Data Protection Declaration

Overview

The protection of personal data and the responsible handling of information entrusted to us are of particular importance to us. Medac Gesellschaft für klinische Spezialpräparate m.b.H. (“medac”, “we”, “us” or “our”) processes personal data only in accordance with the applicable legal requirements, in particular the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG).

This Privacy Notice applies to the CDMO website of Medac Gesellschaft für klinische Spezialpräparate m.b.H. It informs you how, to what extent and for what purposes we process personal data in connection with your use of this CDMO website. This concerns in particular

·       the provision of the website and hosting (see section 2.1),

·       the use of cookies and similar technologies, in particular Local Storage and Session Storage (see sections 2.2 and 2.3),

·       consent management using CCM19 Cloud (see section 2.4),

·       the use of Google Tag Manager and Google Analytics (see sections 2.5 and 2.6),

·       the integration of map and location functions via Mapbox (see section 2.7),

·       contacting us via the contact form, by email, by telephone or by other means (see section 2.8),

·       the use of information resources, downloads and external links (see section 2.9), and

·       the initiation, performance and administration of business relationships in connection with our CDMO offering (see section 3).

Supplementary general information on data protection at medac can be found in the general privacy notice on medac’s main website, available at: https://www.medac-group.com/legal/privacy-policy. To the extent that this CDMO Privacy Notice contains specific or different information, the provisions of this Privacy Notice shall prevail for the use of the CDMO website.

1. Controller and Data Protection Officer

The controller within the meaning of data protection law is:

Medac Gesellschaft für klinische Spezialpräparate m.b.H.
Theaterstraße 6
22880 Wedel
Germany

Telephone: +49 (0)4103 - 8006-0

Email: contact@medac.de

For CDMO enquiries: cdmo@medac.de

You can contact our Data Protection Officer at:

Medac Gesellschaft für klinische Spezialpräparate m.b.H.
Dr. Anna-Kristina Roschek
Theaterstraße 6
22880 Wedel
Germany
Telephone: +49 (0)4103 - 8006-0

Enquiries addressed to the Data Protection Officer may also be sent using the contact details set out above, with the subject line “Data Protection Officer”.

2. Use of our CDMO Website

In order to use this website, it is necessary to process personal data to the extent described below. In addition, we use cookies and similar technologies, in particular Local Storage and Session Storage. When you access our website, a cookie banner is displayed, which informs you about the use of cookies and similar technologies that are not strictly necessary and enables you to give or refuse your consent.

Any consent given is voluntary and may be withdrawn or changed at any time with effect for the future via the cookie settings. Cookies and similar technologies that are strictly necessary for the operation of our website are used without your consent, provided that the storage of, or access to, information on your device is necessary in order to provide the website or to technically implement your selection in the cookie banner. Cookies and similar technologies that are not strictly necessary are used only if you have given your prior consent.

2.1 Provision of the Website and Hosting

When you access our website, the browser you use automatically transmits information that is technically necessary in order to display the website to you and to ensure its stability and security. This includes, in particular, the IP address, date and time of access, the page accessed, the previously visited page (referrer URL), browser type and browser version, operating system, device information, amount of data transferred and access status.

The purposes of the processing are the provision of the website, technical administration, ensuring system security and stability, detecting misuse and attacks, and error analysis. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and user-friendly provision of our website.

The website is operated on a Microsoft Azure cloud infrastructure. The cloud server location of the website is in France. To the extent that Microsoft processes personal data on our behalf in connection with hosting, Microsoft acts as a processor on the basis of a data processing agreement pursuant to Article 28 GDPR.

As Microsoft is part of a group of companies operating worldwide, access by affiliated companies, in particular from the USA, cannot be entirely ruled out. To the extent that personal data is transferred to the USA, such transfer is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, provided that the relevant recipient is appropriately certified. The European Commission has adopted the relevant adequacy decision for the EU-US Data Privacy Framework; the certification of individual companies can be verified via the official DPF list. Where required, the European Commission’s Standard Contractual Clauses and further appropriate safeguards are used in addition.

The access data referred to above will be deleted or anonymised as soon as it is no longer required for the purposes stated. Longer storage will take place only to the extent necessary to investigate or defend against attacks, remedy technical faults or comply with legal obligations.

