Supplemental Privacy Notice (EEA)

  • FIRST PUBLISHED: 1 April 2024
  • LAST UPDATED: Insert Date1 September 2025

We take your privacy very seriously. Please read this privacy notice carefully as it contains important information on how and why we collect, store, use and/or share your personal information. It also explains your rights in relation to your personal information and how to contact us or supervisory authorities in the event you have a complaint. When we collect, store, use and share your personal information, we are subject to the General Data Protection Regulation (the “GDPR”), which applies across the European Union.

This Privacy Notice is intended for clinical trial personnel in the European Economic Area, explaining how we collect, use, disclose and/or store your personal data in the course of clinical trial.

In this Privacy Notice, “we”, "us" and "our" refer to SUMITOMO PHARMA Co., Ltd., a company organized under the laws of Japan, having its principal office at [6-8, Doshomachi 2-chome, Chuo-ku, Osaka, Osaka 541-0045, Japan], Japan.

We may change this privacy notice from time to time. When we do, we will inform you via our website or other means of contact such as email.

1. How we process your Personal Data

We collect, use, store, generate or disclose to third-parties (hereinafter collectively referred to as “process”) your personal data for the following purposes:

1) To make documents for the conduct of clinical trial:

  • i.Categories of your personal data we process: company name (hospital name), name, CV of doctor, and financial disclosure of doctor and his/her family
  • ii.Lawful basis: processing of your personal data is necessary for compliance with a legal obligation to which the controller is subject.
  • iii.Period for which we store your personal data: 25 years after clinical trial ends (CTR)
  • iv.Recipients we disclose your personal data to: clinical research organization, system provider for documents for conduct of clinical trial, and regulatory authorities.

2) To communicate with contract research organizations (site, CRO, doctor, researcher):

  • i.Categories of your personal data we process: company name (hospital name), name, address, telephone and mail address of person in charge
  • ii.Lawful basis: processing of your personal data is necessary for the purpose of our legitimate interests, namely implementing clinical trial.
  • iii.Period for which we store your personal data: Until the information is unnecessary after clinical trial ends
  • iv.Recipients we disclose your personal data to: N/A.

2. Security of Personal Data

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we appropriately limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

3. Transfers of Data Outside the EEA

We may engage third-party contractors, which assist us in processing your personal data for the purposes described above. These contractors are established and located in Japan and countries around the world.

When the Recipients are located in Japan, your personal data is protected in accordance with the Act on the Protection of Personal Information of Japan. The European Commission has decided that Japan ensure an adequate level of data protection (the “Adequacy Decisions”) and that personal data can be lawfully transferred to Japan without requiring any specific authorization.

Where we need to transfer your personal data to countries or territories that are not covered by the Adequacy Decisions, we will protect your personal data by virtue of data transfer contracts with the concerned Recipients in line with the Standard Contractual Clauses adopted the European Union or the United Kingdom pursuant to the GDPR.

4. The Rights of Data Subjects

You have the following rights regarding personal data collected and processed by us.

  • Information regarding our data processing: You have the right to obtain from us all requisite information regarding our data processing activities that concern you (Articles 13 and 14 GDPR).
  • Access to personal data: You have the right to obtain from us confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and certain related information (Article 15 GDPR).
  • Rectification or erasure of personal data: You have the right to obtain from us the rectification of inaccurate personal data concerning you without undue delay, and to complete any incomplete personal data (Article 16 GDPR). You may also have the right to obtain from us the erasure of personal data concerning you without undue delay, when certain legal conditions apply (Article 17 GDPR).
  • Restriction on processing of personal data: You may have the right to obtain from us the restriction of processing of personal data, when certain legal conditions apply (Article 18 GDPR).
  • Object to processing of personal data: You may have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you, when certain legal conditions apply (Article 21 GDPR.
  • Not to be subject to automated decision-making: You may have the right not to be subject to automated decision-making (including profiling) based on the processing of your personal data, insofar as this produces legal or similar effects on you, when certain legal conditions apply (Article 22 GDPR).
  • Access to the standard contractual clauses on the basis of which your personal data is being transferred abroad, if applicable.

For further information on each of those rights, including the circumstances in which they apply, please contact us.

If you would like to exercise any of those rights, please:

  • email to us to the address indicated below; and
  • let us know what right you want to exercise and the information to which your request relates.

We hope that we can resolve any query or concern you may raise about our use of your information.

The GDPR also gives you right to lodge a complaint with a supervisory authority, in particular in the European Union (or European Economic Area) country and/or state where you work, normally live or where any alleged infringement of data protection laws occurred.

5. EU REPRESENTATIVE

As we are based outside of the EU, Article 27 GDPR required that we appoint an EU representative to handle certain data subject requests and queries. In compliance with this, we have appointed DataRep to act as our representative. Any queries requiring the input of our representative, should please be directed to them as follows:

  • sending an email to DataRep at datarequest@datarep.com quoting < SUMITOMO PHARMA Co., Ltd.> in the subject line,
  • contacting DataRep on online webform at www.datarep.com/data-request, or
  • mailing your inquiry to one of the following address;
  • DataRep, 15 Piaţa Charles de Gaulle, nr. 1-T, Bucureşti, Sectorul 1, 011857, Romania
  • DataRep, Place de L'Université 16, Louvain-La-Neuve, Waals Brabant, 1348, Belgium
  • DataRep, Viale Giorgio Ribotta 11, Piano 1, Rome, Lazio, 00144, Italy
  • DataRep, 72 rue de Lessard, Rouen, 76100, France
  • DataRep, Calle de Manzanares 4, Madrid, 28005, Spain
  • DataRep, Laugavegur 13, 101 Reykjavik, Iceland

Please note that if you choose to mail your enquiry, it is essential that you mark your letters for ‘DataRep’ and not ‘SUMITOMO PHARMA Co., Ltd.’, or your enquiry may not reach them. Please refer clearly to SUMITOMO PHARMA Co., Ltd. in your correspondence.

6. Contact us

For further information and inquiry, contact:

Data Protection Officer

SUMITOMO PHARMA Co., Ltd.