Unless indicated otherwise, the provision of personal data processed for the purposes indicated above is optional. In the event of refusal to provide your data, objection to processing or withdrawal of the consent previously given, Recordati will not be able to carry out the scientific information activities towards the HCP or the communications, as described above.
At the end of the storage periods identified above, the personal data of the Data Subjects will be deleted, unless there are further legitimate interests of the Data Controller for establishing, exercising or defending a legal claim that make their storage necessary, subject to minimization. In such case, the Data Controller will store the personal data for as long as necessary for this purpose.
The Data Controller also informs the Data Subject that at the time of collection and on the occasion of sending each communication made for the pursuit of the aforementioned Purpose, he/she has the possibility to: (i) withdraw, at any time, any consent given (see point 8 below as to how consent can be withdrawn); (ii) object to the processing of their personal data based on the legitimate interest of the Data Controller, in the manner better described in point 8 below.5. Profiling
The Data Controller informs the Data Subjects that, with reference to the Purpose referred to in Paragraph 4 letter b) above (i.e. profiling activities), this activity has the sole purpose of identifying, on the basis of specific parameters identified by Recordati, in a precise and effective manner the professional and scientific profiles of the Data Subjects, as well as their specific professional needs so as to allow the same to optimize the performance of the activity of scientific information and the distribution of its contents.
Profiling in this regard will enable the Data Controller to avoid sending mass medical-scientific communications to the recipient HCP, in circumstances where such communications may not be of interest to the HCP. Rather, these communications are limited only to those Data Subjects for which they are more relevant and adherent, according to the needs, interests and professional characteristics of the Data Subjects. Personalized communications may also be indirectly of benefit for the patients of the individual Data Subjects as they may increase the Data Subject’s awareness about specific relevant areas of diseases or medical practices.
In any case, the profiling mentioned above: 

– will not take place on the basis of an automated decision-making process from which legal or similarly significant effects derive for the Data Subjects pursuant to art. 22 of the GDPR;
– will not affect the rights of the Data Subjects;
– will not have any prolonged and permanent impact for Data Subjects, considering that the personal data collected by the Data Controller through its medical representatives are periodically updated.

Furthermore, considering that the processing in question is based on the legitimate interest of the Data Controller, the Data Controller guarantees that it has previously carried out an assessment aimed at ensuring the proportionality of the processing so that the rights and freedoms of the Data Subjects are not prejudiced, taking into account their reasonable expectations in relation to the specific processing activity carried out (so-called “Legitimate Interest Assessment” or “LIA”).
Data Subjects may request further information on the LIA referred to above, by contacting the Data Controller or the DPO at the addresses indicated below.
This is without prejudice to the right of the Data Subject to object to the performance of profiling activities at any time, in accordance with the procedures better described in point 8 below.
6. Recipients
The Data Controller informs the Data Subjects that their personal data may be communicated or made accessible for the Purposes listed above, and according to the legal bases listed above, to the following recipients or categories of recipients, as independent data controllers or, where necessary, data processors specifically selected and appointed pursuant to Article 28 of the GDPR which include:

• suppliers of platforms for customer relationship management (CRM) and related technical assistance and maintenance services (all categories of personal data are shared);
• companies that carry out market analyses/research (the categories of personal data shared are those indicated in par. 3, lett. a. above);
• communication agencies and/or event organization (the categories of personal data shared are those indicated in par. 3, lett. a. above);
• competent authorities, regulatory, prosecuting, law enforcement, tax or governmental authorities by virtue of legal provisions or regulations or European Union legislation (all categories of personal data may be shared);
• in connection with a corporate transaction, a merger, consolidation, reorganisation, financing, change in control or acquisition of all or a portion of the Data Controller’s business by a third party (all categories of personal data may be shared);
• other companies of the Recordati Group, subject to the consent of the Data Subject, when such consent is necessary under applicable Privacy Legislation (the categories of personal data shared are those indicated in par. 3, lett a. and b. above).

The complete list of recipients, including more details on the activities they are carrying out, the industry, sector and sub-sector and their headquarters, is kept at the Data Controller’s registered office and can be consulted upon request to be sent to the addresses indicated in point 8 of this policy.