Scope
This Privacy Policy applies to the website probandeninfo.de, operated by hVIVO Mannheim, hVIVO Kiel, and CRS Clinical Research Services Berlin GmbH. It does not apply to websites operated by third parties that may be linked from our website.
Data Processing When Using Our Website
Whenever you access the hVIVO/CRS website or retrieve an individual file, the following information is automatically recorded in server log files:
IP address of the requesting device
- Site name (Environment: PROD / STAGING / DEV)
- Site URL (requested domain)
- Date and time of access
- Name and URL of the requested file
- Referring website (Referrer URL)
- HTTP status code
- Request method (e.g., GET, POST)
- Log type (NGINX, PHP, Error)
- Server protocol (e.g., HTTP/1.1)
- Browser type and version
- Operating system
- Device type
This data processing is necessary to ensure the proper functioning of the website and its correct display on the respective device. The legal basis for this processing is Article 6(1)(f) of the GDPR (the legitimate interest of hVIVO/CRS in maintaining the stability and functionality of the website). The data is stored in Frankfurt am Main, Germany. The data recorded in the log files is used exclusively to ensure the technical operation of the website. This log data is not shared with third parties.
Data Retention
Access logs and error logs are retained for 7 days and are then automatically deleted.
Data older than 7 days (up to a maximum of 60 days) may only be retrieved upon request through a manual retrieval process by authorized Senior Technical Support personnel.
After 7 days, the access logs are deleted from the server and additionally archived in an AWS S3 bucket.
Data processing when using a web form and in the context of any subsequent contact:
When you use one of our web forms, you knowingly and expressly transmit to us the data you enter there. The purpose for which the web form data is used is described below:
Subject databank and newsletter: On our website, you have the option of applying via a web form as a prospective study participant for inclusion in our databases. In doing so, you also sign up for a newsletter, through which you will be regularly informed about current studies. During registration, data such as name, contact details, address, as well as information like your date of birth, height, and weight are requested and transmitted to hVIVO/CRS. hVIVO/CRS uses your submitted personal data exclusively to inform you about study offers that match your profile. If we consider study participation to be fundamentally possible, by completing the web form you agree to be contacted (by phone, email, or in writing) by staff of the hVIVO/CRS recruitment team and to be informed about current study offers. The data you provide in the context of this contact and further follow-up conversations will be stored in hVIVO/CRS’s subject databases. This may also include information on health as well as ancestral background. This information is required because clinical trials investigate questions using patient/subject groups that are as uniform as possible (participants in a clinical trial should therefore have a similar ancestral background). The legal basis for the data processing is your consent pursuant to Art. 6(1)(a) as well as Art. 9(2)(a) GDPR.
When registering for the newsletter, your IP address as well as the date and time of registration are stored. This serves to prevent misuse of the service or of the data subject’s email address. The storage furthermore serves the purpose of being able to prove your registration if necessary.
The legal basis for the data processing is your consent pursuant to Art. 6(1)(b) and Art. 6(1)(c) GDPR.
Callback service: You can request a callback via a contact form on the website. For this purpose, personal data such as name, phone number, email address, as well as availability are requested. hVIVO/CRS uses your submitted personal data exclusively to fulfill your callback request. The legal basis for the data processing is your consent pursuant to Art. 6(1)(a) GDPR.
Employees of hVIVO Mannheim, hVIVO Kiel, and CRS Clinical Research Services Berlin GmbH, as well as their respective affiliated companies, who are bound by confidentiality, may access your personal data insofar as this is necessary for the performance of their duties. These are, for example:
- Employees of the Subject/Patient Management department at all hVIVO/CRS trial sites and their respective affiliated companies
- Clinical study personnel of the hVIVO/CRS trial site and its respective affiliated companies to which you have applied
- Employees of the Quality Control, Quality Assurance, and Quality Management departments of the hVIVO/CRS trial site and its respective affiliated companies to which you have applied
- IT administrators of hVIVO/CRS Mannheim and its affiliated companies. This access also includes a data comparison of your study participation across hVIVO/CRS trial sites. This is done for your own safety, in order to prevent you from participating in clinical trials at hVIVO/CRS simultaneously or at too short an interval. In addition, public authorities may access the data due to legal requirements, as may external service providers or affiliated companies for the purpose of study recruitment, study participation, system maintenance, or for administrative reasons. hVIVO/CRS ensures that the data-processing company has data protection regulations comparable to the level of data protection in Germany and the EU. This is achieved by means of standard contractual clauses published by the European Commission.
Hosting
For the hosting and maintenance of our website, we rely on the use of service providers, whom we bind to compliance with legal requirements via a data processing agreement.
Subject database:
Depending on the location, hVIVO/CRS uses two software solutions for the subject database.
Salesforce: One of the software solutions is based on the Salesforce platform. Salesforce is a cloud-based CRM (Customer Relationship Management) tool that is widely used in various industries, such as healthcare/the pharmaceutical industry.
