1. General
This Privacy Policy describes the way in which we at BeMVO handle your personal data.
We take the protection of your personal data seriously and comply with the applicable legislation, including the General Data Protection Regulation (“GDPR”).
When you first register on, or make your first use of, the National Medicines Verification System (hereinafter “NMVS”, you will be asked to accept this Privacy policy. Every further use of the NMVS implies that you are bound by this Privacy & Cookie Policy.
Your registration for receiving information or updates concerning the NMVS (hereinafter “Newsletter”), for example through our website www.bemvo.be, hereinafter the “Website”, also implies that you agree to and are bound by this Privacy & Cookie Policy. This Privacy & Cookie Policy also applies to you if you visit or use our Website.
Your registration on or your use of the “NMVS Software Supplier Portal” of Arvato Systems Group (hereinafter “Arvato Development Portal”) also implies that you are bound by this Privacy & Cookie Policy.
This Privacy Policy applies to you because you are a user of the NMVS in Belgium or Luxembourg (i.e. a pharmacy, hospital, wholesale distributor of medicinal products, manufacturer of medicinal products, importer of medicinal products, etc.) (hereinafter “End User”) or because you are affiliated with an End User and are appointed within the End User as a point of contact or are responsible for compliance with statutory obligations with regard to the NMVS. This Privacy & Cookie Policy also applies to you if you visit or use our Website.
This Privacy Policy may be amended if our services or the applicable legislation so require. We will communicate the new version of the Privacy Policy to you and publish it on the NMVS and our Website. A continued use of the NMVS and our Website after you were informed of the updated Privacy & Cookie Policy is considered to be your acceptance of the new Privacy & Cookie Policy.
2. The party that processes your personal data
Belgian Medicines Verification Organisation vzw, with its registered office at Luxemburgstraat 20, 9140 Temse, Belgium, registered with the Crossroads Bank for Enterprises (KBO) under number 0675.740.701 (hereinafter “BeMVO” and “We”) is responsible as a Data Controller for the processing of your personal data on the NMVS and the Website.
3. Which personal data we process
- Category 1: We process the surname, first name, and contact details of the End Users of the NMVS (email, telephone number, address, etc.), as well as your capacity (pharmacist, etc.). We also process the name and contact details of the persons responsible at End Users (for example, the name and contact details of the pharmacist who is responsible within the pharmacy or the hospital). These data are processed by us because they are communicated to us for processing, for example at the moment you register on the NMVS or sign up for our Newsletter, at the moment an agreement is entered into between us and the producers or distributors of medicinal products or “Marketing Authorization Holders”, at the moment you register on the Arvato Development Portal, or because the End User or the organisation you are affiliated with has communicated these data to us for processing. These data may also be processed by us based on lists of the National Institute for Health and Disability Insurance (“RIZIV”), via the Federal Agency for Medicines and Health Products (“FAGG”), or the Federal Public Service (FOD) for Health.
- Category 2: Other data may also be processed if you expressly communicate these to us, e.g. your gender, interests, etc. These data can be communicated to us at the moment you register on the NMVS or sign up for our Newsletter. Here too, providing these details to us and accepting this Privacy & Cookie Policy are considered to be your consent to this processing operation.
- Category 3: After your registration on the NMVS we can also record your IP address. Accepting this Privacy & Cookie policy is considered to be your consent to this processing operation.
- Category 4: In addition, certain data are collected by means of cookies. Please refer to article 11 below for more information regarding our use of cookies. Here too, accepting this Privacy & Cookie policy is considered to be your consent to this processing operation.
4. Legal basis for the processing of your personal data
By communicating your personal data to us (for example, when you register on the NMVS, sign up for a newsletter, or through the Arvato Development Portal), and accepting this Privacy & Cookie policy, you give your consent to our processing of your personal data. By continuing to use the NMVS (e.g. logging on to the NMVS), our newsletters or our Website, you confirm each time your acceptance of this Privacy & Cookie Policy.
In addition to your consent, the necessity of complying with a statutory obligation (i.e. Directive 2011/62/EU relating to falsified medicinal products and the Delegated Regulation 2016/161/EU; hereinafter referred to as “Legislation relating to Falsified Medicinal Products”) is considered to be an additional legal basis for the processing of your personal data. This also applies, for example, for data we process based on information received through the RIZIV, the FAGG, or the FOD for Health.
Finally, the necessity of offering you the contractually agreed services (i.e. access to the NMVS) is considered to be an additional legal basis for the processing of your personal data (in other words: the performance of the agreement between us and you is also considered to be a legal basis).
5. To what end we process your personal data
We process your personal data to enable the End Users to gain access to the NMVS and to allow the NMVS to function in the best possible way (e.g. identification of End Users in every stage of the verification of medicinal products) and to inform you of updates and other information regarding the NMVS.
