Adcock Ingram Healthcare (Pty) Ltd Privacy Policy
1. INTRODUCTION
1.1 Adcock Ingram (“ADCOCK INGRAM) is a leading South African pharmaceutical manufacturer, and is listed on the Johannesburg Stock Exchange. Its mission is “to provide quality products that improve the health and lives of people in the markets it serves”. ADCOCK INGRAM manufactures, markets, and distributes a wide range of healthcare products and is a leading supplier to both the private and public sectors of the market. In this notice, reference to ADCOCK INGRAM refers to the holding company and its South African subsidiaries.
1.2 ADCOCK INGRAM operates through a decentralised, autonomous operating model that consists of four commercial business units in South Africa i.e. Prescription, Consumer, Over-the-counter (OTC) and Hospital. Each business unit is structured to serve specific customer needs and to meet specific regulatory requirements. These commercial divisions are supported by the following shared services: Distribution, Drug Management and Development, IT and services rendered by the head office.
1.3 As part of managing the business and creating value for its various stakeholders, ADCOCK INGRAM is required, in certain instances, to process personal information. Accordingly, ADCOCK INGRAM is required to protect the personal information as set out in the Protection of Personal Information Act 4 of 2013, including its Regulations (POPI Act).
1.4 This notice constitutes ADCOCK INGRAM’s policy statement to declare its commitment to comply with the POPI Act. Accordingly, it provides insights on how ADCOCK INGRAM processes personal information of data subjects as set out in the POPI Act.
1.5 ADCOCK INGRAM shall ensure that personal information is processed within the parameters of the law
1.6 This notice must be read in conjunction with the POPI Act and its Regulations, where applicable.
2. OBJECTIVE
2.1 The objective of this notice is to give effect to the POPI Act and to provide clarity on the following:
2.1.1 What personal information ADCOCK INGRAM collects about a data subject and the basis thereof;
2.1.2 How ADCOCK INGRAM uses and protects the personal information of a data subject;
2.1.3 How long ADCOCK INGRAM keeps the personal information of a data subject;
2.1.4 The rights of a data subject regarding their personal information; and
2.1.5 What the data subject should do if he/she does not want to provide ADCOCK INGRAM with his personal information.
3. INTERPRETATION AND DEFINITIONS
In this notice:
3.1 Clause headings are for convenience and reference only and shall not be used in the interpretation thereof;
3.2 Any gender includes the other genders and a natural person includes a juristic person and vice versa;
3.3 All the annexures (if any) hereto are incorporated herein and shall have the same force and effect as if they were set out in the body of this notice;
3.4 The following words and/or expressions shall, unless the context indicates otherwise, bear the meaning assigned to them below and in the POPI Act;
3.4.1 “Cookie/s” (also called web cookie, Internet cookie, browser cookie, or simply cookie) is a small piece of data sent from a website and stored on the user’s computer by the user’s web browser while the user is browsing to inter alia remember stateful information (such as items added in the shopping cart in an online store) or to record the user’s browsing activity.
3.4.2 “Data subject” means the person to whom Personal information relates;
3.4.3 “Employee” means a permanent, fixed-term or temporary employee of ADCOCK INGRAM;
3.4.4 “Operator” means a third party that processes Personal information in terms of a mandate or contract with ADCOCK INGRAM, without coming under the direct authority of ADCOCK INGRAM;
3.4.5 “Information officer” means the person appointed by ADCOCK INGRAM, from time to time, who is responsible for the monitoring of compliance, by ADCOCK INGRAM, with the conditions for the lawful processing of Personal information; dealing with requests made to ADCOCK INGRAM in terms of the POPI Act; working with the Regulator in relation to investigations conducted in relation to prior authorisation by the Data subject and ensuring compliance by ADCOCK INGRAM with the provisions of the POPI Act;
3.4.6 “Person” means any person, company, close corporation, trust, partnership or other entity;
3.4.7 “Personal information” means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to—
3.4.7.1 information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;
3.4.7.2 information relating to the educational, medical, financial, criminal or employment history of the person;
3.4.7.3 any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;
3.4.7.4 the biometric information of the person;
3.4.7.5 the personal opinions, views or preferences of the person;
3.4.7.6 correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
3.4.7.7 the views or opinions of another individual about the person; and
3.4.7.8 the name of the person if it appears with other Personal information relating to the person or if the disclosure of the name itself would reveal information about the person;
3.4.8 “Privacy Notice or Notice” means this Notice as amended from time to time;
3.4.9 “Processing” means any operation or activity or any set of operations, whether or not by automatic means, concerning Personal information, including—
3.4.9.1 the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;
3.4.9.2 dissemination by means of transmission, distribution or making available in any other form; or
3.4.9.3 merging, linking, as well as restriction, degradation, erasure or destruction of information.
