Introduction

Below you will find the privacy notice of CREATE. In order to provide its services, CREATE processes personal data. Personal data is any information relating to an identified or identifiable natural person. All personal data is processed with the greatest possible care and with due observance of the European General Data Processing Ordinance (GDPR), as well as applicable national laws and regulations.

In this document CREATE describes its privacy policy that applies to external parties. This privacy notice consists of a general part and a specific part to the various external parties of which CREATEprocesses personal data.

General provisions

A. Controllers

The following party processes your personal data in the capacity of joint controllers:

• CREATE Regulatory Consultancy, CoC/KvK 80415008

All of the aforementioned controller(s) are established at the Stadionweg 214-3 te Amsterdam (1077 TE). These controller(s) are hereinafter jointly referred to as “CREATE”.

B. Sharing of personal data with third parties

In the execution of its activities, CREATE involves both parties that process personal data (“processors”) on behalf of CREATE.

CREATE uses the services of the following regular processors:

• Stripe

Processing outside the EEA

To the extent that processors are located outside the European Economic Area (“EEA”), CREATE ensures that transfers of personal data take place only under strict safeguards.

C. Security of the personal data

CREATE takes the protection of personal data seriously and takes appropriate measures for the legal profession to prevent abuse, loss, unauthorized access, unwanted disclosure and unauthorized changes.

CREATE is not responsible for information sent to CREATE and/or its employees via unsafe networks.

D. Exercise of the rights of data subjects

Under the GDPR, data subjects have a number of rights with regard to personal data relating to them:

• The right of access

• The right of rectification

• The right of removal

• The right to limit the processing of personal data concerning him or her

• The right to data portability

• The right to object to processing

If processing, as described in this privacy notice, takes place on the basis of consent, the data subject has the right to withdraw his or her consent to the processing of personal data concerning him or her. This has no consequences for processing that took place prior to the revocation of that consent. The personal data that CREATE has processed up to that moment will be removed, unless another processing basis is applicable to the processing that justifies the storage of the personal data.

If you do not agree with the way in which CREATE processes your personal data or if you have any questions about the processing of your personal data or this privacy notice, we kindly request you to contact your contact person at CREATE or our complaints officer via info@create-ra.com. If we are unable to resolve this issue, or if you prefer not to discuss your complaint with us, you have at all times the right to contact the Dutch Personal Data Authority (Autoriteit Persoonsgegevens), the Dutch supervisory authority.

E. Opt-out marketing

The data subject has the right to object at any time to the use of his or her personal data for marketing purposes, which means receiving newsletters and/or invitations. Unsubscribing is possible by using the link at the bottom of the newsletters/invitations or by sending an e-mail to info@create-ra.com.

Specific provisions

CREATE processes personal data of various external persons, namely:

• (former) clients and involved parties

• external experts;

• potential clients who use question time;

• participants in seminars organised by CREATE;

For each category of data subjects, it will be explained below which personal data are processed, on which processing basis the processing takes place, which processing purposes apply to the processing and which retention periods are applicable. The specific section on the processing of applicant’s personal data can be found on our careers page.

A. (Former) Clients and data subjects

Personal data
CREATE processes the following personal data of its clients (or their representatives/contact persons) and other parties involved in a client case:

• surname;

• first names;

• gender, in order to use the correct title;

• address (work, unless it concerns a private person);

• telephone numbers

• function;

• e-mail address;

• company/employer;

• domain name;

• information provided to it by third parties, including counterparties, insofar as this holds relevance to the performance of the services;

• account numbers, in connection with the payment of settlements, orders to pay legal costs and necessary other payments arising from the services provided by CREATE to its clients;

Where we are legally obliged to do so under the Counter Terorrismand Anti-Laudering Act (in Dutch: “Wet ter voorkoming van witwassen en financieren van terrorisme”) or the Regulation on the Legal Profession (in Dutch: “Verordening op de Advocatuur”), CREATE will process a copy of the ID of the client or his director/representative. CREATE requests clients to send a copy of their passport without a citizen service number (BSN) and therefore does not process the citizen service number.

Processing purposes
CREATE processes the aforementioned personal data of its clients and contact persons/directors at clients for the following purposes:

• the provision of consulting services to its clients and the invoicing thereof,

• the provision of digital services such as, but not limited to, web applications to its clients and the invoicing thereof,

• the performance of an agreement between CREATE and its clients,

• compliance with the legal and professional obligations incumbent upon CREATE;

• mediating and settling complaints;

• to the extent necessary, conducting legal proceedings.

• Marketing and communication activities.

Legal bases of the processing
CREATE only processes the personal data if:

• CREATE has a legitimate interest for the processing, which is understood to mean the provision of services by CREATE to its clients, bringing the products and services of CREATE to the attention of the party concerned, as well as the legitimate interest CREATE has in running its firm (including compliance with insurance obligations and professional obligations);

• the processing is necessary for the execution of an agreement that CREATE has concluded with the data subject;

• CREATE must comply with a statutory obligation; or

• the data subject whose data are being processed has given his consent for the processing;

Retention periods
CREATE shall not retain the collected personal data for longer than is strictly necessary to realise the purposes for which the data was collected, or for longer than retention is legally required. To this end, CREATE maintains the following retention periods for each processing purpose:

• For personal data that have been processed for providing consulting services, a retention period of five (5) years applies on the basis of the conditions that are imposed on CREATE by virtue of financial administrative obligations. The aforementioned term of five years shall apply from the moment a consultancy agreement terminates. 

