Cell Therapy Catapult Limited Privacy Policy

This Privacy Statement explains what we do with your personal data, whether you are visiting our website, corresponding with us or using our services.  It describes how we collect, use and process your personal data, and how, in doing so, we comply with our legal obligations to you.  

This Privacy Statement applies to the personal data for our trials participants, partners, prospective partners, suppliers and the general public who interact with us.

For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR"), the company responsible for your personal data ("Cell Therapy Catapult" or "us") are a Data Controller.

What data do we collect and how do we use it?

TRIALS PARTICIPANTS

The main reasons that we collect data regarding trials subjects are:

  1. Trials subjects – we provide clinical research to subjects who have consented to a clinical trial.  We will hold pseudonimised data on you, which means that we are unable to identify your name or further personal information.   All correspondence will remain with the holder of your master record, which is the body where you signed up for the trial.  By working in this way we can maintain your privacy and collect only the information we need to undertake the trials. Clinical trials are only carried out with your informed consent and your rights are further explained on the ‘informed consent form’ that you will be asked to sign.  Clinical trials data is retained for 30 years. We might publish results of trials, but before we do we will ensure that all personal information is removed from any report.

In providing these services your data may be shared with regulators.

We also use some of your personal data in our legitimate interests, we do not think that any of the following activities prejudice individuals in any way – in fact, they help us to offer you a more tailored, efficient service. However, you do have the right to object to us processing your personal data on this basis.

  1. Support services – we might collect and hold personal information in providing supporting services, for example:
    1. Managing enquiries
    2. Managing complaints

CLIENTS AND COMMERCIAL PARTNERS

The main reasons that we collect data regarding clients and commercial partners, which will include other partners such as academics wishing to work with Cell Therapy Catapult are:

  1. Managing relationships – We will collect the details for our contacts within your organisation, such as names, telephone numbers and email addresses.  We may also hold extra information that you or someone in your organisation has chosen to tell us.  We hold this information in order that we can maintain a relationship with you and enter into contractual arrangements etc.
     
  2. Managing finances – We may collect personal information in relation to our Finance processes such as bank details, so that we can pay you. In certain circumstances, such as when you engage with our Finance teams, we may share information with other third parties such as debt recovery agents.
     
  3. Licensing and IP – If you are partnered with us on a new therapy or manufacturing process then some limited personal data may be included in our licensing applications.  In general these will be shared with the MRHA which is a UK entity, however it is possible that information might also be passed to other licensing authorities outside of the EEA.  In these cases we will ensure that your data is protected by recognised safeguards as detailed in the international section of this privacy statement. 
     
  4. Meeting mandatory requirements – we will collect personal information in the process of managing our clinical trials and supporting services in a compliant manner.  We need to obtain and maintain personal information to evidence clinical trials safety, such as identification and career and qualifications records, medical information to support incident investigations, and records of training courses.  Where we collect any sensitive information, we ensure that we have a lawful reason or we obtain your explicit consent. 

    Where information is collected to support the manufacture of pharmaceuticals we will retain this information for 7 years.  If the personal data is required to support clinical trials, it will be retained for 30 years to meet our regulatory obligations.

    In providing these services, your data may be shared with official agencies such as clinical trials regulators.

We also use some of your personal data in our legitimate interests, we do not think that any of the following activities prejudice individuals in any way – in fact, they help us to offer you a more tailored, efficient service. However, you do have the right to object to us processing your personal data on this basis.

  1. Marketing and developing our business – we may from time to time collect personal information from you or other sources to help us to grow our business, such as when you provide us with a business card or we obtain your information at conferences etc.    If we do obtain information in this way we will inform you of our intention to use it in the development of our business,

    We will always respect your right to restrict this type of processing of your personal data by providing you with the opportunity to opt-out of these type of communications.
     
  2. Support services – we might collect and hold personal information in providing supporting services, for example:
    1. Contacting individuals in relation to press releases
    2. Collating and managing business proposals

 

SUPPLIERS

The main reasons that we collect data regarding suppliers are:

  1. Managing relationships – We will collect the details for our contacts within your organisation, such as names, telephone numbers and email addresses.  We may also hold extra information that someone in your organisation has chosen to tell us.
     
