Privacy Policy

PRIVACY NOTICE

At the Medicines and Healthcare products Regulatory Agency (the Agency) we are committed to protecting and respecting your privacy.

This privacy notice describes how we collect, store and use your personal information, in accordance with the Data Protection Act 2018 and the General Data Protection Regulation (GDPR) 2016/679.

WHO ARE WE?

The Medicines and Healthcare products Regulatory Agency (the Agency), is an executive agency of the Department for Health and Social Care (DHSC).  The DHSC, together with its executive agencies, is a single legal entity (or controller) under data protection law. You will find further information about DHSC, the Agency and its three centres on http://www.gov.uk

The Agency’s regulatory centre is known as MHRA. It publishes the British Pharmacopoeia and produces British Pharmacopoeia Chemical Reference Substances (BPCRS) on behalf of the British Pharmacopoeia Commission.

You can contact the British Pharmacopoeia at bpcom@mhra.gov.uk or write to us at:

MHRA
British Pharmacopoeia
10th Floor
10 South Colonnade
Canary Wharf
London
E14 4PU

CONTACT OUR DATA PROTECTION OFFICER

If you have any queries, concerns or complaints about the way in which MHRA processes your personal data, please contact our Data Protection Officer at dataprotection@mhra.gov.uk in the first instance. DHSC also has a Data Protection Officer whom you can contact if you prefer. Their email address is data_protection@dhsc.gov.uk.

RAISING A FORMAL COMPLAINT

You have the right to make a complaint to the Information Commissioner’s Office (ICO) if you have concerns about the way in which we are handling your personal data. The ICO generally asks that you attempt to resolve your concerns with us before approaching them. For information about how to raise a concern with them, please see https://ico.org.uk/global/contact-us/.

OUR PURPOSE AND LEGAL BASES FOR PROCESSING YOUR PERSONAL DATA

Creation of accounts on the BP website to purchase or access our products and subscriptions

The legal basis we rely on to process your personal data is GDPR article 6(1)(b) – contract. This means that the processing is necessary to enable you to purchase the British Pharmacopoeia Chemical Reference Substances (BPCRS) and to view any on-line subscriptions you have purchased and any updates to them.  This also enables us to contact you regarding any updates to the products you have purchased.

To notify users when the next edition becomes available

The legal basis we rely on to process your data is GDPR article 6(1)(f) – legitimate interest.    This means that we will process your data to inform you of when the next edition becomes available unless you tell us not to.

To market our products

The legal basis we rely on to process your data is GDPR article 6(1)(a) - consent.  This means that TSO will send you marketing materials on our behalf if you have provided your explicit consent to receive them.  Every marketing email you receive contains an unsubscribe link so you can withdraw consent at any time.

WHAT TYPES OF PERSONAL DATA ARE WE COLLECTING?

When you purchase our publications or create an account on the BP website we collect basic information about you including your name, email address, and telephone number. If you order British Pharmacopoeia Chemical Reference Substances (BPCRS) through our website, we will also collect information about your company and delivery preferences.

Our website also uses cookies which are small files sent from us to your computer where they are stored and may be read. You can find out more about the use of cookies and any online identifiers they capture in our Cookie Policy.

RETENTION OF YOUR DATA

The period for which we will retain personal information will vary depending on the purposes that it was collected for, as well as the requirements of any applicable law or regulation:

If you have signed up for an account on the website, we will store your personal information and the information in your account for as long as is necessary to provide the account, and for the period for which you or we could bring legal processing in relation to the running of your account

If you order a product through the website, we will store your personal information and information about your order for as long as is necessary to comply with applicable tax legislation, and for the period for which you or we could bring legal processing in relation to your order.

YOUR RIGHTS

Data Protection law gives you certain rights when we process your personal data. Some of these only apply in certain circumstances.  For further information on how these rights apply, please see https://ico.org.uk/your-data-matters/

The rights are to:

*request a copy of your data

*ask us to correct your data or to complete it if you believe it is incomplete

*ask us to erase your data

*ask us to restrict processing

*ask for your data in an accessible form

*object to the processing

*be told if we use automated decision making or profiling

WHO ARE OUR PROCESSORS?

MHRA has contracts with its processors which means they can only use your personal data in ways that we instruct them. The Stationery Office Limited (TSO) is our processor for hosting and management of the British Pharmacopoeia website, www.pharmacopoeia.com on our behalf. We also use data processors to process your payments. Worldpay is our processor for the purchase of BPCRS and Veriphone is TSO’s sub-processor for BP Publications.

TSO may also share information with its parent company, Williams Lea, approved service providers and other Williams Lea entities, where this is necessary to fulfil our contract with you and is lawful to do so.  We approve any sub-processors that TSO uses to process your personal data to ensure that they are similarly bound by contracts to protect personal data and process it lawfully.

INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION

TSO process your personal information using data centres located inside the European Union and data centres located outside the European Union (third countries). Where TSO transfer personal information to a third country outside of the European Economic Area they have standard contract clauses in place.

If you wish to obtain a copy of these standard contract clauses, please contact us at bpcom@mhra.gov.uk.

THIRD-PARTY SITES

Our website contains links to sites owned and operated by third parties. They have their own privacy policies and terms and conditions which we advise you to review before browsing those sites. We do not accept any responsibility or liability for third-party websites.

All British Pharmacopoeia publication purchases will be directed to www.tsoshop.co.uk which is owned and operated by TSO.

CHANGES TO THE TERMS OF THIS PRIVACY POLICY

This Policy will be reviewed from time to time to take account of changes to our operations or practices and, further, to make sure it remains appropriate to any changes in law, technology, and the business environment.  Any personal information held will be governed by the most recent legislation.

Should we propose to use your personal data for another purpose, we will inform you of what we plan to do prior to doing so.