Privacy Statement

I am a Healthcare ProfessionalI am a Patient / Patient RepresentativeI am a Job Applicant

Galapagos (“the Company,” “we” or “us”) values your privacy and we want to be transparent about the information we collect, why we collect it, and how the information is used. For the personal data collected through this website, Galapagos NV, Generaal De Wittelaan 11 A3, 2800 Mechelen is the controller. In this way, we control the process by which your personal data is collected and the purposes for which your personal data is used.

Furthermore, we want you to know your rights regarding your personal data. This Privacy Statement addresses how we handle and protect personal data collected via the Galapagos website (“the Site”) or a related website controlled by the Company or personal data collected in the provision of any support or other services (“Services”). We strongly recommend that you read this Privacy Statement and, if you have any questions, contact us via dpo@glpg.com.

We confirm that personal data will be dealt with in accordance with the Belgian, European, and relevant United States privacy laws and regulations, including the Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data – General Data Protection Regulation (GDPR).

Personal data includes any information relating to an identified or identifiable natural person (also known as a “data subject”). This may include, but is not limited to: your name, address, email address, phone number, identification number or place of work. More information on personal data we collect can be found below in specific sections of this Privacy Statement.

We use your personal data solely for the purposes of processing your requests, to conduct our business, to develop analytics and aggregated data that allow us and our partners to improve our Site and related Services or to correspond with you. Below is a summary of the channels through which information is currently collected on the Site including the type of personal data collected via each channel and how that data is used.

We will only process your personal data if we have obtained your prior consent, if the processing is necessary to perform our contractual obligations or to take pre-contractual steps at your request, if the processing is necessary to comply with legal or regulatory obligations or if the processing is necessary for our legitimate interests.

Purpose and additional details Categories of personal data concerned Legal basis
Use of our website:
You can use our website to subscribe to press releases, to register for clinical trial updates and to contact us.
  • Identification data and contact details: name and e-mail address
  • Professional information: company you work for
  • Preferred language of communication
 Based on consent to get connected with us

 
Contact:

  • The contact page provides you with our office addresses, e-mail addresses and telephone contact information should you wish to contact us.
  • Our contact details can be found on our online reporting page or in the news section of the Site.
  • Based on the personal data you provide us, we may communicate with you in response to your inquiries, to provide the services you request.
  • We will communicate with you by e-mail or telephone, in accordance with your preference.
  • Identification data and contact details: name and e-mail address
  • Professional information: company you work for
  • Preferred language of communication
  • Any other information you wish to share with us
 Our legitimate interest to answer your question
News via e-mail:
Your name and e-mail address are kept in a database which is hosted outside the EEA. We have made the necessary efforts to ensure that the processor responsible for this database has implemented sufficient technical and organisational measures to safeguard this data.
We may also use your personal data to communicate with you regarding the following:

  • with your express consent, to contact you in the future regarding studies involving the same investigative compound or new opportunities from Galapagos that may be appropriate;
  • service-related announcements on rare occasions when it is necessary to do so. For instance, if our Services are temporarily suspended for maintenance, we might send you an email;
  • inform you about important changes to this policy or Site.
  • Identification data and contact details: name and e-mail address
  • Professional information: company you work for
  • Preferred language of communication

 

 Based on the consent which is obtained when you subscribe. Remember that you have the absolute right to unsubscribe from our e-mails at any time by using the unsubscribe link provided in each communication we send you.

