Privacy Statement

3.1 In addition to the purposes set out in the relevant summaries above, we may also process Personal Data where necessary for the following purposes:

1. to comply with legal obligations to which we are subject;
2. to establish, investigate, exercise or defend or settle a legal claim;
3. to pursue our legitimate interest or that of a third party, but only where such processing is necessary to achieve the relevant outcome and provided that it is not outweighed by a risk of harm to your interests, rights and freedoms. Examples include maintaining the security and safety of our products and services and preventing fraud and illegal activity; and/or
4. in limited cases, we may also rely on your consent (in which case, we will provide additional information regarding the proposed purpose of processing) or where we need to protect the vital interests for you or someone else, or where it is necessary to do so in the public interest.

3.2 The Special Category Data that may be processed by us are set out in the relevant Audience summary applicable to you as set out at section ‎2 of this Statement. Where we process Special Category Data, it will be justified by a condition set out at section ‎3.1‎ above and also by one of the following additional conditions:

1. in accordance with paragraph 10 of Schedule 1 of the UK’s Data Protection Act 2018 – for example where we seek to prevent or detect unlawful acts (e.g., fraud or antisocial behavior);
2. where necessary to undertake scientific research in the public interest in accordance with Article 9(2)(j) GDPR and paragraph 10 of Schedule 1 of the UK’s Data Protection Act 2018;
3. where necessary to protect the vital interests for you or someone else where you are physically or legally incapable of giving consent (for example in exceptional emergency situations, such as a medical emergency), or, where it is necessary to do in the public interest; and/or 
4. the processing is otherwise permitted by applicable law, such as in relation to legal claims, or in limited cases, based on your explicit consent.

3.3 We will only use your Personal Data for the purpose for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your Personal Data without your knowledge, in compliance with the above rules, where this is required or permitted by law.

4.1 We will share Personal Data with the third parties as set out in the relevant Audience summary applicable to you as set out in section ‎2 above.  We may also share your Personal Data with the following third parties:

1. service providers that we appoint to act as Processors on our behalf - these may include providers of: IT services and infrastructure; data hosting; logistics; information security; marketing services and other services necessary for our business operations;
2. professional advisors, such as law firms, accountants, auditors and consultants;
3. public authorities, regulatory authorities and law enforcement agencies, and other third parties where necessary to comply with any applicable legal obligation, taxation requirement, court order, summons, search warrants or any other legal or regulatory obligation or request to which we are or may become subject;
4. a potential or confirmed investor, purchaser, liquidator or administrator of a member of the Diaceutics Group;
5. other members of the Diaceutics Group, to enable or support us in providing our services;
6. legal authorities or enforcement bodies where disclosure is necessary to exercise, establish or defend the legal rights of Diaceutics Group; and/or,
7. other companies and organizations to protect the rights, property or safety of the Diaceutics Group, our customers, or others, such as for the purposes of security, fraud protection and credit risk reduction.

We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed without authorization, or otherwise altered or disclosed. We limit access to your Personal Data to those employees, agents, and contractors who have a business need to know.

All our third-party service providers and members of the Diaceutics Group are required to take appropriate security measures to protect your Personal Data in line with our information security policies, and we only permit them to process your Personal Data for specified purposes and in accordance with our instructions.

Although we take reasonable steps to protect the Personal Data you provide to us, the transmission of information via the internet is not completely secure, and we cannot guarantee the security of any information you transmit to us. Any such transmission is at your own risk. Once we have received your information, we use physical, electronic and procedural safeguards designed to prevent unauthorized access.

Some of the entities with whom we may share your Personal Data (including members of the Diaceutic Group) are based outside the UK and/or the European Economic Area (“EEA”).  

In accordance with the GDPR, whenever we transfer your personal data out of the UK and/or EEA, we ensure an equivalent degree of protection is afforded to it by ensuring appropriate safeguards have been implemented. If you would like further information on the specific safeguards used by us when transferring your Personal Data out of the UK and/or EEA, please contact [email protected]

We will only retain your Personal Data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements including applicable statutory limitation periods.

At the end of the applicable retention period, we will securely destroy your Personal Data. In some circumstances, we may anonymize your Personal Data so that it can no longer be associated with you, in which case we may use such information without further notice to you.

We undertake some limited profiling where set out in the relevant summaries in section ‎2 above.

However, you will not be subject to decisions that have a significant impact on you based solely on automated decision-making.

9.1 GDPR

The table below sets out the additional rights applicable to you where the GDPR applies to our processing of your Personal Data.

You can exercise any of these rights, or request any additional information by submitting a request to [email protected] or by mail marked for the attention of Global Compliance Officer at: Diaceutics PLC, First Floor, Building Two, Dataworks at Kings Hall Health and Wellbeing Park, Belfast, Co Antrim, BT9 6GW.
We will provide you with information on any action taken upon your request in relation to any of these rights without undue delay and at the latest within one month of receiving your request. We may extend this by up to two months if necessary, however we will inform you if this arises.

