Hinweis zur Sprache. Die rechtsverbindliche Fassung dieser Datenschutzerklärung ist die englische. Der vollständige Text folgt nachstehend. Bei Fragen auf Deutsch schreiben Sie bitte an privacy@explicatos.com.
This policy explains how „ЕКСПЛИКАТОС“ ООД (Explicatos Ltd.) processes personal data. It covers three groups of people:
- Visitors to this website — Section 3
- Users of our platforms acting for a client organisation — Section 4
- Medical professionals whose professional activity we research — Section 6
1. Controller
| Controller | „ЕКСПЛИКАТОС“ ООД (Explicatos Ltd.), EIK 204711009, ul. Rodopski Izvor 72, entr. A, floor 3, ap. 12, Vitosha district, Sofia 1618, Bulgaria |
| Data protection contact | privacy@explicatos.com |
| Data Protection Officer | We have assessed the criteria in Art. 37 GDPR and have not appointed a Data Protection Officer. Data protection enquiries are handled at privacy@explicatos.com. |
2. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and receive a copy (Art. 15)
- Rectification of inaccurate or incomplete data (Art. 16)
- Erasure in the circumstances set out in Art. 17
- Restriction of processing (Art. 18)
- Data portability where processing is based on consent or contract and carried out by automated means (Art. 20)
- Object to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21)
- Withdraw consent at any time where processing is based on consent, without affecting prior lawfulness
To exercise any of these rights, write to privacy@explicatos.com. We respond within one month, extendable by two further months for complex requests. We may need to verify your identity first.
You may also lodge a complaint with a supervisory authority, in particular in the country of your habitual residence or place of work. Our lead authority is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria, www.cpdp.bg.
3. Visitors to this website
3.1 Server log files
Our hosting provider automatically records technical data on each access: IP address, date and time, page requested, referrer URL, browser type and version, and operating system. We use this to deliver the site securely, to troubleshoot and to prevent abuse, on the basis of our legitimate interest in a secure and functioning website (Art. 6(1)(f)).
Hosting is provided by DigitalOcean LLC on servers located in the European Union, under DigitalOcean’s data processing agreement, which incorporates the European Commission’s Standard Contractual Clauses. Server logs are retained for 30 days and then deleted automatically.
3.2 Contact form and demo requests
When you submit our form we process the details you enter: name, business email address, company, country, your area of interest and any message you add. We use these solely to respond to your enquiry and to arrange a demonstration, on the basis of steps taken at your request prior to entering into a contract (Art. 6(1)(b)), or our legitimate interest in responding to business enquiries (Art. 6(1)(f)).
We retain enquiries for 12 months from our last contact with you, unless a business relationship begins, in which case the records are kept for the duration of that relationship and for as long as required by Bulgarian accounting and tax law.
3.3 Appointment booking
Demonstrations are arranged by email. This website does not embed any third-party calendar or scheduling service, and no data is transmitted to such a provider.
3.4 Cookies
This website uses only cookies that are strictly necessary for it to function. These do not require your consent. We do not use advertising cookies and we do not profile visitors to this website.
3.5 Fonts
Typefaces used on this website are served from our own servers. No connection is made to third-party font providers and no data about your visit is transmitted to them.
4. Users of our platforms
Where your organisation has a subscription or project with us, we process your name, business email address, organisation, role, and login and usage records, in order to provide access to our platforms, to keep them secure and to support you. The basis is performance of the contract with your organisation (Art. 6(1)(b)) and our legitimate interest in securing our systems (Art. 6(1)(f)). Records are kept for the duration of the subscription and for a defined period afterwards for audit and security purposes.
5. Job applicants
Applications sent to us are processed only to assess the application, on the basis of steps prior to a possible employment relationship. Unsuccessful applications are deleted within six months unless you agree to us keeping them longer.
6. Medical professionals in our databases
What we do and why
Explicatos researches the professional and scientific activity of medical professionals and makes structured professional profiles available to organisations in the pharmaceutical and medical device sectors. Those organisations use them to identify appropriate experts for scientific exchange, clinical research, advisory activity, medical education and congress programmes.
The purpose of our databases is the systematic mapping of fields of medical activity and of the specialists who practise in them.
