Privacy and Cookie Notice for Website Visitors and Po-tential Study Participants
Summary of the key points
- The Celgene International II S.a.r.l., initiates, organizes and finances the “YELLOWSTONE Study Program”. This consists of clinical studies that investigate the efficacy and tolerability of an investigational drug against Crohn’s disease. Trials24 GmbH, Denninger Str. 30, 81679 Munich, Germany, is assisting in the search for study participants. We, Celgene International II S.a.r.l. and Trials24 GmbH, are
jointly responsible for the website and the questionnaire under data protection law.
- Based on your answers to the questionnaire, we would like to find out whether you are eligible to participate in the study and whether you are interested in taking part.
- The questionnaire is voluntary and anonymous.
- If you are eligible and interested in participating in the study program, you may leave your contact information following the questionnaire and consent to be contacted regarding possible participation in order to provide you with further non-binding information regarding possible study participation.
- If you provide us with your contact details, the questionnaire is no longer anonymous.
- Your consent to be contacted does not constitute consent to participate in the study itself. The questionnaire and further contact are completely non-binding for you.
- To track the use of our website we would like to use analysis tools from third-party providers. This is carried out pseudonymously, so that these third-party providers do not receive any information that directly identifies you. We only use these tools with your prior consent. The analysis tools, on the other hand, do not record any areas of our website that require personal data (e.g. questionnaire or contact form). When you visit us for the first time, we ask you for your cookie and data protection consent. You can view and adjust/revoke this at any time (see section F.4 below). In addition, by tracking the use of our website, you consent to us transferring your data to service providers in the USA, where there is no level of data protection comparable to that in the EU or UK (see section E.4).
If you have any queries, please contact Trials24 GmbH, as Celgene International II S.a.r.l. itself does not have access to your data.
Table of contents
A) General information
1. The Scope
With this data protection information we explain our handling of your personal data to you, when you
- visit our information website at https://www.crohns-study.co.uk about the YELLOWSTONE Study Program to investigate the efficacy and tolerability of an investigational drug for Crohn’s disease
- fill in the questionnaire there, with the help of which you can determine whether you are suitable to take part in the study, and
- decide to leave us your contact details to send you further information about possible participation in the YELLOWSTONE Study Program.
In addition, we inform you about your rights under the UK General Data Protection Regulation (UK GDPR) and the use of so-called “cookies”.
This document does not refer to the participation in the YELLOWSTONE Study Program itself and the related data processing by the study sites. If you later decide to participate in this study program, you will receive separate, comprehensive information on this from the study site and provide separate data protection consent.
2. Contact details
We, the following two companies, are the responsible parties within the meaning of the UK GDPR, as joint responsible parties within the meaning of Art. 26 UK GDPR:
Denninger Str. 30
81679 Munich, Germany
Phone: +49 89 21537 4990
Contact details of the data protection officer of Trials 24 GmbH: firstname.lastname@example.org
Celgene International II S.a.r.l.
The Data Protection Officer
Bristol Myers Squibb
3. Joint Controllership of Trials24 GmbH and Celgene International II S.a.r.l.
Trials24 GmbH and Celgene International II S.a.r.l. have stipulated in a contract in accordance with the requirements of the UK GDPR that, in the relationship between our companies, Trials24 GmbH is largely responsible under data protection law for the collection and further use of your data from the questionnaire as well as for contacting you and, if necessary, making an appointment. This applies in particular to the fulfilment of the information obligations under data protection law and your rights under the UK GDPR.
The central point of contact for asserting your rights under the UK GDPR (see section I below) is Trials24 GmbH, as Celgene International II S.a.r.l. does not have access to your data.
