Effective Date: 16 February 2023
Last Updated: February 2023
Clario and each of its affiliates, including eResearchTechnology, Inc. and Bioclinica, Inc. (collectively, “Clario” or the “Company”, “we”, “us” or “our”), prioritizes the confidentiality and security of personal data. This Privacy Notice applies to our processing of personal data that you provide to the Company via one of the channels enumerated below. In this Notice, we explain the guidelines that apply to our processing of your personal data and provide information to which you are entitled under applicable data protection laws.
Please read this Notice in its entirety to ensure that you are fully informed. If you have any questions or concerns about how Clario processes your personal data, please contact us as described in the Contact Us section below.
1.1 What is personal data?
For purposes of this Notice, personal data broadly refers to any information relating to an identified or identifiable individual that directly or indirectly identifies the individual by reference to one or more factors specific to their physical, physiological, mental, economic, cultural, or social identity. Personal data does not include such information if it is anonymous (i.e., the personal data can no longer be traced back to the individual to whom it relates).
Examples of personal data include:
- Your first and last name
- Your employee identification number
- Your home address
- Your home or personal mobile telephone number
- Your personal email address
- The names of your family members
- Your date of birth
- Specific employment information about you (i.e., information from your CV or resume)
1.2 What is sensitive personal data?
Sensitive personal data is a category of personal data that may be more sensitive in nature compared to the personal data listed above.
Examples of sensitive personal data include:
- Race or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Genetic data or biometric data (processed solely to identity an individual)
- Health-related data
- Financial data (in certain jurisdictions)
- Data concerning an individual’s sex life or sexual orientation
- Trade-union membership (in some regions)
2. The Personal Data You Provide to Clario
2.1 If you visit our website www.clario.com and/or use the contact form or chat function on the website, contact Clario for customer service, or otherwise communicate with us:
2.1.1 Types of personal data collected by Clario
When you use the contact form or the chat feature on our website www.clario.com, contact Customer Support, or otherwise communicate with Clario, we collect and process your personal data. Clario collects, processes, and stores the following types of personal data (if provided by you):
- Name, job title, email address, phone number
- Information about the subject matter of your inquiry
- Date of your inquiry
- Other information you provide in connection with your inquiry
- Product-specific interest(s)
- Description of business question or need
We encourage you not to provide sensitive personal data to us unless it is strictly necessary for the processing of your inquiry. In this context, the information should only be sent in a highly encrypted form if you send the information by e-mail.
2.1.2 Clario’s purposes for processing
Your personal data will be processed for the following purposes:
- Handling of your inquiry
- General communication with you
2.1.3 Clario’s legal bases for processing
For purposes of Section 2.1, Clario processes your personal data on the below-mentioned bases. The basis depends on the nature of your inquiry.
Legitimate interests: We may process your personal data on the basis of our legitimate interests in handling and responding to your inquiry, communicating with you, and developing our products and services (Article 6(1)(f) of the General Data Protection Regulation).
Contractual obligations: If your inquiry concerns a (potential) formation of contract, we process your data to implement measures before the formation of contract (Article 6(1)(b) of the General Data Protection Regulation).
2.1.4 Retention period
Your personal data will be stored for as long as may be required to handle your inquiry. However, the data can be stored for a longer period in anonymised form.
Essential cookies guarantee certain functionality without which the user may be unable to use the website as intended. Non-essential cookies collect information about the way the website is used or to store information that the user enters into the website (such as username, language preferred, or user location). Whereas essential cookies are used to ensure the basic functionality of the website, non-essential cookies are used to improve the performance of the website and offer the user personalized features.
2.3 If you sign up to receive our newsletter(s) or other marketing materials from Clario:
2.3.1 Types of personal data collected by Clario
Clario collects, processes, and stores your personal data when you sign up for our newsletter(s). Clario may collect, process, and store the following types of personal data (if provided by you):
- Your name and email address
- Your consent
- Your interests
- Your click-behaviour in relation to published material
2.3.2 Clario’s purposes for processing
Your personal data may be processed for the purposes of Clario’s marketing activities, which may include statistical analysis.
