Privacy policy

ASH Therapeutics GmbH & Co. KG ("ASH") may revise this policy ("Privacy Policy") from time to time by updating this page. You can review the Privacy Policy at any time by visiting the Privacy Policy link at the bottom of one or more pages on the ASH web site ("Web Site") or by contacting privacy@ash-therapeutics.com requesting a current copy. The term "You" as used herein refers to all individuals and/or entities accessing this Web Site, contacting ASH or being contacted by ASH for any reason or else interacting with ASH.

Data collected by ASH

When You access and use the Web Site, request additional information about ASH, make a proposal, otherwise contact ASH or are being contacted by ASH for any reason or else interact with ASH, ASH may collect certain information ("Your Data") in accordance with this Privacy Policy. The collection, storage, use and any other form of processing Your Data by ASH occurs exclusively in the interest of ASH's business operations. ASH will not sell, transmit, disseminate or else disclose Your Data for any other purpose. Insofar as You can – even if only in theory – be identified by Your Data, they constitute "personal data". This applies to Your Name and Your personal email address, but can also be the case for more elements of Your Data, including such relating to Your use of the Web Site.

When You access and use the Web Site, certain information, including Your IP address, is automatically logged. ASH generally saves such invariably and automatically stored log data only for a very limited amount of time and only to prevent abuse of the Web Site; analysis of this very limited and invariably collected information for other purposes – if any – will only use aggregated and anonymized log data.

When You contact ASH, are contacted by ASH, or else interact with ASH, ASH will collect and store Your Data as provided by You or on Your behalf (e.g. Your name, contact details, e-mail address, phone number, etc.) to the extent necessary to contact You, to document the event, and to deal with the request or concern at hand. ASH will generally not collect personal data other than from You or from persons or entities acting on Your behalf.

Legal information regarding personal data and processing

There are special provisions regarding the protection of personal data, in particular the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) and the Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR). ASH will process personal data strictly in accordance with these provisions. According to these provisions, ASH is legally obligated to provide You with the following information:

Controller

Responsible for the collection and processing of personal data and the determination of the purposes and means is ASH Therapeutics GmbH & Co. KG, Leipziger Str. 51, 10117 Berlin, Germany, telephone: +49 30 5858 4350-0, for the use of this Web Site and for general inquiries with ASH. Responsible for the video surveillance of ASH’s premises is think-cell Operations GmbH (address as before). Please contact us at privacy@ash-therapeutics.com with any queries regarding data protection.

Purposes of processing personal data and legal basis / Legitimate interests

ASH processes personal data exclusively for its own business purposes, in particular (but not limited to) contacting You, attributing, answering and archiving Your queries, improving, optimizing and making our offerings and this Web Site more user-friendly, and to prevent and persecute illegal abuse.

The legal basis of processing personal data is, if You have not given consent to the processing, art. 6 para. 1 subpara. 1 lit. f GDPR, or, within the framework of a contract or while negotiating a contract, art. 6 para. 1 subpara. 1 lit. b GDPR. If You have given consent to the processing, the legal basis is art. 6 para. 1 subpara. 1 lit. a GDPR.

ASH's legitimate interests pursued by processing personal data are the unhindered, reasonable and customer-focused administration of ASH's day-to-day business, in particular by allowing and facilitating the communication with current and prospective partners as well as other persons, the documentation of business processes, the compliance with legal obligations, the prevention of detrimental and abusive interferences, and the further development and improvement of our offerings and processes.

Recipients of personal data

Personal data collected by or on behalf of the controller will exclusively be stored and processed by ASH and enterprises that are acting on behalf of ASH and are subject to obligations of diligence and confidentiality. ASH does not intend to transfer personal data to other third parties.

Personal data will be processed in the EU. If personal data is transferred to a party acting on behalf of ASH and located outside the EU without Your express consent, Your rights will be protected by appropriate safeguards — in particular by standard data protection clauses. You can request a copy of such standard data protection clauses at privacy@ash-therapeutics.com.

Storage period

Personal data will generally be stored for as long as they are deemed to serve ASH's legitimate business interests as outlined above or ASH is under an obligation to retain the information. The rights of the data subject as outlined below remain unaffected.

Your rights

• You are entitled to obtain from ASH free-of-charge confirmation as to whether or not personal data concerning You are being processed. Where this is the case, You are further entitled to obtain access to the personal data and additional information in accordance with art. 15 GDPR.
• In case personal data concerning You is inaccurate or incomplete, You have the right to obtain rectification or completion. In the instances covered by art. 17 and art. 18 GDPR, You are entitled to request the erasure or the blocking / restriction of processing of data.
• You have, in accordance with art. 21 GDPR, the right to object, on grounds relating to Your particular situation, at any time to processing of personal data concerning You, even where ASH pursues legitimate interests. You can object, without cause, at any time to processing of personal data concerning You for direct marketing purposes.
• Furthermore, You are entitled to request in accordance with art. 20 GDPR the transmission of personal data concerning You and provided by You to You or directly to another data controller.
• Where processing Your Data is based on Your consent, You have the right to withdraw Your consent at any time, without affecting the lawfulness of processing based on Your consent before its withdrawal.
• If You consider that the processing of personal data relating to You infringes applicable law, You have the right to lodge a complaint with a supervisory authority. Such complaint will not prejudice any other administrative or judicial remedy. The competent supervisory authority for ASH is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany, https://www.datenschutz-berlin.de.

No obligation to provide personal data

You are generally required neither by law nor contract to provide ASH with personal data. If You opt to request further information regarding ASH or our offerings or contact ASH, it is generally mandatory to provide ASH with certain information regarding Your company and Your contact details. Otherwise, we might be unable to communicate with You or enter into business with Your company. You may, however, choose to provide us with so-called "role contact details" (e.g., a departmental email address, a switchboard phone number, etc.) that do not allow ASH to identify You as an individual.