Privacy Policy
1. Introduction
HCPC Brands Europe B.V. ("HCPC Brands", "we", "us", "our"), registered in the Netherlands at Papaverweg 34, 1032 KJ Amsterdam, respects your privacy and is committed to protecting the personal data you share with us. This Policy explains what personal data we collect, why, how we use it, and what rights you have under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Dutch Implementation Act (UAVG).
2. Data Controller
| Company | HCPC Brands Europe B.V. |
|---|---|
| Address | Papaverweg 34, 1032 KJ Amsterdam, Netherlands |
| privacy@hcpcbrands.com |
3. What Personal Data We Collect
- Name, job title, employer, email, phone, and postal address you provide to us
- Information submitted via our contact form, including product portfolio and regulatory requirements
- Data provided in the context of a Responsible Person mandate, including formulation data and Product Information Files (PIF)
- Data contained in a cosmetovigilance report or consumer complaint, which may include data concerning health and, where the reporter provides them, their contact details
- Automatically collected website data: IP address, browser type, pages visited, the language-preference cookie, and the IP address and browser data sent to Google when web fonts load or when you choose to load the map
4. Purposes and Legal Basis
- Performance of a contract - to provide RP, PIF, CPSR, cosmetovigilance, SDS, UFI/PCN, EU Representative and GPSR services
- Legitimate interest - to respond to enquiries, maintain business relationships, and send information about our services to professional contacts; you can object to that marketing at any time and we stop. Electronic marketing is sent only where permitted by the applicable communications rules, including consent where required or a valid statutory exception
- Legal obligation - to comply with reporting obligations under Regulation (EC) 1223/2009
- Consent - for non-essential cookies and the optional loading of the map; withdrawable at any time
- Health data (Article 9 GDPR) - a cosmetovigilance report may contain data concerning health, which requires an Article 6 basis and a condition under Article 9(2). We do not treat those two conditions as interchangeable. For the statutory duty to assess and notify serious undesirable effects, we rely on Article 6(1)(c) together with Article 9(2)(i): processing necessary for reasons of public interest in the area of public health, on the basis of Union law - Article 23 of Regulation (EC) No 1223/2009 - with the safeguards Article 9(2)(i) requires, namely restricted access, professional confidentiality, pseudonymisation as soon as identification is no longer needed, and retention limited to the vigilance purpose. For optional processing outside our statutory vigilance duties, we obtain explicit, informed consent before processing identifiable health data, where consent is an appropriate basis under Articles 6 and 9. Receiving health information unprompted is not in itself consent: we ask for it separately, for a defined purpose, and record when it was given and how it can be withdrawn. Pseudonymised health data remains subject to the GDPR, including Articles 6 and 9. Only data rendered genuinely anonymous falls outside its scope. We delete or anonymise data when retention is no longer necessary; any continued pseudonymised retention requires a documented purpose, legal basis and retention period.
Overview per processing activity
The table below sets out, for each category of personal data, why we process it, on what legal basis, who receives it, how long we keep it, and whether it leaves the European Economic Area. Where a category is processed for more than one purpose, each purpose has its own basis and its own retention period.
| Data category | Purpose | Legal basis | Recipients | Retention | Outside the EEA |
|---|---|---|---|---|---|
| Contact details of client staff (name, role, employer, email, phone) | Delivering the agreed services and communicating about them | Performance of a contract (Art. 6(1)(b)) where that individual is personally a party to the contract; otherwise legitimate interest (Art. 6(1)(f)) in performing the engagement with the client organisation | Our own staff; our IT and hosting providers as processors | For the duration of the engagement and afterwards only as long as the specific record is still needed; where a record forms part of our financial administration, the retention period in the row for that administration applies to it | A transfer outside the EEA requires an applicable Chapter V GDPR mechanism, such as an adequacy decision covering the recipient or appropriate safeguards under Article 46. The applicable mechanism depends on the recipient, country and service. |
| Enquiry data submitted through the contact form | Answering the enquiry and, where it leads to one, preparing an engagement | Legitimate interest (Art. 6(1)(f)); steps prior to a contract (Art. 6(1)(b)) only towards the individual who would be a party to that contract | Our own staff; our IT and hosting providers as processors | Two years from the last contact, unless a contractual relationship follows | No |
| Cosmetic dossier data (formulations, PIF, safety report, CPNP notification) | Compiling and maintaining the dossier and notifying the product | Article 6(1)(c) GDPR where a legal obligation applies to HCPC in the relevant role; Article 6(1)(b) only where necessary for a contract with the individual concerned; otherwise Article 6(1)(f) where justified by the legitimate interest in performing the client engagement. | Competent authorities; the safety assessor engaged for the CPSR; the CPNP portal | Ten years following the date on which the last batch was placed on the market (Art. 11 of Regulation (EC) No 1223/2009) | No |
| Chemical dossier data (safety data sheets, C&L and PCN notifications) | Preparing the documentation and making the required notifications | Article 6(1)(c) GDPR where a legal obligation applies to HCPC in the relevant role; Article 6(1)(b) only where necessary for a contract with the individual concerned; otherwise Article 6(1)(f) where justified by the legitimate interest in performing the client engagement. | Competent authorities and poison centres; ECHA portals as required | Under Article 36 REACH, the relevant duty holder must retain the information required to meet its REACH obligations for at least ten years after it last manufactured, imported, supplied or used the substance or mixture, as applicable. This does not automatically set the retention period for every personal record or PCN document. | No |
| Cosmetovigilance reports, including data concerning health | Assessing, notifying and following up undesirable effects | Legal obligation (Art. 6(1)(c)) with Art. 9(2)(i); explicit consent (Art. 6(1)(a) with Art. 9(2)(a)) for optional processing beyond that duty | Competent authorities; the safety assessor where the assessment requires it; the client whose product the case concerns | Only as long as the case requires; the regulatory record is kept in the dossier for the period stated in the cosmetic dossier row | A transfer outside the EEA requires an applicable Chapter V GDPR mechanism, such as an adequacy decision covering the recipient or appropriate safeguards under Article 46. The applicable mechanism depends on the recipient, country and service. |