2.3.3 Clario’s legal bases for processing
For purposes of Section 2.3, Clario processes your personal data on one or more of the following legal bases:
Consent: Clario will only use your personal data for direct marketing, including for sending out newsletters, if you have given your prior and explicit consent to our doing so (Article 6(1)(a) of the General Data Protection Regulation). You can always withdraw your consent by clicking on the unsubscribe link at the bottom of each email or by contacting us as described below. Note, however, withdrawing your consent does not affect the legality of the processing that preceded the withdrawal.
Legitimate interests: The processing of your personal data will, in connection with analysis and statistics, be based on our legitimate interests in being able to improve and develop our service (Article 6(1)(f) of the General Data Protection Regulation).
2.3.4 Retention period
Your personal data will be stored for as long as your consent to receive newsletter(s) or other marketing materials is active.
Documentation relating to your marketing consent is kept for two (2) years from the time you have withdrawn your consent to receive direct marketing material. The retention period is determined based on Clario’s legitimate interest in being able to document that direct marketing has been carried out in accordance with the applicable legislation (Article 6(1)(f) of the General Data Protection Regulation).
2.4 If you apply to work at Clario:
2.4.1 Types of personal data collected
Clario may, as permitted by law depending on your country of residence, collect, process, and store the following personal data:
- Personal data that you disclose in your job application and CV as well as any attachments
- Personal data that you disclose during any job interviews
- Information about you, including information regarding your previous jobs, activities, competencies, performance, as well as information about you that is publicly available, including information posted on social media
- Criminal records
- References from your previous and/or current employers
- Additional information you will provide in relation to the recruitment process
2.4.2 Clario’s purposes for processing
Your personal data will be processed for the purpose of determining your qualifications for employment and to reach a hiring decision.
2.4.3 Clario’s legal bases for processing
For purposes of Section 2.4, Clario will mainly process your personal data based on the following legal bases:
Request to enter into an employment contract with Clario: We may process your personal data on the basis of your request to enter into an employment contract with Clario (Article 6(1)(b) of the GDPR).
Legitimate interests: We may process your personal data on the basis of our legitimate interests in carrying out further assessments to aid in reaching a hiring decision, including on the basis of personality tests (where permitted) and publicly available information on the internet (Article 6(1)(f) of the GDPR).
Consent: In exceptional cases and only when no other legal basis can be applied, Clario may ask separately for your consent to process your personal data (Article 6(1)(a) and 9(2)(a) of the GDPR). Clario will, for instance, only take references from your previous and/or current employers or collect your health information or criminal records if you have consented to this.
2.4.4 Retention period
If you are offered a position with Clario, your job application and additional relevant personal data obtained during the recruitment and hiring process will be stored in your employee file for the duration specified by applicable laws. If no such duration is specified, Clario will retain your personal data in accordance with its record retention policy.
If you are not offered a position with the Company, we will store your job application and any additional personal data obtained during the recruitment process for a period of time following your rejection as required under local applicable law. If no such duration is specified, Clario will retain your personal data in accordance with its record retention policy.
2.5 If you are a Vendor of, Supplier to, other Business Partner of Clario:
2.5.1 Types of personal data collected
Clario may collect, process, and store the following types of personal data about you:
- Your name and job title
- Your business contact information (telephone, email, mailing address)
- Individual information (e.g., preferred language(s), CV, qualifications)
- Organisational information such as the nature of the work performed by your employer and your specific role/responsibilities for your employer
- Information related to the product(s) or service(s) you provide to Clario
We may receive such information directly from you (primarily through emails and other correspondence with you) or from a third party such as your employer.
2.5.2 Clario’s purposes for processing
Your personal data may be processed for the following purposes:
- General planning, fulfilment, and the management of the business relationship, including the negotiation, execution, and amendment of contracts or other agreements
- Administration such as the processing of payments, rating evaluations, accounting, auditing, as well as providing support
- Providing newsletters and other marketing communications
- Responding to inquiries from you
- General communication with you in connection with the business relationship
2.5.3 Clario’s legal bases for processing
For purposes of Section 2.5, Clario primarily processes your personal data on one or more of the following grounds:
Contractual obligations: In certain cases, the processing of your personal data is necessary to fulfil a contract (Article 6(1)(b) of the General Data Protection Regulation).