2.2 Cookies and Similar Technologies

When you visit our website, cookies and similar technologies may be used. Cookies are small text files that are stored on your device. Local Storage and Session Storage are storage areas in your browser in which information can be stored. These technologies may be used to store information on your device or to access information already stored on your device.

Technologies that are strictly necessary for the operation of the website are used without consent. The legal basis for storing information on, or accessing information from, your device is Section 25(2) No. 2 TDDDG. The subsequent processing of personal data is carried out on the basis of Article 6(1)(f) GDPR, insofar as it is necessary for the provision, security and functionality of the website. To the extent that we are required to document consents, the legal basis is also Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR. Section 25 TDDDG distinguishes between storage or access operations requiring consent and those that are strictly necessary for the digital service expressly requested.

Cookies and similar technologies that are not strictly necessary are used only if you have previously given your consent via the consent management tool. In this case, the legal basis for storing information on, or accessing information from, your device is Section 25(1) TDDDG. The legal basis for the subsequent processing of personal data is Article 6(1)(a) GDPR. You may withdraw or change any consent given at any time with effect for the future via the cookie settings.

You can disable the storage of cookies in your browser settings and delete stored cookies as well as Local Storage and Session Storage entries. Please note that use of our website may be restricted without certain technically necessary cookies and similar technologies.

2.3 Overview of Cookies and Storage Technologies Used on the Website

In particular, the following cookies and storage technologies are used on the website:

2.4 Consent Management with CCM19 Cloud

We use the consent management tool CCM19 Cloud on our website. The provider is Papoo Software & Media GmbH, Auguststraße 4, 53229 Bonn, Germany. CCM19 is used to obtain, manage and document consents for cookies and similar technologies that are not strictly necessary.

For this purpose, CCM19 may process, in particular, information about your consent decision, a pseudonymous identifier, technical device and browser information, the date and time of the consent or change, and the categories selected by you. This processing is necessary in order to technically implement the selection made by you and to be able to demonstrate consents.

The legal bases are Section 25(2) No. 2 TDDDG, Article 6(1)(f) GDPR and, to the extent that the documentation of consents given is concerned, Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR.

The consent information stored in Local Storage will generally remain stored until you change your cookie settings or delete the relevant browser data. To the extent that consent information is also documented in order to demonstrate consents given, it will be deleted as soon as it is no longer required for that purpose and no statutory documentation or retention obligations prevent deletion.

2.5 Google Tag Manager

We use Google Tag Manager on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is used to manage website tags centrally and to technically integrate other services, in particular analytics services.

Google Tag Manager itself does not create any analytics profiles of its own. However, it may be used to trigger other services. Where services requiring consent are integrated via Google Tag Manager, those services are activated only after you have given your consent.

The legal basis for the use of Google Tag Manager is Article 6(1)(f) GDPR, insofar as the service is used for the technical administration of the website. Our legitimate interest lies in the efficient and secure management of the services used on the website. Where services requiring consent are loaded via Google Tag Manager, this takes place exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.

When Google Tag Manager is loaded, your browser may establish a connection to Google servers. In this context, in particular your IP address as well as technical device and browser information may be processed.

In connection with the use of Google Tag Manager, a transfer of personal data to Google group companies in the USA cannot be ruled out. To the extent that personal data is transferred to the USA, such transfer is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, provided that the relevant recipient is appropriately certified. Where required, the European Commission’s Standard Contractual Clauses are used in addition.

2.6 Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables us to analyse the use of our website so that we can improve our online offering and align it with users’ interests.

Google Analytics is loaded on this website only after you have given your prior consent. In this context, in particular your IP address, device and browser information, information about your use of the website, referrer information and cookie IDs may be processed. We use Google Analytics 4. According to Google, your IP address is not logged or stored, but is used only to derive location information and is then discarded.

We use Google Analytics in conjunction with Google Consent Mode. Without your consent, Google Analytics is not loaded for analytics purposes. After you have given your consent, corresponding consent signals are transmitted to Google.

The legal basis for storing information on, and accessing information from, your device is your consent pursuant to Section 25(1) TDDDG. The legal basis for the subsequent processing of personal data is Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future via the cookie settings.

