Xgate Privacy Policy

Pursuant to art. 13 of EU Regulation 679/2016 (GDPR) and the Italian Privacy Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018), Axenso S.r.l. (hereinafter the “Data Controller”), with registered office in Milan, via Gallarate 106, VAT no. 08703390966, informs you that the personal data (hereinafter the “Data”) you provide through the centralised registration process for the various websites and apps it operates (so-called Xgate), or otherwise acquired through access to the digital services of Axenso S.r.l., will be processed in compliance with the aforementioned GDPR and Privacy Code and in the manner described below.

Purpose of this Notice

The purpose of this document is to describe how the centralised registration to the Data Controller's various websites and access to the various digital services offered are managed, with regard to the processing of personal data of Users who interact with the related services offered by the Data Controller.

The information on data processing is provided only for processing carried out by the Data Controller through its own websites and does not extend to processing carried out by third parties that the User may consult via links. With respect to such further processing, Axenso S.r.l. assumes no responsibility, and the User must refer to the individual privacy policies of the third parties acting as Data Controllers.

Users should read this Privacy Notice carefully before providing their data. It supplements the content of any specific privacy policies on the relevant websites/apps.

Nature of the data

The Data that may be collected by the Data Controller are so-called common data, i.e. information relating to your professional activity, such as personal details, number and province of registration with the Medical Association, specialisation, e-mail, etc., as indicated in the registration form, for the purpose of verifying and authenticating your professional profile. The Data Controller will in no way collect so-called special categories of data relating to Users.

Purposes and methods of processing

Your data will be processed through collection, recording, organisation, storage, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure and distribution, in such a way as to guarantee their integrity and confidentiality through the adoption of the most advanced security tools. Processing will be carried out electronically for the following purposes:

• (a) to allow your centralised registration to the various websites managed by the Data Controller, in order to facilitate access to professional content dedicated to professional Users;
• (b) centralised authentication and registration for web and mobile (Single Sign On), including password recovery, to access the Data Controller's digital services;
• (c) subscription to the specific services offered by the Data Controller through the individual websites/apps, for which specific information is provided in the privacy policies of the individual websites/apps;
• (d) subject to prior and specific consent, sending medical-scientific or related information or publications (e.g. congresses, seminars, conferences);
• (e) subject to prior and specific consent, collecting information about your professional activity and related interests in order to develop, provide and improve the services provided by Axenso;
• (f) subject to prior and specific consent, transfer of personal data to Axenso s.r.l. in order to be contacted by it for promotional communication purposes;
• (g) market research and statistical analysis, using anonymous and aggregated data;
• (h) fulfilling obligations established by law, by a regulation, by EU legislation or by an order of the Authorities (such as accounting and tax reporting obligations);
• (i) exercising the rights of the Data Controller, for example the right of defence in court.

The Data Controller will process personal data for the time necessary to fulfil the above purposes and in any case for no longer than 10 years from the termination of the service.

Centralised registration procedure (Xgate)

The aim of this procedure is to offer Users a single solution to access and benefit from the services offered by the Data Controller, as well as the scientific content available through its websites/apps. The User can therefore register only once and, using the credentials created, access the content on the Data Controller's various websites/apps. Access to the websites is restricted to doctors and healthcare professionals; therefore, in order to verify that registrations are made only by professional Users, user verification and authentication procedures are also implemented. Once the registration form has been completed with the required data, a message is sent to the e-mail address provided, through which the User must confirm the registration via a link in the e-mail (confirmed opt-in). Once registration has been confirmed, the credentials provided by the User are verified by accessing data in public registers (e.g. professional associations).

Centralised management of data collected through the websites/apps (Xgate)

As highlighted above, personal data provided during registration or during visits to the Data Controller's various websites/apps will be managed jointly, to give the User unified management of their profiles and to make it easier to control the provision and use of their data. The centralised data thus collected by the Data Controller may be used to respond to Users' specific requests regarding the services and projects offered by the Company and, subject to the User's specific consent, for profiling and medical-scientific information activities.

Medical-scientific information and profiling activities

Data collected centrally from the various websites/apps may be processed by the Data Controller, subject to the User's consent, to send Users medical-scientific information material (e.g. professional publications, invitations to events, etc.) by e-mail or by automated means. Consent is requested at the bottom of the registration form. Failure to give consent will not affect registration to the Axenso s.r.l. websites/apps, whose services the User may still use. To allow the User to easily object to such communications, any communication relating to new services or features offered by the Company will give the User the option of refusing further similar communications, without prejudice to the possibility of using the services requested. In addition, the data collected may be used to improve the services and medical-scientific information offered by Axenso s.r.l. through its websites/apps, making them more consistent with and relevant to the User's professional activity. The processing of data for profiling activities is optional and will be carried out only if the User gives specific consent, which will be requested at the bottom of the registration form. For medical-scientific information and profiling activities, the Data Controller will process personal data for the time necessary to fulfil the related purposes and in any case for no longer than 2 years from the termination of the service. The User is informed that, also in relation to profiling activities, they may exercise the rights set out in art. 15 et seq. of the GDPR, as further described below.

Communication of data

The Data may be communicated, exclusively for the above purposes, to the following categories of recipients:

• (i) parent companies, subsidiaries or affiliates of the Data Controller;
• (ii) persons, companies, associations or professional firms providing services or assistance and consultancy to Axenso S.r.l.;
• (iii) companies assisting the Data Controller in managing the websites/apps and related databases;
• (iv) entities entitled to access the data under legal provisions and secondary legislation or under instructions issued by authorities empowered to do so by law, including Farmindustria.

These parties will use the data as Data Controllers and/or Data Processors. In addition, the data may be known, as they are responsible for carrying out certain processing operations on behalf of the Data Controller, both by internal staff, as authorised and/or designated persons, for the management of our relationship, and by external parties acting as processors or independent controllers. Personal data are stored on servers located outside Italy. In any case, the Data Controller may, if necessary, move the servers to countries outside the EU. In that case, the Data Controller hereby ensures that any transfer of data outside the EU will take place in compliance with Chapter V of the GDPR.

Data Controller and DPO

The Data Controller is Axenso S.r.l., based in Milan, in the person of its legal representative pro tempore. The updated list of processors and of persons authorised to process data is kept at the registered office of the Data Controller. The DPO is Avv. Marco Giuri (email marcogiuri@studiogiuri.it).

Data subject rights

Pursuant to current legislation, you may at any time exercise your rights against the Data Controller, as set out in art. 15 et seq. of the GDPR.

In addition to these rights, you have the right to lodge a complaint with the Supervisory Authority in the cases provided for by law.

You may exercise the above rights at any time by sending:

• a registered letter with return receipt to Axenso S.r.l. – Operational headquarters – Via Gallarate n. 106 – 20151 Milan;
• an e-mail to privacy@axenso.com.

For further information on how to exercise these rights, please see the “Data Subject Rights Procedure” at www.axenso.com.