Categories of data
We process professional information only: full name; professional email address and the institutional address and telephone of the place of work; gender; a photograph where the person has published one professionally; education, professional experience, specialisation and scientific degree; publications and authorship; participation in clinical trials; congress and event participation, including talks given; membership of professional societies; publicly accessible professional digital activity; and transfers of value disclosed by pharmaceutical companies under industry codes and national law. We also hold classifications we derive from this information.
We do not process information about religion, sexual orientation, political affiliation, health, or private life. We do not process special categories of personal data within the meaning of Art. 9 GDPR.
We do not collect or store national identification numbers (EGN), dates of birth, private addresses or private contact details. Any contact details we hold are those of the institution at which the person works.
Sources
All data is collected from publicly accessible sources. We do not obtain it from the individuals themselves. The main categories of source are:
- registers maintained by professional and branch organisations under statutory authority
- websites and registers of hospitals, universities and research institutions
- clinical trial registries, including clinicaltrials.gov
- scientific literature databases, including PubMed
- congress and event programmes, and published abstracts
- professionally published curricula vitae and institutional profile pages
- transparency and disclosure reports published by pharmaceutical companies
- publicly accessible professional digital and social channels
Because the underlying material is spread across a very large number of public websites, an exhaustive list of individual sources is not possible. We record the source of each item of information we hold, and can tell you the source of any data relating to you on request.
Legal basis
We process this data on the basis of the legitimate interests pursued by us and by our client organisations under Art. 6(1)(f) GDPR: identifying medical experts whose professional and scientific activity is relevant to a given therapeutic area, so that scientific exchange, research collaboration and medical education can be directed to the appropriate specialists.
In reaching this position we have taken into account that the data concerns professional and scientific activity rather than private life, that it is drawn from sources the individuals themselves have made public in a professional capacity, that we process no special categories of data, and that individuals may object at any time and are notified as described below. We keep a record of this assessment and will provide further information on request.
Recipients
Profiles are made available to client organisations in the pharmaceutical and medical device sectors under written contract. We also use service providers, in particular cloud hosting, which process data on our instructions under written data processing agreements.
Notification — Article 14
Where we hold an email address for a medical professional whose data we have collected, we send a notification informing them that they have been included, what categories of data we hold, and how to review, correct or be removed from the database.
Where we do not hold contact details, or where individual notification would involve disproportionate effort within the meaning of Art. 14(5)(b) GDPR given the number of individuals and the public nature of the sources, this policy serves as the public information required in those circumstances.
Retention
Profiles are kept for as long as the individual remains professionally active in a relevant field and the information remains accurate, and are reviewed and updated periodically. Data that is no longer necessary is deleted.
Your rights, and how to use them
If you are a medical professional and believe your data appears in our databases, you may exercise all the rights set out above by writing to privacy@explicatos.com. On request we will tell you what we hold about you and where each item came from.
Right to object. Because this processing relies on legitimate interests, you may object at any time on grounds relating to your particular situation, under Art. 21(1) GDPR. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is needed for legal claims. In practice, we remove the profile.
Where we have already supplied your data to a client, we will inform that client of your correction or erasure request, unless this proves impossible or would involve disproportionate effort.
7. International transfers
Personal data is stored on servers within the European Union. Our hosting provider, DigitalOcean LLC, is established in the United States; where its personnel may access data for support or maintenance, this is covered by a data processing agreement incorporating the European Commission’s Standard Contractual Clauses.
We do not otherwise transfer personal data outside the European Economic Area.
8. Security
We apply technical and organisational measures appropriate to the risk, including access control on a need-to-know basis, individual user accounts and passwords, encryption of data in transit, backups, contractual security guarantees from our cloud provider, written confidentiality undertakings from everyone who processes data on our behalf, and periodic internal review of compliance at least twice a year.
9. Children
Our services are directed to businesses and professionals and are not intended for children. Under Art. 25c of the Bulgarian Personal Data Protection Act, a child must be at least 14 for consent to be valid in connection with information society services. We do not knowingly process children’s personal data.
10. Changes
We may update this policy. The current version is always available at this address, with its version number and effective date shown at the top. Where changes are material we take reasonable steps to notify those affected.
11. Contact
Questions about this policy: privacy@explicatos.com, or by post to „ЕКСПЛИКАТОС“ ООД, ul. Rodopski Izvor 72, entr. A, floor 3, ap. 12, Vitosha district, Sofia 1618, Bulgaria.