4. PROCESSING OF PERSONAL INFORMATION
4.1 Personal information ADCOCK INGRAM collects about a data subject and the basis thereof
The Personal information ADCOCK INGRAM collects in the ordinary course of business includes:
a. only information that is adequate, necessary, and relevant to enable it to effectively render a service or assist in any manner required, such as the Data subject’s name, identity number (where applicable), registration number, Data subject’s employees or its director’s Personal information, contact information etc;
b. electronic communications sent to ADCOCK INGRAM;
c. information submitted to ADCOCK INGRAM in response to a vacancy advertisement;
d. technical information, for instance through the use of cookies, such as – activity data, such as when the Data subject completes a form on the ADCOCK INGRAM website, subscribes to a newsletter, alerts or other services from ADCOCK INGRAM or taking part in a competition, prize draw or survey;
e. information from the Data subject’s visits to the ADCOCK INGRAM website, including the type of browser and operating system that the Data subject uses, access times, pages viewed, URLs clicked on, his IP address and the pages visited before and after navigating the ADCOCK INGRAM website;
f. social media tracking pixels that allow platforms such as Facebook and Twitter to interact with the ADCOCK INGRAM website and give feedback on the Data subject’s actions;
g. device information, including the unique device identifier, hardware model, operating system and version and mobile network information;
h. Personal information that ADCOCK INGRAM collects when it monitors other websites may include the Data subject’s public Personal information, for example when ADCOCK INGRAM monitors digital conversations on public platforms to understand what people are saying about it or the pharmaceutical industry in general. ADCOCK INGRAM may combine information that it has about a Data subject from various sources; and
i. Personal information that ADCOCK INGRAM collects when a Data subject reports a possible side effect or adverse event associated with one of its products may include information such as gender, date of birth and information about the Data subject’s health.
j. The ADCOCK INGRAM website uses various technologies including “cookies” which allow the website to recognise and respond to the Data subject as an individual. The Data subject can elect to accept or decline cookies. If a Data subject elects to decline cookies, not all elements of the website may function as intended, so his website experience may be affected.
4.2 Protecting the Data subject’s Personal information
a. ADCOCK INGRAM uses a variety of security measures and technologies to help protect Personal information of a Data subject from unauthorised access, use, disclosure, alteration or destruction in line with applicable Personal information protection and privacy laws. For example, when ADCOCK INGRAM shares the Personal information of a Data subject with external suppliers, it shall put in place a written agreement which commits the suppliers to keep the Data subject’s Personal information confidential, and to put in place appropriate security measures to keep it secure.
b. The transmission to ADCOCK INGRAM of information via the internet or a mobile phone network connection may not be completely secure and any transmission is at the Data subject’s risk.
c. Despite the security measures that ADCOCK INGRAM has in place to protect Personal information of a Data subject (firewalls, password access and encryption methods), the Data subject acknowledges that it may be accessed by an unauthorised third party, e.g. as a result of an illegal activity.
d. From time to time ADCOCK INGRAM may provide links to websites or mobile applications that it does not own or control. This Notice does not apply to those websites. If a Data subject chooses to use those websites, he must check the legal and privacy policies or statements posted on each website or mobile application he accesses to understand their privacy practices.
4.3 How does ADCOCK INGRAM use the Personal information of a Data subject
ADCOCK INGRAM may use the Personal information of a Data subject to provide the Data subject with information and services including:
a. online events, such as webcast events;
b. press releases;
c. job postings;
d. financial results;
e. marketing communications about ADCOCK INGRAM products and services. ADCOCK INGRAM will obtain consent for marketing to the extent required by law.
f. Contact and interact with the Data subject, including to:
i. respond to requests from the Data subject (for instance in case the Data subject applied for employment); and
ii. provide important notices and updates, such as changes to terms, standard operating procedures (SOPs), policies, security alerts and administrative messages.
g. Operate ADCOCK INGRAM’s business, including:
i. Screening visitors through CCV footage, conducting searches for dangerous weapons and completing the attendance register for security purposes to ensure that only authorised persons enter the premises of ADCOCK INGRAM.