Please note that we may ask you to verify your identity when you seek to exercise any of your data protection rights. We may also contact you to ask you for further information in relation to your request to speed up our response.

While we hope to be able to resolve any concerns you have about the way that we are processing your Personal Data, you have the right to lodge a complaint with a supervisory authority if you believe that your Personal Data has been processed in a way that does not comply with the Data Protection Legislation or have any wider concerns about our compliance. For the UK, you can lodge such a complaint with the Information Commissioner's Office (ICO) by calling the ICO helpline on 0303 123 1113 or via their website here.

9.2. CCPA

The California Consumer Privacy Act (CCPA) requires that we provide California residents with certain specific information about how we handle their Personal Information, whether collected online or offline. The table below sets out generally the categories of Personal Information about California residents that we collect, disclose and sell to others for a business purpose. We collect these categories of Personal Information from the sources and for the purposes explained in this Statement. Our collection, disclosure and use of Personal Information about a California resident will vary depending upon the circumstances and nature of our interactions or relationship with such resident.

Residents of California also have the following rights:

1. Do-Not-Sell. California residents have the right to opt-out of the sale of their Personal Information. We will only share your Personal Information with advertising and analytics providers where you have consented to this in accordance with our Cookie Policy – you can opt out again at any time via our cookie preference tool.
2. Notice at Collection. At or before the point of collection, notice must be provided to California residents of the categories of Personal Information collected and the purposes for which such information is used.
3. Verifiable Requests to Delete & Requests to Know. Subject to certain exceptions, California residents have the right to make the following requests, at no charge:
   
   Request to Delete: California residents have the right to request deletion of their Personal Information that we have collected about them and to have such Personal Information deleted, except where an exemption applies.
   
   Request to Know: California residents have the right to request and, subject to certain exemptions, receive a copy of the specific pieces of Personal Information that we have collected about them in the prior 12 months and to have this delivered, free of charge, either (a) by mail or (b) electronically in a portable (and, to the extent technically feasible, readily useable format that allows the individual to transmit this information to another entity without hindrance). 

1. California residents also have the right to request that we provide them with certain information about how we have handled their Personal Information in the prior 12 months, including the:

   • categories of Personal Information collected;
   • categories of sources of Personal Information;
   • business and/or commercial purposes for collecting and selling their Personal Information;
   • categories of third parties with whom we have disclosed or shared their Personal Information;
   • categories of Personal Information that we have disclosed or shared with a third party for a business purpose; and
   • categories of third parties to whom the residents’ Personal Information has been sold and the specific categories of Personal Information sold to each category of third party.

2. California residents may make Requests to Know up to twice every 12 months.

   4. Submitting Requests. Requests to Know, and Requests to Delete may be submitted by emailing us at [email protected] or by mail marked for the attention of Global Compliance Officer at: Diaceutics PLC, First Floor, Building Two, Dataworks at Kings Hall Life Sciences Park, Belfast, Co Antrim, BT9 6GW. We will respond to verifiable requests received from California residents as required by law.
   5. Right to Non-Discrimination. The CCPA prohibits discrimination against California residents for exercising their rights under the CCPA.

If we amend this Statement, in whole or part, any changes will be posted on our website, and we will take reasonable steps to bring this to your attention where appropriate.

CCPA: means the California Consumer Privacy Act of 2018 (CCPA);

Controller: means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data (Article 4(7) GDPR);

Data Protection Legislation: means, as applicable, any law, rule, regulation, decree, statute, or other enactment, order, mandate or resolution, to the extent applicable to either Party relating to data security, data protection and/or privacy, including (amongst others) the General Data Protection Regulation and the Data Protection Act 2018;

Diaceutics Group: means Diaceutics Plc and all of its subsidiaries from time to time, including: 

Diaceutics Inc.

Diaceutics Ireland Ltd.

Diaceutics Pte. Ltd.

Diaceutics Pte. Ltd. - Japan branch

Diaceutics Pte. Ltd. - South Korea branch

Diaceutics Precision Medicine Technology (Guangzhou) Ltd.

EEA: refers to the European Economic Area which consists of all EU member states, plus Norway, Iceland, Liechtenstein; 

Electronic Mail: includes but is not limited to email, text, video, voicemail, picture and answerphone messages (including push notifications and in-platform notifications);

General Data Protection Regulation or GDPR: includes the General Data Protection Regulation (EU) 2016/679) implemented in the EU (EU GDPR) and also includes (where appropriate) reference to the version of the GDPR implemented in the United Kingdom (UK GDPR);  

Personal Data: under the GDPR, this refers to any information relating to an identified or identifiable natural person ("data subject");

Personal Information: defined by the CCPA to refer to any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. It does not include publicly available data as defined by the CCPA.

Processor: means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller (Article 4(8) GDPR); and

Special Category Data: means Personal Data revealing the following: political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data (where used for identification purposes); data concerning health; data concerning a person’s sex life; and data concerning a person’s sexual orientation.