Privacy Policy

Protecting the Privacy of Personal Data

H. Lundbeck A/S (“Lundbeck”) is firmly committed to protecting the privacy of the personal data we collect. In processing personal data, Lundbeck (as data controller) will comply with applicable legislation, including the General Data Protection Regulation (“GDPR”) and the Danish Data Protection Act.

In this policy, you can read how Lundbeck processes your personal data when you use this website, www.lundbeck.com. If you use www.undbeck.com to apply for a job or use our Compliance Hotline (as an external), please read the privacy policies specifically applicable to these services. When Lundbeck processes personal data collected through other channels than via this website, Lundbeck will specifically inform you how your personal data is processed. However, for certain specific processing activities you can read more under Section 1. If you have any questions, please don’t hesitate to reach out to Lundbeck’s Data Protection Officer using the contact details set out in Section 6.

1. Lundbeck’s processing of personal data

When you use Lundbeck.com and the features therein, we may process the following personal data about you as set out below.

Type of processing and categories of individuals	Categories of personal data and source if relevant	Purpose of processing	Legal basis	Disclosure of personal data, if relevant and legal basis for the disclosure	Retention
Subscribers to investor notifications	Email address Alert type (your preferences) Language preferences Whether consent for direct marketing and processing of personal data has been given	Providing the requested email notification/alert Direct marketing	The legal basis is consent, cf. Article 6(1)(a) of the GDPR or Lundbeck’s legitimate interest in providing you with the requested email notifications, cf. Article 6(1)(f) of the GDPR.	To continuously ensure the safety of our products we may disclose your personal data to relevant local health authorities, business partners and the Lundbeck Group companies. The legal basis for the disclosure is: a legal obligation in section 53 of the Danish Medicines Act and section 6 and 7 of the Danish executive order on the monitoring of adverse reactions from medicinal products which implements parts of Chapter 3 of Title IX of Directive 2001/83/EC of the European Parliament and of the Council of 06 Nov. 2001, as amended by Directive 2010/84/EU of the European Parliament and of the Council of 15 Dec. 2010 cf. Article 6 (1) (c) of the GDPR; to ensure high standards of quality and safety of healthcare and of medicinal products cf. Article 9(2)(i) of the GDPR. criminal convictions: section 8(4) of the Danish Data Protection Act cf. Article 10 of the GDPR. It is Lundbeck’s assessment that the disclosure of criminal convictions is necessary for the medical and scientific assessment and to ensure high standards of quality and safety of healthcare and of medicinal products	Personal data related to your subscription to notifications for investors will be deleted immediately after you have unsubscribed from our service, unless storage for a longer period is required under applicable law.
Users of “contact us” form (PV)	If users of Lundbeck.com use our “contact form” for reporting on side effects and adverse events regarding our medicinal products (as patients), we will obtain the following data from the patient: Contact information (name/initials, address, email address) Country Information on date of birth, age/age group, gender Information on health and medication Sex life/sexual orientation (only if reported and relevant) In general, this category of data is not specifically requested and collected but only captured and processed if reported in connection with an adverse event report and relevant for the medical and scientific assessment and evaluation of the case. Criminal convictions/offences (only if reported and relevant) In general, this category of data is not specifically requested and collected but only captured and processed as part of an adverse event report related to a legal case or an insurance case or where the data relevant for the medical and scientific assessment and evaluation of the case. Other personal data contained in the message or in the attached document Healthcare professional and individuals reporting on behalf of patients: Contact information (name/initials, address, email address) Country HCP profession/title (only HCPs) Other personal data contained in the message or in the attached document The source of data obtained in the “contact us” form (PV) is relative/individual or healthcare professionals reporting on behalf of you and publicly available sources such as websites or social media (in general, these sources are not monitored. Due to relevant regulation, Lundbeck employees that incidentally identify adverse events in publicly available sources (e.g. social media) are however obliged to report those to Lundbeck.	It is a legal requirement that H. Lundbeck A/S collects and processes your personal data. We are obliged to register, monitor and analyse theadverse events that are reported to Lundbeck and to perform medical and scientific evaluation of any adverse event that may be related to a Lundbeck product. This is done to ensure high standards of quality, to enhance patient care and patient safety and to assess the risk-benefit profile of medicines.	