Data Protection and Privacy Policy
Data Protection and Privacy Policy
This notice is effective 21 May 2018 and last updated 03 August 2026.
“Galsana" is a trading brand of Galen Limited (company number NI056542), a company incorporated in Northern Ireland with its registered office at Seagoe Industrial Estate, Craigavon, BT63 5UA. References in these terms to "Galsana", "we", "us" and "our" are references to Galen Limited and its affiliates trading as Galsana. This notice is issued by Galen Limited.
Galsana is committed to preserving the privacy of all individuals that share their information with Galsana. Galsana is committed to ensuring that if we handle information about any individual, we do so with full regard to the individual’s privacy and in full compliance with applicable laws on data privacy and confidentiality.
Our Data Protection and Privacy Policy (“Policy”) will define the main types of personal information that we may have access to and process within our organisation; how we use any personal information and the steps which are taken to protect the information that you provide to us. The Policy also sets out how Galsana complies with data privacy laws and regulations, including but not limited to the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) and other national laws implementing data privacy and confidentiality requirements.
Galsana has put in place internal policies to ensure that our employees are fully aware of the legal requirements relating to data privacy and confidentiality.
By using our websites, products and services, your Personal Data may be collected and processed in accordance with this Privacy Policy and the applicable legal bases described within it.
Types of Information That We Collect From You and How It Will Be Used
Personal Data
“Personal Data” means any information or set of information that identifies or can reasonably be used to identify an individual and includes, in the context of GDPR, all information defined as “Personal Data” within GDPR, comprising any information relating to an identified or identifiable natural person, where an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal Data does not include information that is anonymous.
Sensitive Personal Data
References to “Sensitive Personal Data” in this Policy includes (in the context of GDPR) “Special Categories of Personal Data” (as such term is defined in GDPR) comprising personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation, as well as information about criminal convictions and offences. References to Sensitive Personal Data in the Policy shall also include for the purposes of the Swiss-US Privacy Framework ideological views or activities, information on social security measures or administrative or criminal proceedings and sanctions, which are treated outside pending proceedings. Galsana will process information as Sensitive Personal Information as appropriate, and comply with applicable laws in respect of such processing (see Section 3 below for further details). Additionally, information will be treated as Sensitive Personal Data where it is received from a third party that treats and identifies it as sensitive.
1. Galsana as a Data Controller
Galsana as a data controller, will collect, process, and store certain Personal Data and Sensitive Personal Data including, but not limited to, the examples listed below.
(a) Employee Data
Galsana will collect Personal Data and Sensitive Personal Data of Galsana employees, workers, contractors and applicants seeking employment with Galsana. As a data controller, Galsana determines the purpose and means of such processing. Galsana collects and processes all employee information of staff for human resource purposes, including payroll, tax and performance reviews and assessments. Galsana also collects Personal Data and information from applicants (who may be existing employees or external individuals) who apply to recruitment offers and positions (either directly or through an employment agency). This information may include contact details, professional qualifications, previous professional experience, references and relevant background checks. External advisors and consultants’ information will be collected and processed in the same manner and in accordance with Galsana’s standard operating procedures.
(b) Marketing and Website Visitors
Galsana will collect and process Personal Data, including names and contact details, of customers, prospective customers and other business contacts in the course of our marketing activities and other legitimate business related purposes.
When you visit or register on any Galsana website, you may be asked to voluntarily provide certain information about yourself, including your name and contact details. We may also collect information about you from e-mails, letters or business cards you provide to us. We may use your information to contact you for your views on our products and to notify you occasionally about important changes or developments to the site or our products. Further, where you have consented, we might also use your information to let you know about other products which we offer which may be of interest to you and we may contact you by post, telephone or fax, as well as by e-mail. If you change your mind about being contacted in the future, please let us know, either by availing of the “unsubscribe” option in our marketing-related correspondence or by contacting us (see Section 8).
(c) Suppliers and Site Visitors and Virtual Audits
Galsana may be required from time to time to process information relating to consultants, contractors, suppliers and other third parties engaged by Galsana to provide services to it or who otherwise visit our premises (including for example, site security records and CCTV for the purposes of maintaining site security, and which are in accordance with our standard operating procedures). Galsana may also be required to process information of individuals on site (including employees) as part of filming for, or otherwise performing, virtual audits. There are prominent notices at the relevant locations throughout our sites where filming for virtual audits occurs and where CCTV is in operation.
(d) Health Professionals
Galsana will collect and process Personal Data about health professionals with whom we have dealings in connection with Galsana products. This information may include name, contact details, practice area and details of dealings with Galsana (e.g. details of medical enquiries, adverse event reporting, clinical trial involvement, meetings with our sales representatives and participation in relevant conferences, meetings, panels or speaker engagements).
