Privacy Policy(external research/IITs)

Last update: August 2026

Dear Researcher,

With this privacy policy we would like to inform you about
• what personal data we process in the context of the application process for study funding and the subsequent funding of a study,
• what we use these data for,
• how you can object to its use or withdraw your consent, and
• what other rights you have as a data subject and how you can assert them.

1. Who is responsible for data processing and whom can I contact?

The responsible body for data processing (data controller) in the sense given in the GDPR is:

Bionorica SE
Kerschensteinerstr. 11–15
92318 Neumarkt
Telephone: +49 (0) 9181 231-90
Fax: +49 (0) 9181 231-265

Our company data protection officer can be reached via email at datenschutz@bionorica.de (/mailto:datenschutz@bionorica.de) by post at the above address (please include the line ‘ATTENTION: Company Data Protection Officer’.

2. Am I obligated to provide data?

In the context of the application process for study funding and the subsequent funding of a study, you are only required to provide the personal data relating to yourself and the key members of your proposed study team which are necessary for the study funding selection process or which we are legally obligated to collect. Without these data, we will usually not be able to fund a study.

3. Which sources and data does Bionorica SE use?

We process personal data which we receive from you within the scope of the application process for study funding and the subsequent funding of a study.

The personal data we process includes, in particular:
• name and contact details such as address, telephone number and email address,
• curriculum vitae and evidence of qualifications (e.g. GxP certificates),
• remuneration of the study team members (as part of the budget information provided by you),
• as well as other data comparable to the categories mentioned above.

4. Processing purposes and legal basis

We process personal data for the purpose of reviewing submitted study proposals and the subsequent funding of studies in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) according to the following legal bases.

4.1. To fulfil contractual obligations (Art. 6 para. 1 cl. 1 lit. b of the GDPR)

Data are processed for performance of contracts concluded with you and for implementation of pre-contractual measures at your request (e.g. review of a study proposal during the application process for study funding).

4.2. Based on legitimate interests (Art. 6 para. 1 cl. 1 lit. f of the GDPR)

In addition, we process personal data beyond the scope required for performance of the contract in order to safeguard our legitimate interests. This may include, in particular, the following legitimate interests:

• maintaining appropriate commercial oversight of study funding,
• verification of qualifications of study team members.

Whilst doing so, we always assess on a case-by-case basis whether our interests in processing outweigh the interests of a data subject in non-processing.

4.3. Based on your consent ( Art. 6 para. 1 cl. 1 lit. a of the GDPR)

If you have granted us consent to process personal data for specific purposes (e.g. in the event of a transfer of data to a third country without appropriate safeguards), this processing is lawful based on this consent.

After granting your consent, you can withdraw it at any time. This also applies to the withdrawal of declarations of consent given to us before the GDPR came into effect. Please note that withdrawal of your consent does not affect the lawfulness of processing carried out up to the time of withdrawal.

You can withdraw consent free of charge by sending a formless statement to the contact given in Section 1. If you withdraw your consent by telephone, we may ask you to provide additional proof of your identity in another way.

4.4. To comply with legal obligations (Art. 6 para. 1 cl. 1 lit. c of the GDPR) or in the public interest (Art. 6 para. 1 cl. 1 lit. e of the GDPR)

Like every company, Bionorica SE has numerous legal obligations which make processing of personal data necessary. As examples, identification obligations for prevention of money laundering as well as compliance with tax obligations and regulatory documentation requirements relating to medicinal products can be stated here.

Furthermore, in a few exceptional cases, processing may be necessary in regard to public interest (e.g. the transmission of pseudonymised adverse drug reactions (e.g. side effects) and potential quality defects to the relevant authorities).

5. When is automated individual decision-making used?

We generally do not use automated decision-making according to Art. 22 GDPR in the context of the application process for study funding and the subsequent funding of a study. If we employ these techniques in individual cases, we will inform you about this separately insofar as we are required to do so by law.

6. Who gets my data?

Within Bionorica SE, access to your data is granted to those positions and departments that require it for the purposes of our lawful processing.

Carefully selected and controlled service providers engaged by us may also be granted access to data. Such service providers are obligated within the framework of commissioned processing to comply with the data protection requirements that also apply to us. These may include, for example, companies in the fields of IT services, logistics, print services, telecommunications as well as consultancies and marketing agencies.

Data will only be disclosed to recipients outside Bionorica if we have a legal basis for doing so (e.g. legal obligation, consent or legitimate interest), unless the study is jointly funded together with another research cooperation partner.

7. Are data transferred to companies in third countries or to international organisations?

As a general rule, your personal data will not be transferred to recipients outside the European Union (so-called third countries).

However, it may be necessary to discuss your proposal with the BNO subsidiary in the sponsor's home country in order to support a comprehensive decision-making process during the application phase.

In such cases, data are only transferred to locations in countries outside the European Union if, in addition to general requirements for data transfer, there is also an adequacy decision (Art. 45 GDPR) or appropriate safeguards (Art. 46 GDPR) and, if necessary, additional measures are taken or the requirements of Art. 49 are fulfilled (for example, the corresponding consent).

8. How long are my data stored?

We process your personal data only as long as necessary for fulfilment of our processing purposes described above. Once the data are no longer needed for fulfilment of the processing purposes described above, they are erased. In addition, data may be processed on a temporary basis for the following purposes:

• fulfilment of commercial, tax or other legal retention obligations. The retention or documentation periods prescribed there are up to ten years;
• preservation of evidence in the context of the statute of limitations. Pursuant to Sections 195ff. of the German Civil Code (BGB), these statutory limitation periods can be up to 30 years, whereby the normal limitation period is three years.

If your study proposal is not selected for funding, personal data will be erased six months after our final decision, except for your name and contact details, which will be retained for five years.

In the event that funding is granted, we process the data for a period of ten years following completion of the study.

9. What rights do I have as a data subject?

As a data subject you have the right to access pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR, and the right to data portability according to Art. 20 GDPR. With respect to the right to access and the right to erasure, the limitations set forth in Sections 34 and 35 BDSG apply. You also have the right to lodge a complaint with a responsible data protection supervisory authority (Art. 77 GDPR in conjunction with Section 19 BDSG).

Furthermore, you have the right to object under Art. 21 GDPR. You can object to the processing of personal data on the basis of Art. 6 para. 1 lit. e or f GDPR at any time without giving reasons.