Amongst other things, we process your personal data
- For data of categories 1 and 3: To enable the NMVS to function in the best possible way, i.e. to ensure that every End User has been registered in a correct manner, including recording the personal data of points of contact or persons responsible at each End User. The NMVS ensures that the authenticity of a medicinal product is checked at several times. Every time a medicinal product is scanned by an End User (e.g. a pharmacist at the moment of delivery to the patient), the name and the IP address of the End User are processed as well. As a result, personal data of the person responsible within the End User may also be processed at that moment;
- For data of categories 1 and 2: To provide you with targeted information, such as sending emails and newsletters that may be of interest to you (e.g. information regarding new functionalities or particulars of our services; if, for example, you state that you are a pharmacist, we can send you newsletters or other information that is specifically tailored to pharmacists);
- For data of categories 3 and 4: To carry out analytical research in order to optimise our Website (in terms of both technology and content); as well as, based on anonymous data, mapping the preferences, interests, surfing behaviour, and backgrounds of the visitors to our Website (for more information with regard to anonymous data, please refer to “cookies” below)
- For data of categories 1 up to and including 4: To answer questions from End Users, partners, and competent authorities, and to manage the technical administration of the NMVS and our Website. This only applies in the context of the applicable Legislation relating to Falsified Medicinal Products.
Your personal data are treated with strict confidentiality and are not disclosed to third parties or used for direct marketing purposes, unless we have obtained your express prior consent (“opt-in”), e.g. for the purposes stated in this Privacy & Cookie Policy (such as newsletters). This consent may be withdrawn at any time, without stating reasons and without charges, by sending an email to info@bemvo.be.
Your personal data may be disclosed to and further processed by partners of BeMVO in the framework of the NMVS, e.g. partners authorised for operating verification systems for medicinal products in other EU member states (i.e. National Verification Organisations authorised in other EU member states), the umbrella organisation for verification of medicinal products in Europe (European Medicines Verification Organisation vzw/asbl), and our IT partner Arvato Systems GmbH. This only applies in the context of the applicable Legislation relating to Falsified Medicinal Products.
BeMVO will only disclose your personal data to employees who are themselves contractually bound by obligations of confidentiality.
In the event of (a suspicion of) serious violations of the law or the End User Terms & Conditions (Conditions of Use), we have the right to disclose your personal data to the competent judicial authorities or police services. We can also do this to protect our rights or those of a third party or to safeguard the security of the users of the NMVS.
6. For how long we retain your personal data
All personal data are retained for the period of time that is necessary for us to provide the service.
This Privacy Policy remains in force between you and us until one of the parties terminates the contractual relationship in writing (notice of termination can be given by email). The processing of your personal data remains applicable until termination of the contractual relationship between yourself and us. On termination of the contractual relationship, we will automatically remove your personal data, unless we have a statutory obligation to retain these personal data (e.g. in the context of the applicable Legislation relating to Falsified Medicinal Products). We reserve the right to retain these data for six months after termination, to offer you the option to recuperate these data if you would like to repeal your cancellation or transfer your data to another contract.
7. Right of access, correction, and objection
You have the right to obtain free access to your personal data at any time. You can do so by sending an email to info@bemvo.be.
You also have the right to correct or alter your personal data if they are inaccurate, incomplete, or irrelevant, also by sending an email to info@bemvo.be. In case of requests for access to or correction of your data we always request you to include a copy of your identity card to enable us to verify your identity before disclosing this information. You also have the right to transfer your personal data to another controller.
You have the right to object to the processing of your personal data. You can do so by sending an email to info@bemvo.be (with a copy of your ID card attached). However, you cannot object to the processing of your personal data if this is necessary for the performance of the contractual obligations or in the context of the applicable Legislation relating to Falsified Medicinal Products.
You are at all times personally responsible for the accuracy of the data you communicate to us.
8. Contact: information, questions or complaints
If you have any questions, comments or complaints regarding the processing of your personal data or with regard to cookies, you can communicate this, either directly to us (by email: info@bemvo.be or through the contact details on our Platform or the postal address stated at the top of this Privacy & Cookie Policy), or to the Data Protection Authority (this is the former Privacy Commission: Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, +32 (0)2 274 48 35, or through the contact details on its website www.dataprotectionauthority.be).
9. Data leaks
If you notice or suspect that a data leak has occurred, we request you to contact us as soon as possible (by email: info@bemvo.be or through the contact details on our Website or the postal address stated at the top of this Privacy & Cookie Policy), or the Data Protection Authority (Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, +32 (0)2 274 48 35, or through the contact details on its website www.dataprotectionauthority.be).
10. Security
We take the security of your personal data seriously. We have taken adequate technical and organisational measures to protect your personal data.
We are, however, not liable for any direct or indirect damages arising from your incorrect or unlawful use of personal data. You yourself are responsible for correctly storing your password, access code and other login details, and for keeping these confidential. Any negligent or unlawful use of these data by the user or a third party (unless this was caused by a fault on our part) falls outside our responsibility and liability. In case of loss, theft, or unlawful use of your login details you must inform us as soon as possible.
Our Website contains links to other websites that we do not control and to which this Privacy & Cookie Policy does not apply. We are not liable for the content of these websites.