Table Of ContentWhen Lundbeck processes personal data collected through other channels than via Lundbeck.com, H. Lundbeck A/S will specifically inform you how your personal data is
processed. However, for certain specific processing activities where personal data is collected or obtained via other channels/devices/third parties than Lundbeck.com, you can
read more below.
Type of Categories of personal data and Purpose of Legal basis Disclosure of personal Retention
processing source if relevant processing data, if relevant and legal
and basis for the disclosure
categories of
individuals
Employee • Name and contact information • Being able to contact The legal basis is Personal data related to
emergency an employee’s next Lundbeck’s legitimate next of kin will be deleted
contact - Next of kin in case of an interest in being able once the relevant Lundbeck
The source of data regarding you as
of kin to emergency. to contact the next of employee no longer works
next of kin to a Lundbeck employee is
employees at kin in case of an at Lundbeck.
the employee.
H. Lundbeck emergency, cf. Article
A/S 6(1)(f) of the GDPR.
Scientific • Health information • As a pharmaceutical The legal basis is The data may be Personal data related to
research data • Biological material / human samples company, Lundbeck Article 9 (2)(j) of the transferred, including to scientific research will be
- (including processes personal GDPR cf. the Danish universities or authorities, deleted according to
RWD data) data for scientific Act on Processing of subject to the provisions set retention periods set in the
The source of data regarding scientific
research purposes Personal Data out in Section 10 of the the contracts which the source
research is various research data
within a range of Section 10. Danish Act on Processing of of the data, however, will be
bases, including public databases and
areas. Read more Personal Data. deleted at the latest 5 years
biobanks.
about Lundbeck’s after it has been received.
activities within In specific cases, other
The personal data will be research and appropriate legal basis may
pseudonymised and the data will not be development here. be relied upon.
directly identifiable to Lundbeck.
Video • Personal data recorded by thermal • Improving the safety The legal basis is The data obtained via video Recordings will be deleted
surveillance – camera on Lundbeck’s property and thereby Lundbeck’s legitimate surveillance may be shared after 30 days unless storage
visitors at the increasing the level interest in trying to with the police in case of for a longer period is
Lundbeck of security on the prevent, detect and suspicion of an illegal act. required under the Danish
The source of data collected through
property in site in Valby and/or solve crime, cf. Article The legal basis is § 8(4) of TV Monitoring Act.
video is the camera capturing your
Valby and/or Lumsås. 6(1)(f) of the GDPR. the Danish Data Protection
whereabouts and actions on
Lumsås Act, cf. Article 10 of the
Lundbeck’s property in Valby and/or
GDPR.
Lumsås. If criminal data is
processed the legal
basis is § 8 of the
.
Danish Data
Protection Act, cf.
Article 10 of the
GDPR.
Site access / • Name, telephone number, email • Being able to The legal basis is Personal data are stored for
Guest address provide access to Lundbeck’s legitimate as long as necessary to fulfil
registration – • Photo (if applicable) you as a visitor or an interest in knowing the purpose described
Externals external working at who is always present above, however, for site
visiting the site for a limited on the site, cf. Article access data no longer than
The source of data in relation to site
Lundbeck’s period of time. 6(1)(f) of the GDPR. 36 months, and for guest
access/guest registration (when not
premises in registration data no more
collected directly from you) is either a
Valby and/or than 12 months.
Lundbeck employee or your employer.
Lumsås .
Work related • Personal data that are a part of the • To increase safety The legal basis is We store your personal data
accidents – information we collect on how the and to be able to Lundbeck’s legitimate for as long as necessary to
Externals accident happened. implement corrective interests in improving fulfil the purposes described
working at the and preventive site security and above, however for no
Lundbeck actions. preventing future longer than 12 months
The source of data in relation to work
property in accidents, cf. Article
related accidents may also be (when
Valby and/or 6(1)(f) of the GDPR.
not collected directly from you) a
Lumsås
Lundbeck employee or another witness.
Investors – • Name, • Keeping a register of The legal basis is Personal data are disclosed We store your personal data
Investors’ • Address, Lundbeck’s investors Lundbeck’s legal to the VP SECURITIES A/S for as long as necessary to
acquisition of • Number of shares, • Inviting to general obligation the Danish for the purpose of investor fulfil the purposes described
shares in H. • Number of votes assembly Companies Act, cf. administration. The legal above, however for no
Lundbeck A/S • Investor type • Analysing article 6(1)(c) of the basis is section 61 of the longer than 18 months.
composition of GDPR, and Danish Companies Act, cf.
investors Lundbeck’s legitimate article 6(1)(c).
• Being able to interests in (i)
The source of data in relation to
communicate with analysing the
investors (when not collected directly
investors composition of
from you) is VP Securities A/S.
Lundbeck’s
shareholders, (ii)
being able to
communicate with
shareholders (e.g. in
relation to sending out
invitation for general
assembly) and (iii)
paying dividends to
shareholders, cf.
article 6(1)(f) of the
GDPR.
Meeting In limited situations, Lundbeck may • Relevant business The legal basis for For smaller meetings, the We store your personal data
participants – (audio/video) record purposes such as for recording is recording may be shared for a maximum of 30 days,
recording of meeting/presentations/webinars example; to ensure Lundbeck’s legitimate with meeting participants or unless you have been
meetings (“Meetings”) if is assessed that there that the meeting can interests in pursuing a invited participants that informed otherwise.
is a specific need and relevant be translated in case relevant business were absent at the meeting.
business purpose for this. The of non-English purpose (as The legal basis is
Lundbeck meeting host will always speaking Lundbeck described to the left), Lundbeck’s legitimate
specifically inform you if video employees or to cf. Article 6(1)(f) of interests in pursuing a
recording takes place at the Meeting ensure that the video the GDPR. In light of relevant business purpose
you will attend. will be made the business purpose (as described to the left), cf.
available to invited of the meetings, the Article 6(1)(f) of the GDPR.
In case the Meeting you participate participants if they interests of the
in is recorded, we will process are absent at the participants are Other types of transfer or
meeting. generally assessed uses (e.g. for larger
• your digital image (if you have not to override
meetings; upload to the
your video camera turned on), Lundbeck’s interests. Lundbeck intranet) will be
• audio recordings of your assessed on a case by case
input/question at the meeting basis.
(if you speak), and
• written input/questions you
provide via the chat-functions
(e.g. for webinars or similar).
Market Lundbeck may collect the following on • Preforming market The legal basis is If the market research study
Research – health care professionals participating research Lundbeck’s legitimate is product related, we keep
health care in Market Research interest in during and use the market
professionals market research in research reports for a
participating in order to ensure the period corresponding with
- Contact details and
questionnaires business of Lundbeck the patent protection on the
- Answers to market research
from third party confirms with the product + and additional 5
questions
Market market demand, cf. years. If the market
-
Research Article 6(1)(f) of the research study is not
The answers are collected from a third
Partners GDPR. product related, both more
party market research partner, and
general within a disease
compiled into a syndicated data file,
area or a specified market,
where the personal details of the
we keep and use the market
individuals are not included. However,
research reports for no
as the relevant market research partner
longer than 10 years after
holds the key to the anonymized data
files the data contained in the files are the completion of the
still regarded as personal data under market research study.
the GDPR. Lundbeck will never get
access to the key and will therefore
never be able to link the answers listed
in the data files to specific persons.
Last updated: 12 January 2021
