Privacy Policy | Ascendis Pharma US

Introduction

At Ascendis Pharma A/S (“Ascendis Pharma”), we are working to build a leading, fully integrated biopharmaceutical company that provides meaningful improvement in patients’ lives. For more information about Ascendis Pharma, please visit our website – ascendispharma.com.

Ascendis Pharma respects your right to privacy. This Privacy Notice explains who we are, how we collect, share and use personal information about you, and how you can exercise your privacy rights within the below-mentioned areas:

Website
- Website visitors (cookies)
- General Contact Information
- Investors & News
- Use of this Website by Minors
Recipients of communications
Clinical Trials
Pharmacovigilance and Product Safety
Contract & Vendor Management
Healthcare Professionals & Other Stakeholders
Patients, caregivers & Patient Organizations
Job Applicant

If you have any questions or concerns about our use of your personal information or would like to exercise any of your rights — including object to the processing of your personal information in the way that we describe in this notice – please contact us. More information can be found at the end of this notice.

Data controller is Ascendis Pharma A/S, Tuborg Boulevard 12, 2900 Hellerup, Denmark, attn. [email protected].

General Information

Who does Ascendis Pharma share my Personal Information with?
We disclose your personal information to the following recipients:

Our group companies, third party services providers and partners, who provide data processing services to us, or who otherwise process personal information for purposes that are described in this Privacy Notice or notified to you when we collect your personal information. An overview of where we hold offices is available here https://ascendispharma.com/about-us/#company-profile/.
Any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person.
Potential buyer (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Notice.
Any other person with your consent to the disclosure.

We require all third parties processing personal information on our behalf (data processors) to have appropriate technical and organizational security measures in place to protect your personal information, in line with applicable data privacy legislation. We further require that they do not share your personal information with any third parties without our explicit consent and without guaranteeing adequate security standards and that they will hold it securely and retain it for the period we instruct.

How does Ascendis Pharma keep my Personal Information secure?
Ascendis Pharma uses appropriate measures to protect your personal information that we collect and process.

Ascendis Pharma takes appropriate technical and organizational measures to ensure that all personal information is kept secure, including security measures to prevent personal information from being accidentally lost or used or accessed in an unauthorized way. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information.

Ascendis Pharma limits access to your personal information to those who have a genuine business need. Those processing your personal information will do so only in an authorized manner and they are subject to confidentiality.

Ascendis Pharma also has procedures in place to deal with any suspected data security breach. We will notify you and any data protection authority of a suspected data security breach where legally required to do so.

Unfortunately, the transmission of information via the Internet is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted through any online means.

International data transfers
Your personal information may be transferred to and processed in countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country of residence (and, in some cases, may not be as protective).

The servers that we use to host your personal information are located in Denmark and the US – and our group companies and third party service providers and partners operate globally. This means that when we collect your personal information, we may process it in any of these countries.

However, we have taken appropriate safeguards to ensure that your personal information will remain protected in accordance with this Privacy Notice. These safeguards include implementing the European Commission’s Standard Contractual Clauses and, as needed, appropriate supplementary measures for transfers of personal information between our group companies, which require all group companies to protect personal information they process from the EU/EEA in accordance with EU data protection laws.

Our Standard Contractual Clauses can be provided on request. We have implemented similar appropriate safeguards with our third party service providers and partners and further details can be provided upon request.

Data retention
We retain collected personal information where we have an ongoing legitimate business need to do so (e.g., to provide you with a service you have requested).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible (e.g., because your personal information has been stored in back-up archives), we will securely store your personal information and isolate it from any further processing until deletion is possible.

Your data protection rights
By law, in some instances you have the right to:

Request information about whether we process your personal information, and, if so, which information and why we are processing it.

Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of your personal information and to check that we are lawfully processing it. If you wish to request access to this information, please complete the Request Form.

Request correction of your personal information. This enables you to have any incomplete or inaccurate information corrected.

Request erasure of your personal information. This enables you to ask us to delete or remove your personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).

Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.

Object to automated decision-making, including profiling. This enables you to object to being subject to a decision based on automated processing.

Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information, e.g., if you want us to establish its accuracy or the reason for processing it.

Request transfer of your personal information in an electronic and structured form to you or to another party (commonly known as a right to “data portability”). This enables you to receive your personal information in an electronically useable format and to transfer your data to another party in an electronically useable format.

Withdraw consent. In the limited circumstances where you may have provided your consent to the collection, processing or transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis in law for doing so.

Complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority. (Contact details for data protection authorities in the EEA, Switzerland and certain non-European countries are available here – link.)

You can exercise your data protection rights, as mentioned above, by contacting us using the contact details provided under the How To Contact Us section below.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

We respond to requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

State-specific Information

This supplemental notice is provided for individuals residing in states that have enacted state privacy laws that provide specific rights for their residents. It explains your rights regarding your personal data and how we handle your personal data. Certain terms in this notice are defined by applicable state law and their meanings may differ from the meanings applied elsewhere on our website.

Residents of certain states have rights regarding the personal data that businesses collect and handle. This includes the right to know what specific elements of personal data we collect about you, the right to request access or deletion of your personal data, as well as the right to direct a business to stop selling or sharing your personal information.

Sources of Personal Data We May Collect

We collect personal data from the following categories of sources:

Your device or browser
Directly from you when you provide information
Our affiliates and business partners
Data verification services
Marketing vendors and advertising networks
Public databases

Personal Data We May Collect, Process and Disclose

We collect and process the following categories of personal data:

Identifiers, such as name and government-issued identifier (e.g., Social Security Number)
Personal information, as defined in the California safeguards law, such as contact and financial information.
Characteristics of protected classifications under California or federal law, such as age, gender, medical conditions, and marital status.
Commercial information, such as transaction information
Internet or network activity information, such as browsing history and interactions with our websites.
Geolocation data, such as device location.
Audio, electronic, visual and similar information, such as call and video recordings.
Professional or employment-related information, such as work history and prior employer.
Inferences drawn from any of the personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics.

We may also disclose the above data to our subsidiaries, affiliates, vendors, and third party partners, such as our service providers, for our operational business purposes:

We may use this personal data to serve you; to connect you with third parties; to validate your ability to access and/or use certain products, services and information; to provide and improve products and services; to protect patients; to respond to inquiries and fulfill requests; to send administrative information to you; to send you certain marketing communications; to personalize certain experiences; and to facilitate social sharing or messages services when available. We may also use this personal information to operate, manage, and maintain our business, for our employment purposes, and to otherwise accomplish our business purposes and objectives, for example, developing, improving, repairing, and maintaining our products and services; conducting research, clinical studies, analytics, and data analysis; maintaining our facilities and infrastructure; undertaking quality and safety assurance measures; conducting risk and security controls and monitoring; detecting and preventing fraud; performing identity verification; performing accounting, audit, and other internal functions, such as internal investigations; complying with law, legal process, and internal policies; maintaining records; and exercising and defending legal claims.

We do not sell personal data.

We may retain your personal data for as long as needed or permitted for the purpose(s) for which it was obtained and as outlined in this Privacy Policy, depending on the length of our relationship with you, whether there is a legal obligation or recommendation to retain.

Your Rights

The following states provide privacy rights to their residents: California, Virginia, Utah, Connecticut, Nevada. Subject to certain exceptions and depending on where you live and the type of data we process about you, you may have the right to make the following requests, at no charge. Should you make a request, we may require certain identifying data from you or your authorized representative to verify your request. We will honor your request if it complies with applicable state privacy laws. Questions and concerns can be emailed to [email protected].

