{/* Section 1: Introduction & Effective Date */}

Espandiar Pharmaceuticals GmbH (“Espandiar,” “we,” “us,” or “our”) is committed to protecting the privacy and personal data of all individuals with whom we interact, including healthcare professionals, patients, clinical trial participants, business partners, employees, and website visitors. This Privacy Policy describes our practices regarding the collection, use, disclosure, storage, and protection of personal data in connection with our operations, our website at espandiar.com, and all related services, platforms, and communications.

This Privacy Policy takes effect on January 1, 2025 and applies to all personal data processed by Espandiar Pharmaceuticals GmbH from that date forward. It supersedes all prior privacy notices or policies previously published by the company. We reserve the right to amend this policy at any time in accordance with Section 13 below. Any material changes will be communicated through appropriate channels, including publication on this website.

Regulatory Framework

This Privacy Policy has been drafted in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), the German Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”), Directive 2001/83/EC as amended, and all applicable national implementing legislation governing data protection in the pharmaceutical and life sciences sector.

{/* Section 2: Data Controller */}

The data controller responsible for your personal data within the meaning of Article 4(7) of the GDPR is:

Espandiar Pharmaceuticals GmbH

Registered office: Frankfurt am Main, Hessen, Germany
Commercial Register: Handelsregister (to be registered)
Email: Info@espandiarpharma.com
Telephone: +49 1522 3449208

As the data controller, Espandiar Pharmaceuticals GmbH determines the purposes and means of processing personal data. Where we engage third-party service providers to process personal data on our behalf, such providers act as data processors under a written data processing agreement in accordance with Article 28 of the GDPR. We remain fully responsible for the lawful processing of your personal data.

{/* Section 3: Types of Personal Data Collected */}

Espandiar Pharmaceuticals collects and processes different categories of personal data depending on the nature of our interaction with you and the applicable legal basis. The following categories describe the types of personal data we may collect:

Identity Data

Title, first name, last name, date of birth, gender, nationality, photograph, and government-issued identification numbers (e.g., passport number, national ID) where required for regulatory compliance, such as clinical trial participant identification or Good Distribution Practice (GDP) record-keeping.

Contact Data

Postal address, email address, telephone number(s), fax number, and any other contact details provided through our website contact forms, business correspondence, conference registrations, or during the course of professional interactions.

Professional Data

Professional qualifications, medical licensure numbers, specialty, institutional affiliation, professional registration details (e.g., with national medical chambers), job title, employer name, and business address. This data is collected primarily in the context of interactions with healthcare professionals, key opinion leaders, and scientific collaborators.

Technical Data

Internet Protocol (IP) address (anonymized where feasible), browser type and version, operating system, device identifiers, access times, pages viewed, referring URL, click patterns, and other technical interaction data collected automatically when you visit espandiar.com or use our digital platforms.

Health-Related Data (Special Categories under GDPR Article 9)

In the course of pharmacovigilance activities, clinical trials, and medical information services, Espandiar may process special categories of personal data concerning health, including adverse event reports, medical history, diagnosis information, concomitant medications, laboratory values, and clinical outcomes. Processing of such data is conducted under the explicit derogations provided in Article 9(2)(h) and Article 9(2)(i) of the GDPR (healthcare provision, public health, and pharmaceutical law purposes) and is subject to enhanced safeguards, including pseudonymization, restricted access, and professional confidentiality obligations.

{/* Section 4: Legal Basis for Processing */}

Espandiar processes personal data only on lawful bases as defined by the GDPR. The applicable legal basis depends on the specific processing activity and the context in which the data is collected. The following legal bases may apply:

Consent (Article 6(1)(a) GDPR): Where you have given clear, informed, and unambiguous consent to the processing of your personal data for one or more specific purposes, such as receiving marketing communications, participating in optional surveys, or allowing cookies beyond strictly necessary functionality. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Contractual Necessity (Article 6(1)(b) GDPR): Where processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract, such as processing supplier data to fulfill purchase orders or processing employee data to execute employment contracts.

Legitimate Interest (Article 6(1)(f) GDPR): Where processing is necessary for the purposes of legitimate interests pursued by Espandiar or by a third party, provided that such interests are not overridden by your fundamental rights and freedoms. Examples include business development activities, network security monitoring, fraud prevention, and internal audit. We always conduct a balancing test to ensure that your rights are not unduly compromised.

Legal Obligation (Article 6(1)(c) GDPR): Where processing is necessary for compliance with a legal obligation to which Espandiar is subject, including pharmaceutical regulations (Directive 2001/83/EC, Regulation (EU) No 726/2004), pharmacovigilance reporting requirements (Regulation (EU) No 1235/2010), tax and accounting laws, and employment legislation.

