Individual rights

Abadía Retuerta, S.A., is committed to respect your privacy and to duly protect your personal information when collecting and sharing data with others in the performance of its legitimate business activities.

To complement the Novartis Policy on Personal Data Protection, Abadía Retuerta, S.A. has adopted the Binding Corporate Rules (BCR), a set of principles governing the international transfer of personal data of Abadía Retuerta, S.A.’s employees, customers and business partners, as well as other individuals whose data is collected and processed in the EU and Switzerland. The approval of the Novartis Binding Corporate Rules by the EU and Swiss Data Protection authorities enables Novartis to comply with the data protection laws of EU countries and Switzerland when sending your personal information from these countries to its subsidiaries around the world.

Which personal data protection principles apply?

Novartis companies sending your personal information from the EU or Switzerland to other countries must comply with applicable laws, in addition to Novartis policies and the Binding Corporate Rules. In particular, these companies:

• collect and process your personal information through transparent and lawful means;
• process your personal information only for specific and legitimate purposes and do not use it for any other purpose;
• inform you of the transfer of your personal information and, if necessary, ask for your consent, where required by local law.
• retain your personal information only for as long as necessary, unless longer or shorter retention periods are required or permitted by law.
• preserve the confidentiality of your personal information and take appropriate and reasonable security measures to protect against unauthorized access, accidental loss or damage, misuse, and unauthorized alteration or deletion.

What are my rights?

If you are an Abadía Retuerta, S.A. collaborator, customer or business partner, or other person whose personal information has been collected and processed by Abadía Retuerta, S.A., in the EU or Switzerland, you have the following rights:

• may ask Abadía Retuerta, S.A. to inform you about the collection and use of your personal information by Abadía Retuerta, S.A. in accordance with the applicable local laws;
• may request Abadía Retuerta, S.A. to correct, delete or not use your personal information if it is incomplete or inaccurate;
• you may object to the processing of your personal information and require Abadía Retuerta, S.A. not to continue processing your data provided that you have a legitimate justification for doing so.
• you may request a review of decisions made by automatic processing of your personal information if such decisions significantly affect you.

How can I exercise my rights?

In the event that your personal information has been sent to a Novartis Group company located in a non-EU country other than Switzerland and such company does not provide an adequate level of protection and you believe that your personal information has been processed in breach of the Binding Corporate Rules, you may proceed as follows:

• file a complaint with the Novartis Business Practices Office (BPO) by sending an e-mail to: business.practicesofficer@novartis.com. Your complaint will be investigated following our internal procedures.
• lodge a complaint with the competent data protection authority or file a lawsuit in the courts of Switzerland or the EU country from which your personal information was sent.