Data Privacy Framework Policy

Syner-G Biopharma Group, (“Syner-G,” “we,” “us,” “our” or “Company”) complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. Syner-G has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Syner-G has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles (collectively, the “DDPF Principles”), the DPF Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

 

Scope

This Data Privacy Framework Policy (the “Policy”) sets forth the privacy principles that Syner-G follows when processing Personal Data received from customers or prospective customers located in the European Economic Area (“EEA”), Switzerland, and the United Kingdom while providing services from the United States (“U.S.”). This Policy does not apply to information collected through other Syner-G websites or to information collected during Syner-G sponsored sales and marketing activities. This Policy also does not apply to Personal Data collected through Syner-G’s recruiting process. For purposes of this Policy, Personal Data means data about an identified or identifiable individual that is received by Syner-G in the United States from the EEA, Switzerland, or the United Kingdom, and recorded in any form, and is within the scope of Regulation (EU) 2016/679 (“General Data Protection Regulation” or “GDPR”), the Swiss Federal Data Protection Act, or the UK Data Protection Act 2018, respectively.   

 

Syner-G’s Role as a Service Provider to its Customers and Prospective Customers

Syner-G is the creator of certain products, and in connection with these products, Syner-G provides product demonstrations, product development, product enhancements, professional technical services (collectively “Services”) for the benefit of its customers and prospective customers in the EEA, Switzerland, and the United Kingdom through employees who may be located in the U.S. These U.S.-based employees may process Personal Data to provide Services to customers and prospective customers located in the EEA, Switzerland, or the United Kingdom. 

Customers using Syner-G’s solutions are responsible for the data that they submit to Syner-G or upload into Syner-G maintained services and solutions. Customers determine the categories of Personal Data and other information that are stored by Syner-G. Similarly, Syner-G’s customers and prospective customers who share data with Syner-G in connection with any of its Services determine which categories of Personal Data will be shared and for what purposes. Consequently, Syner-G does not generally know the categories of Personal Data to be processed or the purpose(s) of the processing unless and until Syner-G receives this information from its customers or prospective customers.   This data usually consists non-identifiable information such as AGE, Sex, Race, Weight and other physical statistics related to medical studies.

When Syner-G processes Personal Data, Syner-G does so only for the purpose of providing Services.

 

The Customer’s and Prospective Customer’s Responsibilities with Respect to Personal Data

Syner-G customers and prospective customers may choose to include Personal Data among the data stored within the Syner-G cloud or otherwise shared with Syner-G in connection with its provision of Services. 

Syner-G processes only the Personal Data that its customers or prospective customers have chosen to share with Syner-G. Syner-G has no direct or contractual relationship with the subject of such Personal Data (a “Data Subject”). As a result, when a customer or prospective customer shares Personal Data, the customer or prospective customer is solely responsible for satisfying all legal obligations owed directly to the Data Subject under applicable data protection laws.

It is the customer’s or prospective customer’s responsibility to ensure that the Personal Data it collects can be legally collected in the country of origin. The customer or prospective customer is also responsible for providing to the Data Subject any notices required by applicable law and for responding appropriately to the Data Subject’s request to exercise his or her rights with respect to Personal Data. In addition, the customer or prospective customer is responsible for ensuring that its use of Syner-G’s cloud offerings or Services is consistent with any privacy policy the customer or prospective customer has established and any notices it has provided to Data Subjects.

Syner-G is not responsible for its customers’ or prospective customers’ privacy policies or practices or for the customers’ or prospective customers’ compliance with such policies or practices. Syner-G does not review, comment upon, or monitor its customers’ or prospective customers’ privacy policies or their compliance with such policies. Syner-G also does not review instructions or authorizations provided to Syner-G to determine whether the instructions or authorizations are in compliance with, or conflict with, the terms of a customer’s or prospective customer’s published privacy policy or of any notice provided to Data Subjects.  Customers and prospective customers are responsible for providing instructions and authorizations that comply with their policies, notices, and applicable laws.

 

Syner-G’s Compliance with the Data Privacy Framework Principles

Syner-G employees located in the United States may provide Services for customers and prospective customers located in the EEA, Switzerland, or the United Kingdom. To provide such Services, Syner-G may process Personal Data. Syner-G will apply the following DPF Principles to Personal Data physically or remotely transferred from the EEA, Switzerland or the United Kingdom to the United States.

 

ACCESS

Pursuant to the Data Privacy Frameworks, data subjects have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States under the Data Privacy Frameworks, should direct their query to privacy@synergbiopharma.com. If requested to remove data, we will respond within a reasonable timeframe. 

When Syner-G receives Personal Data, it does so on its customer’s or prospective customer’s behalf. To request access to, or correction, amendment or deletion of, Personal Data, Data Subjects should contact the Syner-G customer or prospective customer that collected their Personal Data. Syner-G will cooperate with its customers’ and prospective customers’ reasonable requests to assist Data Subjects to exercise their rights under the DPF.  