1. The right to know what specific elements of personal data we collect about you, which includes the following.
  - The right to know the categories of personal data we have collected.
  - The categories of our sources from which the personal data is collected.
  - The categories of third parties to whom we disclose personal data to.
  - The specific elements of personal data we have collected about you.
  - The categories of personal data we sold or shared, if applicable.
  - The categories of personal information we disclosed for a business purpose.
  - Our business or commercial purpose for collecting, selling, or sharing your personal data.
2. The right to delete personal data that we have collected from you, subject to certain exceptions. 
3. The right to correct inaccurate personal data we maintain about you. </span
4. The right to limit the use or disclosure of sensitive personal data, subject to certain exceptions.
5. The right to opt-out of targeted advertising, the sale or sharing of your personal data with other parties, if applicable, and of using your data for profiling purposes if the profiling produces legal or similarly significant effects for you.
6. The right not to receive discriminatory treatment for exercising your privacy rights. This right extends to an employee, applicant, or independent contractor who may not be retaliated against for exercising a right.
7. The right to obtain a copy of your data in a portable format. You may request to receive your personal data in a readily useable format, to the extent technically feasible.

To make a request described above, please complete the Request Form. Our privacy team will review your request and respond to you as quickly as possible. If we are unable to comply with your request due to an exception or limitation, we provide further explanation in writing. If we need more time, we will inform you of the reason and extension period in writing. If we do not act on your Request within the 45 days response period, or in the event of an extension we will inform you in writing within 90 days of the reasons for not taking action, as well as provide an explanation of any rights you have to appeal the decision.

California and Delaware "Do Not Track" disclosures

We do not monitor nor respond to Do Not Track browser requests. Please see our Privacy Policy for more information.

Updates to this Privacy Notice
We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.

How to Contact Us
If you have any questions or concerns about our use of your personal information, please contact: Ascendis Pharma A/S, Tuborg Boulevard 12, 2900 Hellerup attn.: [email protected].

Changes to this Privacy Notice
We reserve the right to make changes to this Privacy Notice from time to time. The at all times applicable Privacy Notice will be available at www.ascendispharma.com. In the event of significant changes, you will be notified via email.

1. Website

When using our website, you have the option to provide your personal information for certain requests. Please click on your area of interest and learn more:

1.1 Website visitors (cookies)

When you use Ascendis Pharma’s website, personal information related to your online behavior and your IP address may be collected through cookies.

The processing of personal information in relation to necessary cookies is based on an agreement between you and Ascendis Pharma to be able to use the functions of the website (GDPR article 6(1)(b)). The processing of personal information in relation to statistical and preference cookies is based on our legitimate interest in offering you the best possible products and services (GDPR article 6(1)(f)). The processing of personal information in relation to marketing cookies, also based on your preferences, is based on your prior consent (GDPR article 6(1)(a)).

In addition, Ascendis Pharma will always obtain a valid cookie consent, in accordance with the EU cookie executive order, before cookies are placed on your device.

To be able to process personal information in connection with cookies for the above purposes, we may provide access to your personal information for third parties who, on the basis of a contractual relationship with Ascendis Pharma, provide relevant services, e.g. IT suppliers, analytics companies and suppliers of marketing material. Under certain circumstances Ascendis Pharma will act as a joint controller with the third parties. For more information on the role of the third parties, deletion of cookies, withdrawal of consent etc., please refer to Ascendis Pharma’s Cookie Statement and the cookie pop-up window: https://ascendispharma.us/privacy-policy/#cookies.

1.2 General Contact Information

On the Contact Us section you can see the contact information for all our offices, and you are also able to contact us by sending inquiries to [email protected].

Except where specifically retained, the normal practice is to delete these questions, save for the normal back-up of the system, after responding to the request.

It is also possible to contact our Medical Affairs team on [email protected].

Emails received by the Medical Affairs team will be circulated to the appropriate people within Ascendis Pharma with the expertise to address the questions asked. The questions may be retained by Ascendis Pharma if they are relevant for present or future activities of Ascendis Pharma or where there is a legal requirement to retain such questions.

What Personal Information does Ascendis Pharma collect and why?

Email and the personal information you provide in your email.

We process this information for the following purposes:

To review, assess and answer your question(s).

1.3 Investors & News

The Investor Contact section (IR contact) provides you with a form inviting you to send any investor relations requests.