(e) Regulatory and Pharmacovigilance Activities
Galsana may collect Personal Data (including Sensitive Personal Data) about you when you, or a third party, provide us with information about you in relation to an adverse event that affected you or someone else. We may also receive medical information queries or complaints relating to our products. In order to fulfil our pharmacovigilance obligations, we may use or share your information to investigate the adverse event, contact you for further information about the adverse event you have reported or provide reports to relevant regulatory authorities. We may also be required to share your information with our commercial partners where we have a legal or contractual obligation to do so.
2. Galsana as a Data Processor
Although Galsana will most often be considered a data controller, there may be some limited instances where Galsana may be required to process Personal Data (and, if applicable, Sensitive Personal Data) as a data processor on behalf of a third party (e.g. where a commercial partner subcontracts certain pharmacovigilance or regulatory responsibilities to Galsana) Where this is the case Galsana will process such Personal Data in accordance with the instructions of the applicable data controller.
3. Legal Basis for Processing (Where Galsana Acts as a Data Controller)
Unless we specify at the point of collection that we are relying on a data subject’s consent to process their Personal Data (in which case we will comply fully with all applicable legal requirements in relation to consent, including under GDPR) Galsana relies on one or more of the other legal bases available for processing Personal Data, including (from a GDPR perspective):
(i) the processing is necessary for the purposes of the legitimate interests pursued by Galsana or by a relevant third party;
(ii) the processing is necessary for compliance with a legal obligation;
(iii) the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or
(iv) the processing is necessary to protect the vital interests of the data subject or another individual.
Where Sensitive Personal Data is processed, GDPR requires us to have (as well as one of the legal grounds described above), an additional legal ground to justify using this sensitive information. The appropriate additional legal ground will depend on the circumstances and includes (a) processing that is necessary for carrying out obligations and exercising specific rights in the field of employment or social security, (b) processing in connection with the establishment, exercise or defence of legal claims, (c) processing that is necessary for reasons of public interest in the area of public health, such as ensuring high standards of quality and safety of health care and of medicinal products or medical devices, and (d) explicit consent of the data subject – where we choose to rely on consent to process Sensitive Personal Data we always obtain the explicit consent of the individual data subjects concerned.
Galsana will also conduct Data Protection Impact Assessments (“DPIA”) as and when required, and in accordance with applicable law, taking into account, inter alia the nature, scope, context and purposes of the processing. Such DPIAs include a description of the processing operations and purposes of processing, the necessity and proportionality of the processing operations in relation to the purposes, the risks to the rights of data subjects and controls to mitigate the risks.
4. Disclosure of Information
The information you provide to us may be held on our computer systems in the UK (or in respect of information provided to our affiliates outside the UK, in the jurisdictions where those affiliates are established). This information may be accessed by, or given to our staff or other third parties (including third party service providers) working either within or outside the UK, for the purposes set out in this policy or for other purposes approved by you. At times, personal information will be shared by Galsana with companies working as agents of Galsana and third parties strictly on a “need to know” basis and to satisfy business requirements. Galsana does not trade or sell any personal information. Under certain circumstances, Galsana may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. Finally, if our business enters into a joint venture with or is sold to or merged with another business entity, your information may be disclosed to our new business partners or owners.
5. Security and Data Retention
Galsana has implemented both organizational and technological measures to protect Personal Data and Sensitive Personal Data against accidental or unlawful destruction, loss, alteration, disclosure or access including, but not limited to, documented policies, procedures, and instructions, documented training, physical and logical secure access, role based access to minimum level required for job functionality, and data encryption. Your information will only be retained for as long as necessary for the purposes of the processing. Retention periods are determined taking into account legal, regulatory, contractual and business requirements. Once information is no longer required, it will be securely deleted, destroyed or anonymised in accordance with our records retention procedures.
6. Transfers Outside of the European Union
Galsana has put in place measures to ensure that adequate protection is provided to Personal Data where legally mandated. Countries outside the UK and the European Economic Area do not always have strong data protection laws. However, we will always take steps as a data controller to ensure that your information is used by third parties in accordance with this Policy.
7. Accessing and Updating Your Information
Your information will only be used for the purpose for which it was originally collected. You have the right to know what Personal Data/Sensitive Personal Data is held by Galsana as data controller and to ensure that such data is accurate and relevant for the purposes for which Galsana collected it. Upon reasonable request and as required by applicable law (including GDPR), Galsana allows you to access your Personal Data/Sensitive Personal Data held by Galsana as data controller, in order to request the correction, amendment or deletion of such data that you demonstrate to be incorrect or incomplete at any time, or where such data is being processed in violation of applicable law (including GDPR), or where such data is no longer necessary in relation to the purposes for which it was collected, or to request a limiting of the use and disclosure of your personal data. Such requests can be made by contacting Galsana by email or otherwise in writing (using the contact details set out in Section 8). Requests from Galsana employees may also be made to our HR Department. Galsana will respond in a timely manner to all reasonable requests to access, amend or delete any such Personal Data/Sensitive Personal Data, and in accordance with applicable law, and reserves the right to charge up to the maximum fee payable (as permitted by applicable law) for such requests in order to cover administration costs.
