BRD – Biotechnology Research and Documentation S.r.l.
(hereinafter “BRD” or the “Company”) is committed to protecting the personal data of all individuals with whom it interacts, including website visitors, clients, clinical trial participants, investigators, suppliers, and other business contacts.
This Privacy Policy (“Policy”) describes how we collect, use, disclose, and safeguard personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”) and the Italian Personal Data Protection Code (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018), as well as any other applicable national or sector-specific legislation.
Please read this Policy carefully. By accessing our website or engaging with our services, you acknowledge that you have read and understood its contents.
Data Controller
The Data Controller, within the meaning of Article 4(7) GDPR, is:
BRD – Biotechnology Research and Documentation S.r.l.
Via Francesco Sforza 15, 20122 Milano (MI) – Italy
P.IVA (VAT): 11354020965
E-mail: info@brd-cro.com
BRD may also act as a Data Processor on behalf of its clients (sponsors of clinical studies) pursuant to Article 28 GDPR. In those cases, the relevant Data Processing Agreement between BRD and the sponsor governs the processing activities.
Data Protection Officer (DPO)
Where required under Article 37 GDPR (e.g., in the context of large-scale processing of special categories of data related to clinical research), BRD appoints a Data Protection Officer. If a DPO has been designated, their contact details are:
DPO Contact: info@brd-cro.com
Requests addressed to the DPO will be treated with strict confidentiality.
Types of Personal Data Collected
Depending on the nature of your relationship with BRD, we may collect the following categories of personal data:
3.1 Website Visitors
- Technical and navigation data (IP address, browser type, pages visited, access timestamps) collected automatically via server logs and cookies;
- Contact information voluntarily provided through the contact form (name, e-mail address, message content);
- Newsletter subscription data (e-mail address).
3.2 Clients, Sponsors & Business Partners
- Identification data (name, surname, job title, organisation);
- Contact data (e-mail address, telephone number, business address);
- Financial and contractual data (bank details, VAT number, purchase orders, invoices);
- Communications exchanged in the context of service delivery.
3.3 Clinical Trial Participants (where applicable)
Special Category Data. Clinical research activities may involve the processing of health data (Article 9 GDPR). Such processing is governed by specific, separate information notices provided to participants at the time of enrolment, in compliance with ICH/GCP guidelines, the applicable Ethics Committee opinion, and sector-specific Italian regulations (including D.Lgs. 211/2003 and D.Lgs. 52/2019).
- Identification data and health information;
- Data contained in Case Report Forms (CRFs);
- Adverse event and pharmacovigilance data.
3.4 Investigators, Site Staff & Healthcare Professionals
- Professional credentials and CVs;
- Contact and institutional affiliation data;
- Training and certification records.
3.5 Job Applicants
- CV and application documents (name, contact details, educational and professional background).
Purposes and Legal Basis for Processing
| Purpose | Legal Basis (Art. 6 GDPR) |
|---|---|
| Responding to enquiries submitted via the contact form or by e-mail | Art. 6(1)(b) – pre-contractual measures; Art. 6(1)(f) – legitimate interest |
| Provision of contracted CRO services (regulatory, monitoring, data management, biostatistics, medical writing, pharmacovigilance, project management) | Art. 6(1)(b) – contract performance |
| Management of clinical trials (incl. processing of participants’ health data) | Art. 6(1)(c) – legal obligation; Art. 9(2)(i) and (j) – public interest / scientific research, supported by adequate safeguards |
| Pharmacovigilance obligations (SAE reporting, periodic safety reports) | Art. 6(1)(c) – legal obligation (EU and national pharmacovigilance regulations) |
| Website analytics and improvement (cookieless / privacy-respecting analytics) | Art. 6(1)(f) – legitimate interest |
| Newsletter and service updates | Art. 6(1)(a) – consent (freely given, specific, informed, and withdrawable at any time) |
| Accounting, invoicing, and tax obligations | Art. 6(1)(c) – legal obligation |
| Management of job applications | Art. 6(1)(b) – pre-contractual steps; Art. 6(1)(a) – consent for retention beyond selection |
| Establishment, exercise, or defence of legal claims | Art. 6(1)(f) – legitimate interest; Art. 9(2)(f) for health data |
Where processing is based on consent (Article 6(1)(a) GDPR), you have the right to withdraw it at any time without affecting the lawfulness of prior processing.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, and in any event in compliance with applicable statutory retention periods:
- Contact enquiries: up to 24 months from the last interaction, unless a contractual relationship is established;
- Client and contractual data: 10 years from the end of the contractual relationship, in accordance with Italian civil and tax law (Art. 2220 Codice Civile; D.P.R. 600/1973);
- Clinical trial data: as required by the applicable clinical trial regulation (minimum 25 years from trial completion, or longer if mandated by GCP guidelines or sponsor requirements);
- Pharmacovigilance records: as required by EU and national pharmacovigilance legislation;
- Newsletter subscriptions: until withdrawal of consent;
- Job applications: 12 months unless you consent to a longer retention period;
- Accounting records: 10 years as required by Italian law.
Upon expiry of the retention period, data are securely deleted or irreversibly anonymised.
