Data Protection Notice for BD Customers - Europe

BD is advancing the world of health by improving medical discovery, diagnostics and the delivery of care. In doing so, we collect, process and use large quantities of personal information. We collect and use information from customers, healthcare professionals, patients, business partners and other external parties with whom we interact. BD* takes data privacy seriously and believes that carrying out our business activities in compliance with applicable data protection laws and in accordance with sustainable corporate governance is fundamental to our business success.

This Data Protection Notice for BD* Customers - Europe (“Notice”) explains our practices as the responsible controller in relation to the collection, processing and use of personal data of individuals at BD’s customers and prospective customers who are located in the European Economic Area or Switzerland (or to whom EU data protection law otherwise applies).  Such individuals may include healthcare professionals, procurement staff, technical or support staff and other staff members, as well as business contacts at hospitals, companies, institutions, purchasing organizations, distributors, wholesalers, agents and other intermediaries. If you fall into one of those categories, this Notice will help you understand what data BD may collect about you, how BD uses and safeguards that data, and with whom we may share it.

* In this Notice, BD or "we" means Becton, Dickinson and Company and all its worldwide subsidiaries and affiliates, including C.R. Bard and affiliates, each of which is referred to in this Notice as a BD Affiliate.

We may change this Notice periodically, so we encourage you to review it from time to time.

You should expect that the recipients identified above which will receive or have access to your personal data may be located inside or outside the European Economic Area (" EEA").

• For recipients located outside the EEA, some are certified under the EU-U.S. Privacy Shield and others are located in countries with adequacy decisions pursuant to Art. 45 GDPR (including Switzerland and Canada in particular), and, in each case, the transfer is thereby recognized as providing an adequate level of data protection from a European data protection law perspective.
• Other recipients might be located in countries which have not been recognized as providing an adequate level of protection from a European data protection law perspective (for example, the USA, India or Malaysia). We will take all necessary measures to ensure that transfers out of the EEA are adequately protected as required by applicable data protection law.
  • With respect to data transfers to countries not providing an adequate level of data protection, we will base the transfer on appropriate safeguards, such as standard data protection clauses adopted by the European Commission or by a supervisory authority (Art. 46(2)(c) or (d) GDPR), approved codes of conduct together with binding and enforceable commitments of the recipient (Art. 46 (2)(e) GDPR), or approved certification mechanisms together with binding and enforceable commitments of the recipient (Art. 46 (2)(f) GDPR). You can ask for a copy of such appropriate safeguards by contacting us as set out in Section 7 below.
  • Data transfers to BD Affiliates is protected by standard data protection clauses adopted by the European Commission (Art. 46(2)(c) or (d) GDPR).
  • Data transfers to processors which are neither certified under the EU-U.S. Privacy Shield nor in a country with an adequacy decision will typically also be protected by such standard data protection clauses.

Right to withdraw your consent: If, in accordance with applicable law, you have declared your consent regarding certain types of processing activities (in particular regarding the receipt of direct marketing communication via email, SMS/MMS, fax, and telephone), you can withdraw this consent at any time with respect to future processing by using the methods mentioned in the original or any related communication. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal. You can also withdraw your consent by contacting us as set out below. 

Additional data privacy rights: Pursuant to applicable data protection law, you have the right to: (i) request access to your personal data; (ii) request rectification of your personal data; (iii) request erasure of your personal data; (iv) request restriction of processing of your personal data; (v) request data portability; and/or (vi) object to the processing of your personal data. Below please find further information on your rights to the extent that the GDPR applies. Please note that these rights might be limited under the applicable local data protection law. 

• Right to request access to your personal data: As provided by applicable data protection law, you have the right to obtain from us confirmation as to whether or not personal data concerning you is processed, and, where that is the case, to request access to the personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipient to whom the personal data have been or will be disclosed. However, this is not an absolute right and the interests of other individuals may restrict your right of access. 

You have the right to obtain a copy of the personal data undergoing processing free of charge. For further copies requested by you, we may charge a reasonable fee based on administrative costs. 

• Right to request rectification: As provided by applicable data protection law, you have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement. 

• Right to request erasure (right to be forgotten): As provided by applicable data protection law, you have the right to obtain from us the erasure of personal data concerning you and we may be obliged to erase such personal data. 

• Right to request restriction of processing: As provided by applicable data protection law, you may have the right to obtain from us restrictions on the processing of your personal data. In this case, the respective data will be marked and may only be processed by us for certain purposes. 

• Right to request data portability: As provided by applicable data protection law, you may – in cases where processing is based on consent or the performance of a contract, and the processing is carried out through automated means – have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit those data to another entity without hindrance from us. 

• Right to object: Under certain circumstances, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by us and in such circumstances we are required to cease processing your personal data. If you have a right to object and if you exercise this right, your personal data will no longer be processed for such purposes by us.

This online request form enables you to submit a request to exercise your rights under GDPR. Please fill out the below form and we will address your request.

Access online request form

You may exercise this right by contacting us as stated in Section 7 below. Such a right to object may, in particular, not exist if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded. If you have given your consent to receive direct marketing via email, SMS/MMS, fax, and telephone, you may withdraw your consent as explained above.

You also have the right to lodge a complaint with the competent data protection supervisory authority in the relevant Member State (for example, the place where you live or work - contact details can be found here: https://edpb.europa.eu/about-edpb/board/members_en).

We may update this Notice from time to time in response to changing legal, regulatory or operational requirements. We will notify you of any such changes, including when they will take effect, by updating the "Last revised" date above or as otherwise required by applicable law.
Last revised: 22 November 2018