In connection with the use of Google Analytics, a transfer of personal data to Google LLC in the USA cannot be ruled out. To the extent that personal data is transferred to the USA, such transfer is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, provided that the relevant recipient is appropriately certified. Where required, the European Commission’s Standard Contractual Clauses are used in addition.

2.7 Mapbox

We use services provided by Mapbox on our website in order to provide map content, location information or similar graphical functions. The provider is Mapbox, Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, USA. When content from Mapbox is loaded, your browser establishes a connection to Mapbox servers. In this context, in particular your IP address, browser and device information, date and time of access, the page accessed, referrer information, location or map section data, and technical usage, diagnostic and telemetry data may be processed.

To the extent that information is stored on or accessed from your device for the integration of Mapbox, or the integration is not strictly necessary, Mapbox is used on the basis of your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. To the extent that Mapbox is loaded without storage or access operations requiring consent in order to display the website or location-related information, we base the subsequent processing of personal data on Article 6(1)(f) GDPR. Our legitimate interest lies in the user-friendly presentation of location-related information in connection with our CDMO offering.

When Mapbox is used, data may be transferred to the USA. Mapbox, Inc. is certified under the EU-US Data Privacy Framework. Where required, the European Commission’s Standard Contractual Clauses are used in addition.

2.8 Contacting Us via the Contact Form, by Email, by Telephone or by Other Means

If you contact us, we process the personal data provided by you. This includes, in particular, your name, contact details, company, role, country, the content of your enquiry and further correspondence. If the contact form is used, the additional information requested there may also be processed, in particular information about your area of interest, requested services or dosage forms in connection with our CDMO offering.

The provision of your information is voluntary. The information marked as mandatory in the contact form is required in order to process your enquiry. Without this information, we may be unable to process your enquiry, or may only be able to process it to a limited extent.

The processing is carried out for the purpose of handling your enquiry and communicating with you. Depending on the content of the enquiry, the legal basis is Article 6(1)(b) GDPR, insofar as the processing is necessary for the performance of pre-contractual measures or a contract, Article 6(1)(f) GDPR on the basis of our legitimate interest in the proper handling of enquiries and business communications, and Article 6(1)(c) GDPR, insofar as statutory retention or documentation obligations apply.

To the extent necessary to process your enquiry, we may forward your enquiry within the medac group or to competent external recipients, for example if your enquiry concerns another company of the medac group, a specific product, a business relationship or a particular area of responsibility. Disclosure will take place only where there is a legal basis under data protection law.

We delete the data once your enquiry has been finally dealt with and no statutory retention periods or legitimate interests in further storage prevent deletion.

2.9 Information Resources, Downloads and External Links

If you use information resources, download functions or other content on our website, we process the access data technically required for this purpose as described in section 2.1. This concerns, in particular, access to information pages, location information, CDMO-related content and the download of documents provided. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the provision of user-friendly information and download functions.

Our website may contain links to third-party websites, for example to other websites of the medac group, to external information resources or to other third-party websites. As long as you do not click on these links, our current configuration does not establish any connection to the respective third-party providers solely by embedding such links.

If you click on an external link, you leave our website. The privacy notices and responsibilities of the respective provider then apply. We have no influence over the processing of personal data by these third-party providers.

3. Business Relationships and Performance of Contracts

If you yourself, or the company or organisation for which you work, have or are entering into a business relationship with us, we process personal data to the extent necessary for the initiation, performance and administration of the business relationship. This includes, in particular, contact details, communication data, information about your position or role, contractual and business correspondence and, where applicable, order, invoice and payment data as well as other data in connection with the relevant business relationship.

The legal basis is Article 6(1)(b) GDPR, insofar as you yourself are a contracting party or pre-contractual measures are carried out at your request. Where you act as an employee, contact person, representative or other contact person of a company or organisation, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the initiation, performance and administration of the business relationship with the relevant company or organisation. Where statutory retention or documentation obligations apply, Article 6(1)(c) GDPR is the legal basis.

