Privacy Notice
This page functions as a Privacy Notice explaining how Bavarian Nordic processes your personal data.
You can read more about how we process your personal data on this page, where you can choose the specific situation and processing activity that you want to know more about. You can also learn about your rights as well as how we process personal data in general.
1. Data controller
The entity responsible for the processing of your personal information is:
|
Bavarian Nordic A/S |
Bavarian Nordic UK Ltd. |
The entity responsible for the processing of your personal information will mostly be Bavarian Nordic A/S, however in some situations it might be another of our group companies, and, in such case, it will be noted as part of the description of the specific processing activities.
If you have any questions, and/or would like to get in touch with us, our contact details are as follows:
Email address: [email protected]
Telephone number: +45 33 26 83 83
You can also always contact our Group Data Protection Officer on e-mail [email protected].
2. Description of the processing
Bavarian Nordic Customer Service
|
Purpose This includes handling all inquiries coming via emails, phone, contact formulars, and social media. Note that inquiries related to pharmacovigilance and drug safety matters are described under “Pharmacovigilance (drug safety)” and inquiries related to clinical trials under “Clinical Trials”. If you are a study patient participating in a clinical trial, please do reach out to your local Site Investigators for any inquiries related to this, as Bavarian Nordic cannot, as the sponsor of the trial, know the identity of the study patients. |
|
Categories of personal data Ordinary personal data, such as:
Sensitive personal data: We do not process sensitive personal data as part of general customer service, and we will delete such if received wrongly. |
|
Source(s) of the personal data
|
|
Legal basis for the processing Ordinary personal data:
|
|
Recipients
|
|
Data retention Our retention periods are determined based on our purpose for processing your personal data and whether we have a legal obligation to store your personal data for either compliance or regulatory purpose and whether storage is relevant to ensure our interests and contractual obligations. |
|
Purpose When you visit our website, we collect personal data about you, including by using cookies. We use the information to optimize the user experience on our website and to make statistics on the use of our website. You can read more about our cookies in our cookie policy, where you can also read more about the third-party cookies that we use, and if we are joint controllers with providers of such, you can find a link to the relevant other privacy notices. Remember that you can always withdraw or change your consent in our cookie solution, and you can also block cookies in your browser. |
|
Categories of personal data Ordinary personal data, such as:
Sensitive personal data: We do not process sensitive personal data when you visit our website. |
|
Source(s) of the personal data
|
|
Legal basis for the processing Ordinary personal data:
|
|
Recipients
|
|
Data retention |
Health Care Professionals (HCPs) and other experts
Note that the legal entity responsible for the processing of your personal information, the data controller, is the legal entity of our group companies (see “data controllers” above) located in the country where you are located as well, e.g. if you are a German HCP, the data controller is Bavarian Nordic GmbH.
|
Purpose This can include correspondence and communication with you as part of our general business operations, payment of fees and disclosure of such where required by law, HCP analysis, sending materials to you and providing you with marketing and promotional messages and materials and information about our business and our products, that may be tailored to your area of expertise and interest . We use the following channels to send you marketing messages: e-mail, text messages via phone or other text message services (such as Whatsapp), social media (Facebook and similar), business media (LinkedIn and similar) and medical networks, tracking of your (online) behavior related to sending your marketing material, including your reading of and interaction with the material that we send you. promotion of BN and as part of disease awareness campaign if you participate in such, hosting and participation in events, compliance with HCP disclosure and reporting obligations, and for internal compliance auditing/monitoring purposes. |
|
Categories of personal data Ordinary personal data, such as: Identity and contact information (name, email, picture, etc.,). Professional information (job title, workplace, area of expertise/speciality, educational information, medical ID number). Financial information (information related to payment of HCP services, including your fee, reimbursements, bank account details, contract terms and participation in HCP services and activities). Information related to marketing and communications (information about your preferences, your consent etc.) if you have given your consent for us to send you direct marketing. Also, if you have given your consent, we will process information collected via pixels and similar technology placed in emails to you about when you open the email as well as your online behaviour related to your actions when receiving the email (e.g. which links did you click on, the websites you visit afterwards etc.) Information related to interviews with you, events, speaker arrangements, etc. if you have agreed to participate in such as part of collaboration with us. Any other information included in our correspondence and contact with you. Sensitive personal data: We do not process sensitive personal data about you as HCP. |
|
Source(s) of the personal data
|
|
Legal basis for the processing
We will of course obtain your consent when sending you direct marketing material as required by national marketing and cookies (and similar technology) law, and you can always withdraw your consent by contacting us, see below under “your rights”. |
|
Recipients Our group companies (see “data controllers”). Service providers and third-party vendors that we work with, including cloud-services and hosting and IT providers. Professional advisers, including lawyers, consultants, and auditors. Social media and other digital channels if we publish posts based on interviews with you or if you have given your consent for us to do so for marketing and targeting purposes. Regulators and other authorities, namely relevant health and tax authorities. To the public in cases/countries where we are required by law to disclose any payments to you as an expert for transparency purpose. |