The recipient of this form is the Ascendis Pharma CFO, who will respond and, if relevant, involve other employees within Ascendis Pharma.

Except where specifically retained, and if necessary for present or future activities of Ascendis Pharma, the normal practice is to delete the form and any related personal information, save for the normal back-up of the system, after responding to the request.

What Personal Information does Ascendis Pharma collect and why?

Depending on the fields you fill in, we may collect: first and last name, email, title, company, investor type, country, workplace, fax, home phone, and comments/questions.
News alert: email.

We process this information for the following purposes:

Managing our relationship with you by answering your request.
Providing you with the relevant news about Ascendis Pharma.

When signing up to automatically receive Ascendis Pharma financial information by use of the Email Alerts section your email will be sent to West LLC that manages all news for Ascendis Pharma.

1.4 Use of this Website by Minors

We do not intend for our websites to be used by anyone under the age of 18.

2. Recipients of communications

You may sign up to receive communications from Ascendis Pharma via our website and other channels.

What Personal Information does Ascendis Pharma collect and why?

When you sign up for receiving communications, we register your name and email address that you provide in this connection. We will always obtain your explicit consent if you provide us with any health information when you sign up for communications.

We use the information to provide you with the communications you sign up for, statistics, analytics and reporting.

The legal bases for processing your personal information are consent in accordance with the GDPR article 6(1)(a) to send communications and our legitimate interest in accordance with the GDPR article6(1)(f) to perform statistics, analytics and reporting, The legal basis for processing your health information is explicit consent in accordance with the GDPR article 9(2)(a) and 6(1)(a).

Who does Ascendis Pharma share my Personal Information with?

Your personal information is shared with our data processors that assist us with obtaining your consent and providing you with communications you have signed up for, as well as our system hosting provider.

Your personal information will not be shared with any third parties that are not acting as data processors on behalf of Ascendis Pharma.

Retention/deletion of personal information

Your personal information will be deleted when no longer necessary to fulfill the purposes stated above. Information that is necessary to send communications will be kept for 2 years after you have opted out to receive communications. Your health information will be deleted shortly after you opt out. Statistical data may however be processed in anonymized form for a longer period.

3. Clinical Trials

At Ascendis Pharma we conduct clinical trials and the protection of personal information is of high importance to us.

We will process personal information on subjects participating in the clinical trials as well as clinical site personnel working in the studies.

In our Subject Information and Consent Form we provide persons participating in our clinical trials with relevant information about our use and processing of their personal information.

Such personal information will be kept in accordance with regulatory requirements for clinical trials, i.e., up to 2 years after the last marketing application which may happen more than 25 years from collection of such personal information.

What Personal Information does Ascendis Pharma collect and why?

Subjects participating in the clinical trials

The personal information collected depends on the specific clinical trial, but may include:

Ordinary personal information such as your sex, date of birth, body weight and height.
Special categories of personal information: your ethnicity, your medical data, including your medical history, scans, blood samples, biopsies and your health status and information about your use of the trial medicine, the effect it has on you, and its potential side effects etc.

We process this information for the following purposes:

The personal information is collected and processed to support marketing authorization applications.

Ascendis Pharma will only process your personal information in a pseudonymous form. This means that a unique trial identification number will be assigned to you by the study doctor and all personal information shared with Ascendis Pharma will only be linked to this unique trial identification number. Ascendis Pharma will not know your name.

The purpose of processing your personal information in connection with the study is our legitimate interests in developing, improving and marketing pharmaceutical products in accordance with the GDPR article 6(1)(f). We also need to process your personal information for the purpose of complying with mandatory legal and regulatory requirements applicable to the conduct of a clinical trial in accordance with GDPR articles 6(1)(c) and 9(2)(b). These purposes combined with the necessity to conduct clinical trials for ensuring high standards of quality and safety of health care and of medicinal products or medical devices (see article 9(2)(i) in the GDPR) form the legal basis for the collection and use of your personal information.

