Data protection: your rights

Individual rights

Novartis is committed to respecting your privacy and to adequately protecting your personal information when collecting and sharing data with other people in the performance of its legitimate business activities. 
As well as the Novartis policy on Personal Data Protection, Novartis has adopted the Binding Corporate Rules (BCR), a set of principles governing the international transfer of personal data of partners, customers and business partners of Novartis, in addition to other persons whose data is collected and processed in the EU and Switzerland. The adoption of the Binding Corporate Rules of Novartis on the part of the EU and of the Swiss Data Protection authorities enables Novartis to comply with the data protection laws of the countries of the EU and Switzerland when you submit your personal information from these countries to its global subsidiaries.

What are the applicable principles relating to the protection of personal data?

Novartis companies that send your personal information from the EU or Switzerland to other countries must comply with applicable laws, as well as Novartis policies and the Binding Corporate Rules. Specifically, these companies:

• collect and process your personal information by transparent and lawful means;

• process your personal information solely for specific and lawful purposes and do not use it for any other purpose;

• inform you of the transfer of your personal information and, if necessary, request your consent, as required by local laws;

• preserve your personal information only for the time required, unless the law requires or permits longer or shorter storage periods;

• preserve the confidentiality of your personal information and take appropriate and reasonable security measures to protect it from any unauthorised access, damage, or accidental loss, misuse and any unauthorised alteration or erasure.

What are my rights?

If you are a collaborator, customer or trading partner of Novartis or someone else whose personal information has been collected and processed by Novartis in the EU or in Switzerland, you have the following rights:

• you can ask Novartis to provide information about the collection and use of your personal information that it carries out based on the applicable local laws;

• you can ask Novartis to correct, delete or not to use your personal information if it is incomplete or inaccurate;

• you can oppose the processing of your personal information and require Novartis to not continue processing your data as long as you have legitimate grounds for doing so.

• you can request a review of the decisions made by the automatic processing of your personal information, in the event that those decisions have a significant effect on said information.

How can I exercise my rights?

If your personal information has been sent to a Novartis company in a country that does not belong to the EU and is not Switzerland, and that company does not provide an adequate level of protection and you consider your personal information has been processed in breach of the Binding Corporate Rules, you can proceed as follows:

• file a complaint with the Novartis Business Practices Office (BPO) by sending an e-mail to: business.practicesofficer@novartis.com. Your complaint will be investigated in accordance with our internal procedures.

• file a complaint with the competent data protection authority or file a complaint with the courts of Switzerland or the EU country from which your personal information has been sent.