  2. Managing finances – We may collect personal information in relation to our Finance processes such as bank details, so that we can pay you. In certain circumstances, such as when you engage with our Finance teams, we may share information with other third parties such as debt recovery agents.

 

  1. Meeting mandatory requirements – we will collect personal information in the process of managing our clinical trials and supporting services in a compliant manner.  We need to obtain and maintain personal information to evidence clinical trials safety, such as identification and career and qualifications records, medical information to support incident investigations, and records of training courses.  Where we collect any sensitive information, we ensure that we have a lawful reason or we obtain your explicit consent.

    Where information is collected to support the manufacture of pharmaceuticals we will retain this information for 7 years.  If the personal data is required to support clinical trials, it will be retained for 30 years to meet our regulatory obligations.

    In providing these services, your data may be shared with official agencies such as clinical trials regulators.

 

STAFF AND APPLICANTS

The main reasons that we collect data regarding staff and applicants are:

  1. Recruitment Process – You might provide to us, or we might receive from another source such as an agency, your CV.  This will contain personal information relating to yourself such as name and contact details and your career history.  If you are unsuccessful in applying for a position with us we will delete this information and any interview notes within 12 months.  If you are successful, we will retain your CV along with other work records in accordance with our data retention standard operating procedure.
     
  2. HR Records – We will collect personal information in relation to managing both your own and our interests in relation to your employment contract.  You will be provided a staff specific privacy statement as part of your induction process.  This will contain a more detailed overview of how we process your personal data in relation to employment.
     

WEBSITE USERS

We collect a limited amount of data from our Website Users, which we use to help us to improve your experience when using our website and to help us manage the services we provide. This includes information such as how you use our website, the frequency with which you access our website, and the times that our website is most popular.

Unless you specify otherwise, we may share your information with providers of web analytics services, marketing automation platforms and social media services to make sure any advertising you receive is targeted to you.

We collect a limited amount of data from our Website Users, which we use to help us to improve your experience when using our website and to help us manage the services we provide. This includes information such as how you use our website, the frequency with which you access our website, your browser type, the location you view our website from, the language you choose to view it in and the times that our website is most popular. If you contact us via the website, we will collect any information that you provide to us, for example your name and contact details. 

Cookies 
Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and allows us to improve our site. For detailed information on the cookies we use and the purposes for which we use them see our Cookie policy.

International - How do we store and process your data internationally?

There may be occasions where we need to process your data internationally, if we do this regularly it will be noted in this privacy statement.  If we are to do this more occasionally then this may be:

  • to third parties (such as advisers or other Suppliers to our business);
  • to overseas clients;
  • to clients within your country who may, in turn, transfer your data internationally;
  • to a cloud-based storage provider; and
  • to other third parties, as referred to here.

 

We want to make sure that your data are stored and transferred in a secure way. We will therefore only transfer data outside of the European Economic Area or EEA where it is compliant with data protection legislation and the means of transfer provides adequate safeguards in relation to your data, for example:

  • by way of data transfer agreement, incorporating the current standard contractual clauses adopted by the European Commission for the transfer of personal data by data controllers in the EEA to data controllers and processors in jurisdictions without adequate data protection laws; or
  • by signing up to the EU-U.S. Privacy Shield Framework for the transfer of personal data from entities in the EU to entities in the United States of America or any equivalent agreement in respect of other jurisdictions; or
  • transferring your data to a country where there has been a finding of adequacy by the European Commission in respect of that country's levels of data protection via its legislation; or
  • where it is necessary for the conclusion or performance of a contract between ourselves and a third party and the transfer is in your interests for the purposes of that contract (for example, if we need to transfer data outside the EEA in order to meet our obligations under that contract if you are a Client of ours); or
  • where you have consented to the data transfer.

 

Your rights.

You retain various rights in respect of your data, even once you have given it to us. These are described in more detail below.
 

To get in touch about these rights, please contact us. We will seek to deal with your request without undue delay, and in any event within one month (subject to any extensions to which we are lawfully entitled). Please note that we may keep a record of your communications to help us resolve any issues you raise.
 

