At the Medicines and Healthcare products Regulatory Agency (the Agency) we are committed to protecting and respecting your privacy.
This privacy notice describes how we collect, store and use your personal information, in accordance with the Data Protection Act 2018 and the General Data Protection Regulation (GDPR) 2016/679.
WHO ARE WE?
The Medicines and Healthcare products Regulatory Agency (the Agency), is an executive agency of the Department for Health and Social Care (DHSC). The DHSC, together with its executive agencies, is a single legal entity (or controller) under data protection law. You will find further information about DHSC, the Agency and its three centres on http://www.gov.uk
The Agency’s regulatory centre is known as MHRA. It publishes the British Pharmacopoeia and produces British Pharmacopoeia Chemical Reference Substances (BPCRS) on behalf of the British Pharmacopoeia Commission.
You can contact the British Pharmacopoeia at email@example.com or write to us at:
10 South Colonnade
CONTACT OUR DATA PROTECTION OFFICER
If you have any queries, concerns or complaints about the way in which MHRA processes your personal data, please contact our Data Protection Officer at firstname.lastname@example.org in the first instance. DHSC also has a Data Protection Officer whom you can contact if you prefer. Their email address is email@example.com.
RAISING A FORMAL COMPLAINT
You have the right to make a complaint to the Information Commissioner’s Office (ICO) if you have concerns about the way in which we are handling your personal data. The ICO generally asks that you attempt to resolve your concerns with us before approaching them. For information about how to raise a concern with them, please see https://ico.org.uk/global/contact-us/.
OUR PURPOSE AND LEGAL BASES FOR PROCESSING YOUR PERSONAL DATA
Creation of accounts on the BP website to purchase or access our products and subscriptions
The legal basis we rely on to process your personal data is GDPR article 6(1)(b) – contract. This means that the processing is necessary to enable you to purchase the British Pharmacopoeia Chemical Reference Substances (BPCRS) and to view any on-line subscriptions you have purchased and any updates to them. This also enables us to contact you regarding any updates to the products you have purchased.
To notify users when the next edition becomes available
The legal basis we rely on to process your data is GDPR article 6(1)(f) – legitimate interest. This means that we will process your data to inform you of when the next edition becomes available unless you tell us not to.
To market our products
The legal basis we rely on to process your data is GDPR article 6(1)(a) - consent. This means that TSO will send you marketing materials on our behalf if you have provided your explicit consent to receive them. Every marketing email you receive contains an unsubscribe link so you can withdraw consent at any time.
WHAT TYPES OF PERSONAL DATA ARE WE COLLECTING?
When you purchase our publications or create an account on the BP website we collect basic information about you including your name, email address, and telephone number. If you order British Pharmacopoeia Chemical Reference Substances (BPCRS) through our website, we will also collect information about your company and delivery preferences.
RETENTION OF YOUR DATA
The period for which we will retain personal information will vary depending on the purposes that it was collected for, as well as the requirements of any applicable law or regulation:
If you have signed up for an account on the website, we will store your personal information and the information in your account for as long as is necessary to provide the account, and for the period for which you or we could bring legal processing in relation to the running of your account
If you order a product through the website, we will store your personal information and information about your order for as long as is necessary to comply with applicable tax legislation, and for the period for which you or we could bring legal processing in relation to your order.
Data Protection law gives you certain rights when we process your personal data. Some of these only apply in certain circumstances. For further information on how these rights apply, please see https://ico.org.uk/your-data-matters/
The rights are to:
*request a copy of your data
*ask us to correct your data or to complete it if you believe it is incomplete
*ask us to erase your data
*ask us to restrict processing
*ask for your data in an accessible form
*object to the processing
*be told if we use automated decision making or profiling
WHO ARE OUR PROCESSORS?
MHRA has contracts with its processors which means they can only use your personal data in ways that we instruct them. The Stationery Office Limited (TSO) is our processor for hosting and management of the British Pharmacopoeia website, www.pharmacopoeia.com on our behalf. We also use data processors to process your payments. Worldpay is our processor for the purchase of BPCRS and Veriphone is TSO’s sub-processor for BP Publications.
TSO may also share information with its parent company, Williams Lea, approved service providers and other Williams Lea entities, where this is necessary to fulfil our contract with you and is lawful to do so. We approve any sub-processors that TSO uses to process your personal data to ensure that they are similarly bound by contracts to protect personal data and process it lawfully.
INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION
TSO process your personal information using data centres located inside the European Union and data centres located outside the European Union (third countries). Where TSO transfer personal information to a third country outside of the European Economic Area they have standard contract clauses in place.
If you wish to obtain a copy of these standard contract clauses, please contact us at firstname.lastname@example.org.
Our website contains links to sites owned and operated by third parties. They have their own privacy policies and terms and conditions which we advise you to review before browsing those sites. We do not accept any responsibility or liability for third-party websites.
All British Pharmacopoeia publication purchases will be directed to www.tsoshop.co.uk which is owned and operated by TSO.
This Policy will be reviewed from time to time to take account of changes to our operations or practices and, further, to make sure it remains appropriate to any changes in law, technology, and the business environment. Any personal information held will be governed by the most recent legislation.
Should we propose to use your personal data for another purpose, we will inform you of what we plan to do prior to doing so.