Legitimate interests: We may process your personal data on the basis of our legitimate interests in, for example, managing day-to-day operations in accordance with legitimate and fair business practices, including planning, execution and management of the cooperation or our legitimate interest in, for example, performing marketing activities (where consent is not required) and providing support. The processing may also be necessary for our legitimate interest in preventing fraud or establishing, defending, or asserting legal claims (Article 6(1)(f) of the General Data Protection Regulation).
Legal obligations: The processing of your personal data will in some cases be necessary for compliance with legal obligations, such as our obligation to prevent illegal activities (Article 6(1)(c) of the General Data Protection Regulation.
2.5.4 Retention period
Your personal data will be stored for as long as is necessary to fulfil the business relationship.
2.6 If you engage with Clario on the Company’s social media pages:
Clario and the social media providers through which Clario posts and maintains content are jointly responsible for the processing of personal data collected in connection with your visit to any profile(s) maintained by the Company.
Clario maintains profiles or pages on the following social media platforms:
Facebook (operated by Meta)
- You can customize your privacy settings on Facebook here
LinkedIn Ireland Unlimited Company
- You can customize your privacy settings on LinkedIn here
Twitter (Twitter, Inc.)
YouTube (operated by Google LLC)
2.6.1 Types of personal data collected
When you visit or interact with the Company’s social media profiles, Clario [and the social media provider] may collect, process, and store the following types of personal data about you (if provided):
- Information available on your applicable social media profile, including your name, gender, civil status, workplace, interests, image, and your city
- Whether you “like” or have applied other reactions to our profile
- Comments you leave on our posts
- Data confirming that you have visited our profile(s)
2.6.2 Clario’s purposes for processing
Clario processes your personal data for the following purposes:
- Improving our products and services, including our social media profiles and pages
- Conducting analysis about stakeholder engagement with our social media presence
- To be able to communicate with you
- General marketing purposes
Social media providers process for their own purposes and each has its own privacy notice that you should review to become familiar with their purposes for processing.
2.6.3 Clario’s legal basis for processing
For purposes of Section 2.6, your personal data is processed on the following legal basis:
Legitimate interests: Clario bases the processing of your personal data on our legitimate interests in being able to communicate with and market to you on our social media profiles, as well as our legitimate interest in improving our products and services (Article 6(1)(f) of the General Data Protection Regulation).
2.6.4 Retention period
3. Clario’s Sharing of Your Personal Information
To achieve the above purposes, we may give third parties that provide relevant services to us access to your personal data based on their contractual relationship with Clario. Such third parties may include IT service suppliers or other suppliers that process personal data for us. Such suppliers will only process personal data in accordance with our instructions according to the signed agreements that we have with them.
In the case of any change in Clario’s corporate structure, including a partial transfer of Clario’s assets containing personal data, the processing basis for the related transfer of personal data is, as a rule, Article 6(1)(f) of the General Data Protection Regulation, since Clario has an interest in transferring parts of its assets and making commercial/structural changes.
In addition to what is described above, your personal data is generally not disclosed to a third party without your consent. However, in certain circumstances and as required by law, it may be necessary to disclose your personal data, including when required in response to subpoenas, warrants, or court orders, in connection with any legal or regulatory process, or to comply with relevant laws. We will also share your personal information as necessary to establish or exercise our rights, to defend against a legal claim, to investigate, prevent, or take action regarding possible illegal activities, suspected fraud, safety of person or property, for audit purposes, or a violation of our policies.
4. International Transfers of Your Personal Data
Clario is an international company with affiliates and subcontractors based in many countries around the world. Clario may need to transfer your personal data to other jurisdictions that may not offer the same legal protections for personal data as your country of residence. Any such transfer will be conducted in compliance with the applicable data protection law and transfer mechanisms, such as the EU Standard Contractual Clauses (“SCCs”). You have the right to receive a copy of the SCCs upon request.