Right to object: this right enables you to object to us processing your personal data where we do so for one of the following four reasons: (i) our legitimate interests; (ii) to enable us to perform a task in the public interest or exercise official authority; (iii) to send you direct marketing materials; and (iv) for scientific, historical, research, or statistical purposes.
 

  • If your objection relates to direct marketing, we will act on your objection by ceasing this activity. 
  • If your objection relates to consent that you have previously given, you may withdraw this consent at any time and we will cease to carry out the particular activity that you previously consented to unless we consider that there is an alternative reason to justify our continued processing of your data for this purpose in which case we will inform you of this condition.
     

Right to access:  You may ask us to confirm what information we hold about you at any time, and request us to modify, update or Delete such information. We will need to verify your identity and may ask for more information about your request. If we provide you with access to the information we hold about you, we will not charge you for this unless your request is "manifestly unfounded or excessive". If you request further copies of this information from us, we may charge you a reasonable administrative cost where legally permissible. Where we are legally permitted to do so, we may refuse your request. If we refuse your request we will always tell you the reasons for doing so. 
 

Right to erasure: You have the right to request that we erase your personal data in certain circumstances. Normally, the information must meet one of the following criteria:

  • the data are no longer necessary for the purpose for which we originally collected and/or processed them;
  • you have withdrawn your consent to us processing your data, and there is no other valid reason for us to continue processing;
  • the data has been processed unlawfully;
  • it is necessary for the data to be erased in order for us to comply with our legal obligations as a data controller; or
  • if we process the data because we believe it necessary to do so for our legitimate interests, you object to the processing and we are unable to demonstrate overriding legitimate grounds for our continued processing.

We would only be entitled to refuse to comply with your request for one of the following reasons: 

  • to exercise the right of freedom of expression and information;
  • to comply with legal obligations or for the performance of a public interest task or exercise of official authority;
  • for public health reasons in the public interest;
  • for archival, research or statistical purposes; or
  • to exercise or defend a legal claim.
  • when complying with a valid request for the erasure of data we will take all reasonably practicable steps to delete the relevant data.

 

Right to restrict processing: You have the right to request that we restrict our processing of your personal data in certain circumstances. This means that we can only continue to store your data and will not be able to carry out any further processing activities with it until either: (i) one of the circumstances listed below is resolved; (ii) you consent; or (iii) further processing is necessary for either the establishment, exercise or defence of legal claims, the protection of the rights of another individual, or reasons of important EU or Member State public interest. 
 

The circumstances in which you are likely to request that we restrict the processing of your personal data are:

  • where you believe the data we are processing is inaccurate, where we will restrict processing for the period during which the accuracy of the data is verified;
  • where you object to our processing of your personal data for our legitimate interests.
  • where our processing of your data is unlawful, but you would prefer us to restrict our processing of it rather than erasing it; and
  • where we have no further need to process your personal data but you require the data to establish, exercise, or defend legal claims.

If we have shared your personal data with third parties, we will notify them about the restricted processing unless this is impossible or involves disproportionate effort. We will, of course, notify you before lifting any restriction on processing your personal data.
 

Right to rectification: You have the right to request that we rectify any inaccurate or incomplete personal data that we hold about you. If we have shared this personal data with third parties, we will notify them about the rectification unless this is impossible or involves disproportionate effort. Where appropriate, we will also tell you which third parties we have disclosed the inaccurate or incomplete personal data to. Where we think that it is reasonable for us not to comply with your request, we will explain our reasons for this decision.
 

Right of data portability: If you wish, you have the right to transfer your personal data between data controllers. To allow you to do so, we will provide you with your data in a commonly used machine-readable format that is password-protected so that you can transfer the data to another online platform.

  • You can lodge a complaint with a supervisory authority by contact the Information Commissioners Office whose website is www.ico.org.uk 
     
  • If you would like to exercise any of these rights, or withdraw your consent to the processing of your personal data (where consent is our legal basis for processing your personal data) please contact us. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

Contacting us

Should you have any questions or wish to exercise any of your rights as detailed in the privacy statement you should contact our Data Protection Manager at Cell and Gene Therapy Catapult, at 12th Floor Tower Wing, Guy’s Hospital, Great Maze Pond, London SE1 9RT

Discover who we are