Clinical site personnel

We process the following information regarding the clinical site personnel:

Name, workplace, work address, work e-mail, work phone number, job title
CV
Financial disclosure

We process this information for the following purposes:

Confirm your qualifications and experience. We do this in order to comply with the suitability requirements for individuals conducting trials under clinical trials legislation;
Communicate about the clinical study;
Comply with financial reporting requirements under the US Sunshine Act, EFPIA Disclosure Code and/or other local laws in respect of the payments made for the services provided;
Collect, process, store and retain the personal information for the time it is required under clinical study legislation which may be up to 25 years depending on country regulations;
Management and administration purposes.

We primarily process your personal information which is necessary to fulfill the contract in accordance with the GDPR 6(1)(c). For clinical personnel we do not directly engage with as part of the CTA, the legal basis for processing personal information is our legitimate interest in management and administration purposes relating to the study in accordance with the GDPR article 6(1)(f). Further, we process your information for the proper performance of the clinical study to required standards and in order to meet legal obligations set out in clinical trials law, transparency laws and associated regulations in accordance with the GDPR section 6(1)(c).

Who does Ascendis Pharma share my Personal Information with?

Subjects participating in the clinical trials

If required, we may disclose your personal information to the appropriate regulatory authorities, auditors and ethics committees in accordance with the GDPR sections 6(1)(c) and 9(2)(b) as well as for the purpose of the study in accordance with article 9(2)(i).

There may also be a need for some of your personal information to be shared with a service provider on the study, for example, to conduct training with you. No company is allowed to use your personal information other than relating to this clinical study and must keep it confidential.

Clinical site personnel

If required, we may disclose your personal information to the appropriate regulatory authorities, auditors and ethics committees in accordance with the GDPR section 6(1)(c).

4. Pharmacovigilance and Product Safety

What Personal Information does Ascendis Pharma collect and why?
We process the information that you, your family, legal representative or health care professionals provide directly to us in relation to reporting of adverse events/adverse drug reaction. If the adverse events/adverse drug reaction have been reported to one of vendors (including data processors), we may also receive adverse event/adverse drug reaction reporting’s from these parties.

Depending on your role (category of data subject), we process your personal information for different purposes and therefore with different legal bases:

Patient subject to adverse events/adverse drug reactions:
When processing personal information of the patient subject to the adverse event/adverse drug reaction, we process the following types of data: initials, gender, age, medical history, type of medicine, sickness, and other relevant medical data that may be contained in the reporting. The purpose of this processing is the fulfillment of our legal obligation to file a report on adverse events/adverse drug reactions in accordance with the GDPR article 6(1)(c) and article 9(2)(i), cf. the Danish Data Protection Act section 7(3).

Reporter of adverse events/adverse drug reactions:
If you are the reporter of adverse events/adverse drug reactions, we may process your full name, professional information, contact data (i.e. phone number, address and/or email). The purpose of this processing is the fulfillment of our legal obligation to file a reporting on adverse events/adverse drug reaction, hereunder our legitimate interest in identifying and/or contacting you as the reporter of the adverse events/adverse drug reactions, in accordance with the GDPR article 6(1)(f) and article 6(1)(c).

Who does Ascendis Pharma share my Personal Information with?

In order to pursue the above listed purposes your personal information may be made available to third party data processors (service providers) providing relevant services under contract to Ascendis Pharma. Such service providers will only process the personal information in accordance with our instructions, hereunder for reporting’s on adverse events/adverse drug reactions by receiving them, processing the content, etc. and providing IT services.

Some of your personal information will be disclosed to other companies within the Ascendis Pharma group acting as separate data controllers for administration purposes, but only if these have relevance for the processing of the adverse events/adverse drug reactions in question. Certain personal information will also be disclosed to governmental and other regulatory authorities where required by law. The legal bases for such disclosure are the GDPR articles 6(1)(c) and 9(2)(i) cf. the Danish Data Protection Act section 7(3). Furthermore, we may disclose your personal information to our external lawyers and the courts if the processing is necessary for our legitimate interest in establishing, exercising or defending legal claims in accordance with the GDPR article 6(1)(f) and the GDPR article 9(2)(f).