B) Questionnaire on potential study participation1. Type of personal data and purposes of use Celgene International II S.a.r.l. (hereinafter referred to as “BMS”) is developing an investigational treatment for Crohn’s disease. BMS is the “sponsor” of the “YELLOWSTONE Study Program”. This consists of clinical studies in which the efficacy and tolerability of an investigational drug of the sponsor is examined in study sites (e.g. university hospitals). The sponsor is responsible for the studies in that they initiate, organize and finance. With this website we would like to inform about the study program and find potential study participants. a) Questions on eligibility for the study program (questionnaire) You can use the questionnaire to find out whether you are eligible to participate in the study program. You are not obliged to insert your name or contact details. We also do not store your IP address. The IP address is a number that your Internet provider assigns to your PC, smartphone or other terminal device, either temporarily or permanently. With a full IP address, it would be possible to identify the connection owner in individual cases, for example, using additional information from your internet access provider. The questionnaire is not recorded by our analysis tools. The questionnaire is therefore anonymous and, of course, voluntary. b) Consent to be contacted If you are suitable for participation in the study program and are interested, you can leave your contact details following the questions and allow us to contact you regarding possible participation. This will enable us to provide you with further information, which you can discuss with your attending physician, for example. The corresponding online consent is then:
Data protection consent – contact regarding possible participation in the YELLOWSTONE Study Program
I consent to Trials24 GmbH, Denninger Str. 30, 81679 Munich, Germany, linking my contact details provided below (name, email/telephone) with my answers from the questionnaire to contact me by email and/or telephone (as requested by me). My consent includes data about my health (Crohn’s disease).
The sole purpose of contacting you is to provide information about possible participation in the YELLOWSTONE Study Program to develop a treatment with a new investigational drug for Crohn’s disease. This is completely non-binding for me. My data will be processed exclusively for this purpose.Notes: Your data protection consent is voluntary. You can revoke this at any time with effect for the future. To do so, please contact Trials24 GmbH, Denninger Str. 30, 81679 Munich, Germany or email@example.com. By giving your consent, you are not yet agreeing to participate in the study program. In the event of participation in the study, you will receive further information from the study site and provide a separate declaration of consent there. If you do not provide consent, we will not be able to assist you in making a non-binding appointment with a study site. Alternatively, you can contact a study site directly or speak to your doctor. If you give your consent, we will subsequently ask you for your name and the desired form of contact (email/telephone) and accordingly for your email address and/or telephone number via an online form. We also ask you to tell us in which federal state you live, so that we can select a study site near you. 2. Storage period We delete your information on the questionnaire 90 days after the study program has ended. If you withdraw your consent, we will delete your data immediately. 3. Data recipients We may also use technical service providers for the provision of the questionnaire who process your data according to our instructions (so-called “processors”). Trials24 GmbH currently uses the following processors to carry out the questionnaire: Lamano GmbH & Co KG, Prenzlauer Allee 36G, 10405 Berlin. 4. Legal basis The legal basis for the processing of your data concerning the questionnaire is your consent (Art. (6)(1)(a) UK GDPR).
C) Contact form
You can send inquiries directly to Trials24 GmbH using the contact form on the website. We only need your email address. The indication of the name is voluntary. The data transmission is encrypted.
We use your personal data to process your request and, if this purpose is fulfilled, we usually delete it after 90 days. For data concerning a study participation, section B applies.
Legal bases are our legitimate interest according to Art. 6 (1)(f) UK GDPR, as we would like to enable you to contact us quickly and directly, and your consent according to Art. 6 (1)(a) UK GDPR, if your request concerns health data. If you do not wish to give your consent, please use an alternative contact option.
D) Integration of external fonts (Adobe Typekit)We use Adobe Typekit, a service provided by Adobe Systems Software Ireland Companies (4-6 Riverwalk, Citywest Business Campus, Dublin 24, Republic of Ireland; hereinafter “Adobe”), which gives us access to a font library from Adobe. We do not include Adobe Typekit on the questionnaire pages or on the contact information form, so no information is sent to Adobe. When integrating the fonts we use, your browser must establish a connection to an Adobe server and download the required font there. In addition, Adobe may store cookies on your computer. Details on the data collected and the data processing as well as the cookies used can be found at https://www.adobe.com/privacy/policies/adobe-fonts.html. Adobe may transfer data to countries outside the EU, the European Economic Area and the UK. For more information and to learn how Adobe maintains an adequate level of privacy protection, please see Adobe’s privacy notice at https://www.adobe.com/privacy/policy.html (“Does Adobe transfer my personal information across borders?”). The legal basis for the integration of Adobe Typekit are our legitimate interests in a fast and efficient provision of the respective fonts (Art. 6 (1)(f) UK GDPR).