The legal basis for Lundbeck’s collection and processing of your personal data is: a legal obligation in section 53 of the Danish Medicines Act and section 5 of the Danish executive order on the monitoring of adverse reactions from medicinal products which implements parts of Chapter 1 and 3 of Title IX of Directive 2001/83/EC of the European Parliament and of the Council of 06 Nov. 2001, as amended by Directive 2010/84/EU of the European Parliament and of the Council of 15 Dec. 2010 cf. Article 6 (1) (c) of the GDPR; to ensure high standards of quality and safety of health care and of medicinal products cf. Article 9(2)(i) of the GDPR; and criminal convictions: section 8(3) of the Danish Data Protection Act cf. Article 10 of the GDPR. It is Lundbeck’s assessment that the processing of criminal convictions is (when relevant) necessary for the medical and scientific assessment and to ensure high standards of quality and safety of healthcare and of medicinal products.	We may disclose your personal data to: our affiliates within the Lundbeck Group other recipients depending on your inquiry in order to handle your request. Depending on your inquiry, the legal basis for the disclosure is contract (Article 6(1)(b) of the GDPR), consent (Articles 6(1)(a) and 9(2)(a) of the GDPR), compliance with a legal obligation (Article 6(1)(c)) and/or Lundbeck’s legitimate interest in providing the requested service and handling your inquiry, cf. Article 6(1)(f) of the GDPR.	According to relevant pharmacovigilance legislation we are obliged to store your personal data for the lifetime of the product plus additional 10 years, as a minimum. However, the retention period of the personal data may be longer where union law or national law so requires.
Users of “contact us” form (other inquiries than PV)	Name, telephone number, email address Name of organization Country Other personal data contained in the message or in the attached document Type of requested service, if any	Providing the requested service Handling of inquiries	The legal basis is Lundbeck’s legitimate interest in providing the requested service and handling inquiries, including examinations in this regard, cf. Article 6(1)(f) of the GDPR.	We may disclose your personal data to our affiliates within the Lundbeck Group other recipients depending on your inquiry in order to handle your request. Depending on your inquiry, the legal basis for the disclosure is contract (Article 6(1)(b) of the GDPR), consent (Articles 6(1)(a) and 9(2)(a) of the GDPR), compliance with a legal obligation (Article 6(1)(c)) and/or Lundbeck’s legitimate interest in providing the requested service and handling your inquiry, cf. Article 6(1)(f) of the GDPR.	Personal data related to your requests and inquiries will be deleted immediately after replying to you unless storage for a longer period is required under applicable law.
All users of the website (via cookies)	By use of cookies, we may collect information on how you use lundbeck.com and your online behaviour. The type of personal data collected are: IP address, including your network location Information about your computer Type of browser Search words	We use necessary cookies, functional cookies, statistical and marketing cookies. Please see a full description of these cookies in our Cookie Policy.	We use necessary cookies, functional cookies, statistical and marketing cookies. Please see a full description of these cookies in our Cookie Policy.	Data collected via cookies may be shared with our third party cookie providers, including via plug-ins. In certain cases, Lundbeck will be considered joint controller with some of these third parties. You can read more and find a link to the privacy notification of these third parties in our Cookie Policy.	Cookies and the connected collection of personal data will be deleted as described in the Cookie Policy unless storage for a longer period is required under applicable law.
When Lundbeck processes personal data obtained through other channels than via this website, Lundbeck will specifically inform you how your personal data is processed. However, for certain specific processing activities where personal data is collected or obtained via other channels/devices/third parties than Lundbeck.com, you can read more if you click on the below. Personal data regarding next of kin to Lundbeck employees obtained or collected via H. Lundbeck A/S employees Personal data obtained from third parties for scientific research Personal data obtained through video surveillance at the Lundbeck property in Valby and/or Lumsås Personal data collected in relation to site access/guest registration at the Lundbeck property in Valby and/or Lumsås Personal data collected in relation to work related accidents at the Lundbeck property in Valby and/or Lumsås Personal data obtained in relation to investors’ acquisition of Lundbeck shares Personal data obtained in limited situations when Lundbeck audio/video records a meeting Personal data obtained from third parties as part syndicated data files in market research

2. Voluntary / mandatory provision of data

When we collect personal data directly from you, e.g. via contact forms or when you sign up for Lundbeck Magazine or Investor notifications, you provide the personal data voluntarily. You are not obligated to provide the information to us. The consequences of not providing the personal data are that we cannot provide the service or assist you in relation to the inquiry you request.