Inform you about changes to the site or policy/service-related announcements: We process your personal data for these purposes on the basis of our legitimate interest to do so.
Clinical research information portals:

  • From time to time, we create information portals on the Site to provide interested parties with information regarding clinical research studies. When subscribing to future updates on these portals, you may be required to fill in a registration form.
  • We store information that we collect to create a “profile” of your preferences.
  • We use this profile to improve the content of the Services and related products in which you have expressed interest.
  • We do not share your profile with third parties other than as set forth in our Terms and Conditions for any of the Services that may be in effect from time to time.
  • Identification data and contact details: name and e-mail address
  • Country
  • Preferences

 

 We process this personal data on the basis of our legitimate interest.
Business contacts:

In case you are a business contact person for Galapagos, your personal data is used for business relationship management purposes such as maintaining the ongoing relationship with, e.g., our contractors, service providers, partners, consultants, etc
  • Identification data and contact details: name, e-mail address, telephone number
  • Professional data: organization related details, contact history, signature.
 We process this personal data on the basis of the execution of a contract.
Our customers:

In case you are a customer or prospect customer of Galapagos, your personal data is used for business development purposes such as communication on the Services and related products, organization of focus-group discussions, market studies and others.

Our customer database includes individuals with whom we had previous business relations including but not limited to researchers that participated in clinical trials, Key Opinion Leaders, (former-) members of the advisory and scientific boards, contacts gathered at events, and individuals that have contacted Galapagos.
  • Identification data and contact details: name, e-mail address, telephone number (the database also includes publicly available contact information).
  • Professional data: organization related details, contact history with Galapagos
 We process this personal data on the basis of our legitimate interest.
Healthcare Professionals:

If you are an Healthcare Professional in a business relationship with Galapagos, we suggest you to have a look at our privacy notice for HCPs.
Patient/Patient Representatives:

If you are a patient or a patient representative collaborating with us, we suggest you to have a look at our privacy notice patients/patients representatives.
Applicants:

If you are a job applicant applying for a job at Galapagos, we suggest you to have a look at our privacy notice for applicants.

You have the possibility to exercise your rights as described in the GDPR. As a data subject, you can exercise the following rights:

  • Right to information: You may request access to all personal data collected (including processing purposes, categories of personal data, estimated retention period) for inspection.
  • Right to rectification: It is important that the personal details Galapagos processes are correct and up to date. You can always request to correct your personal data if you are of the opinion that certain details are incorrect or incomplete.
  • Right to erasure: You can request to exercise your right to erasure if the personal data that Galapagos has about you is no longer necessary to reach the goal for which they were collected or if your data was used in an unlawful manner. You cannot exercise the right to erasure in the following circumstances: (i) if your personal data that Galapagos has is necessary to exercise the right to freedom of expression, (ii) if there is a legal obligation to keep the personal data or (iii) if there are reasons of public interest that can be used to justify keeping the details (e.g. public health or scientific, statistical or historical research purposes).

    You acknowledge that, if you refuse to provide certain data or ask for the erasure of your personal data, we will no longer be able to provide certain services.

  • Right to restriction: In general, you can exercise the right to restrict the processing of personal data when it is unclear whether and when personal data should be deleted. You can invoke this right if the accuracy of the data in question is disputed, if you do not want the data to be deleted, if the data is no longer necessary to achieve the original purpose but may not be deleted under the law or if your objection to processing has not yet been decided.
  • Right to withdraw consent: If the processing activity is based on our consent, you have a right to withdraw this consent at any point. Please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. In the context of direct marketing, you can always withdraw your consent.
  • Right to object: Under certain circumstances, you have the right to object to the processing of your personal data. Please note that you are not entitled to object to the processing of your personal data if such personal data is necessary for the execution of the agreement between us or your company (for example: for invoicing the data subject or the data subject’s company for ordered services), or for the exercise of legal claims. Remember that you always have the absolute right to object to direct marketing.
  • Right to data portability: You have the right to receive your personal data that is processed by us, in a structured, commonly used and machine-readable format and/or to transmit that data to another controller.
  • Right to lodge a complaint: In case of issues, we encourage you to contact Galapagos directly in order to reach an amicable solution. However, if you believe an amicable solution is not possible or desirable, you can use your right to lodge a complaint with the supervisory authority who is responsible for the protection of personal data in the country where you reside. The contact details of the supervisory authorities in Europe, can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

To exercise the abovementioned rights, you can contact Galapagos’ Data Protection Officer, dpo@glpg.com. After verifying your identity and data subject rights applicability criteria, we will do everything reasonably possible to comply with the request unless it will require completely unreasonable measures (e.g. technically or organizationally virtually impossible or extremely costly). We may refuse to handle requests that are unreasonably repetitive or systematic.

service agencies that we may engage to assist us. We will never pass your personal data to anyone else without your consent, except for (a) successors in title to our business, or (b) when required by law. We will share your personal data with providers only in the ways that are described in this Privacy Statement.