E) Website analysis and hosting, data transfer to third countries
1. Server Logfiles
When you call up a single page of our website, our web servers record in a log file the address (URL) of the page called up, the date and time of the call-up, any error messages and, if applicable, the operating system and browser software of your end device as well as the website from which you are visiting us.
The incoming IP address is stored by our servers for one week and then irrevocably deleted from the log file. This does not apply to the questionnaire (see section B1a). Here, the incoming IP address is not stored.
The log file data is used by us exclusively to ensure the functionality of our services (e.g. error analysis, ensuring system security and protection against misuse). Insofar as log data qualifies as personal data in individual cases, the legal basis for the processing of the log file data is our aforementioned legitimate interests, Art. 6 (1)(a) UK GDPR.
For the hosting of the website (without questionnaires) we use RAIDBOXES GmbH, Friedrich-Ebert-Straße 7, 48153 Münster, Germany, as our processor.
3. Google Analytics (analysis of website usage)
If you give us your consent to data processing for statistical purposes, we use the “Google Analytics” service from Google as an analysis tool to record how users use our website in pseudonymised form. We do this to create anonymous evaluations and to design our website accordingly.
If you give us your consent to data processing for statistical purposes, you thereby also consent to the transfer of your data to Google in the USA. For details on your consent in this regard, please see section E.4.
On the pages of the questionnaire and the form for your contact details, we do not integrate Google Analytics, so Google will have no access to information in this regard.
You can view the status of your consent here and change it at any time:
Google Analytics is an analysis tool of Google LLC in the USA (Google).
Google acts as our processor in providing Google Analytics.
For additional information on data protection at Google, please see Google’s data protection information.
By means of Google Analytics, we record when you call up which pages of our website, your rough location as well as data on the device you use (e.g. device type, operating system or screen resolution). This data is processed pseudonymously, i.e. it cannot be directly linked to you. Personal data such as your email address or your name are therefore not linked to your user behavior.
IP anonymisation has been activated on our website so that your IP address is shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser within the scope of Google Analytics will not be merged with other Google data.
Google will use this information on our behalf for the purpose of evaluating your use of the website, compiling reports on website activity and, where applicable, providing other services relating to website activity and internet usage to us as website operators.
Your data collected within the scope of Google Analytics will be deleted after 14 months.
The processing of your data is based on your consent.
4. Consent to the transfer of data to third countries
You give us your consent – revocable at any time with effect for the future – to transfer your data to companies in non-EU countries. No measures have been taken (e.g. contractual agreements) to compensate for this deficit.
The companies or countries are listed in section F.3.
You can adjust your cookie and privacy consents here.
(To withdraw consent for data transfer to unsafe third countries, please uncheck all optional checkboxes)
By giving your consent, you expressly agree to our transferring your data to the aforementioned companies in unsafe third countries, in particular the USA, while accepting the risks mentioned below.
The processing takes place in these countries without complying with the EU or UK data protection principles of lawfulness, fair processing, transparency, purpose limitation, data minimisation, accuracy and storage limitation, integrity and confidentiality. In addition, your rights to information, access, rectification, erasure, restriction of processing, data portability and objection guaranteed under EU and UK law may not be enforceable in these countries.
