Privacy Notice – Saniona A/S
Privacy Notice for Saniona A/S
Introduction
Saniona A/S (“we”, “us” or “Saniona”) respects your privacy and is committed to protecting your personal data.
This Privacy Notice explains how we collect and process personal data about individuals who interact with us in a professional or business capacity, including:
- Visitors to our premises
- suppliers, vendors, consultants and independent contractors;
- business and collaboration partners;
- representatives, employees and other personnel of our suppliers and business partners;
- investigators, site personnel, CRO personnel, laboratories, service providers and other individuals working for organisations with which we collaborate in connection with clinical trials or other research activities; and
- other professional contacts, including investors.
Who is the data controller?
The data controller responsible for the processing described in this Privacy Notice is:
Saniona A/S
Murervangen 42
2600 Glostrup
Denmark
CVR no.: 34049610
Email: clo@saniona.com
What personal data do we process?
Depending on your relationship with us, we may process:
- identification and professional contact details, including name, role, employer and business contact information;
- information about our business relationship;
- professional qualifications, CVs, licences, training records, including GCP training, and information about roles and responsibilities in clinical trials or other projects;
- compliance, audit and inspection records;
- system and premises access information, including user IDs and security logs;
- other information provided by you or the organisation you represent and;
- video surveillance footage
Where do we obtain your personal data?
We may obtain personal data directly from you, from your employer or other business and research partners, from our group companies, and from publicly available or professional sources and registers.
Who do we share your personal data with?
Where necessary, we may share personal data with:
- companies within the Saniona group;
- service providers, including IT, hosting, professional and payment providers;
- CROs, clinical trial sites, laboratories, consultants and other research partners;
- auditors, insurers and professional advisers;
- regulatory authorities, ethics committees, courts and other public authorities; and
- potential purchasers, investors or advisers in connection with a corporate transaction.
Service providers acting on our behalf, as data processors, may only process personal data in accordance with our instructions and applicable data protection law.
Why do we process your personal data and what is our legal basis?
We process personal data to:
- manage relationships with suppliers, business partners and consultants, including contracts, communications, payments and collaboration;
- manage and document the involvement, qualifications, training and responsibilities of personnel engaged in clinical trials and other regulated research activities;
- perform supplier due diligence, audits, quality assurance and compliance activities;
- comply with accounting, tax, regulatory and other legal obligations;
- manage access to our systems, premises and maintain IT and information and premises security; and
- establish, exercise or defend legal claims.
Our processing is generally based on our legitimate interests under Article 6(1)(f) GDPR in managing our business, collaborations, security, compliance and legal interests. In relation to video surveillance our processing is based on our legitimate interest in securing the location and the Danish TV-surveillance Act.
Where processing is required by law or regulation, we rely on Article 6(1)(c) GDPR. Where you personally enter into a contract with us, we may rely on Article 6(1)(b) GDPR.
When we rely on legitimate interests, we assess whether our interests are overridden by your rights and freedoms.
International transfers of personal data
Some of our suppliers, service providers or collaboration partners may be located outside the European Economic Area (“EEA”) or may access personal data from outside the EEA.
Where we transfer personal data to a country outside the EEA that has not been recognised by the European Commission as providing an adequate level of data protection, we will implement an appropriate transfer mechanism in accordance with Chapter V of the GDPR.
Such mechanisms may include the European Commission’s Standard Contractual Clauses and, where required, supplementary technical, contractual or organisational measures.
You may contact us if you would like further information about the safeguards applicable to a particular transfer.
How long do we keep your personal data?
We retain personal data only for as long as necessary for the relevant purposes and to meet applicable legal, regulatory and contractual requirements.
Retention periods vary depending on the type of information. Business, contractual, accounting, audit and compliance records are kept for the periods required or reasonably necessary for those purposes.
Personal data forming part of clinical trial documentation may be retained for longer periods where required by law, including, where applicable, for at least 25 years after the end of the relevant clinical trial.
We delete video surveilliance footage after 30 days, unless an incident is reported to the police.
We may retain data for longer where necessary in connection with disputes, investigations or legal claims. Personal data will be deleted or anonymised when no longer required.
Automated decision-making
We do not use the personal data described in this Privacy Notice to make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
Your rights
Subject to applicable data protection law, you may have the right to:
- access your personal data;
- have inaccurate or incomplete data corrected;
- request deletion or restriction of processing;
- object to processing based on our legitimate interests; and
- receive certain personal data in a portable format.
These rights may be subject to legal limitations, including where we are required to retain data by law or for the establishment, exercise or defence of legal claims.
To exercise your rights or ask questions about our processing, please contact:
Email: clo@saniona.com
You also have the right to lodge a complaint with a competent data protection authority. In Denmark, this is Datatilsynet (The Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, tlf. 33 19 32 00, dt@datatilsynet.dk.
Changes to this Privacy Notice
We may update this Privacy Notice from time to time, for example if our processing activities change or applicable legal or regulatory requirements are amended.
Last updated: September 2026