We do not sell, trade, or otherwise transfer to outside parties, personal data we collect from you without your consent, except in cases where we may share personal data for any Services that may be in effect from time to time, including, without limitation, the situations described below:

  • We may release personal data to authorized agents or third-party contractors whom we employ to perform tasks on our behalf and to the extent we need to share information with them to conduct our business or to provide products, services and offers to you. Unless we communicate with you differently, our authorized agents do not have the right to use any personal data we share with them beyond what is necessary to work with us. Hereby you acknowledge that Galapagos may share the personal data we collect from you for the abovementioned purposes.
  • We may disclose your personal data if we believe it is necessary to investigate potential violations of our Terms and Conditions, or to enforce those Terms and Conditions.

For users residing in the European Economic Area (“EEA”), the data that we collect from you may be transferred to, and stored at, a destination outside the EEA. It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers.
If we do transfer data outside the EEA, we will ensure it is protected by implementing the following safeguards:

We are committed to protecting the security and privacy of your information. We implement appropriate technical and organisational measures to restrict access to personal data. Access to the personal data is strictly limited to the employees, agents, contractors, or representatives for whom access is necessary to perform the tasks assigned to them by Galapagos. All data gathered by our Services is stored in a secure, password-protected database. Only we and our third-party processors, if any, have access to this database.

We will protect personal data provided to us by using reasonable security safeguards against loss, theft, unauthorized access, disclosure, copying, use, or modification. Although we and our third-party processors implement standard security protections, we cannot guarantee the physical or electronic security of the servers and databases on which the Services are hosted. We require our partners who receive your information to agree to security requirements consistent with this Privacy Statement. If you create copies of information from the Services, we cannot protect the security and privacy of the information contained in such copies.

Galapagos uses camera surveillance on its premises for safety, security and property protection purposes. Only images will be collected, no match with personal identification data will be made unless required by law for investigation. Camera surveillance images are kept for thirty days, after which they are deleted. The use of surveillance cameras, management of IT equipment, monitoring and litigation management is necessary to protect Galapagos’ legitimate interests for the purposes described.

As a data subject, you have the right to exercise the rights detailed in this Privacy Statement under section 3 Your rights as a data subject.

Our Services are not aimed at people under 16 years of age. We do not knowingly collect personal data from children under the age of 16. If we become aware that a child under the age of 16 has provided us with personal data, we will take reasonable steps to remove such information from our systems and terminate the applicable account.

From time to time, this Privacy Statement may be revised. Any changes to this Privacy Statement will be indicated through the mention of effective date and version number. Continued use of our sites after changes made to our Privacy Statement indicates your consent to the use of newly submitted information. We encourage you to read our Privacy Statement from time to time to stay updated on any changes.

We reserve the right to disclose personal data in the following circumstances:

  • as required by law;
  • if we believe that disclosure is necessary to protect our or others’ rights, property, or safety;
  • to comply with a judicial proceeding, court order, or legal process served on us or the Services; or
  • in connection with an actual or proposed corporate transaction or insolvency proceeding involving all or part of the business or assets to which the information pertains.

By using the Services, you consent to having any personal data you provide to us transferred to and processed in the United States. BECAUSE SOME JURISDICTIONS DO NOT PERMIT CERTAIN LIMITATIONS OR DISCLAIMERS OF LIABILITY, THESE LIMITATIONS MAY NOT APPLY TO YOU.

For questions regarding this Privacy Statement, please contact: dpo@glpg.com.