Vital Interests (Article 6(1)(d) GDPR): Where processing is necessary to protect the vital interests of an individual, for instance in emergency situations where medical information must be disclosed to prevent serious harm to a patient’s health.

{/* Section 5: Purposes of Processing */}

Espandiar processes personal data for the following specific purposes, each supported by an appropriate legal basis as described in Section 4:

Business Development & Partner Management: Managing relationships with Contract Research Organizations (CROs), Contract Development and Manufacturing Organizations (CDMOs), distributors, suppliers, licensing partners, and academic institutions. This includes maintaining CRM records, negotiating and executing contracts, conducting due diligence, and managing joint development programs.

Regulatory Compliance: Preparing, submitting, and maintaining regulatory dossiers (MAAs, variations, renewals), interacting with the European Medicines Agency (EMA), the U.S. Food and Drug Administration (FDA), the Federal Institute for Drugs and Medical Devices (BfArM), the Paul Ehrlich Institute (PEI), and other national competent authorities. This also includes compliance with Good Manufacturing Practice (GMP), Good Distribution Practice (GDP), and Good Pharmacovigilance Practice (GVP) requirements.

Pharmacovigilance: Collecting, processing, and reporting adverse drug reactions (ADRs), adverse events (AEs), medication errors, product quality complaints, and other safety data in accordance with EU GVP Modules I–XVI, ICH E2E guidelines, and applicable national pharmacovigilance legislation. Safety data is handled with the highest degree of confidentiality and reported to regulatory authorities within mandated timeframes.

Clinical Trials: Managing clinical trial data, including informed consent documentation, eligibility assessments, safety monitoring, data management, and regulatory submissions to ethics committees and competent authorities in accordance with the EU Clinical Trials Regulation (CTR) No 536/2014 and ICH Good Clinical Practice (GCP) guidelines E6(R2).

Human Resources & Employment: Managing the employment lifecycle, including recruitment, onboarding, performance management, payroll administration, benefits enrollment, training records, workplace health and safety, and termination processes, in compliance with German employment law and the BDSG.

Marketing & Communications: Sending scientific updates, product information, congress invitations, newsletters, and promotional materials to healthcare professionals and other stakeholders who have provided appropriate consent, in compliance with the German Heilmittelwerbegesetz (HWG) and the FSA Code.

Website Analytics & Improvement: Analyzing website usage patterns to improve user experience, content relevance, and technical performance. Analytics data is collected in anonymized or pseudonymized form where technically feasible.

{/* Section 6: Data Sharing & Third Parties */}

Espandiar may share personal data with carefully selected categories of third parties, always within the scope of the purposes described above and subject to appropriate contractual, organizational, and technical safeguards:

Regulatory Authorities: The European Medicines Agency (EMA), the U.S. Food and Drug Administration (FDA), the Federal Institute for Drugs and Medical Devices (BfArM), the Paul Ehrlich Institute (PEI), national competent authorities of EU Member States, and other health authorities worldwide. Such disclosures are made to fulfill our legal obligations under pharmaceutical legislation and pharmacovigilance requirements.

Contract Research Organizations (CROs): Organizations engaged to conduct clinical trials, bioequivalence studies, pharmacovigilance activities, or regulatory affairs support on our behalf. All CROs operate under written agreements incorporating data processing terms compliant with Article 28 GDPR and applicable GCP/GVP standards.

CDMO Partners & Manufacturing Sites: Contract Development and Manufacturing Organizations involved in the development, production, quality control, and packaging of our pharmaceutical products. Data sharing with CDMO partners is governed by Quality Agreements and Confidentiality Agreements that include data protection provisions.

Logistics & Distribution Partners: Wholesalers, freight forwarders, cold-chain logistics providers, and warehouse operators involved in the storage and distribution of pharmaceutical products, operating in compliance with GDP requirements and subject to appropriate data processing agreements.

IT Service Providers: Cloud infrastructure providers, hosting services, cybersecurity vendors, CRM platform operators, and other technology service providers who process personal data on our behalf as data processors under GDPR Article 28 agreements. All IT service providers are subject to comprehensive security assessments and audit rights.

Legal Advisors & Auditors: External legal counsel, patent attorneys, notaries, statutory auditors, and regulatory consultants who require access to personal data in the context of providing professional services, bound by applicable professional confidentiality obligations.

No Sale of Personal Data

Espandiar Pharmaceuticals does not sell, rent, trade, or otherwise commercialize your personal data to any third party for their own marketing or commercial purposes. We share personal data only as described in this section and only to the extent necessary for the purposes outlined in this Privacy Policy.

{/* Section 7: International Data Transfers */}

Given the global nature of pharmaceutical research, development, manufacturing, and distribution, Espandiar may transfer personal data to countries outside the European Economic Area (EEA). Such transfers are carried out in compliance with Chapter V of the GDPR and ensure an adequate level of data protection is maintained throughout the transfer.

