Privacy policy

1. Executive Summary

This is an important notice regarding your privacy and the way in which Aspire Pharma (referred to as “We” and “Us”) collects and makes use of your personal data. By visiting our website, using our services, or contacting us, you agree to this privacy policy. This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed.

For the purpose of applicable privacy legislation, the Data Controller is APIE Limited, Company Number 773982, Registered Office Fieldfisher Ireland LLP, 45 Mespil Road, Dublin, DO4 W2FI, Ireland.

Questions regarding this policy should be directed to [email protected].

2. Types of Personal Data We Process

We collect and process the following personal data:

• Contact details: name, email, phone, company, job title, postal address (if provided).
• Message content sent via contact forms, email, phone, or in person.
• Special category data (health data) for pharmacovigilance reports.
• Medical inquiries about products, if unrelated to pharmacovigilance.
• Product availability inquiries.
• Product quality complaints, if unrelated to pharmacovigilance.
• Website usage data and log data (IP address, user agent, timestamp, referrer URLS, pages visited).

3. Purposes & Legal Bases

We process personal data for the following purposes under lawful bases:

• Handling enquiries, fulfilling contracts and pre-contract activities — processing necessary to perform a contract or to take steps at a request prior to entering into a contract. (Legal basis: Art.6(1)(b) – Contractual Necessity).
• Customer relationship management, business administration and security — processing necessary for our legitimate interests in operating and securing our business and systems. (Legal basis: Art.6(1)(f) — Legitimate interests).
• Marketing communications (email / newsletter) — with respect to direct marketing by electronic mail we rely on consent (where required) Art.6(1)(a) or, where lawful and appropriate, legitimate interest Art.6(1)(f). You will be provided with an opt-in and a clear method to opt-out/unsubscribe for marketing messages.
• Website operation and necessary cookies — strictly necessary processing for website functionality (Legal basis: Art.6(1)(f) where legitimate interest applies and/or necessary to provide a service requested by the user).
• Analytics & marketing cookies / widgets — only processed after explicit consent by the user via a cookie-consent tool (Legal basis: Art.6(1)(a) — Consent).
• Pharmacovigilance / safety reporting — processing required to comply with our legal obligations and to perform tasks carried out in the public interest (Legal basis: Art.6(1)(c) or public task where relevant). Processing of special category data (health data) for PV is done in accordance with Art.9 (e.g., Art.9(2)(h) or applicable national derogations) where necessary for pharmacovigilance and patient safety.
• Cookies and Consent: Necessary cookies operate without consent. Non-essential cookies (analytics, marketing, social widgets) will only be set after explicit consent.

4. Data Subject Rights

You can exercise the following rights in relation to your personal data, subject to any legal exemptions:

• Access: Request a copy of the personal data we hold about you and information about how we process it.
• Rectification: Ask us to correct inaccurate or incomplete personal data.
• Erasure (Right to be forgotten): Request deletion of your personal data where we no longer have a lawful basis to retain it.
• Restriction of processing: Ask us to restrict processing while a dispute or verification is resolved.
• Data portability: Request a copy of your personal data in a structured, commonly used, machine-readable format and, where technically possible, request transmission to another controller.
• Object to processing: Object to processing based on legitimate interests (including profiling) — we will cease processing unless we can demonstrate compelling legitimate grounds.
• Withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting processing conducted prior to withdrawal.

How to exercise your rights: Contact our Data Protection Officer at [email protected]. We will verify your identity and respond within the statutory timeframes (typically one month unless an extension applies).

If you remain dissatisfied, you have the right to lodge a complaint with a supervisory authority. For Aspire Pharma the responsible supervisory authority is:

Federal Commissioner for Data Protection and Freedom of Information

• Address: Godesberger Allee 185-189, 53175 Bonn, Germany
• Email: [email protected]
• Phone: +49 228 99 9582-5110

5. Data Retention

We retain personal data only as long as necessary for the purposes stated, as well as for compliance with legal, regulatory, tax, accounting, or reporting obligations. Retention periods are determined based on data type, sensitivity, purpose, risk of harm, and legal requirements.

Data is securely deleted when no longer required.

6. Disclosure of Your Information

We only share personal data with third parties when it is strictly necessary for legitimate business purposes and in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). Such sharing is governed by robust safeguards, including Data Processing Agreements (DPAs) that ensure GDPR compliance and equivalent protections for any sub-processing activities. Where personal data is transferred outside the European Economic Area (EEA), we implement recognised legal mechanisms such as Standard Contractual Clauses or rely on adequacy decisions to maintain a high level of data protection.

Specifically, we may share your information with:

• Website hosting providers and cloud storage providers.
• Pharmacovigilance / drug safety service providers.
• Marketing Authorization Holders (MAHs) or legal manufacturers where your report or query relates to a product they own/licence.
• CRM and business systems vendors used to manage enquiries and customer data.
• Email delivery and analytics vendors.
• Legal advisers, auditors and professional advisers where necessary to obtain legal advice or auditing services.
• Competent authorities and regulators (e.g., medicines regulators, law enforcement) where required by law.

All processors or service providers who process personal data on our behalf operate under a written Data Processing Agreement (DPA) and are required to implement appropriate technical and organisational safeguards.

7. International Transfers

In some circumstances, we may transfer personal data to service providers or partners located outside the European Economic Area (EEA). Where the European Commission has issued an adequacy decision (Article 45 GDPR), these transfers are considered to provide an adequate level of protection.

Where no adequacy decision applies, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (Article 46(2)(c) GDPR) or, in limited cases, specific exemptions under Article 49 GDPR.

Apart from the transfers described above, we do not transfer your personal data to countries outside the EU/EEA or to international organisations.

8. Data Security

At Aspire Pharma, protecting your personal data is a core commitment. We operate an information security management system aligned with internationally recognised standards, including ISO 27001 and Cyber Essentials. This framework ensures robust safeguards are in place to prevent loss, misuse, unauthorised access, alteration, or disclosure of personal data.

Access is strictly limited to trained employees, trusted partners, and service providers who need it for legitimate business purposes. All parties are required to follow our instructions and uphold strict confidentiality obligations.

We maintain clear procedures to detect and respond swiftly to any potential data security incident. Should a breach occur, we will act promptly to contain the situation and, where required, notify affected individuals and relevant authorities.

Our approach goes beyond compliance. By embedding cyber resilience into our operations, we work to minimise the likelihood of security incidents and to ensure that, if they do occur, they are quickly identified, controlled, and resolved with minimal impact. This ongoing commitment provides a secure foundation for our users, customers, and partners, giving you confidence that your data is protected to the highest standard.

9. Changes to the Privacy Policy and Duty to Inform Us of Changes

Updates will be posted to the company website, and changes take effect immediately for future data collection. Regular users should review the policy periodically.