Retention/deletion of personal information

We will delete your personal information when we no longer need to process them in relation to one or more of the purposes set out above, hereunder if we are under a legal obligation to retain the data. However, we will not keep the data longer than 10 years after expiration of marketing authorization except where the data may be processed and stored for a longer period in anonymised form in order for us to improve the pharmaceutical products.

5. Contract & Vendor Management

At Ascendis Pharma we collaborate with third party providers and partners.

What Personal Information does Ascendis Pharma collect and why?
Depending on the interaction we have with you or your employer, we may collect and process the following categories of personal information:

Work contact details (such as name, work mobile phone, job title).
Contract terms and signature.
Billing details and payments.
Information about ordering and performance of services.
Work product.
CVs and other qualification records (only applicable to some).
Training documentations (primarily GxP related and only applicable to some).
Relation management information.

We process this information for the following purposes:

The continuous business relationship between Ascendis Pharma and you or your employer.
Compliance with security, safety and product quality requirements.

The processing of your personal information is either based on GDPR article 6(1)(b) (necessary for the performance of a contract between the company that you represent and Ascendis Pharma), GDPR article 6(1)(c) (e.g. legal obligation that follows from bookkeeping legislation) and GDPR article 6(1)(f) (our legitimate interest in being able to run our business and to be able to manage Ascendis Pharma’s business relationship, including being able to communicate with you).

Who does Ascendis Pharma share my Personal Information with?

In order to pursue the above listed purposes, your personal information may be made available to third party data processors (service providers) providing relevant services under contract to Ascendis Pharma. Such service providers will only process the personal information in accordance with our instructions, hereunder in order to provide IT services.

Some of your personal information may be disclosed to other companies within the Ascendis Pharma group acting as separate data controllers when it is necessary in order to fulfill the contract (GDPR article 6(1)(b)). Furthermore, we may disclose your personal information to our external lawyers and the courts if the processing is necessary for our legitimate interest in establishing, exercising or defending legal claims in accordance with the GDPR article 6(1)(f).

Retention/deletion of personal information

Any personal information collected about the employees of these companies will be retained for as long as we have a contractual relationship with their employer and for up to two years after providing the products / services or after termination of a contract.

We may however be required to keep some of your personal information for a longer period to fulfill legal requirements. For instance, bookkeeping material will be stored in 5 years from the closing of the current financial year and GxP documentation may be kept for up to 30 years.

6. Healthcare Professionals & Other Stakeholders

At Ascendis Pharma we collaborate and interact with Healthcare Professionals and other stakeholders, such as payors and other business partners, to advance our business objectives and gain valuable insights.

What Personal Information does Ascendis Pharma collect and why?
Depending on the interaction we have with you and your country of practice, we may collect and process the following categories of personal information:

Personal information such as your name, age, gender and contact details.
Work contact details (such as name, work mobile phone, job title).
Professional information such as your place of practice, job title, National Provider Identified (NPI), license number, the medical field in which you are active, your professional qualifications and scientific activities (such as previous clinical trial experience, and participation in past or pending research studies with Ascendis Pharma and other companies), publication of academic or scientific research and articles, and membership in associations and boards, etc.
Information on interactions with Ascendis Pharma, such as what kind of meetings we have held, topics discussed, your knowledge of and questions you have had on our business and products, what kind of material we have displayed to you and any feedback that you have provided, as well as your opinions and routines on prescribing, routines regarding your patients and diagnosis, and similar information.
Transfer of value.
Contract terms and signature.
Billing details and payments.
CVs and other qualification records (only applicable to some).

We process this information for the following purposes:

Managing our relationship with you, also to plan potential collaboration, contact, visits, follow-ups and meetings.
To comply with financial reporting requirements under the US Sunshine Act, EFPIA Disclosure Code and/or other local laws in respect of the payments made for the services provided;
To help evaluate the information we provide to you and ensure that it is relevant given your expertise, interests and preferences.
To understand your scientific-therapeutic approach and satisfaction with Ascendis Pharma.