Data Recipients and Disclosures
Your personal data may be shared with the following categories of recipients, strictly on a need-to-know basis:
- Sponsors and co-investigators in clinical trials (under Data Processing Agreements or Joint Controller arrangements);
- Regulatory authorities and Ethics Committees (AIFA, EMA, IRBs) when legally required;
- IT and cloud service providers acting as Data Processors pursuant to Article 28 GDPR;
- Professional advisors (lawyers, auditors, accountants) bound by confidentiality obligations;
- Banks and payment service providers for financial transactions;
- Judicial, law enforcement, or supervisory authorities when required by law or court order.
BRD does not sell, rent, or trade personal data to third parties for commercial or marketing purposes.
International Transfers Outside the EEA
In the context of multi-national clinical trials or when using cloud infrastructure, personal data may be transferred to countries outside the European Economic Area (EEA). Any such transfer is carried out only if one of the following conditions is met:
- The European Commission has issued an adequacy decision for the destination country (Article 45 GDPR);
- Appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission (Article 46 GDPR), supplemented by a Transfer Impact Assessment where required;
- A specific exception (derogation) under Article 49 GDPR applies, such as explicit consent or the necessity for the performance of a contract.
You may request further information on transfer mechanisms by contacting us at the address indicated in Section
Cookie Policy
Our website uses cookies and similar tracking technologies. Cookies are small text files stored on your device when you visit a website.
8.1 Categories of Cookies We Use
- Strictly necessary cookies: essential for the website to function correctly. They do not require your consent (Art. 122 D.Lgs. 196/2003; Italian DPA guidelines).
- Analytics cookies: used to understand how visitors interact with the website. We use only privacy-preserving analytics (anonymised/aggregated data). Where third-party analytics tools are used, they are configured to anonymise IP addresses and disable data sharing with the tool provider.
- Preference cookies: remember your settings and choices to improve your experience.
- Marketing/profiling cookies: BRD does not currently use profiling cookies for advertising purposes.
8.2 Managing Cookies
You may accept, reject, or customise non-essential cookies through the cookie banner displayed on your first visit. You may change your preferences at any time via the cookie settings link in the website footer. You can also configure your browser to block or delete cookies; please refer to your browser’s help documentation.
Note that disabling certain cookies may affect the functionality of the website.
Your Rights as a Data Subject
Under Chapter III of the GDPR and the Italian Data Protection Code, you have the following rights with respect to your personal data:
Right of Access (Art. 15)
Obtain confirmation of whether your data is being processed and receive a copy of it.
Right to Rectification (Art. 16)
Request correction of inaccurate or incomplete personal data.
Right to Erasure (Art. 17)
Request deletion of your data where no longer necessary, or where consent is withdrawn and no other legal basis applies.
Right to Restriction (Art. 18)
Request that we limit the processing of your data in specific circumstances.
Right to Data Portability (Art. 20)
Receive your data in a structured, machine-readable format or have it transmitted to another controller (where technically feasible).
Right to Object (Art. 21)
Object to processing based on legitimate interest or for direct marketing purposes.
Automated Decision-Making (Art. 22)
Not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
Right to Withdraw Consent
Withdraw consent at any time, without affecting prior lawful processing based on that consent.
How to Exercise Your Rights
To exercise any of the above rights, please submit a written request to info@brd-cro.com or by post to the address in follow section. We will respond within 30 days of receipt; this period may be extended by up to two additional months for complex or high-volume requests, in which case we will notify you of the extension and the reasons for it.
We may request proof of your identity before processing your request in order to protect the security of your data.
Right to Lodge a Complaint
If you consider that the processing of your personal data infringes the GDPR or applicable Italian law, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali):
Garante per la Protezione dei Dati Personali
Piazza Venezia 11, 00187 Roma – Italy
Website: www.garanteprivacy.it
E-mail: garante@gpdp.it
You also have the right to lodge a complaint with the supervisory authority of your habitual place of residence or place of work within the EU/EEA.
Security Measures
BRD implements appropriate technical and organisational security measures in accordance with Article 32 GDPR and the principles of data protection by design and by default (Article 25 GDPR), including:
- Encryption of personal data in transit (TLS/HTTPS) and, where appropriate, at rest;
- Access control and role-based permissions ensuring that only authorised personnel access personal data;
- Regular staff training on data protection and information security;
- Pseudonymisation of clinical trial data where applicable;
- Regular review and testing of security procedures;
- Business continuity and data backup procedures.
In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, BRD will notify the Garante per la Protezione dei Dati Personali within 72 hours (Article 33 GDPR) and, where the breach is likely to result in a high risk, will communicate directly with affected individuals without undue delay (Article 34 GDPR).
Children’s Privacy
Our website and general services are not directed to children under the age of 14 (the minimum age for valid consent under Italian law, pursuant to Article 2-quinquies D.Lgs. 196/2003). We do not knowingly collect personal data from children under 14 through our website without verifiable parental consent.
In clinical research contexts involving paediatric participants, processing is carried out in compliance with specific ethical approvals, parental or guardian consent, and applicable regulations including EU Paediatric Regulation (EC) No 1901/2006.
Updates to This Policy
BRD reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our internal data processing activities. The date of the last revision is indicated in the header of this document.
Where changes are material, we will notify registered users or newsletter subscribers by e-mail. We encourage you to review this Policy periodically. Continued use of our website following any update constitutes acceptance of the revised Policy.