 

CHOICE

Data subjects have the right to opt out of (a) disclosures of their Personal Data to third parties not identified at the time of collection or subsequently authorized, and (b) uses of Personal Data for purposes materially different from those disclosed at the time of collection or subsequently authorized. Syner-G’s customers and prospective customers are responsible for informing Data Subjects when they have the right to opt out of such uses or disclosures. To request to limit the use and disclosure of your personal information, please submit a written request to privacy@synergbiopharma.com.

 

Data Subjects who wish to limit the use or disclosure of their Personal Data should submit that request to Syner-G’s customer or prospective customer that controls the use and disclosure of their Personal Data. Syner-G will cooperate with its customers’ and prospective customers’ instructions regarding Data Subjects’ choices.

 

SECURITY

Syner-G is committed to safeguarding the Personal Data that it receives. While Syner-G cannot guarantee the security of Personal Data, Syner-G takes reasonable and appropriate measures to protect Personal Data in Syner-G’s possession from loss, misuse, unauthorized access, disclosure, alteration and destruction.

Syner-G utilizes a combination of online and offline security technologies, procedures and organizational measures to help safeguard Personal Data.  For example, facility security is designed to prevent unauthorized access to Syner-G computers. Electronic security measures — including, for example, network access controls, passwords and access logging — provide protection from hacking and other unauthorized access. Syner-G also protects Personal Data through the use of firewalls, role-based restrictions and, where appropriate, encryption technology. Syner-G limits access to Personal Data to employees, subcontractors, and third-party agents that have a specific business reason for accessing such Personal Data.  Individuals granted access to Personal Data are aware of their responsibilities to protect such information and are provided appropriate training and instruction.  

 

DATA INTEGRITY AND PURPOSE LIMITATION 

Syner-G’s customers and prospective customers are responsible for limiting their collection of Personal Data to that which is necessary to accomplish the purposes disclosed to Data Subjects and compatible purposes. They also are responsible for providing Syner-G with instructions or authorization for the processing of Personal Data consistent with such purposes.   

Syner-G’s customers and prospective customers also are responsible for ensuring that (a) Personal Data they collect is accurate, complete, current and reliable for its intended uses; and (b) Personal Data is retained only for as long as is necessary to accomplish the customer’s or prospective customer’s legitimate business purposes disclosed to the Data Subject and for compatible purposes. Syner-G will cooperate with customers’ and prospective customers’ reasonable requests for assistance in meeting these obligations.

In the performance of Services, Syner-G will request only the minimum amount of information required to perform the applicable Services and will retain such information only for as long as necessary to provide the Services or for compatible purposes, such as to provide additional Services, to comply with legal requirements, or to preserve or defend Syner-G’s legal rights.

 

ONWARD TRANSFER 

Syner-G may disclose Personal Data to subcontractors and third-party agents who assist Syner-G in providing Services to its customers and prospective customers. Before disclosing Personal Data to a subcontractor or third-party agent, Syner-G will obtain assurances from the recipient that it will: (a) use the Personal Data only to assist Syner-G in providing the Services; (b) provide at least the same level of protection for Personal Data as required by the DPF Principles; and (c) notify Syner-G if the recipient is no longer able to provide the required protections. Upon notice, Syner-G will act promptly to stop and remediate unauthorized processing of Personal Data by a recipient. Syner-G will remain liable for onward transfers to its subcontractors and third-party agents. 

Syner-G may also be required to disclose, and may disclose, Personal Data in response to lawful requests by public authorities, including for the purpose of meeting national security or law enforcement requirements. To the extent permitted, Syner-G will inform its relevant customer or prospective customer before making such disclosure and provide it with a reasonable opportunity to object to such disclosure.

Syner-G will not otherwise disclose Personal Data to third parties.

 

RECOURSE, ENFORCEMENT & LIABILITY  

In compliance with the EU-U.S. DPF Principles, including the UK Extension of the EU-U.S. DPF Principles and the Swiss-U.S. DPF Principles, Syner-G commits to resolve complaints about your privacy and Syner-G’s collection or use of Personal Data transferred to the United States pursuant to this Policy.

European Union, Swiss, and United Kingdom individuals with DPF inquiries or complaints should first contact Syner-G’s Data Protection & Privacy Department by emailing privacy@synergbiopharma.com.

Syner-G has further committed to refer unresolved privacy complaints under the DFP Principles to an independent recourse mechanism, Data Privacy Framework Services, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers for more information and to file a complaint. This service is provided free of charge to you.

 

If your DFP complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not otherwise resolved by other redress mechanisms. For more information about binding arbitration, visit https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2

The Federal Trade Commission has jurisdiction over Syner-G’s compliance with the DPF. 

 

For More Information

Data Subjects with questions about how Syner-G processes Personal Data should first contact the Syner-G customer or prospective customer that collected the Personal Data. Syner-G’s Data Protection & Privacy Department can be contacted by emailing privacy@synergbiopharma.com. This policy is executed in English and may be translated into other languages. In the event of any conflict or discrepancy between the English language version and a translated version, the English language version of this policy shall control.

 

Changes to this Privacy Policy

Syner-G may revise this Policy at any time. If Syner-G decides to materially change this Policy, Syner-G will post the revised Policy at this location.  

Effective Date:   December 21, 2023