We collect information about you from a variety of sources, including directly from you and from:

Documents or forms that you provide to participate in Ascendis Pharma-sponsored or -supported initiatives, such as Ascendis Pharma-sponsored clinical research and development activities, or in other contexts.
Publicly available sources.
Online and other databases and websites, which may be managed by third parties.

The legal bases for processing your Personal Information is based on our legitimate interest to pursue the above purposes of maintaining our relationship with, evaluating information we provide to you, and understanding your scientific-therapeutic approach in accordance with GDPR article 6(1)(f), GDPR article 6(1)(b) if the information is necessary to conclude agreements/contracts with you or GDPR article 6(1)(c) if necessary for compliance with legal obligations to which Ascendis Pharma is subject.

7. Patients, Caregivers & Patient Organizations

Ascendis Pharma engages with patients, caregivers and caregiver organizations to provide support and education of these groups.

What Personal Information does Ascendis Pharma collect and why?
Depending on the interaction we have with you, we may collect and process the following categories of personal information:

Personal information such as name, contact information, personal opinions and preferences.
Financial information and insurance coverage
Health information

We process the personal information for the purposes of engagement, support, and education. The legal basis for processing your personal information is our legitimate interest to provide support and education in accordance with GDPR article 6(1)(f) and the necessity to process your personal information to conclude contracts/agreements in accordance with GDPR article 6(1)(b).

We will always obtain your consent to process your health information in accordance with GDPR articles 9(2)(a) and 6(1)(a).

Retention/deletion of personal information

We will store your personal information as long as it is necessary in order to fulfill the contract and up to two years after providing the products / services or after termination of a contract.

Bookkeeping material will be stored in 5 years from the closing of the current financial year.

8. Job Applicant

Ascendis Pharma uses the job site Workable, an online application provided by Workable Software Limited, USA, to assist with our recruitment process.

Where you apply for a job opening through a third party job portal, this portal may collect your consent, which is freely given by you during the application process, to disclose your personal information to the job portal owner and Ascendis Pharma.

You do not have to provide the requested information, but it might affect your application if you do not.

What Personal Information does Ascendis Pharma collect and why?

Personal Information Provided by You

We may collect personal information from you at the application stage, when shortlisting candidates for an interview, during the interview and the assessment of your profile for the position, and when making a conditional and/or final employment offer. We may perform pre-employment background and reference checks with your permission and may also perform sanctions screening. All checks/screenings are carried out in a fair and consistent manner and will be limited to information that is directly relevant to the position being applied for and in pursuance of our legitimate business interests.

Specifically, we may collect the following information:

Personal information, including name, contact details, and photo, if provided by you.
Previous experience and employment entitlements, education, qualifications, CV and answers to questions relevant to the position you have applied for.
Information provided when completing tests or profile questionnaires and/or attending an interview.
Proof of your identity and qualifications, criminal records if relevant, referrals and health information where we are legally obligated to collect it.
Details of your visits to Workable’s Website including, but not limited to, traffic data, location data, weblogs and other communication data, the site that referred you to Workable’s Website and the resources that you access.
Application history for jobs at Ascendis Pharma.

Personal information about your physical or mental health, alleged commission or conviction of criminal offences, and trade union membership are considered “sensitive” personal information under applicable data privacy laws. We will only process such personal information if you have either given your explicit consent, we are legally required or allowed to collect and process it, or you have deliberately made it public. We will only request such sensitive personal information that is necessary, proportionate and in pursuance of our legitimate business interests. By providing any sensitive personal information you explicitly agree that we may collect and use it in accordance with this Privacy Notice.

Personal Information from Other Sources

Workable provides Ascendis Pharma with the facility to link the personal information you provide to Ascendis Pharma, with other publicly available information about you that you have published on the Internet – this may include sources such as LinkedIn and other social media profiles.