ii. complying with applicable laws, regulations and guidance; and
iii. complying with demands or requests made by regulators, governments, courts and law enforcement authorities.
h. Improve ADCOCK INGRAM’s day-to-day operations, including:
i. for internal purposes such as auditing, data analysis and research to help ADCOCK INGRAM deliver and improve its digital platforms, content and services;
ii. to monitor and analyse trends, usage and activities in connection with ADCOCK INGRAM products and services to understand which parts of ADCOCK INGRAM digital platforms and services are of the most interest and to improve the design and content of those platforms;
iii. to improve ADCOCK INGRAM products and services and communications to the Data subject; and
iv. to ensure that ADCOCK INGRAM has up-to-date contact information for the Data subject, where applicable.
4.4 How long will ADCOCK INGRAM keep Personal information of a Data subject ADCOCK INGRAM will always keep the Personal information of a Data subject for the period required by law and where it needs to do so in connection with legal action or an investigation in which it is involved. Otherwise, ADCOCK INGRAM will keep Personal information of a Data subject:
a. for as long as needed to provide the Data subject with access to services he has requested;
b. where the Data subject has contacted ADCOCK INGRAM with a question or request, for as long as necessary to allow ADCOCK INGRAM to respond to the question or request and as required by law.
4.5 Instances where sharing of Personal information of a Data subject by ADCOCK INGRAM is permitted
a. ADCOCK INGRAM may share Personal information of a Data subject with the following third parties:
i. ADCOCK INGRAM agents and suppliers, including those who provide it with technology services such as data analytics, hosting and technical support;
ii. ADCOCK INGRAM’s professional advisors, auditors and business partners;
iii. regulators, governments and law enforcement authorities; and
iv. other third parties in connection with re-organising all or any part of ADCOCK INGRAM’s business.
b. Personal information of a Data subject may be processed by ADCOCK INGRAM and ADCOCK INGRAM’s third party suppliers outside of the Data subject’s home country. Personal information laws in the countries to which the Personal information of a Data subject is transferred may not be equivalent to, or as protective as, the laws in the Data subject’s home country.
c. ADCOCK INGRAM will implement appropriate and reasonable measures to ensure that the Personal information of a Data subject remains protected and secure when it is transferred outside of the Data subject’s home country, in accordance with applicable Personal information protection and privacy laws. These measures include data transfer agreements implementing standard data protection clauses.
4.6 The Data subject’s rights regarding his Personal information
The Data subject is entitled to:
a. request ADCOCK INGRAM for access to Personal information ADCOCK INGRAM holds about him;
b. request the correction and/or deletion of his Personal information;
c. request the restriction of the processing of his Personal information, or object to that processing;
d. withdraw his consent to the processing of his Personal information (where ADCOCK INGRAM is processing his Personal information based on his consent);
e. withdraw his consent to receive marketing messages;
f. request for the receipt or the transfer to another organisation, in a machine-readable form, of the Personal information that he has provided to ADCOCK INGRAM; and
g. complain to his local data protection authority if his privacy rights are violated, or if he has suffered as a result of unlawful processing of his Personal information.
4.7 What the Data subject should do if he/she does not want to provide ADCOCK INGRAM with his Personal information
4.7.1 Where a Data subject is given the option to share his Personal information with ADCOCK INGRAM, he can always elect not to do so.
4.7.2 If a Data subject objects to the processing of his Personal information, or if he has provided his consent to processing and he later choose to withdraw it, ADCOCK INGRAM will comply with the request in accordance with its legal obligations. ADCOCK INGRAM’s legal obligations in respect of the withdrawn information shall therefore cease to exist.
5. IMPORTANT NOTICE TO DATA SUBJECTS
5.1 By visiting ADCOCK INGRAM’S website and communicating electronically with ADCOCK INGRAM, the Data subject consents to the processing, including transfer of his Personal information as set out in this Notice.
5.2 ADCOCK INGRAM is continually improving its methods of communication and adding new functionality and features to its website. Due to these ongoing changes, changes in the law and the changing nature of technology, ADCOCK INGRAM’s data protection practices will change from time to time. If and when its protection practices change, ADCOCK INGRAM will update this Notice to describe its new practices. The Data subject is encouraged to check it regularly.
6. CONTACT US
6.1 For any questions or requests regarding this Notice or if a Data subject would like to exercise his rights including contacting the Information officer, please use the following contact information of the Information officer: 011 635 0109 or email legal.info@adcock.com
7. PAIA Manual