Whistleblowing Platform Privacy Statement

Whistleblowing Policy and Data Protection & Privacy Notice

The information you provide through this platform will be processed by Pharmaron Beijing Co., Ltd. (hereinafter referred to as “Pharmaron Beijing”), or any of those companies, partnerships and other legal persons which are directly or indirectly controlled by Pharmaron Beijing Co., Ltd (“Pharmaron”, the “Company”, “we” or “us”). 

We will as personal information handler or data controller operate the whistleblower channels and are committed to protecting your personal data. To ensure that you can make informed decisions and feel confident about choosing to share personal data with us through our whistleblower channels, please read this Whistleblowing Policy and Data Protection & Privacy Notice (hereinafter referred to as the “Privacy Notice”).

If you do not accept the terms below, we are unable to process any information through this platform and suggest you contact your supervisor or manager to discuss the matter further.

  1. General

This service is a web and phone-based intake system provided by Pharmaron to individuals for reporting suspected violations of laws, regulations, Pharmaron’s policies, and/or other obligations of Pharmaron.

  1. Use of this service

Use of this service is entirely voluntary. You are encouraged to report possible violations directly to your supervisors or managers. If you feel that you are unable to do so, you may use this service to make your report.

This service is a confidential online reporting system that allows you to report on certain matters related to suspected violations of law or Pharmaron’s policies, as well as other concerns you may have, to Pharmaron. Your personal data will be processed for the purpose of investigating these reports and taking any necessary or appropriate action. If you have any reasonable suspicion in respect of any director, supervisor and/or any other senior management member of the Company, you may also report the suspicion through the whistleblowing channels set forth herein. For the avoidance of doubt, applicable laws and regulations require the directors, supervisors and other senior management members of the Company to undertake their corresponding statutory obligations, and the Company’s Whistleblower policy is not in the position to replace or affect such statutory obligations.

Please be aware that the information you submit about yourself, your colleagues, or any aspect of the Pharmaron’s operations may result in decisions that affect others. Therefore, we ask that you only provide information that you reasonably believe is true. You will not be subject to retaliation from us for any report of a suspected violation that is made in good faith, even if it later turns out to be factually incorrect. Please be aware, however, that we oppose malicious whistleblowing, and knowingly providing false or misleading information will not be tolerated. If any whistleblowing proves to be an intentional fabrication, a frame-up or malicious slander according to investigation findings, we will take measures to protect the legitimate rights and interests of the relevant employees and impose punishment against the act of the malicious whistleblowing in accordance with our regulations.

You may choose to submit whistleblowing with your real names or anonymously. The information you submit will be treated confidentially except in cases where this is not possible because of legal requirements or in order to conduct an investigation, in which case the information will be handled sensitively. We encourage you to identify yourself in order for us to follow up with questions we may have.

You must specify the subjects and the underlying facts of the whistleblowing, following the principles of objectivity and authenticity. When submitting the whistleblowing information, please follow the below instructions as far as possible:

  • Clearly describing the underlying facts, including the names of persons, the time, places and events, etc. involved;
  • Providing valid information or evidence in as much detail as possible; and
  • Writing clearly, where the whistleblowing is in writing. 

You are obligated to cooperate with our authorized investigators after submitting the whistleblowing. You must use your best efforts to provide evidence and specific information about the subject matter of the whistleblowing in order to enable us to conduct necessary review and investigation prior to imposing any disciplinary action. Supporting evidence may be in the form of written or electronic documents. Such evidence may include external or our internal documents, emails or records, etc.

  1. Types of personal data and legal basis

Pharmaron may collect and process personal data about you on the following legal bases:

  1. Legitimate interest: To the extent permitted under the applicable law, Pharmaron may collect and process personal data about you for the purpose of pursuing a legitimate interest of Pharmaron, including to ensure compliance with applicable laws and regulations during the ordinary course of business and facilitate the provision of information regarding a suspected breach of such compliance. 
  2. To comply with a legal requirement: Pharmaron may collect and process personal data about you for the purpose of complying with legal requirement imposed by law, regulation or other national rules specific for the reported concern if applicable in accordance with China’s Personal Information Protection Law (“PIPL”), the EU General Data Protection Regulation (“GDPR”), UK GDPR, etc.
  3. Your Consent: Where required under applicable law, Pharmaron will seek your consent to Pharmaron’s collection and processing of personal data about you, provided that such consent can be withdrawn by you at any time. However, please note that the withdrawal of your consent does not affect the lawfulness of any processing that occurred before its withdrawal.

For the purpose above, this service captures the following personal data and information that you provide when you make a report:

(i) your name and contact details (unless you report anonymously) and whether you are employed by the Pharmaron;

(ii) the name and other personal data of the persons you name in your report if you provide such information (i.e.: description of functions and contact details); and

(iii) a description of the alleged misconduct as well as a description of the circumstances of the incident.

