Who we are
Torbay Pharmaceuticals Limited manufactures high-quality injectable medicines and oral liquids for both the UK and international markets. As a data controller, Torbay Pharmaceuticals Ltd is registered with the Information Commissioner (ZB621437) in accordance with the UK General Data Protection Regulations. Our registered company number is 14955659.
Making contact
If you would like to discuss anything in this privacy notice, or exercise any of your Data Protection Rights, please contact:
Data Protection Officer
Torbay Pharmaceuticals Ltd, Wilkins Drive, PAIGNTON, Devon, TQ4 7FG
dataprotection@torbaypharma.com
The categories of personal information that we process include:
• Personal and contact information (such as name, date of birth, address and contact information & job role)
• Bank and financial and payment information (for example bank details used for paying invoices to contractors
• Routine communications records (typically email or LinkedIn messages)
• Technical information (such as IP address or in cookies when visiting the website)
• Adverse event information (when reporting an adverse event, or being the subject of an adverse event)
We process this information in order to:
• Manage existing commercial relationships and contract with Torbay Pharmaceuticals Ltd
• Develop new commercial relationships with Torbay Pharmaceuticals Ltd
• Monitor website usage and help improve the user experience.
• Investigate, assess and report adverse medication events in line with our legal and regulatory responsibilities
The Lawful basis for processing the personal data.
• Data processed as part of business development and customer management is processed on the basis of Legitimate Interest
• Technical data collected as part of providing and monitoring our website is collected as a Legitimate Interest
• Personal data that is processed from time to time when handling adverse events is processed on the basis of compliance with a legal obligation. Rarely, but possibly, this may include data relating to health of an individual, which would be processed as being ‘Necessary for reasons of substantial public interest’. Under the Data Protection Act the public interest is defined as ‘Regulatory requirements’
Where is the data obtained from:
Most information we process will have been provided by you directly as part of routine business activities through your communication with us, or use of the website.
In some circumstances information is provided to us via a third party. Most commonly this is from:
• Contact information from publicly accessible websites used for business development
• Information provided via commercial networking sites (primarily LinkedIn)
Sharing with other people
There are times when information is made available to other people who process that data on our behalf.
These are:
• Typical financial processing services such as Bottomline for BACS payments and associated banking services.
• Social media services that provide website analytics and marketing services such as Facebook, LinkedIn and Google
• Standard IT service providers such as the providers of our IT support systems, and staff communications service providers (primarily Microsoft)
• External professional clinical assessors when investigating and reporting adverse events
• On rare occasions, other organisations like the police or social services need it to detect or investigate crime or when a formal court order has been made.
International transfers
All standard data is processed within the United Kingdom or the EEA. As part of disaster recovery plans for some IT services it is possible that data may be transferred to a different geographic region temporarily as part of the recovery procedures.
Clinical reviewers, and regulators may be based internationally. In this situation any personal data that is transferred is done so under the Article 49.1(d) derogation – the transfer is necessary for important reasons of public interest.
Storage, retention and erasure
Personal data is processed and stored in standard IT communications platforms and ERP systems designed to operate in pharmaceutical manufacturing environments.
Records are retained in line with normal legal obligations, requirements of insurance providers and legitimate interests of Torbay Pharmaceuticals Ltd.
At the end of the retention period, data is securely erased. Should you have questions about specific retention periods you can contact our DPO on the details above.
Your data protection rights
Under data protection law, you have rights including:
• Your right of access – You have the right to ask us for copies of your personal information.
• Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing – You have the right to ask us to restrict the processing of your
personal information in certain circumstances.
• Your right to object to processing – You have the right to object to the processing of your personal
information in certain circumstances.
• Your right to data portability – You have the right to ask that we transfer the personal information
you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month
to respond to you.
Please contact us using the details provided at the top of this privacy notice if you wish to make a request.
Freedom of information requests
Torbay Pharmaceuticals Ltd is not a “public authority” as defined under the Freedom of Information Act and we will therefore not respond to requests for information made under this Act.
Making a complaint
If you have any concerns about our use of your personal information, you can make a complaint to us, please contact our Data Protection Officer on the details provided above.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
ICO website: https://www.ico.org.uk
Version history:
This is version 1.0 of the notice, published on 21 Oct 2024