5. Your Rights
5.1 Rights of EEA/UK Residents
Pursuant to the General Data Protection Regulation (“GDPR”), below is additional specific information which relates to the processing of personal data of individuals who are in the European Economic Area and the United Kingdom.
- You have the right to access the personal data we process about you
- You have the right to object to our collection and further processing of your personal data
- You have the right to rectification and deletion of your personal data, however there are certain statutory exceptions, including the Bookkeeping Act
- You have the right to ask us to restrict the processing of your personal data
- In certain circumstances, you may also request to receive a copy of your personal data and to transmit the personal data you have provided to us to another data controller (data portability)
- You can withdraw any consents you may have given at any time. We will then delete your personal data unless we may continue the processing on another basis. You can cancel our newsletter by clicking on the link at the bottom of the newsletter.
You also have the right to lodge a complaint with the Data Protection Authority in your country, including the Data Protection Commission, regarding the processing of your personal data in the EEA/UK. Contact details are available at https://www.dataprotection.ie/en/contact/how-contact-us or https://edpb.europa.eu/about-edpb/board/members_en.
5.2 Rights of California Residents
Subject to legal limitations, if you are a resident of California, you may have the right to make the following choices regarding your personal information:
- Access to Your Personal Information. You may request access to your personal information by contacting us as described below. If required by law, upon request, we will grant you reasonable access to the personal information that we have about you. You may be entitled to ask us for a notice describing what categories of personal information (if any) we share with third parties or affiliates for direct marketing.
- Changes to Your Personal Information. You may have a right to modify your personal information. You may contact us as described below in order to request that your information be modified. Note that we may keep historical information in our backup files as permitted by law.
- Deletion of Your Personal Information. You may request that we delete your personal information by contacting us as described below. If required by law, we will grant a request to delete information, but you should note that in many situations we must keep your personal information to comply with our legal obligations, resolve disputes, enforce our agreements, or for another one of our business purposes.
- Objection to Certain Processing. You may object to our use or disclosure of your personal information by contacting us as described below.
- Promotional Emails. You may choose to provide us with your email address for the purpose of allowing us to send communications and promotional materials to you. You can stop receiving most emails by following the unsubscribe instructions in emails that you receive. If you decide not to receive these emails, we may still send you service-related communications.
- Revocation of Consent. If you revoke your consent for the processing of personal information then we may no longer be able to provide you services. In some cases, we may limit or deny your request to revoke consent if the law permits or requires us to do so, or if we are unable to adequately verify your identity. You may revoke consent to processing (where such processing is based upon consent) by contacting us at the address described below.
Please note that, as required by law, we will require you to prove your identity. We may verify your identity by telephone call or email. Depending on your request, we will ask for information such as your name, your physical address, or the name of the clinical trial in which you participated. We may also ask you to provide a signed declaration confirming your identity. Following a request, we will use reasonable efforts to supply, correct or delete personal information about you in our files.
6. Data Controller and Data Protection Officers (DPOs)
A “data controller” is the entity that determines the purposes and means of the processing of your personal data. For purposes of this Notice, the controller of your personal data is:
eResearchTechnology, Inc., a Clario company
1818 Market Street, Suite 2600
Philadelphia, PA, 19103 USA
Clario’s registered Data Protection Officers (“DPOs”) are:
- Susanne Stougaard (legacy Bioclinica) – [email protected] / +45 7227 3002
- Klaus Hoogestraat (legacy ERT) – [email protected] / +49 9305 720 6650
7. Privacy Notice Updates
Clario reserves the right to revise the content of this Privacy Notice from time to time or more frequently if important changes require an update. Changes to this effect will be reflected on this page. Clario recommends you review this Notice periodically as we will always show the date of the latest changes at the top of this Notice.
8. Contact Us
If you have any questions about this Privacy Notice, please feel free to contact us:
1818 Market Street, Suite 2600
Philadelphia, PA, 19103 USA