4. Recipients of Personal Data

Within our company, only those departments and persons receive access to personal data that require such access in order to fulfil the purposes set out in this Privacy Notice. In addition, personal data may be transferred within the medac group to the extent necessary and legally permissible for the processing of your enquiry, the performance of a business relationship or for administrative reasons.

We use service providers that process personal data on our behalf. These include, in particular, IT and hosting service providers, providers of consent management solutions, and technical service providers for the operation, maintenance and security of the website. We conclude agreements pursuant to Article 28 GDPR with processors.

Personal data is transferred to further recipients only where there is a legal basis for doing so. Such recipients may include, in particular, public authorities, courts, advisers, auditors or other third parties, insofar as this is necessary to comply with legal obligations, perform contracts or establish, exercise or defend legal claims. Any consent given may be withdrawn by you at any time with effect for the future.

5. Transfers to Countries Outside the EEA

Personal data is transferred to recipients outside the European Union and the European Economic Area only to the extent necessary for the purposes set out in this Privacy Notice and provided that the requirements of Articles 44 et seq. GDPR are met.

In connection with the provision of our website and the integration of individual services, Microsoft, Google and Mapbox in particular may be involved in the processing. In this context, access from the USA cannot be entirely ruled out. To the extent that a provider is certified under the EU-US Data Privacy Framework, we base the transfer on the European Commission’s adequacy decision.

Where no adequacy decision exists or the relevant certification is not applicable, we use appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses, and, where required, take additional protective measures. Only in exceptional cases may a transfer be based on explicit consent pursuant to Article 49(1)(a) GDPR.

6. Storage Period and Deletion

We store personal data only for as long as this is necessary for the respective processing purposes. Thereafter, the data will be deleted or anonymised, unless statutory retention periods, documentation obligations or legitimate interests in further storage prevent this.

Statutory retention periods may arise in particular from commercial and tax law provisions. Longer storage may also take place where this is necessary for the establishment, exercise or defence of legal claims, the investigation or defence against attacks, the remedying of technical faults or compliance with legal obligations.

For documents relevant under commercial and tax law, statutory retention periods of generally six, eight or ten years may apply, depending on the type of document.

7. Data Security

We take appropriate technical and organisational measures to protect personal data against loss, destruction, manipulation, unauthorised access and unauthorised disclosure. Our website is generally made available using HTTPS encryption. You can identify this by the address bar of your browser and the lock symbol displayed there.

8. Your Rights

Data protection law grants you a number of rights in relation to data concerning you. Subject to the statutory requirements, you have in particular:

·       the right to request access to the personal data concerning you that is processed by us (Article 15 GDPR),

·       the right to rectification of inaccurate data (Article 16 GDPR),

·       the right to erasure of data that may no longer be stored (Article 17 GDPR),

·       the right to restriction of processing in certain cases (Article 18 GDPR),

·       the right to data portability, i.e. to receive data that you have provided in electronic form or to have it transmitted to a third party (Article 20 GDPR), and

·       the right to withdraw any consent given with effect for the future (Article 7(3) GDPR). The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Please note that, in the event of a withdrawal, we may continue to retain your consent to the extent necessary in order to demonstrate that consent was given and withdrawn. The legal bases for such retention are Article 6(1)(c) GDPR in conjunction with Article 5(1)(a), Article 5(2) and Article 7(1) GDPR, as well as Article 6(1)(f) GDPR.

You may also object to processing where it is based on legitimate interests pursuant to Article 6(1)(f) GDPR. This applies on grounds relating to your particular situation. Where personal data is processed for direct marketing purposes, you may object to such processing at any time without having to provide specific reasons.

Whether and to what extent these rights exist in an individual case and the conditions that apply to them are determined by the GDPR and the BDSG. To exercise your rights, you may contact us using the contact details set out in section 1. You also have the right to lodge a complaint with a data protection supervisory authority. If you have any questions or complaints concerning data protection at medac, we recommend that you first contact our Data Protection Officer.

9. No Automated Individual Decision-Making

We do not use your personal data for automated decision-making within the meaning of Article 22 GDPR.

10. Amendments to this Privacy Notice

New legal requirements, technical changes or changes to our processing operations may make it necessary to amend this Privacy Notice. The current version is available on our website.

Last updated: July 2026

Change cookie settings