Adequacy Decisions (Article 45 GDPR): Where the European Commission has issued an adequacy decision recognizing that a third country ensures an adequate level of data protection (e.g., the United Kingdom, Switzerland, Japan, Canada, Israel, and certain other jurisdictions), transfers to such countries proceed without additional safeguards.

Standard Contractual Clauses (Article 46(2)(c) GDPR): For transfers to countries without an adequacy decision, Espandiar relies on the European Commission’s Standard Contractual Clauses (SCCs) for the transfer of personal data to third countries, as adopted by Commission Implementing Decision (EU) 2021/914. The appropriate module (controller-to-controller, controller-to-processor, or processor-to-processor) is selected based on the specific transfer scenario. A Transfer Impact Assessment (TIA) is conducted prior to each transfer to evaluate the legal framework of the recipient country and to determine whether supplementary measures are necessary.

Supplementary Measures (Article 46 GDPR & Schrems II): Where a Transfer Impact Assessment identifies risks that SCCs alone cannot mitigate, Espandiar implements supplementary technical, organizational, and contractual measures. These may include end-to-end encryption, pseudonymization, strict access controls, contractual commitments regarding government access requests, and, in exceptional cases, suspension of the transfer until adequate safeguards can be established.

{/* Section 8: Data Retention */}

Espandiar retains personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy applicable legal, regulatory, accounting, and reporting requirements. The following retention periods apply to the principal categories of personal data:

Regulatory & Pharmacovigilance Records: Minimum 15 years from the date of marketing authorization grant or renewal, and up to 30 years for certain categories of safety data, in accordance with EU GVP Module VI, Directive 2001/83/EC Article 98(4), and national pharmaceutical legislation. Individual Case Safety Reports (ICSRs) are retained for a minimum of 25 years from the date of report generation.

Clinical Trial Data: Minimum 25 years after the end of the clinical trial, in accordance with ICH E6(R2) GCP guidelines and the EU Clinical Trials Regulation (CTR) No 536/2014. This includes source documents, case report forms, informed consent forms, trial master files, and all safety and efficacy data.

Human Resources Records: Duration of the employment relationship plus 6 years post-termination, in accordance with German commercial law (§ 257 HGB, § 14 AO) and social security legislation. Certain HR records (e.g., workplace accident documentation, medical examinations) may be subject to longer retention periods under occupational health and safety laws.

Business & Contract Records: Duration of the contractual relationship plus 6 to 10 years, depending on the nature of the agreement and applicable statutory limitation periods under the German Bürgerliches Gesetzbuch (BGB) and the Handelsgesetzbuch (HGB).

Marketing Communications Data: Until consent is withdrawn or until the data is no longer relevant to the marketing purpose, whichever occurs first. Marketing lists are reviewed at least annually to remove inactive or unsubscribed contacts.

Website Analytics Data: Anonymized analytics data is retained for a maximum of 26 months from the date of collection, in line with industry best practices and applicable data minimization principles. Raw log data is anonymized or deleted within 30 days.

Upon expiration of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents reconstruction. Retention periods are subject to periodic review and may be extended where required by legal proceedings, regulatory audits, or ongoing investigations.

{/* Section 9: Your Rights */}

Under the GDPR, you are granted a comprehensive set of rights with respect to your personal data. Espandiar is committed to facilitating the exercise of these rights in a timely and transparent manner. Where applicable, these rights are subject to the exemptions and limitations provided for in Articles 23 and 89 of the GDPR.

Right of Access (Article 15 GDPR): You have the right to obtain confirmation as to whether personal data concerning you is being processed, and, where that is the case, access to the personal data and information about the processing, including the purposes, categories of data, recipients, retention periods, and the existence of automated decision-making, including profiling.

Right to Rectification (Article 16 GDPR): You have the right to obtain the correction of inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to Erasure / Right to Be Forgotten (Article 17 GDPR): You have the right to obtain the erasure of personal data concerning you without undue delay where one of the grounds listed in Article 17(1) applies (e.g., data is no longer necessary, consent is withdrawn, you object to processing). This right does not apply where processing is necessary for compliance with a legal obligation, for the establishment, exercise, or defense of legal claims, or for archiving purposes in the public interest, including pharmacovigilance and scientific research.

Right to Restriction of Processing (Article 18 GDPR): You have the right to obtain the restriction of processing of personal data concerning you where the accuracy of the data is contested, processing is unlawful but you prefer restriction over erasure, Espandiar no longer needs the data but you require it for legal claims, or you have objected to processing pending the verification of legitimate grounds.

Right to Data Portability (Article 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller without hindrance from Espandiar, where processing is based on consent or contractual necessity and is carried out by automated means.

Right to Object (Article 21 GDPR): You have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on legitimate interests (Article 6(1)(f)). Espandiar shall cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims. You also have the right to object to processing for direct marketing purposes at any time.

