or current harm, loss or infringement of rights.
Processed data
About the whistleblower: name, surname, contact information for communication (address, e-mail address or phone number), information about relation of the whistleblower with the Company (for example, an employee, service provider), information about the fact, whether the whistleblower has reported on the violation previously, other information about the whistleblower, specified in the whistleblower’s report or which is obtained and used within the framework of review of the whistleblower’s report, if it is not possible to review valuably the whistleblower’s report or the violation case initiated on the basis of that without such information.
About the relative and/or related person of the whistleblower: could be such personal data as name, surname, contact information, office in the Company.
Legal basis
Fulfilment of the legal duty and processing for public interests (Article 6(1)(c) and (e) of the Regulation), arising from the Whistleblowing Law.
Provision of legitimate interests of the controller (Article 6(1)(f) of the Regulation), the Company has legitimate interest – to ensure effective review of the whistleblower’s report, implement the right of the Company to protection of values and reputation of the Company, protection and sustainability of economic interests of the Company, as well as to ensure disclosure of the violation of the internal regulatory enactment, prevention of the criminal offence and other illegal activity, prevention of possible or current harm, loss or infringement of rights.
Transfer to processor and / or third parties
In cases specified by the regulatory enactments of the supervisory and law enforcement authorities (State Police, Corruption Prevention and Combating Bureau, State Labor Inspectorate, etc.) or in the event that the Company has grounds to defend its legitimate interests by applying to law enforcement authorities (for example, the court, the State Police).
The Company may use a personal data processor that ensures the storage of personal data.
Duration of storage
Pseudonymization of the whistleblower’s personal data takes place immediately after receiving the whistleblower’s report.
The data is stored for 1 (one) year after the completion of the investigation of the whistleblower’s report. Afterwards, the data is destroyed or deleted within 3 (three) months, except if the Company has a legal obligation to store the data for a longer period of time in accordance with the requirements of the regulatory enactments, or if legal proceedings or any investigation has been initiated due to the violation indicated in the report of the whistleblower.
Personal data processing of visitor of the website
The Company uses necessary or mandatory cookies on websites managed by it – these are cookies that, in accordance with regulatory enactments, the Company may store on your device without consent, if they are necessary for the operation of the specific website. By default, the rest of the cookies are disabled, except for the necessary cookies that ensure the basic functionality and operation of the website. The use of other types of cookies requires your permission – consent and they will be used only after you have given your consent. Read more about the cookies used by the Company and their management in Our Cookie Use Policy, available here.
What are your rights and other importand things in relation to the performed personal data processing
What are my rights in relation to the performed personal data processing?
Where to turn in order to exercise your rights of the data subject?
You can obtain information about your personal data available at the disposal of the Company or exercise your other rights as a data subject in one of the following ways:
Upon receiving the application, the Company evaluates its content and the possibility of identification of the applicant, and depending on the relevant situation, the Company reserves the right to ask the applicant to identify himself in addition, in order to ensure the security and disclosure of the data to be provided to the right person.
To what recipients do we make your personal data available?
The Company takes the necessary measures to process your personal data in accordance with applicable laws and to ensure that personal data is not accessed by third parties who do not have a relevant legal basis for processing your personal data.
As per need, your personal data can be accessed by:
From where we obtain your personal data?
We can obtain your personal data in any of the following forms:
Are your personal data used for making automated decisions?
We do not your use personal data for making of automated decisions.
Are your personal data transferred outside of the countries of the European Union (EU) or European Economic Area (EEA)?
We process your personal data mostly in the territory of the European Union. In case it is necessary to entrust the processing of personal data to a cooperation partner or service provider located outside the European Union and the European Economic Area, measures are taken to ensure that the relevant cooperation partner or service provider processes the data in a country in respect of which there is a decision of the European Commission on ensuring an adequate level of protection of personal data, or that the relevant cooperation partner or service provider ensures the signing and compliance with the standard contract clause approved by the European Commission regarding the transfer of personal data to third countries.
Entry into force, availability and changes to the Privacy Policy
This Privacy Policy shall enter into force on 3 October 2024.
The current version of the Privacy Policy is published on the website of the Company, as well as is available in the printed form pursuant to request in the administration of the Office of the Company at 5 Rūpnīcu Street, Olaine.
The Company shall be entitled to make changes to the Privacy Policy.