You also have the right to object to certain processing activities, request restriction of processing, request the transfer of your Personal Data to another organisation in certain circumstances, and withdraw any consent previously provided where processing is based on consent. Withdrawal of consent will not affect the lawfulness of processing carried out prior to such withdrawal.
If you have concerns about how Galsana processes your Personal Data or Sensitive Personal Data, you may contact us using the details set out in Section 8 and we will endeavour to investigate and resolve your concerns promptly.
Additional Privacy Statement for Residents of the State of California, USA
California consumers have a right to knowledge, access, and deletion of their personal information under the California Consumer Privacy Act. California consumers also have a right to opt out of the sale of their personal information by a business and a right not to be discriminated against for exercising one of their California privacy rights. Galsana does not sell or trade any personal information and does not discriminate in response to privacy rights requests.
Galsana outlines our privacy practices in this Privacy Policy, including what personal information is collected, the source of the personal information, and the purposes of use, as well as whether Galsana discloses that personal information and if so, the categories of third parties to whom it is disclosed. Californian residents may submit a request to exercise your rights under the CCPA by contacting us at the contact address at Section 8 below in the first instance.
8. Contact
Please contact us at the address below if you have any comments, queries, requests or complaints relating to our use of your information.
Data Protection Officer
Almac House
20 Seagoe Industrial Estate
Craigavon
BT63 5QD
Email address: dataprotectionofficer@almacgroup.com
9. Dispute Resolution
Galsana has put in place mechanisms to verify our ongoing adherence to applicable data protection requirements. If you have any concerns or complaints regarding the way we collect, use, store or otherwise process your Personal Data or Sensitive Personal Data, we encourage you to contact Galsana's Data Protection Officer in the first instance using the contact details set out in Section 8.
Galsana will investigate complaints and respond in accordance with applicable law and within a reasonable timeframe. We will endeavour to resolve concerns promptly and fairly.
If you are dissatisfied with our response, or believe that our processing of your Personal Data does not comply with applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority. In the United Kingdom, this is the Information Commissioner's Office ("ICO"), which can be contacted via www.ico.org.uk
10. Changes to Our Privacy Policy
Any changes to our Policy in the future will be posted to our website.
11. Galsana – Cookie Policy
Galsana may from time to time collect information from you by using “cookies”. At Galsana, we are strongly committed to protecting your privacy and as such we want to ensure that you are always aware of how we are using cookies on our websites and how this may affect you.
You can navigate around our websites without giving us any personal information. However, the cookie policy in this section sets out a brief explanation explaining our practices for the occasions where cookies are used.
What Are Cookies?
A cookie is a text file that is placed on your computer, mobile phone or tablet by the websites. Cookies cannot be used to run programs or deliver viruses to your computer. Cookies are uniquely assigned to you, and can only be read by a web server in the domain that issued the cookie to you.
How We Use Cookies
Galsana uses cookies to improve services for you by:
- Measuring how many people are using the different areas of the websites so that popular sections can be improved.
- Analysing anonymous data to help us understand how visitors interact with the websites so we can improve the services offered.
- Enabling a service to recognise your computer so you don’t have to give the same information several times during one task.
Cookies may be used on our customer facing applications, and although we are not actively storing any information pertaining to the user in a form of a cookie, some of the application servers which Galsana uses may write temporary files to enable them to perform as part of their normal usage. This data is not recorded by Galsana.
Cookies do not usually contain personally identifiable information, and if at times Galsana requires you to register your information, the cookie which is associated with your registration information is used in a limited manner to allow Galsana to offer increased functionality of our websites. We do not share any of our data with any third parties. The personal or system information is not stored in the cookie.
Some cookies are set by trusted service providers we use to operate our websites, including HubSpot (for our contact and enquiry forms and related marketing). HubSpot delivers its scripts through Cloudflare, which sets a short-lived bot-management cookie (__cf_bm). We also use Cloudflare Turnstile to protect our forms from abuse, which does not set cookies on our site.
You can manage your cookie preferences at any time using the “Manage Cookies” link in the footer of our website, which lets you accept or reject non-essential cookies. You can also set your web browser to accept cookies, reject cookies, or notify you each time a cookie is sent. To find out more about cookies and how to manage them, please visit www.allaboutcookies.org. Please check our website periodically to inform yourself of any updates.
Galsana uses Google Analytics, a web analytics service provided by Google, to understand how visitors use our websites and to compile reports on website activity so that we can improve the services we offer. Google Analytics cookies are only set after you provide consent through our cookie banner, and you can withdraw that consent at any time using the “Manage Cookies” link in the footer. We do not use this information to identify you personally.
With your consent, Galsana also uses cookies for advertising and ad personalisation, so that we can show you advertising for our own products that is more relevant to you and measure how our advertising campaigns perform. These cookies are only set after you provide consent through our cookie banner, and you can withdraw that consent at any time using the “Manage Cookies” link in the footer.
For more information about how Google uses cookies for advertising personalisation, please refer to Google’s Privacy & Terms site.