Right to Withdraw Consent (Article 7(3) GDPR): Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. You may withdraw consent by contacting our Data Protection Officer using the contact details provided in Section 14.

Rights Related to Automated Decision-Making and Profiling (Article 22 GDPR): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except in limited circumstances permitted by the GDPR.

To exercise any of these rights, please submit a written request to our Data Protection Officer (see Section 14). We will respond to your request without undue delay and in any event within one month of receipt. This period may be extended by a further two months where necessary, taking into account the complexity and number of your requests, in which case you will be informed of the extension and the reasons for the delay.

{/* Section 10: Cookies & Tracking */}

Espandiar uses cookies and similar tracking technologies on espandiar.com to enhance your browsing experience, analyze website traffic, and understand how visitors interact with our content. Cookies are small text files placed on your device that enable certain website functions and facilitate data collection.

For a comprehensive description of the cookies we use, their purposes, categories, and how you can manage your cookie preferences, please refer to our dedicated Cookie Policy. The Cookie Policy forms an integral part of this Privacy Policy.

{/* Section 11: Data Security */}

Espandiar implements robust technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. Our security program is designed in accordance with the state of the art (Stand der Technik) as required by Article 32 of the GDPR and is aligned with ISO 27001 information security management principles.

Encryption: All personal data is encrypted in transit using Transport Layer Security (TLS 1.3) for data transmitted over public networks. Data at rest is encrypted using AES-256 encryption for databases and storage systems containing personal or sensitive information.

Access Controls: Access to personal data is restricted on a need-to-know and role-based basis through a comprehensive Identity and Access Management (IAM) system. Multi-factor authentication (MFA) is mandatory for all systems processing sensitive personal data, including pharmacovigilance databases and clinical trial platforms.

Pseudonymization: Where feasible, personal data is pseudonymized to reduce risks to data subjects. In clinical trials and pharmacovigilance, patient identifiers are replaced with unique study codes or safety report reference numbers, with the key held separately under strict access controls.

Data Protection Impact Assessments (DPIAs): We conduct DPIAs for processing activities that are likely to result in a high risk to the rights and freedoms of natural persons, in accordance with Article 35 of the GDPR. This includes processing of health data at scale, systematic monitoring of publicly accessible areas, and the use of new technologies in pharmaceutical research.

Incident Notification: In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, Espandiar will notify the competent supervisory authority within 72 hours of becoming aware of the breach, in accordance with Article 33 of the GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also communicate the breach to you directly without undue delay (Article 34 GDPR).

{/* Section 12: Children's Data */}

The Espandiar Pharmaceuticals website and its content are directed at healthcare professionals, business partners, investors, and other adult stakeholders in the pharmaceutical and life sciences industry. Our website is not directed at children under the age of 16, and we do not knowingly collect personal data from individuals under 16 years of age.

In the context of clinical trials involving pediatric populations, the processing of children’s data is governed by specific provisions of the EU Clinical Trials Regulation (CTR) No 536/2014, national ethics committee approvals, and parental or guardian consent requirements. Such processing is conducted under the derogations provided in Article 8 of the GDPR and is subject to enhanced protections.

If we become aware that we have inadvertently collected personal data from a child under 16 without verifiable parental consent, we will take immediate steps to delete that data from our systems. If you believe that a child under 16 has provided us with personal data, please contact our Data Protection Officer at the address provided in Section 14.

{/* Section 13: Changes to This Policy */}

Espandiar Pharmaceuticals reserves the right to update, modify, or replace this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law or regulation, or for other operational, legal, or regulatory reasons. We will not materially reduce your rights under this Privacy Policy without providing appropriate notice.

When we make material changes to this Privacy Policy, we will notify you by posting the updated policy on espandiar.com with a revised “Effective Date” at the top of this page. For changes that significantly affect how we process your personal data, we may also provide additional notification through email, website banners, or other appropriate communication channels, depending on the nature and scope of the changes and your relationship with us.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of espandiar.com or our services after the publication of any changes constitutes your acceptance of the updated Privacy Policy.

{/* Section 14: Contact */}

If you have any questions, concerns, or requests regarding this Privacy Policy, the processing of your personal data, or the exercise of your rights under the GDPR, please contact our Data Protection Officer:

Data Protection Officer

Espandiar Pharmaceuticals GmbH
Frankfurt am Main, Hessen, Germany
Email: Info@espandiarpharma.com
Telephone: +49 1522 3449208

You also have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR. The competent supervisory authority for Espandiar Pharmaceuticals GmbH is:

Hessischer Beauftragter für den Datenschutz und die Informationsfreiheit

(Hessian Commissioner for Data Protection and Freedom of Information)
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany
Website: datenschutz.hessen.de