GDPR Privacy & Cookie Policy

Contents

  1. Introduction
  2. Definitions
  3. Data Protection Legislation
  4. The information we collect
  5. Cookies, Analytics and Tracking Technologies
  6. How we use your information
  7. Who we might share your information with
  8. How long we keep your information for
  9. How we keep you updated on our products and services
  10. Giving your reviews and sharing your thoughts
  11. Your rights over your information
  12. Security
  13. International Transfers
  14. What happens if our business changes hands?
  15. Contact Us
  16. Changes to Our Privacy Notice

 

1. Introduction

ARMGO Pharma, Inc. (referred to as “ARMGO”, “We, “Our” or “Us”), are committed to protecting the privacy and security of your Personal Data. This ARMGO Privacy Notice applies to you if you are:

  • A user of https://www.armgo.com/
  • An employee, contractor or other associated party of an entity with which ARMGO may conduct business operations; or,
  • An individual with whom ARMGO may conduct business operations.

We have developed this Privacy Notice to inform you of the information we collect, what we do with your Personal Data, what we do to keep it secure as well as the rights and choices you have over your Personal Data. It is important that you read this Privacy Notice so that you are aware of how and why we are using such Personal Data. If you reside in the United States, please see our US Privacy & Cookie Policy notice here.

2. Definitions

For the purposes of this ARMGO Privacy Notice:

Affiliate means an entity that controls, is controlled by, or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.

Company (referred to as either “ARMGO”, “the Company”, “We”, “Us” or “Our” in this Agreement) refers to ARMGO Pharma Inc, 923 Saw Mill River Road, PMB#260 Ardsley, NY 10502, United States. Cookies are small files that are placed on Your computer, mobile device, or any other device by a website, containing the details of Your browsing history on that website among its many uses.

Data Controller, for the purposes of both UK and EU GDPR, refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data. For the purpose of both UK and EU GDPR, the Company is the Data Controller.

Data Processor, for the purposes of both UK and EU GDPR, refers to the Company’s Service Providers.

Data Protection Legislation, as defined in the Data Protection Legislation section below.

Device means any device that can access the Service such as a computer, a mobile phone, or a digital tablet.

Personal Data is any information that relates to an identified or identifiable individual.
For the purposes of both UK and EU GDPR, Personal Data means any information relating to you such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity.

Service refers to the Website, unless otherwise stated.

Service Provider means any natural or legal person who processes Personal Data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the

Service or to assist the Company in analyzing how the Service is used. For the purpose of both UK and EU GDPR, Service Providers are considered Data Processors.

Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).

Website refers to the ARMGO website, accessible at https://www.armgo.com/

You means the individual accessing or using the Service, whether on their own behalf or on behalf of an entity, as applicable. Under both UK and EU GDPR (General Data Protection Regulation), You can be referred to as the Data Subject or as the User if you are the individual using the Service.

3. Data Protection Legislation

Throughout this document we refer to Data Protection Legislation.

In the United Kingdom (UK), Data Protection Legislation means the Data Protection Act 2018 (‘DPA 2018’), United Kingdom General Data Protection Regulation (‘UK GDPR’), the Privacy and Electronic Communications (EC Directive) Regulations 2003 (‘PECR’) and any legislation implemented in connection with the aforementioned legislation.

Where data is processed by a controller or processor established in the European Union (EU) or comprises the data of people in the European Union, Data Protection Legislation includes the General Data Protection Regulation (Regulation (EU) 2016/679) (‘EU GDPR’) as well as any local data protection implementation laws. This includes any replacement legislation coming into effect from time to time.

ARMGO Pharma, Inc. is the Data Controller (‘controller’) for Your Personal Data, unless otherwise stated. In certain situations, ARMGO may act as the Data Processor (‘processor’) where we are processing your information upon the instructions of our Affiliates – in these instances our Affiliates act as the Data Controller.

We have appointed a Data Protection Officer (DPO) to help us monitor internal compliance, inform, and advise on data protection obligations, and act as a point of contact for data subjects and supervisory authorities. For further details on how you can contact our DPO, please see the Contact Us section below.

4. The information we collect

The type of Personal Data that we will collect on you will depend on whether you are a user of this Website, a Service Provider or a Business Partner, by which we mean an employee, contractor or other associated party of an entity with which ARMGO may conduct business operations, or an individual with whom ARMGO may conduct business operations (which may include healthcare professionals).