The rule of law (e.g. the principle of proportionality), respect for human rights and fundamental freedoms (e.g. the right to protection of personal data) in the country concerned may not meet EU or UK standards. This is the case, for example, in relation to rules on public security, defense, national security and criminal law, as well as access to and application of personal data by public authorities. There may also be insufficient protection for onward transfers of personal data to other insecure third countries. Administrative or judicial enforcement of your rights may be limited in insecure third countries compared to the EU or UK.
In addition, unsafe third countries may not have data protection supervisory authorities comparable to those in the EU or UK or may not be able to operate effectively. Authorities in unsafe third countries may lack sufficient enforcement powers and assistance and advice to data subjects, and supervisory authorities may not cooperate with those in the EU or UK.
In USA specifically, government agencies can also access data more easily and extensively, without proportionality and necessity restrictions comparable to those in the EU or UK. In addition, you cannot assert in court compliance with the requirements for access to data by government agencies without US citizenship.
Below we explain the cookies we use and how to adjust your cookie and privacy consent.
Cookies are small text files that are stored in the browser of your terminal device and transferred to us each time you visit our website.
We have divided the cookies we use into two classes:
- “Necessary cookies“ are cookies that are technically necessary for basic website functions to be usable (e.g. questionnaires).
- “Statistics cookies“ are cookies for recording how visitors use the website and which end devices they use in order to design the website in line with requirements (e.g. content alignment with particularly frequently clicked topics, optimisation of the page display to end devices used). The evaluation is anonymous or pseudonymous, i.e. without linking the data with e.g. name, email or address.
Apart from the necessary cookies, we only set cookies with your prior consent.
„First Party Cookies“ refers to cookies set by the domain displayed in the URL line of your browser. “Third party cookies”, on the other hand, are set by other domains. In the following, a “session” refers to a browser session.
If you want to learn more about cookies and find out how to manage or delete them, please go to https://www.allaboutcookies.org/ and the help section of your browser. In the settings of browsers such as Internet Explorer, Safari, Firefox or Chrome, you can determine which cookies should be accepted and which should be rejected. Where exactly you find these settings depends on the type of browser you are using. You can find the corresponding settings with the help function of your browser.
2. Necessary cookies
When you fill out the questionnaire, our server sets two cookies on your computer:
The first cookie contains a random code and is technically necessary because it enables you to answer or interrupt and continue the questionnaire. This cookie is deleted when you close the browser (so-called “session cookie”).
With the second cookie we store your language setting. This cookie expires after 30 days.
3. Statistics cookies
You can find an overview of all cookies here:
"Essential cookies" or "necessary cookies" are cookies that are technically necessary for basic website functions to be usable (e.g. login).
|Provider||Owner of this website, Legal notice|
|Purpose||Stores the settings of visitors selected in the cookie box of Borlabs Cookie.|
|Cookie expiry||1 year|
"Statistics cookies" are cookies for recording how visitors use the website and which end devices they use in order to design the website in line with requirements (e.g. content alignment with particularly frequently clicked topics, optimisation of the page display to end devices used). The evaluation is anonymous or pseudonymous, i.e. without linking the data with e.g. name, e-mail or address.
|Provider||Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland|
|Purpose||Cookie of Google for website analytics. Generates statistical data about how the visitor uses the website.|
|Cookie expiry||2 years|
4. Adjustment of cookie and privacy consent
When you first visit our website, we have asked you for certain cookie and privacy consents. The consents are voluntary and can be revoked by you at any time with effect for the future.
You can view and adjust your cookie and privacy consent here:View Cookie Settings
Your personal user ID is:
Your personal consent history is:
G) Use of a scheduling tool
If we arrange a telephone appointment with you to clarify your questions, we can use an online tool to find an appointment. The appointment serves to clarify your questions over the phone, it is not about an appointment at the study site.
If you do not want us to use an online tool to make appointments, please let us know in advance, e.g. in our email correspondence. We will then refrain from using the online tool.
In connection with the appointment, we record possible appointments, the agreed appointment, including the appointment name, as well as your name and contact details (in particular email address and telephone number) and, if applicable, your acceptance and cancellation of the appointment. The appointment will not indicate that you want to participate in a clinical trial; we will choose a neutral name (e.g. “Clarification of questions about trial participation”).
