Privacy policy

For any privacy-related inquiries, you can contact our Data Protection Officer via email at dataprotection@aurevia.com. 

Privacy policy for job applicants

Privacy notice for direct electronic marketing and personalized sales activities

1 WHAT IS THE PURPOSE OF THIS DATA PRIVACY NOTICE? 

In this data privacy notice, we describe the processing of personal data for business-to-business direct electronic marketing and personalized sales activities.

1.1 WHAT IS THE DIFFERENCE BETWEEN DIRECT ELECTRONIC MARKETING AND PERSONALIZED SALES ACTIVITIES?

By direct electronic marketing, we are referring to non-customized marketing messages sent typically by email. By personalized sales activities, we are referring to customized messages and calls from our sales personnel.

2 WHO IS THE CONTROLLER?

Aurevia Ltd., Kumpulantie 15, 00520 Helsinki, Finland, Business ID 0110079-1.

2.1 THE CHANGE OF NAME OF THE CONTROLLER

The company name changed from Labquality Ltd. to Aurevia Ltd. effective 7.1.2025. The business ID remains the same.

 3 WHO IS THE CONTACT PERSON FOR PERSONAL DATA PROCESSING?

In all data protection-related questions, you can contact our Data Protection Officer at
dataprotection@aurevia.com.

4 WHAT IS THE PURPOSE OF PROCESSING?

There are two purposes for processing described in this data privacy notice: 
•    Personalized sales activities
•    Direct electronic marketing  

5 SCOPE

This data privacy notice addresses processing of contact data exclusively for the two processing purposes described above (section 4). Aurevia also processes contact personal data for other processing purposes such as invoicing and communicating about current and past deliveries. These processing purposes are described in our other data privacy policies.

Should there be any conflict between this data privacy notice and the other notices regarding processing purposes described above (section 4), then this data privacy policy is applied.

6 WHAT IS THE LEGAL BASIS FOR PROCESSING?

The determination of the legal basis is based on GDPR (Art 6.) and national legislation concerning direct electronic marketing.

Sweden 
Legitimate interest for direct electronic marketing and legitimate interest for personalized sales activities.

Finland 
Consent for direct electronic marketing and legitimate interest for personalized sales activities. Aurevia Ltd. will initiate the change of legal basis for Finland direct electronic marketing Q1/2025 from consent to legitimate interest. The data subjects will be informed by email one month before the change becomes effective.

Poland 
Consent for direct electronic marketing and legitimate interest for personalized sales activities. Reference: the Electronic Communications Act.

Germany 
Consent for direct electronic marketing and legitimate interest for personalized sales activities. We ensure that for personalized sales contacts the conditions for presumed consent are met. Reference: the German Unfair Competition Act.

Other European countries 
Consent for direct electronic marketing and legitimate interest for personalized sales contacts.

6.1 LEGITIMATE INTERESTS

When we rely on legitimate interest, our interest is to maintain and develop business-to-business relationships, inform relevant professional contacts about Aurevia’s services and events, and respond to expressed needs in the healthcare quality and compliance field. We always balance these interests against your rights and expectations, and you can object at any time.

7 WHAT INFORMATION IS PROCESSED?

Data subject basic information:

• Name
• Phone number
• Email address
• Address
• Title
• Country of residence
• Affiliate organization

There is also supplementary information such as applicable legal basis per country and marketing contact status.

7.1 WHY IS COUNTRY INFORMATION INCLUDED?

Country information is included for us to able to comply with country-specific national legislation.

8 WHAT ARE THE SOURCES OF INFORMATION?

Marketing and sales contact data are collected from several sources:

• The contact has proactively contacted Aurevia (info mail, webpage, direct contact, phone call).
• The contact has made public the need for services provided by Aurevia or its competitors.
• The contact has met our staff member (live or virtual) in a conference or other relevant business setting.
• The contact has been referred by a member of his/her organization.
• The contact is in a position that is expected to be directly relevant for the services provided by Aurevia.
• The contact information is presented in a context that is relevant for Aurevia services (public tenders, public funding decisions, information on websites, etc.).

9 ARE YOU DISCLOSING THE INFORMATION TO 3RD PARTIES?

We use the vendor Hubspot CRM system as our contact information database (controller-to-processor transfer). We are transferring data outside of the EU to USA. The legal basis of transfer is the EU-USA adequacy decision. Hubspot is a registered member of the Data Privacy Framework program.

Besides HubSpot, we might also share contact data with reliable IT and communications service providers who process this information for us. Each of these providers is obligated by data processing agreements.

10 HOW DO YOU PROTECT MY DATA?

For more information about Hubspot CRM system data security features, please visit https://www.hubspot.com/. Our users have individualized accounts to the Hubspot CRM system and actions of the users are logged.

11 HOW LONG YOU WILL STORE THE DATA?

We store your data for 10 years from:

• Date of addition of your contact data to the database OR
• Last date of purchase,

whichever is later. The storage duration is justified by the length of the lifecycle of drugs, medical devices, and quality systems.

12 IS THERE AUTOMATED PROFILING?

No.

13 WHAT ARE THE RIGHTS OF THE DATA SUBJECTS?

The data subjects have the following rights:

• Right to know what data is being processed
• Right to get data corrected
• Right to get data ported
• Right to restrict processing
• Right to complain to authorities
• Right to get data deleted
• Right to cancel consent

If you wish to exercise your rights, please contact us and we will assess your request in the context of the legal basis applied and relevant national supplementary legislation. 

13.1 WHO TO CONTACT?

Direct all inquiries to the Data Protection Officer at dataprotection@aurevia.com.

13.2 RIGHT TO OBJECT TO MARKETING

You have the right to opt out of direct electronic marketing at any time. Simply click the unsubscribe link in the message or email us at dataprotection@aurevia.com. Once you opt out, we will promptly stop sending you marketing materials.

14 HOW DO YOU INFORM ABOUT UPDATES?

Minor updates are published as a new version of this data privacy notice without additional communication. Major updates are communicated to you with a separate data protection message on our website or by email.

14.1 WHAT ARE MAJOR UPDATES?

• Controller to controller disclosures
• Change of legal basis of processing

15 WHO IS THE APPLICABLE DATA PROTECTION AUTHORITY?

The Office of the Data Protection Ombudsman, Finland

Street address: 
Lintulahdenkuja 4, 00530 Helsinki, Finland 

Postal address: 
PL 800, 00531 Helsinki, Finland

Switchboard: +358 29 566 6700

Registry: +358 29 566 6768

 Email (registry): tietosuoja@om.fi