Business Partners and Service Providers

  • Your name
  • Your contact information (telephone number, email address, or mailing address)
  • Your employment details
  • Where relevant, your pseudonymised unique identification number(s) (e.g., payroll no.)
  • Where relevant, your financial information (e.g., bank information)

Website User

  • Your name
  • Your contact information (email address)
  • Your Contact Us form responses
  • Your Usage Data (e.g., your IP address)

You are under no statutory or contractual requirement or obligation to provide us with your name, contact information of Contact Us form responses; however, we require that information in order for us to deal with you as a Business Partner, Service user, Service Provider (or employee, consultant or associated party) in an efficient and effective manner.

5. Cookie, Analytics and Tracking Technologies

We use Cookies and similar tracking technologies to track the activity on Our Service and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyse Our Service.

You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Service.

Cookies can be “Persistent” or “Session” Cookies. Persistent Cookies remain on your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close your web browser. We use both session and persistent Cookies for the purposes set out below:

Necessary / Essential Cookies
Type: Session Cookies
Administered by: Us
Purpose: These Cookies are essential to provide You with services available through the Website and to enable You to use some of its features. They help to authenticate users and prevent fraudulent use of user accounts. Without these Cookies, the services that You have asked for cannot be provided, and We only use these Cookies to provide You with those services.

Cookies Policy / Notice Acceptance Cookies
Type: Persistent Cookies
Administered by: Us
Purpose: These Cookies identify if users have accepted the use of cookies on the Website.

Functionality Cookies
Type: Persistent Cookies
Administered by: Us
Purpose: These Cookies allow us to remember choices You make when You use the Website, such as remembering your login details or language preference. The purpose of these Cookies is to provide You with a more personal experience and to avoid You having to re-enter your preferences every time You use the Website.

Tracking and Performance Cookies
Type: Persistent Cookies
Administered by: Third Parties
Purpose: These Cookies are used to track information about traffic to the Website and how users use the Website. The information gathered via these Cookies may directly or indirectly identify you as an individual visitor. This is because the information collected is typically linked to a pseudonymous identifier associated with the device you use to access the Website. We may also use these Cookies to test new pages, features, or functionality of the Website to see how our users react to them.

Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Service. This data is shared with other Google services. Google may use the collected data to contextualise and personalise the ads of its own advertising network.

You can opt-out of having made your activity on the Service available to Google Analytics by installing the Google Analytics opt-out browser add-on. The add-on prevents the Google Analytics JavaScript (ga.js, analytics.js and dc.js) from sharing information with Google Analytics about visits activity.

For more information on the privacy practices of Google, please visit the Google Privacy Terms web page: https://policies.google.com/privacy?hl=en

6. How we use your information

Under Data Protection Legislation, the lawful bases we rely on for processing your information are:

  • GDPR Article 6(1)(a) – your consent;*
  • GDPR Article 6(1)(b) – We have a contractual obligation;
  • GDPR Article 6(1)(c) – We have an EU or UK legal obligation;
  • GDPR, Article 6(1)(d) – In order to protect the vital interests of You or a third party;
  • GDPR, Article 6(1)(e) – We have a public interest; or,
  • GDPR, Article 6(1)(f) – We have a legitimate interest.

* Where the lawful basis for processing is Consent, you are able to remove your consent at any time. You can do this by contacting our DPO using the contact details provided in the Contact Us section below.

We may use your information for the following purposes:

Processing Activity Lawful Basis
Where you are a Business Partner, to collect information from you in order to make available our agreed-upon services to you –
Where you are a Business Partner, to collect information from you and take payment from you, make a payment to you, give you a refund or request a refund –
Where you are an employee of ARMGO’s Business Partner or Service Provider, to collect information from you or your employer and liaise with your employer about your contact details and/or the business relationship with Us, as required –
To collect information from you and monitor, provide and maintain our Service Contractual Obligation
To contact you following your enquiry where you have provided your contact information and to reply to any questions, suggestions, issues, or complaints, including any Data Subject Requests, about which you have contacted us Contractual Obligation
To collect your Usage Data in order to power our security measures and services so you can safely access our Website and other services Legitimate Interest in efficiently managing our relationships with Business Partners and Service Providers
To contact you at your request, where you have provided your contact information, about news and information relating to our services through service messages Legitimate Interest in operating our Website in an efficient and secure manner in order to promote our business and our activities
B2B direct marketing to you, where you have provided your contact information, about Our products and services where Your consent is not required under applicable law (for example, where under UK PECR you are classified as a corporate subscriber and/or the ‘soft opt-in’ applies) Legitimate Interest in efficiently managing interactions with users, Service Providers (and their employees, contractors or associated parties) and Business Partners in order to grow our business
B2B direct marketing to you, where you have provided your contact information, about Our products and services where Your consent is required under applicable law (for example, where under UK PECR you are a sole trader, partnership or otherwise classified as an individual subscriber and/or the ‘soft opt-in’ does not apply) Legitimate Interest in securely operating our Website and our business in order to protect our reputation and investment
To retain any accounting information generated during the course of our interaction for statutory accountancy retention periods; to comply with any subpoena or similar demand Contractual Obligation
To respond to and defend against legal claims, establish, exercise or defend our rights (including to detect and prevent fraud), and cooperate with government or law enforcement authorities Legitimate Interest in promoting our products and services in order to develop our reputation (and eventually increase our sales)