Your personal data will be treated confidentially and will only be disclosed as set out below.

  1. How will the personal data and information be processed after your report and who may access personal data and information?

For the purpose of processing and investigating your report and subject to the provisions of local law, the personal data and information you provide may be accessed, processed and used by the relevant personnel of Pharmaron at the need-to-know basis, including Human Resources, Finance, Internal Audit, Legal, Compliance, management, external advisors (e.g. legal advisors), or, in limited circumstances, by technical staff at Pharmaron and data storage vendors. 

Personal data and information you provide may also be disclosed to the police and/or other enforcement or regulatory authorities, or any third party to whom we may choose to sell, transfer or merge parts of our business or our assets. 

The relevant bodies that may receive and process personal data are located in China, UK and US and we take measures to ensure that personal data is adequately protected.

We operate on a global basis. Accordingly, your personal data may be transferred to and stored in overseas affiliates and locations for the purpose of processing and investigating your report, including affiliated companies within the Pharmaron Group outside your country of origin such as Pharmaron Beijing Co., Ltd. in China, Pharmaron UK Limited in the UK, and Pharmaron, Inc. in the US. These affiliates and locations may be subject to different standards of data protection. Pharmaron has reviewed its global internal security standards to confirm that suitable protection for personal data exists within our working environments and IT infrastructure. Pharmaron has also implemented a group data sharing agreement incorporating specific contractual clause designed to protect the transfer and subsequent processing of personal data. 

To the extent required by applicable laws, where your personal data is transferred to any third party overseas (as identified above) and the recipient is based in a jurisdiction that has not been deemed to provide adequate protection of personal data, we will put in place specific contractual protections approved by the relevant data protection regulator. For example, for any transfers of personal data from the UK to a jurisdiction outside the UK, we will use the specific contractual protections approved by the Information Commissioner’s Office.  

For more information about how Pharmaron protects your personal data and the specific contractual safeguards in place, please contact us using the details provided below.  

Please note that applicable laws and regulations may limit or prohibit cross-border transfer of certain data you provide from your country of origin. By submitting such data via Pharmaron’s whistleblower channels, the data may be transferred overseas, and you should take measures to ensure the cross-border data transfer will comply with the applicable laws and regulations.

The personal data you provide will be kept as long as necessary to process your report, or, if applicable, as long as necessary to initiate sanctions or to meet legal or regulatory requirements. After the relevant processing purposes are realized, we will either (a) delete or irreversibly anonymize the personal data, or (b) stop all processing activities in connection with the personal data (except for storing the same with necessary security measures), if we are legally required to keep those data for a longer period of time.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

  1. Accessing information concerning the report

With some exceptions, the subject of the report may request access to information and request correction of personal data that is inaccurate or incomplete, without prejudice to the investigation process and implementation of other applicable laws and regulations. Similarly, with some exceptions, reporters may also access information about the report and request corrections of their personal data in accordance with applicable laws. To make any such corrections, please contact us in the way mentioned below.

  1. How to exercise your choices and rights about your personal data?

Under applicable data protections laws, you have the following rights:

The right to information and access: You have the right to ask us for information about or access to your personal data.

The right to object: You have the right to object to our processing (using) your personal data. This effectively means that you can stop or prevent us from using your personal data. However, it only applies in certain circumstances, and we may not need to stop the processing of your personal data if we can give legitimate reasons to continue using your personal data.

The right to rectification: You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete personal data you think is incomplete.

The right to restriction of processing: You have the right to ask us to restrict the processing of your personal data in certain circumstances.

The right to complain: In the first instance, we would welcome the opportunity to address any complaints you may have about how we use your personal data, and ask that you direct any complaints to us at the contact details set out below. You may also lodge a complaint with the local data protection authority where you reside.

The right to erasure: You have the right to request that Pharmaron erases or deletes your personal data in certain circumstances.

The right to data portability: You have the right to request that Pharmaron transfers the data that we have collected to another organization, or directly to you, under certain circumstances.

Automated individual decision-making: You have the right to ask us not to subject you to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We currently do not engage in such profiling and will notify you prior to doing so.

Considering the protection of whistleblowers, prevention of retaliation, by following the legal requirements from the applicable laws and regulations, including but not limited to PIPL, GDPR, UK GDPR, etc., there are some exemptions for the subject of a report to exercise the above choices and rights, which means their exercising of the above choices and rights may not always be entirely fulfilled.

This Privacy Notice may change from time to time. We will provide information about material changes and seek your consent if required by applicable law. To assist us in ensuring that we can provide the most accurate information possible, we ask that you check this Privacy Notice for updates. We also ask that where we have an ongoing relationship with you and any of the data you have provided is no longer accurate, you keep us informed of this so that we can amend our records accordingly.