Data storage generally takes place in data centers in Germany or the European Union. However, we cannot rule out that, due to legal regulations, data may be accessed by recipients in countries outside the EU. This may also include countries with less strict data protection regulations than Germany.
A corresponding data processing agreement has been concluded with Salesforce.
Further information on data protection at Salesforce can be found here: https://www.salesforce.com/company/legal/privacy/#privacy-statement
AnyRM Solutions GmbH, Panoramastr. 1, 10178 Berlin: As a further software for our subject database, we use the peakfaktor software from AnyRM Solutions GmbH. Data processing outside Germany or the European Union (EU) does not generally take place, as we have restricted our storage location to data centers in Germany. CRS has concluded a data processing agreement pursuant to Art. 28 GDPR with AnyRM Solutions GmbH.
hVIVO/CRS reserves the right to use payout platforms such as Hyperwallet, for example, to disburse compensation payments to study participants. In this context, it is possible that hVIVO/CRS will transmit the names and email addresses of study participants to the operators of the payout platforms.
It is possible that study participants’ data will be transmitted to operators of payout platforms in the USA for the purpose of disbursing the compensation payment. This transmission takes place in compliance with the provisions of Art. 44 et seq. GDPR.
This means that the European Commission has determined that an adequate level of data protection exists (adequacy decision), or that data protection clauses approved by the European Commission have been agreed upon. You will be informed which payout system is used if you participate in a study.
Cookies
Our website uses cookies. Cookies are text files that are stored on the user’s computer system in or by the internet browser. When you access our website, a cookie may be placed on your operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again.
The legal basis for this data processing is Art. 6(1)(a) GDPR (your informed consent) and Art. 6(1)(f) GDPR (hVIVO/CRS’s legitimate interest in optimal functionality of the website).
Cookies are stored until a specified point in time or until you delete them in your browser. If it is a session object, storage lasts until the session expires.
Right of Revocation
You may delete already-stored necessary cookies from your device at any time by deleting the relevant cookies in your browser settings. Instructions on how to do this can be found in your browser manufacturer’s guide. Please note, however, that in this case you may not be able to fully use all functions of this website.
Cookie Consent Tool
To obtain valid consent for cookies and cookie-based applications requiring consent, we use a so-called “cookie consent tool.” The “cookie consent tool” is displayed as an interactive user window when our website is accessed. By ticking boxes, the user gives consent for specific cookies and/or cookie-based applications. As a result, all cookies requiring consent are only loaded once consent has been given by ticking the relevant box.
Processing for the purpose of storing, assigning, or logging cookie settings takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific, and user-friendly consent management for cookies and a legally compliant design of our website.
A further legal basis for the processing is also Art. 6(1)(c) GDPR. As the controller, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user consent.
Where necessary, we have concluded a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.
Your Rights
You have the right to obtain information about the data stored about you at hVIVO/CRS, to receive a free copy of your data, to have your data corrected or deleted, and to demand a restriction of processing or object to further processing. Furthermore, for electronic data that you have provided to hVIVO/CRS yourself, you have the right to have this data transferred to yourself or to a third party in a common format.
These rights apply subject to any conflicting statutory provisions.
You have the right to request information as to whether personal data concerning you is being transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.
Furthermore, you have the right to contact the competent supervisory authority:
CRS Berlin
Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstraße 219, 10969 Berlin
Tel: 030/13889-0
Email: mailbox@datenschutz-berlin.de
hVIVO Kiel
Independent State Center for Data Protection Schleswig-Holstein
P.O. Box 7116, 24171 Kiel
Tel: 0431 988-1200
Email: mail@datenschutzzentrum.de
hVIVO Mannheim
State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Heilbronner Str. 35, 70191 Stuttgart
Tel: 0711/615541-0
Email: poststelle@lfdi.bwl.de
You may also contact any other data protection supervisory authority.
You may withdraw your consent to data processing at any time without giving reasons.
However, data processing carried out up until the point of withdrawal remains lawful and cannot be revoked. After withdrawal, no further data will be processed.
Of course, you may also send us an email. Please note that the content of an email is only protected from unlawful access by third parties if it is encrypted. Third parties include, for example, other internet providers or users. For this reason, please do not send us sensitive personal data, such as health data, in an unencrypted email.
Duration of Storage
The storage duration of personal data results from the respective legal basis, the purpose of processing, and — where applicable — statutory retention periods.
When personal data is processed on the basis of explicit consent pursuant to Art. 6(1)(a) GDPR, the relevant data is stored until you withdraw your consent.
The data in our subject database as well as in the subject/patient files (where they exist) are stored for as long as we must assess whether you are, in principle, suitable for participation in our clinical trials. Since you may apply repeatedly for clinical trials at hVIVO/CRS, and the suitability assessment also takes into account your earlier information, the retention period is indefinite.
Where statutory retention periods exist for data processed in connection with contractual or quasi-contractual obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the retention periods expire, provided it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in its continued storage.
When personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.
Unless otherwise indicated by the other information in this notice regarding specific processing situations, stored personal data will otherwise be deleted once it is no longer necessary for the purposes for which it was collected or otherwise processed.