3. Lundbeck’s use of data processors

Lundbeck uses data processors (e.g. hosting companies, IT providers, including for cookie purposes, consultants, business partners and members of our Lundbeck Group), and your personal data may therefore be transferred to, processed and stored by these third parties engaged by Lundbeck, who will process your data on Lundbeck's behalf and assist in the provision of the content and services you use or request. These third-party providers will be obligated by Lundbeck to safeguard the confidentiality of your data and to take adequate technical and organizational measures to protect your data against accidental or unlawful destruction, loss or alteration, unauthorized disclosure or abuse, or other unlawful processing.

4. Transfer of data to countries outside the EU/EEA

We may transfer personal data to other countries, some of which have not yet been determined by the European Commission to have an adequate level of data protection. Lundbeck will ensure that such transfer(s) will be carried out in accordance with the applicable data protection legislation, including the GDPR.

Transfers to countries outside the EU/EEA may take place if the recipient enters into the EU Standard Contractual Clauses. The transfer can also be made if the recipient is located in a country providing an adequate level of data protection (see the full list of these ‘secure countries’ on the EU Commissions’ website). If your personal data is transferred to other Lundbeck affiliates, the transfer will be based on the Lundbeck Intra Group Agreements (or the Binding Corporate Rules, once implemented). More information can be obtained by contacting Lundbeck via the contact details in Section 6.

For PV data which Lundbeck transfers to health authorities in countries outside the EU/EEA, the legal transfer basis is Article 49(1)(d) of the GDPR (transfer is necessary for important reasons of public interest).

5. Your rights as a data subject

Lundbeck has taken all necessary and adequate steps to protect your personal data and ensure your rights as a data subject.

According to the GDPR and the Danish Act on Processing of Personal Data, you have certain rights described below. Please note that certain limitations may apply to your ability to exercise these rights.

If you want to exercise any of your rights as described, please contact Lundbeck using the contact information set out in Section 6.

Right of access

You have the right to request access to the personal data Lundbeck processes about you. Lundbeck must provide a copy of the personal data undergoing processing as a starting point free of charge or by electronic means, if the request has been submitted in a commonly used electronic form.

Right to rectification

You have the right to rectification of inaccurate personal data concerning you, including completion of incomplete personal data.

Right to erasure (right to be forgotten)

You have the right to erasure of the personal data concerning you.

Right to restriction

You have the right to restrict Lundbeck's processing of personal data concerning you.

Right to data portability

Where processing is based on a consent or a contract and the processing is carried out by automated means, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format. You have the right to transmit this personal data to a third party without hindrance from Lundbeck, if technically possible.

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on legitimate interests as legal basis for the processing (as set out in article 6(1)(f) of the GDPR and section 6 of the Danish Data Protection Act), including profiling based on this provision. Where you have exercised this right to object, Lundbeck must no longer process the personal data unless Lundbeck demonstrates compelling legitimate grounds for the processing, which override your interests, rights and freedoms, or if processing is necessary for the establishment, exercise or defense of legal claims.

Where your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, Lundbeck must no longer process the personal data for such purposes.

Processing on the basis of a consent

If processing of your personal data is based on your consent, you may withdraw your consent at any time. Please note that this does not affect Lundbeck's processing of your personal data prior to the withdrawal of your consent.

Filing of complaint

If your complaint is not resolved by Lundbeck to your satisfaction, you can choose to file a complaint to the Danish Data Protection Agency.

Danish Data Protection Agency (in Danish Datatilsynet)

Telephone number: +45 33 19 32 00

Email address: dt@datatilsynet.dk

Website: www.datatilsynet.dk

6. Contact details for Lundbeck and Lundbeck’s Data Protection Officer

If you have any questions regarding Lundbeck processing of personal data, please contact the Lundbeck Data Protection Officer.

H. Lundbeck A/S

Attn: Data Protection Officer

Ottiliavej 9

2500 Valby

Denmark

Email address: dataprivacy@lundbeck.com

Telephone number: + 45 3630 1311 (ask for our Data Protection Officer).

If you contact our Data Protection Officer, H. Lundbeck A/S will process the personal data you provide us with in your request with the purpose of processing and responding to your request.

Please read our privacy notification regarding this processing activity here.