 

7. Who we might share your information with

We may share your Personal Data with other organisations in the following circumstances:If the law or a public authority says we must share the Personal Data;

  • If we need to share Personal Data in order to establish, exercise or defend our legal rights – this includes providing Personal Data to others for the purposes of detecting and preventing fraud; or
  • From time to time, employ the services of other parties for dealing with certain processes necessary for the operation of our services.

We use Service Providers (“Data Processors”) who are third parties who provide services for us. Examples of these Data Processors include, but are not limited to:

  • Our IT Service Providers, such as Microsoft, Inc.

We have Data Processor Agreements in place with our Data Processors, by which they agree to hold your Personal Data securely and retain it for the period we instruct.

8. How long we keep your information for

We retain your Personal Data in accordance with the Data Protection Legislation. Unless otherwise required by law, your data will be retained for the period specified in the summarised table below and then securely deleted in accordance with our internal policies and procedures.

Purpose Retention Period
Processing data in relation to You as a Service Provider (or employee, contractor or other associated party) or a Business Partner 6 years following the termination of the relevant contract or, if no relevant contract 3 years following last contact at your initiative
Processing data in relation to You as a user of the Website 1 year

 

9. How we keep you updated on our products and services

We make every effort to ensure that we only send such communications to those acting in a business capacity and do not send such materials to consumers via personal email addresses if it is clear they are not acting in such a capacity or have not otherwise provided their consent. We may send you relevant news about our services in a number of ways, including by email.

10. Giving your reviews and sharing your thoughts

When using our Website and other services, you may be able to share information through social networks like Facebook and Twitter. For example, when you ‘like’, ‘share’ or review our Services. When doing this, your Personal Data may be visible to the providers of those social networks and/or their other users. Please remember it is your responsibility to set appropriate privacy settings on your social network accounts so you are comfortable with how your information is used and shared on them.

11. Your rights over your information

You have rights in respect of Your Personal Data. These rights are not absolute and may only apply in certain circumstances.11.1.1 The right to be informed about our collection and use of personal data;You have the right to be informed about the collection and use of your Personal Data. We ensure we do this with our internal and external Privacy Notices (including this document). These are regularly reviewed and updated to ensure these are accurate and reflect our data processing activities.

11.1.2 Right to Access Your Personal Data

You have the right to obtain additional information about and access the Personal Data that we hold about you in many circumstances, by making a request. This is sometimes termed ‘Data Subject Access Request’. If we agree that we are obliged to provide Personal Data to you (or someone else on your behalf), we will provide it to you or them free of charge and aim to do so within the legally required period.We may ask for proof of identity and sufficient information about your interactions with us that we can locate your Personal Data.If you would like to exercise this right, please Contact Us as set out below.

11.1.3 Right to Rectify Your Personal Data

If any of the Personal Data we hold about you is inaccurate, incomplete, or out of date, you may ask us to correct it.If you would like to exercise this right, please Contact Us as set out below.

11.1.4 Right to Erase

You have the right to have personal data erased. This is also known as the ‘right to be forgotten’. For instance, the right to erasure does not apply where we have a legal obligation to retain your Personal Data.If you would like to exercise this right, please Contact Us as set out below.

11.1.5 Right to Restrict Processing

You have the right to ask us to restrict the processing of your personal data. For example, this may be because you have issues with the accuracy of the data we hold or the way we have processed your data.If you would like to exercise this right, please Contact Us as set out below.