We use the data to find a joint telephone appointment with you as quickly and efficiently as possible. In this respect, the legal basis for the data processing are our legitimate interests mentioned above.
We delete the appointment data no later than 60 days after the respective appointment.
For the provision of the online appointment arrangement, we use the tool “Calendly” of Calendly, LLC in Atlanta/USA, which process data for a specific purpose according to our instructions by way of commissioned processing. To ensure the level of protection, we have concluded a contract with Calendly in accordance with the EU Standard Contractual Clauses, which can be found at https://calendly.com/pages/dpa or obtained from us upon request. For details on data protection at Calendly, please see https://calendly.com/pages/privacy.
IP adresse: The IP address is a number that your Internet provider assigns to your terminal device, either temporarily or permanently. With a complete IP address, it is possible to identify the connection owner in individual cases, for example, using additional information from your Internet access provider.
Processors: These are technical service providers who process personal data for us for a specific purpose and according to our specifications. We have entered into contractual agreements with processors in accordance with the requirements of the GDPR to ensure data protection.
2. Legal bases
The UK GDPR allows processing of personal data only if a legal basis permits it. We are legally obliged to inform you of the legal basis for the processing of your data.
In the following, we explain the terms used when citing the legal bases.
Art. 6 (1)(a) UK GDPR
This legal basis allows us to process your data if and to the extent that you have given us your consent.
Art. 6 (1)(f) UK GDPR
According to this legal basis, we are permitted to process your data insofar as this is necessary to protect our legitimate interests (or those of third parties) and your conflicting interests do not prevail.
I) Your rights provided by the UK GDPR
By law, we are obliged to inform you of your rights provided by the UK GDPR. We explain these rights below. You are entitled to the rights under the conditions of the respective data protection provisions. The following description does not grant you any further rights.
Please contact Trials24 GmbH directly to assert your rights, as Celgene International II S.a.r.l. does not have access to your data:
Denninger Str. 30
81679 Munich, Germany
Phone: +49 89 21537 4990
1. Access or Copy
You have the right to request confirmation from us as to whether we are processing personal data relating to you; if this is the case, you have a right of access to that personal data and to the information detailed in Art. 15 UK GDPR.
You have the right to demand that we immediately correct any inaccurate personal data concerning you and, if necessary, complete any incomplete personal data, Art. 16 UK GDPR.
You have the right to demand that we erase personal data relating to you without delay, provided that one of the reasons listed in detail in Art. 17 UK GDPR applies, e.g. if the data is no longer required for the purposes pursued.
4. Restriction of processing
You have the right to demand that we restrict processing (blocking of data) if one of the conditions listed in Art. 18 UK GDPR applies.
5. Data portability
Under certain conditions, you have the right to receive data relating to you that you have provided to us in a structured, common and machine-readable format. You may then transmit this data to others or, if technically feasible, have it transmitted by us, Art. 20 UK GDPR.
6. Right of appeal to a supervisory authority
You have the right to lodge a complaint with a supervisory authority, irrespective of any other administrative or judicial remedy, if you consider that the processing of personal data concerning you infringes the UK GDPR, Art. 77 UK GDPR. You can assert this right before a supervisory authority in the Member State of your residence, workplace or the place of the alleged infringement. You can find the contact details of the supervisory authorities in Germany here (this website is in German).
7. Withdrawal (of consent)
If you have given us your data protection consent, you have the right to withdraw this at any time with effect for the future.
In the event of a withdrawal of your consent granted above, we will delete your data. A withdrawal has no influence on the lawfulness of the processing of your data until your use of this right.
8) Objecion to the processing
You have the right at any time to object to the processing of personal data, on grounds relating to your particular situation, that we carry out based on Art. 6 (1)(e) or (f) UK GDPR. We will then no longer process this data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims (Art. 21 UK GDPR).