Elma Research has adopted this Privacy Policy in order to establish and maintain an adequate level of protection of personal data privacy. This policy applies to the processing of personal data that Elma Research obtains from its customers, doctors and patients who take part in market research in the pharmaceutical sector.

1 - Subject of the processing
The data processed by ELMA Research Ltd are those that you provide and relate to:

personal data and identification data, such as name, residence, telephone number, e-mail address;
data related to the area of specialisation and the healthcare facility in which you operate;
administrative and accounting data, e.g. Fiscal Code or IBAN;
sound and images acquired during interviews;
personal data requested or acquired during the interview, aimed at carrying out market surveys.

2 - Legal basis of the processing
The legal basis of this processing can be observed:

in the provision of consent;
in the execution of obligations arising from the contract with the Commissioner;
in the fulfilment of the obligations provided for by law.

3 - Data source
The personal data held by the Data Controller are collected directly from the data subject via the contact forms and only if necessary, may they come from third parties.

4 - Purposes of the processing
Personal data and any changes that you will communicate in the future to ELMA Research Ltd are collected and processed for the following and sole purposes:

4.1 - Purposes related to the execution of a contract or the fulfilment of mandatory obligations that do not require the consent of the data subject:

accounting and administrative management;
management of activities related to the transparency of cash flow;
management of communication of adverse events, anonymously.

4.2 - Purposes related to the execution of the survey conducted by Elma Research and the analysis of the results collected, based on the consent provided by the data subject:

data processing to define the reference sample;
conducting the survey;
incentive according to industry standards.

The data will be collected through the different methods of conducting the survey which the data subject can use:

telephone interviews;
on-line interviews;
individual or group personal interviews;

Telephone and personal interviews may be recorded by audio/video.

Personal interviews may also be observed by representatives of the Commissioner of the survey and the meeting may be video-streamed

The data subject may be contacted from time to time by email or telephone.

4.3 - Further purposes based on the express consent of the data subject, collected for every individual survey:

transmission of the data subject's contact details to the Pharmacovigilance Department of the Commissioning Company if, during the interviews, an adverse event and/or relevant safety information is mentioned during the market research;
transmission of a copy of the audio recording made during the interview with the Commissioning company and/or the end customer company in which the data subject has participated, in order to help companies' staff gain a better understanding the results of the research;
transmission of an audio or audio/video montage with several clips, which also contain short interviews with the Commissioning company and/or the end customer company in which the data subject participated.
transmission of the image of the data subject during presentations, conferences or events organized by Elma Research S.r.l.

5 - Processing method
Your personal data is processed by means of the operations described in Article 4 No. 2) of the GDPR and, specifically: collection, recording, organisation, storage, consultation, processing, alteration, selection, retrieval, alignment, use, combination, blocking, communication, erasure and destruction of data. Particularly:

Data collection from the data subject, by filling in paper forms or business applications;
Registration and processing in electronic format or hard copy;
Profiling carried out on the basis of medical specialisation
Profiling carried out on the basis of participation in previous research;
Organisation of files in mainly automated form, through company applications and computerised data.
The data will be processed using instruments that guarantee their confidentiality, integrity and availability. The data in question will not be disclosed.

It should be kept in mind that processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Article 4 of the GDPR).

6 - Data storage
The Data Controller will process personal data for the time needed to fulfil the aforementioned purposes; specifically:

identifying personal data and data related to the specialisation: 5 years from the date of the last participation;
administrative and accounting data: 10 years or as required by current regulations;
sound or images captured during interviews: 5 years, in order to be able to fulfil the pharmacovigilance requirements of the Commissioner.

The information collected during the interviews is kept anonymous, separately from the name of the respondent, in accordance with the code of ethics on market research.

7 -  Accessing the processing
For the purposes described in point no. 4, the data will be made accessible to the employees/workers of Elma Research S.r.l. in their capacity as authorised processing parties. The data may also be accessible to third parties, subject to them being appointed Data Processors where necessary, who perform outsourced activities on behalf of the Data Controller, such as:

Fiscal Consultants/Banking Institutes for the purpose of payment of any indemnity;
Providers of support services which are instrumental to the conduct of investigations.

8 - Data disclosure
The data collected will not be disclosed to third parties, but the results of the research, processed in aggregate form, may be disclosed to our Commissioner of the survey in which it is participating and, always respecting the anonymity of the participants, disseminated. The individual interviews may be made accessible to the person who has tasked Elma Research S.r.l. with the research, but in this case, the express consent of the data subject will be requested, as indicated in point 4.3.

Without the need for consent to be expressed, the Data Controller may communicate your data for the purposes referred to in point 4 to the following subjects:

Supervisory bodies, Judicial authorities;
Other subjects who have a legally recognised right to access their personal data.
These subjects will process the data in their capacity as independent data controllers.

 9 - Data transfer
The management and storage of personal data will be carried out on European Union-based servers of the Data Controller and/or third-party companies tasked and duly appointed as Data Processors. If the data were transferred to third countries, the security levels established by Article 45 of the GDPR are guaranteed.

10 - Nature of the provision of data and consequences of refusing to respond
Data are provided optionally. In their absence, it will not be possible to proceed with the survey.

11 - Rights of the data subject
You will have the right to review/resend the audio-video recordings and request their destruction at any time.

According to the provisions of the GDPR, the data subject has the following rights vis-à-vis the Data Controller:

to obtain confirmation as to whether or not personal data is being processed and, if it is, to obtain access to the personal data (Right of access, Article 15);
to obtain the correction of inaccurate personal data that concerns them without undue delay (Right to rectification Article 16);
to obtain the deletion of personal data concerning them without undue delay and the data controller is obliged to delete the personal data without undue delay, if certain conditions are met (Right to be forgotten Article 17);

to obtain the restriction of processing in certain cases (Right to restriction of processing Article 18);

to receive the personal data that concerns them provided in a structured, commonly-used and machine-readable format and have the right to transmit such data to another Data Controller, without hindrance on the part of the data controller to which the personal data have been provided, in certain cases (Right to data portability Article 20);
to object to the processing of personal data that concerns them at any time, for reasons connected with their particular situation (Right to object Article 21);
to receive, without undue delay, notification of the violation of personal data suffered by the Data Controller (Article 34);
to revoke the consent expressed at any time (Conditions for consent Article 7).
Where applicable, the data subject may exercise the aforementioned rights by contacting the Data Controller by e-mail or telephone.  The Data Controller reserves the right to verify the identity of the data subject before taking further action based on their request.
In the event of a complaint, the data subject can contact the Data Protection Authority.

12 - Data Controller
The data controller is ELMA RESEARCH Ltd, 2-7 Clerkenwell Green EC1R0DE, London.

The data subject may exercise the rights set out in point 11 via Email: phv.compliance@elmaresearch.com
The list of managers is available from the Data Controller.

13 - Data contact details of the Data Protection Officer - DPO
Frareg S.r.l. Viale Jenner 38, 20159 Milan, Tel. 02 69010030

Contact person: Mr. Barbosa.  E-mail dpo@frareg.com

14 - Update of this information
This information may change. Any substantial changes will be sent to the data subjects by email or published on the company website at www.elmaresearch.com.

Last update 21st May 2018