11.1.6 Right to Probability

The right to portability gives you the right to receive personal data you have provided to a controller in a structured, commonly used, and machine-readable format. It also gives you the right to request that a controller transmits this data directly to another controller.If you would like to exercise this right, please Contact Us as set out below.

11.1.7 Right to Object

You have the right to object to our processing of some or all of the personal data that we hold about you. This is an absolute right when we use your data for direct marketing purposes. You also have the right to object on grounds particular to your situation when our use of Your Personal Data is based on legitimate interests.If you would like to exercise this right, please Contact Us as set out below.

11.1.8 Rights Related to Automated Decision-Making

You have the right to object to our processing where a decision is made about you solely based upon automated processed and which has significant or legal effects. ARMGO does not intend to conduct any automated decision-making for your Personal Data.If you would like to contact us regarding this right, please Contact Us as set out below.

11.1.9 Rights to file a complaint

You can make a complaint to the relevant data protection supervisory authority, at any time about the way we use your information. However, we hope that you would consider raising any issue or complaint you have with us first. Your satisfaction is extremely important to us, and we will always do our very best to solve any problems you may have.

11.1.10 For more information about your privacy rights

In the UK, the Information Commissioner’s Office (ICO) is the data protection supervisory authority that oversees data protection and privacy matters. They make a lot of information accessible on their website, which you can access here: https://ico.org.uk/for-the-publicDepending on your jurisdiction, it is possible that a different regulator or supervisory authority may govern the processing of Personal Data. Your government’s website should be able to point you in the right direction of the relevant regulatory body. If you have any questions about which supervisory authority applies in your jurisdiction, please Contact Us as set out below.

12. Security

Data security is of great importance to ARMGO. We have put in place technical and organisational measures that are designed to help prevent your Personal Data from being accidently lost, used, or accessed in an unauthorised way, altered, or disclosed.We take security measures to protect your information including:

  • Managing a data security breach reporting and notification system which allows us to monitor and communicate information on data breaches with you or with the applicable regulator when required to do so by law;
  • Implementing access controls to our information technology; and,
  • Deploying appropriate procedures and technical security measures (including encryption, and archiving techniques) to safeguard your information across all our computer systems, networks, websites, mobile apps, and offices.

13. International Transfers

Your Personal Data is processed in any place where the parties involved in the processing are located. This means that this information may be transferred to Devices located outside of Your state, province, country, or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction. In particular, when ARMGO shares data with certain Trusted Data Processors, your Personal Data will be stored and processed within the US and possibly other third countries. Where this occurs, ARMGO will ensure that:

  • any Data Controller receiving your Personal Data has entered into an agreement with ARMGO which contains standard data protection clauses as required by UK and/or EU GDPR or there is an alternative appropriate safeguard in place governing the transfer; and,
  • any Data Processor receiving your Personal Data has entered into an agreement with ARMGO which contains the required Data Processor clauses as well as standard data protection clauses as required by UK and/or EU GDPR or there is an alternative appropriate safeguard in place governing the transfer.

Where you are based in the UK or EU and we transfer your Personal Data out of the UK or EU to countries – such as the US – that are not deemed by the ICO or European Commission (as relevant) to provide an adequate level of Personal Data protection, the transfer will be based on safeguards that allow us to conduct the transfer in accordance with the Data Protection Legislation, such as the specific contracts containing standard data protection clauses approved by the ICO or European Commission (as relevant) providing adequate protection of Personal Data.The relevant transfer terms can be obtained from our Data Protection Officer at dpo@ARMGO.com.

14. What happens if our business changes hands?

We may, from time to time, expand or reduce our business and this may involve the sale and/or the transfer of control of all or part of our business. Any personal data that you have provided will, where it is relevant to any part of our business that is being transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this Privacy Notice, be permitted to use that data only for the purposes for which it was originally collected by us.

15. Contact Us

If you would like to exercise one of your rights as set out above, or you have a question or a complaint about this Privacy Notice or the way your Personal Data is processed, please contact our Data Protection Officer (DPO) by one of the following means:

By email: dpo@ARMGO.com

By telephone: +4402037971289

By post: The DPO Centre Ltd., 50 Liverpool Street, London, UK, EC2M 7PY

16. Changes to Our Privacy Notice

Thank you for taking the time to read our Privacy Notice.We may change this Privacy Notice from time to time (for example, if the law changes). We recommend that you check this Privacy Notice regularly to keep up-to-date. This Notice was last updated on October 21 2022.