|
Data retention Information related to a consent you might have given, will be kept as long as the consent is used actively or until the consent has been withdrawn. |
Shareholders of Bavarian Nordic A/S
|
Purpose This includes, among others, communicating with you as a shareholder and sending you information about our company if you have signed up to receive such, conducting meetings, webcasts, conference calls and other relevant investor relation activities, compliance with Danish corporate regulation, such as the requirement to maintain a shareholder registry, conducting general meetings etc. as well as compliance with various tax legislation and other relevant legislation applicable. |
|
Categories of personal data Ordinary personal data, such as:
Sensitive personal data: We do not process sensitive personal data about you as shareholder. |
|
Source(s) of the personal data
|
|
Legal basis for the processing
|
|
Recipients
|
|
Data retention |
|
Purpose This includes, among others, investigation and control of the safety and effectiveness of our medicines, how it is tolerated by data subjects with different demographics and application for approval for public use of medicine, if applicable, based on these results. |
|
Categories of personal data Ordinary personal data, such as:
Sensitive personal data, such as:
We process personal data related to the results of the clinical trial in a pseudonymized form meaning that your name, contact information and national identification number have been removed from the material that we receive. |
|
Source(s) of the personal data
Note that the information we receive are all pseudonymized meaning we do now know the identity of you as a study patient in our clinical trial. |
|
Legal basis for the processing Ordinary personal data:
Sensitive personal data:
|
|
Recipients
|
|
Data retention When participating in a clinical trial, the personal data that we process about you, is pseudonymized. We will store your pseudonymized personal data for 2 years after the last marketing application is approved, is no longer pending, or is discontinued, unless applicable EU law requires a longer retention period, which may be for up to 25 years after the end of the clinical trial. |
Pharmacovigilance & drug safety
|
Purpose This includes, among others, handling any information about how our products effect data subjects, both in the process of a clinical trial and when the products have been approved and marketed and are in use by the public, and to follow up on and report adverse events to relevant parties and authorities. If you have participated in a clinical trial, we also refer to “Clinical Trials”. |
|
Categories of personal data Ordinary personal data, such as:
Sensitive personal data:
|
|
Source(s) of the personal data
|
|
Legal basis for the processing Ordinary personal data:
Sensitive personal data:
|
|
Recipients
|
|
Data retention |
|
Purpose This includes to conduct market research of our products and our company to find out how certain groups find our products, our company and travel vaccines and diseases in general. We mainly use third party agencies to conduct market research on our behalf and for this reason, we typically do not receive any personal data about you that can identify you. |
|
Categories of personal data Ordinary personal data, such as:
Sensitive personal data:
Sensitive personal data is normally not processed during market research activities, however depending on your answers, we may receive information about adverse events experienced in connection with any use of our products, and if the market research topic requires it, we may process any sensitive personal data that are part of your answers to the market research. See also “Pharmacovigilance (drug safety)”. |
|
Source(s) of the personal data
The agency who you provide the personal data to and who is conducting the market research on our behalf. |
|
Legal basis for the processing Ordinary personal data:
Sensitive personal data:
|
|
Recipients
|
|
Data retention Generally, we will not store your personal data for longer than necessary. Our retention periods are determined based on our purpose for processing your personal data and whether we have a legal obligation to store your personal data for either compliance or regulatory purpose and whether storage is relevant to ensure our interests and contractual obligations. |
Business partners, consultants and other third parties
|
Purpose This includes us working with different third parties such as business partners, consultants, vendors, customers, digital influencers, suppliers, service providers etc. and our interactions with such, including communication, visits etc. This also includes promotional and disease awareness campaigns, where we might get third parties, such as patients, patient organizations or other subject matter experts to participate in interviews or similar campaigns to be used both internally (intranet) and externally (social media, website etc.). |
|
Categories of personal data Ordinary personal data, such as:
Sensitive personal data: As a main rule, we do not process sensitive personal data about business partners, consultants and other third parties. However, if you participate in an interview with us to talk about a disease that you have/have had, we will process health information about you, but always based on your explicit consent. |
|
Source(s) of the personal data
|
|
Legal basis for the processing
|
|
Recipients
|
|
Data retention |
Bavarian Nordic’s Ethics Hotline
|
Purpose This includes to receive, follow up on, investigate and report criminal offenses or other matters reported to the Ethics Hotline. We can process your personal data both if you are reporting to the hotline, but also if you are being reported to the hotline. |
|
Categories of personal data Ordinary personal data, such as:
Sensitive personal data: None (unless the report concerns a matter relating to sensitive personal data, for example discrimination or harassment based on race, ethnicity, religion or political opinions, religious or philosophical beliefs, trade union membership, or sexuality, or exposure to sexual harassment). |
|
Source(s) of the personal data