• Personal data that are processed for marketing purposes (including personal data that are processed for the purpose of sending a newsletter and/or advertising) are kept for five years, unless the personal data are also processed for other purposes, for which a longer period is necessary.

Third parties
Personal data can be shared with:

• Employees, contact persons or representatives designated by CREATE’s clients;

• External experts who are called in with the client’s permission in the context of a specific request for advice and with whom CREATE cooperates;

• Judicial or administrative bodies;

• Regulators;

• The accountant of CREATE;

• Processors engaged by CREATE to provide specific services.

B. External experts

Personal data
CREATE processes the following personal data of external experts:

• surname;

• first names;

• gender, in order to use the correct title to address the expert;

• company

• work address

• business e-mail address

• business phone number and business mobile phone number

• domain name

• account numbers, in connection with the payment of settlements, orders to pay legal costs and necessary other payments arising from the services provided by CREATE to its clients.

Processing purposes
CREATE processes the aforementioned personal data for the following purposes:

• The provision of consulting services to its clients and the execution of an agreement between CREATE and its clients;

• Sending and collecting invoices in connection with work performed by CREATE;

• Mutual advice and consultation and referral of clients;

• To comply with the legal and professional obligations to which CREATE is subject;

• Mediating in and resolving complaints;

• To the extent necessary, conducting legal proceedings;

• Participation in marketing and communication activities and dispatch of marketing communications of CREATE.

Legal bases of the processing
CREATE processes the personal data exclusively on the following legal basis:

• a legitimate interest of CREATE, which is understood to mean the provision of services by CREATE to its clients and (informal) collaborations between the data subject and CREATE

• the processing is necessary for the execution of an agreement that CREATE has entered into with the data subject.

Storage periods
CREATE will not keep the collected personal data for longer than is strictly necessary, or is legally regulated, to achieve the purposes for which the data was collected. To this end, CREATE applies the following retention periods for each processing purpose:

• five (5) years applies on the basis of the conditions that are imposed on CREATE by virtue of financial administrative obligations. The aforementioned term of five years shall apply from the moment a consultancy agreement terminates.Theprocessing of personal data of external experts for other purposes is subject to a retention period of five years from the end of the informal cooperation, unless the informal cooperation is renewed.

Third parties
Personal data can be shared with:

• Employees, contact persons or representatives designated by a client of CREATE;

• An external expert who, with the permission of CREATE’ client, is called in for a specific request for advice and with whom CREATE collaborates;

• Judicial or administrative bodies;

• Supervisors;

• Processors engaged by CREATE to provide specific services.

C. Question Time

CREATE offers parties interested in the services of CREATE the opportunity to briefly become acquainted with CREATE and to explore whether CREATE is able to assist the party in question. In order to book a Question Time appointment, CREATE processes the following personal data:

• Name;

• E-mail address;

• Telephone number.

This data will be processed on the basis of the legitimate interest of CREATE to carry out the Question Time appointment and, where necessary, provide follow-up.

Retention period
CREATE will not keep the collected personal data for longer than is strictly necessary, or is legally regulated, to achieve the purposes for which the data was collected. For question time CREATE uses a retention period of 1 year. Notwithstanding the foregoing, where the potential client decides to engage CREATE, any personal data pertaining to the Question Time appointment leads to an agreement, the Question Time data will be transferred to the file of the client in question and the retention time applicable to client cases shall apply accordingly.

Third parties
Personal data can be shared with:

• Regulators; and

• Processors engaged by CREATE to provide specific services.

D. Participants in CREATE seminars

CREATE regularly sends its clients and other interested parties invitations to seminars. The seminars fulfil the role of network meetings within medical device- and in-vitro diagnostic device regulations and artificial intelligence. During these seminars, relevant developments are discussed. CREATE invites its contacts at clients for these seminars. Each invitation contains the possibility to unsubscribe for further invitations (the so-called ‘opt-out’). Other interested parties can also register to attend a seminar.

Personal data
CREATE processes the name, job title, company name and e-mail address of the person who signs up for a seminar.

Processing basis
The personal data will be processed on the basis of the legitimate interest of CREATE to send its clients marketing and invitations and to facilitate the participation in the seminar. After registration for a seminar, the personal data will be processed on the basis of the legitimate interest of CREATE to invite the person concerned to further seminars. The data subject has the right to object to this processing at any time.

Based on the consent of the person involved, his personal data will be shared with other participants in the seminar. The processing of personal data is necessary for the purposes of the seminar.

Third parties
CREATE shares the name, job title and company name of the seminar participant with other seminar participants.

CREATE also shares the personal data with its processors.