European Economic Area
ADDITIONAL INFORMATION FOR INDIVIDUALS IN THE EUROPEAN ECONOMIC AREA AND THE UNITED KINGDOM
The below information applies to any Data Subject located in the EEA or the UK. For the purposes of processing these Personal Data, OncoBay acts as a “data controller” and our headquarters is located in the United States at 10902 McKinley Drive, Mail Stop MIOMS 242A, Tampa, Florida, 33612, United States. This Privacy Notice does not apply to OncoBay’s processing of Personal Data of clinical trial participants in connection with clinical trials for which OncoBay provides services and acts as a “data processor.” Clinical trial participants should refer to the notice provided at the time of enrollment in the clinical trial for more information regarding the processing of their Personal Data.
Legal Basis of Processing
In this section, we identify the lawful ground we rely on for processing Personal Data.
Consent: If OncoBay relies on consent for the processing of Personal Data, we will provide transparent notice of the purposes for which we seek such consent at the time we collect your Personal Data.
Legal Obligation: OncoBay may process Personal Data as specifically required by applicable legal obligations, such as compliance with legal and regulatory obligations or in response to requests by government or law enforcement authorities.
Contractual Necessity: OncoBay processes Personal Data to fulfill our contracts with you, such as to evaluate and process your applications for employment and to render payment.
Legitimate Interests: OncoBay may process Personal Data subject to its own legitimate interests, such as to operate, to evaluate and improve our business or to facilitate a sale of assets or merger or acquisition.
It may be also necessary for OncoBay to process Personal Data to establish, exercise or defend against fraud, illegal activity, and claims and other liabilities.
Where we require Personal Data to comply with legal or contractual obligations, provision of such information is mandatory: if it is not provided, then we will not be able to manage the employment relationship or meet obligations placed on us. In addition, we may require certain Personal Data for participation within our investigator database, such as information necessary for us to contact you regarding potential clinical trials. In all other cases, provision of requested Personal Data is optional.
We retain Personal Data for as long as is necessary to accomplish the purposes set out in this Privacy Notice, unless a longer period is required under applicable law or is needed to resolve disputes or protect our legal rights, in accordance with the principles set forth in Article 5(1) of the GDPR.
The criteria used to determine the period for which Personal Data about you will be stored varies depending on the legal basis under which we process such Personal Data:
Consent: For the duration of time you have granted and not withdrawn consent, subject to your right, under certain circumstances, to have certain Personal Data about you erased (see Data Subject Rights below).
Legal Obligation: For the duration of time we are legally obligated to keep the information.
Contractual Necessity: For the duration of the contract plus some additional limited period of time that is necessary to comply with law or that represents the limitation period for legal claims that could arise from the contractual relationship.
Legitimate Interests: For a reasonable period of time based on the particular interest, taking into account the fundamental interests and the rights and freedoms of the data subjects.
We may face any threat of legal claim and in that case, we may need to apply a “legal hold” that retains information beyond our typical retention period. In that case, we will retain the information until the hold is removed, which typically means the claim or threat of claim has been resolved.
Transfer of Personal Data Outside of the EEA and UK
OncoBay processes your Personal Data in the United States, which does not provide the same level of data protection as the EEA or the UK. Where your Personal Data is transferred to and/or processed by OncoBay or third parties outside of the EEA or the UK, we will ensure that appropriate safeguards are in place to adequately protect your Personal Data, as required by applicable law, including the execution of standard contractual clauses if the recipients are not located in a country with adequate data protection laws (as determined by the European Commission) or certified under the EU-US Privacy Shield framework. For more information regarding such safeguards, please contact us using the contact details set out under the “Contact Us” heading below.
GDPR Data Subject Rights
Under the GDPR, in certain circumstances, an EEA- or UK-resident Data Subject has certain individual rights with respect to the Personal Data that we hold about them. In particular, you may have the right to:
- Request access to any data held about you;
- Ask to have inaccurate data amended;
- Request data held about you to be erased, provided the data is not required by OncoBay to perform a contract, protect its rights, interests or those of a third party, defend against a legal claim or to comply with applicable laws or regulations;
- Prevent or restrict processing of data which is no longer required;
- Request transfer of appropriate data to a third party where this is technically feasible; and
- Not be subject to be subject to automated decision-making, including profiling.
Additionally, in the circumstances where you may have provided your consent to the collection, processing and transfer of your Personal Data for a specific purpose, you have the right to withdraw your consent for that specific purpose at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
To exercise any of these rights, please contact us using the contact details set out under the “Contact Us” heading below. As a resident of the EEA or UK, you are also entitled to direct any complaints in relation to our processing of your Personal Data to your national or local data protection supervisory authority.
10902 McKinley Drive,
Mail Stop MIOMS 242A
Tampa, Florida 33612