If you have been reported to the hotline, then the source of your personal data depends on who has reported you, but will generally comprise one or more of the following: An employee, a member of the Executive Management or the Board of Directors, or a shareholder, a former employee or a job applicant, a volunteer or a trainee (paid or unpaid) working in or for Bavarian Nordic, a contractor or consultant working in or for Bavarian Nordic, a person working under the supervision and management of a third party with professional or contractual relationship with Bavarian Nordic, such as contractors, subcontractors, and suppliers, or a customer. |
|
Legal basis for the processing Ordinary personal data:
Sensitive personal data: Our processing is necessary for reasons of substantial public interest on the basis of EU and Danish laws (GDPR art. 9.2.g). |
|
Recipients
|
|
Data retention We will delete personal data immediately when it has been concluded that no sanction will be issued, e.g., because, upon investigation, the matter is concluded to be unsubstantiated or because the matter might be substantiated but not of such severity that a sanction is deemed appropriate. |
Third Party Intermediary (TPI’s)
|
Purpose This means that if you are in the management of, or owns, a company that we have defined as a “TPI” doing business on our behalf, we will ask for your personal data in order for us to perform a due diligence of this company and the key personnel of it. |
|
Categories of personal data Ordinary personal data, such as:
Sensitive personal data:
|
|
Source(s) of the personal data
|
|
Legal basis for the processing Ordinary personal data:
Sensitive personal data:
|
|
Recipients
|
|
Data retention Personal data collected in connection with due diligence will be stored for the term of the engagement with you, or the company you are affiliated with, and for a certain period after termination of partnership to ensure compliance with applicable laws and regulation, including the French Sapin II, the U.S. Foreign Corrupt Practices Act, and the UK Bribery Act. |
3. Transfers to countries outside the EU/EEA
In some cases, we will be transferring personal data to countries outside the EU/EEA. This will either be to our group company in the United States, Bavarian Nordic, Inc., or to countries where we are in a process of product approval (as it is required to disclose (pseudonymized) results of clinical trials during the process of product approvals).
Such transfers will take place on the basis of the following legal basis:
- The country/countries and/or certified companies in the country/countries has/have been deemed by the Commission of the European Union to have an adequate level of protection of personal data.
Appropriate safeguards for the transfer:
- through the use of “Model Contracts for the Transfer of Personal Data to Third Countries”, as published by the Commission of the European Union, or any other contractual agreement approved by the competent authorities. You may obtain a copy of the contract/agreement by contacting us.
4. Your rights
You have the following rights:
- You have the right to request access to, rectification or erasure of your personal data, and you also have the right to have the processing of your personal data restricted.
- If processing of your personal information is based on your consent, you have the right to withdraw your consent at any time. Your withdrawal will not affect the lawfulness of the processing carried out before you withdrew your consent. You may withdraw your consent by contacting [email protected].
- You have the right to receive your personal information in a structured, commonly used and machine-readable format (data portability).
- You may always lodge a complaint with a data protection supervisory authority, e.g. The Danish Data Protection Agency.
You can find a list of the relevant data protection supervisory authorities here: European Data Protection Board.
The Swiss Federal Data Protection and Information Commissioner can be contacted here: Contact.
Furthermore, you have THE RIGHT TO OBJECT to processing of your personal data as follows.
- If processing of your personal data is based on article 6(1)(e) or article 6(1)(f), see description of the specific processing activities regarding legal basis, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data.
- Where your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data about you for such marketing.
You can take steps to exercise your rights by contacting us at [email protected].
Note, that there may be conditions or limitations on these rights. It is therefore not certain for example you have the right of data portability in the specific case – this depends on the specific circumstances of the processing activity.
5. Other information
5.1. Mandatory information
There might be cases where we need to process your personal data either to comply with law, or to perform the terms of a contract we have with you, and the consequence of not providing such personal data to us is that we cannot continue our contact with you or provide you a service.
5.2. Use of personal information for new purpose
We will only use your personal information for the purposes for which we have collected such, unless we reasonably consider that we need to use it for another purpose and such new purpose is compatible with the original purpose.
If we need to use your personal information for a new (compatible) purpose, we will inform you of such.
5.3. Automated decision-making
Your personal data will not be used for automated decision-making, including profiling.
5.4. How we keep your personal data secure
We have put in place appropriate security measures to protect your personal data and prevent it from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed.
We have, among others, limited access to your personal information to those employees and other staff who have a business need to have such access, and all such people are subject to a contractual duty of confidentiality.
Further, we have put in place procedures to deal with any actual or suspected personal data breach. We will of course notify you of any breach, where required.
5.5. Third party links
This site may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share your personal information. We do not control these third-party websites and are not responsible for their privacy statements.
When you leave our site, we encourage you to read the privacy statements of every site you visit.
5.6. Children
This site is not intended for children below 16 years old and we do not knowingly process personal data relating to children.
UK-POX-2600002 | June 2026