| Invoicing and contract records | Administering the engagement and meeting our bookkeeping duties | Article 6(1)(c) GDPR where a legal obligation applies to HCPC in the relevant role; Article 6(1)(b) only where necessary for a contract with the individual concerned; otherwise Article 6(1)(f) where justified by the legitimate interest in performing the client engagement. | Our accountant and the tax authority where required | Seven years, the Dutch statutory retention period for business records | No |
| Server log data, including IP address | Keeping the website available and secure | Legitimate interest (Art. 6(1)(f)) in the security and availability of the site | Our hosting provider as processor | Kept only as long as needed to detect and investigate incidents, and in any case no longer than twelve months; the exact period follows the retention set on the hosting platform and we confirm it on request | No |
| Language preference cookie | Serving the site in the language you selected | Strictly necessary for a service you requested; no consent required | Our own website; the cookie value is sent to our server with each request so that the correct language version is served | One year from the moment it is set, unless you clear it earlier; the exact expiry is shown in your browser | No |
| IP address and browser data sent when web fonts load | Rendering the site typography | Legitimate interest (Art. 6(1)(f)) in a consistent presentation. The typography is loaded from Google Fonts, which means your IP address reaches Google; serving the same fonts from our own servers is the less intrusive alternative and is under review. We make the outcome of that review available on request | Google Ireland Limited, as the provider of Google Fonts | Not retained by us; Google's own policy governs any retention on its side | A transfer outside the EEA requires an applicable Chapter V GDPR mechanism, such as an adequacy decision covering the recipient or appropriate safeguards under Article 46. The applicable mechanism depends on the recipient, country and service. |
| IP address and browser data sent when you load the optional map | Showing our location after you choose to load the map | Consent (Art. 6(1)(a)); nothing is sent before you choose | Google Ireland Limited, as the provider of Google Maps | Not retained by us; Google's own policy governs any retention on its side | A transfer outside the EEA requires an applicable Chapter V GDPR mechanism, such as an adequacy decision covering the recipient or appropriate safeguards under Article 46. The applicable mechanism depends on the recipient, country and service. |
| Business contact details used for marketing | Sending information about our services to professional contacts | Legitimate interest (Art. 6(1)(f)) in direct marketing to business contacts; you can object at any time and we stop. Electronic marketing is sent only where the applicable communications rules permit it | Our own staff; our IT and hosting providers as processors | Until you object, and in any case no longer than two years after the last contact | No |
Where we receive personal data indirectly - for example the details of a client's staff, or the contact details of a consumer who reported an undesirable effect - we provide the information required by Article 14 GDPR within its applicable time limits, unless a documented exception applies. We name the source of the data and the categories concerned. A client may deliver our notice on our behalf, but that does not remove our responsibility. Where we rely on the exception in Article 14(5)(a), we verify that the individual already has the required information. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
5. Data Retention
The regulatory file (PIF, including the safety report and the record of undesirable effects) is kept accessible for ten years following the date on which the last batch of the cosmetic product was placed on the EU market, per Article 11 of Regulation (EC) 1223/2009. That obligation concerns the regulatory file itself; it is not an automatic basis for keeping every identifiable complaint or health record for the same period. Identifiable complaint and health data is therefore retained separately, only for as long as it is needed for the assessment, notification and follow-up of the case, after which it is deleted or anonymised while the regulatory file retains the information in the form the Regulation requires. Pseudonymised records still count as personal data, so any pseudonymised retention beyond that point has its own documented purpose, legal basis and period. General enquiry data is retained for up to 2 years unless a contractual relationship is established.
6. Sharing of Personal Data
We do not sell personal data. We may share it with competent authorities (for cosmetovigilance and regulatory reporting), the qualified safety assessor engaged for a CPSR, IT and hosting providers under a Data Processing Agreement, and professional advisers where necessary. Loading our web fonts, and the map if you choose to load it, sends your IP address and browser data to Google Ireland Limited. That connection alone sets no cookie; the map, once loaded, may set cookies and other storage of its own. Where Google Ireland Limited transfers data on to Google LLC in the United States, Google states that it relies on the EU-US Data Privacy Framework and on standard contractual clauses; that is the route Google states; we assess for our own processing which Chapter V route applies before relying on it. Apart from a client established outside the EEA, to whom we may send case information under standard contractual clauses, we make no transfers outside the EEA.
7. Your Rights Under the GDPR
- Right of access, rectification, erasure, restriction, portability, and objection
- Right to withdraw consent at any time
- Right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)
To exercise any of these rights, contact us at privacy@hcpcbrands.com. We respond within one month, as required under the GDPR.
8. Security & Cookies
We implement appropriate technical and organisational measures to protect your data. On a standard page we place one strictly functional cookie to remember your selected language, and we load web fonts from Google Fonts; we do not place tracking, advertising or analytics cookies ourselves. The optional map is loaded only if you choose to load it, and Google may then set cookies of its own. See our Cookie Policy for the complete overview and for how to reverse that choice.
9. Contact
| Data Protection Contact | privacy@hcpcbrands.com |
|---|---|
| Postal Address | HCPC Brands Europe B.V., Papaverweg 34, 1032 KJ Amsterdam, Netherlands |
This Privacy Policy may be updated from time to time. The effective date above indicates the last revision.