Workable’s technology allows Ascendis Pharma to search various databases – some publicly available and others not, which may include your personal information (including your CV), to find possible candidates to fill job openings. Where we find you in this way, we will obtain your personal information from these sources.

Ascendis Pharma may also receive your personal information from a third party who recommends you as a candidate for a specific job opening or for our business more generally.

Where you have applied for a job opening through a third party job portal, and where you have consented to this disclosure, Ascendis Pharma will disclose to the third party job portal provider certain personal information that Ascendis Pharma holds, including but not limited to a unique identifier used by the job portal provider to identify you, and information about your progress through our hiring process for the applicable job opening, as well as tangible, intangible, visual, electronic, present, or future information that we hold about you, such as your name, contact details and other information involving analysis of data relating to you as an applicant for employment (collectively “Disposition Data”). The third party job portal’s privacy notice in respect of its use of the Disposition Data is available on the third party job portal provider’s website.

Where you have applied to a job opening through another provider, Ascendis Pharma may disclose personal information like the Disposition Data defined above to such provider. The provider shall be the data controller of this personal information and shall therefore be responsible for complying with all applicable law in respect of the use of that personal information following its transfer by Ascendis Pharma.

We process this information for the following purposes:

The information you provide during the recruitment process is used to assess your suitability for employment. Our use of this information is based on our legitimate business interest in recruitment of staff for our business.

If you are successful, the personal information you provide during the application process will be securely retained by us as part of your employee file for the duration of your employment and after termination for as long as required by applicable law. Your personal information is stored on our secure servers within the European Economic Area (“EEA”) and the US.

The processing of your personal information is primarily based on GDPR article 6(1)(b) (necessary for the conclusion of a contract between you and Ascendis Pharma). Further, we process your personal information based on our legal obligations in accordance with GDPR article 6(1)(c) (e.g. legal obligations that follow from GxP regulation). We also process your personal information based on GDPR article 6(1)(f) (our legitimate interest) in connection with personality and competence tests and assessments.

The Personal Information we obtain from other sources – e.g. social media – is based on our legitimate interest in accordance with GDPR article 6(1)(f). If you have manifestly made public special categories of data (sensitive data), we may also process such data based on GDPR articles 9(2)(e) and 6(1)(f).

We will generally obtain your consent in accordance with the GDPR article 6(1)(a) to collect references, but we may, based on a specific assessment, do so based on our legitimate interest in accordance with GDPR article 6(1)(f) and the Danish Data Protection Act section 12(3).

For Danish applicants only: Your Personal Information relating to criminal convictions is based on the Danish Data Protection Act section 8(3), cf. GDPR article 10.

For US applicants only: We process personal information regarding your ethnicity to comply with our legal obligation to document diversity, etc.

If you are unsuccessful at any stage of the recruitment process, the information you have provided will be securely retained for up to 6 months from the closure of the recruitment campaign. We retain your information in case any queries or issues arise in relation to the recruitment process, and we need the information to respond to such issues or queries, and/or if a suitable position were to arise at Ascendis Pharma within that time period which we may invite you to apply for.

Automated Decision-making/Profiling

Ascendis Pharma may use Workable’s technology to select appropriate candidates for us to consider based on criteria expressly identified by us, or typical in relation to the position for which you have applied. The process of finding suitable candidates is automatic, however, any decision as to who Ascendis Pharma will hire to fill the position will be made by Ascendis Pharma staff.

Who does Ascendis Pharma share my Personal Information with?

Workable Software Limited, USA, the provider of our job site.
Third party recruitment agencies contracted to assist us with the vetting of job applicants.
Third party assessment vendors contracted to perform assessments as part of the recruitment process.
Our background check provider

Where you apply for a position via the application function on another job site, you should note that the relevant provider of the job site may retain your personal information and may also collect information from Ascendis Pharma in respect of the progress of your application. Any use by the job site provider of your personal information will be in accordance with the job site provider’s Privacy Notice.

July 2022