Privacy policy
At SPI Swedish Pharma Insights (hereafter SPI) we process personal information about a broad range of people, such as our customers, people participating in research and studies, people who attend our events etc.
In the following privacy policy, you can read more about the specific purposes for which we process information and which rights you have according to GDPR.
SPI contact details
Unless otherwise stated, SPI is the controller for the personal information we process.
Nybroviken
Birger Jarlsgatan 2
114 34 Stockholm
Phone +46 8 121 62 600
Email: info@spi.health
VAT/Momsnummer: SE559036369201
For enquiries regarding your rights, please contact us using info@spi.health
Purposes for which we process personal information
In the following you can expand each of the headlines describing a purpose, to get elaborated information about legal basis, retention period, transfer of information etc.
When you are a customer
Purpose and lawful basis for processing
If you work for one of our existing or upcoming customers, we may process your personal information for the purpose of conducting business together. The lawful basis for processing your personal information is our legitimate interest in being able to identify you as an employee of our customer (GDPR article 6(1)(f)).
What information we collect
We process your contact information along with information about your position at our customer. We may also collect information about business interaction and communication in which you take part (telephone calls, e-mails, etc.).
What we do with it
We keep the information for general business reasons, such as being able to prove contracts and agreements, along with general day to day communication.
How long we keep it
In general we keep almost all business communication as long as we have an existing business relation. When our business relation ends, we keep business communication for up till five years after end of contract. For communication which proves agreements, contracts etc., where liability may extend beyond five years, relevant communication will be kept for the term of the liability. In few cases personal information regarding our business interactions may be recorded in our company archives with no current retention policy.
Do we use any data processors?
We store most data on inhouse systems, but some data is stored and processed by data processors.
When you are listed in our CRM system
Purpose and lawful basis for processing
If you have a relation to SPI such as customer, event participant, newsletter subscriber etc., then you are listed in our CRM system. You may also be listed if our sales and marketing department have identified you as a potential customer or other business relation. The lawful basis for processing your personal information is our legitimate interest in keeping track of business contacts and other people a business relation to SPI (GDPR article 6(1)(f)).
What information we collect
Besides general contact information, we collect information about current employer along with job title. Our CRM may also contain notes about our business relation.
What we do with it
We use the information for looking up contacts at our customers and for supporting business decisions. Data is collected and shared with two of our sister companies.
Joint controllership
‘SPI’ – Swedish Pharma Insights AB (Sweden), ’Signum’ – Signum Life Science ApS (Denmark) and ‘Atrium’ Dansk Lægemiddel Information A/S (Denmark) are joint data controllers of personal information collected, stored, and processed in the CRM system.
If your wish to exercise your rights, the request should be sent to SPI, who will process the request on behalf of the other joint controllers. A copy of the joint controller agreement can be supplied upon request.
How long we keep it
Your information will remain in our CRM system as long as you have an active relation to SPI, Signum, or Atrium. Contacts who have been inactive for more than three years are deleted.
Do we use any data processors?
Our CRM system is stored inhouse but contact information such as e-mail will be processed using a data processor.
When you are listed in our CRM system
Purpose and lawful basis for processing
If you have a relation to SPI such as customer, event participant, newsletter subscriber etc., then you are listed in our CRM system. You may also be listed if our sales and marketing department have identified you as a potential customer or other business relation. The lawful basis for processing your personal information is our legitimate interest in keeping track of business contacts and other people a business relation to SPI (GDPR article 6(1)(f)).
What information we collect
Besides general contact information, we collect information about current employer along with job title. Our CRM may also contain notes about our business relation.
What we do with it
We use the information for looking up contacts at our customers and for supporting business decisions. Data is collected and shared with two of our sister companies.
Joint controllership
‘SPI’ – Swedish Pharma Insights AB (Sweden), ’Signum’ – Signum Life Science ApS (Denmark) and ‘Atrium’ Dansk Lægemiddel Information A/S (Denmark) are joint data controllers of personal information collected, stored, and processed in the CRM system.
If your wish to exercise your rights, the request should be sent to SPI, who will process the request on behalf of the other joint controllers. A copy of the joint controller agreement can be supplied upon request.
How long we keep it
Your information will remain in our CRM system as long as you have an active relation to SPI, Signum, or Atrium
If you have any concerns about our use of your personal information, you are most welcome to address your concerns via info@spi.health. Contacts who have been inactive for more than three years are deleted.
Do we use any data processors?
Our CRM system is stored inhouse but contact information such as e-mail will be processed using a data processor.
When you receive electronic marketing (newsletters etc.)
Purpose and lawful basis for processing
We collect and process information with the purpose of sending out electronic marketing to those who have consented to receiving our newsletter or information about events, courses etc.
The lawful basis for processing your personal information is either the necessity for the performance of a contract if you are a customer (GDPR article 6(1)(b)) or our legitimate interest in processing if we have a business relation (GDPR article 6(1)(f)). Se also “When you are listed in our CRM system”.
The lawful basis for sending electronic marketing is you consent in accordance with the Danish Marketing Act § 10. We have a legitimate interest (GDPR article 6(1)(f)) in storing documentation about your consent after withdrawal with the purpose of defending a complaint.
What information we collect
We collect your contact information along with information about fields of special interest. We may also collect information about interaction (telephone calls, e-mails, etc.) and behavior when opening and clicking links in electronic marketing.
What we do with it
We register your contact information in our CRM (Se also “When you are listed in our CRM system”), where we also document your consents for electronic marketing.
We may use information to profile or segment you to adjust which electronic communication you receive.
How long we keep it
We keep your contact information in our CRM system according to the retention periods listed under “When you are listed in our CRM system”.
Documentation about your consent for receiving electronic marketing is kept up till two years after you withdraw your consent. Behavioral information is deleted upon withdrawal of consent.
Do we use any data processors?
Yes, we use an external data processer located within EU/EØS for sending out electronic marketing.
Your rights
You have the right to withdraw your consent at any given. Notice that your only withdraw consent for receiving electronic marketing, not for the processing of your information in general.