GSK general privacy notice

What personal information do we collect about you?

The personal information we collect, and process, may include:

• Basic information – your name, surname (including prefix or title), alias, gender, age or date of birth, as well as your preferred language. Similar information about children may also be collected in very limited circumstances, see ‘Information about children’ for more information; 
• Contact information – information that enables us to contact you, e.g. your personal or business email, mailing address, telephone numbers and profile on a social media platform; 
• Technical and network activity information – information about your device and your usage of our websites, apps and systems, including your IP address, device ID, hardware model and version, mobile network information, operating system and other online identifiers, type of browser, browsing history, search history, access time, pages viewed, URLs clicked on, forms submitted, and physical location;
• Financial information – your bank details, including account name, account number and sort code;
• Product use – data related to your use of our products (including feedback), your purchase history and preferences, your interactions with us, your preferred method of communications with us, and services you may use;
• Health information – your health status, health conditions you are experiencing and health information inferred from information that you have provided to us; and
• Audio visual – photos, videos and voice recordings of you.

You can choose not to give us personal information when we ask you for it. If you decide not to give us your personal information, it may restrict our relationship with you. For example, we may not be able to provide you with the services that you have requested.

Why are we allowed to collect and use your personal information?

We can collect and use your personal information when one of the following applies:

• To take steps before entering into a contract or perform a contract; 
• To follow the law, for example:
  • Record-keeping regulatory monitoring and reporting obligations, including those related to adverse events, product complaints and product safety; and
  • Complying with anti-corruption and transparency obligations;
• You have specifically given us your permission when such permission is obligatory (the law calls it “consent”). You can withdraw your consent at any time. We will normally need your consent in the following circumstances:
  
  • Placing cookies on your device to find out how you use our websites so we can personalise what you see by tailoring content and notifications to the things you are interested in;
  • Certain situations where you share sensitive information about yourself, such as your health;
  • Before we send you certain electronic marketing communications; and
  • In any other situation where personal information processing relies upon your consent. 
• We need to use your personal information for legitimate business purposes, for example, to enable us to run our business successfully. These include:
  • Sending direct marketing materials to you (you will always have the right to opt out of marketing and promotional communications);
  • Conducting audits and internal investigations and complying with internal policies on anti-bribery and conflict of interest;
  • Managing our IT and communications systems and networks;
  • Planning and improving our business activities;
  • Conducting training and gathering feedback for ensuring quality control;
  • Protecting our rights, privacy, safety or property, and/or that of our affiliates, you or others;
  • To provide the functionality of the services we provide you, which includes arranging access to your registered account, and providing you with related customer service;
  • Verifying your eligibility to access certain products, services and data that may be provided only to licensed healthcare professionals or otherwise conducting background checks to ensure we are not precluded from working with you;
  • Analysing or predicting your preferences to identify aggregated trends to develop, improve or modify our products, services and business activities;
  • Interacting with you through online digital advisory forums and allowing you to send messages to another person if you choose to do so;
  • Responding to and handling your queries or requests, including requests for samples;
  • Sending administrative information to you, such as changes to our terms, conditions and policies;
  • Completing your transactions and providing you with related customer service; and
  • Reaching out to you to provide information about our products or request input on surveys relating to our products or services;
• For the establishment, exercise or defence of legal claims or proceedings;
• To protect your vital interests or those of others; and
• Because it is necessary for reasons of substantial public interest, on the basis of applicable laws.

What are your rights regarding your personal information?

You have rights we need to make you aware of. The rights available to you depend on our reason for processing your personal information and the local law in your jurisdiction, and there are exceptions to some rights. Depending on this you may have the right to:

• Withdraw your consent to us processing your personal information for direct marketing purposes;
• Ask GSK about the processing of your personal information including to be provided with copies of your personal information;
• Ask us to correct information you think is inaccurate or incomplete;
• Ask us to delete your personal information;
• Ask us to restrict the processing of your information;
• Object to our processing of your personal information; 
• Ask that we transfer information you have given us from one organisation to another, or to give it to you; and
• Complain to your local data protection authority.

You can find out how to get in touch with us to ask us to do any of the above by looking at the ‘Contact information and your privacy point of contact’ section. 

For your protection, and to protect the privacy of others, we may need to verify your identity before completing what you have asked us to do.

Where we have relied upon your permission to use your personal information, and you later withdraw that permission, we may not be able to complete some of the activities described in ‘How do we use your personal information’. 

With whom do we share your personal information?

We share your personal information on a need to know basis, and to the extent necessary to follow laws and regulations, and in the context of managing our relationship with you.

We share your personal information only with teams in our GSK companies and affiliates who need to see it to do their jobs. Please see this link for a list of our affiliates and their locations.

In some countries, our relationship with you is managed for us by specialised service providers. We will share your personal information with their people and teams who need to see it as part of their job.

We will also share your personal information with other entities, for example:

• Event agencies; 
• Marketing agencies;
• Employment and recruitment agencies;
• Technology suppliers who work with us to develop and improve our websites, digital forums and apps;
• Media services providers who work with us;
• Any entity who may acquire us or part of our business or brands;
• Suppliers managing adverse event reports;
• Local or foreign regulators, courts, governments and law enforcement authorities; and
• Professional advisors, such as auditors, accountants and lawyers.

Additional information if you are based in the European Economic Area (EEA)

The European Commission recognises that some countries outside the EEA have similar data protection standards. The full list of these countries is available here.

If we transfer your personal information to a country not on this list, we do so based on standard contract clauses adopted by the European Commission. These enable us to make international transfers of personal information within our group of companies and meet the data protection laws of the European Union and the General Data Protection Regulation (GDPR).

Cookies, Website and Application Data; Use for Analytics and Marketing

Our websites may use cookies and similar technologies. You can choose to accept or decline cookies. If you choose to decline cookies, not all elements of our websites, apps and services may function as intended, so your experience may be affected.

To the extent that your local laws consider the information collected by cookies and other technologies as personal information, we will treat that information to the standards set out in this privacy notice.

We collect information about your computer browser type and operating system, websites you visited before and after visiting our websites, standard server log information, Internet Protocol (IP) addresses, location data, mobile phone service provider, and mobile phone operating system. We use this information to understand how our visitors use our websites and mobile applications so that we can improve them, the services we offer, and our advertising. We may also share this information with other companies within the GSK group and with other third parties. Some of our websites use Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookies to analyse use patterns and may collect information about your use of the website, including your IP address. More information on Google Analytics can be found here. If you would like to opt-out of having your data used by Google Analytics, you can opt out here.

We also use remarketing services offered by our advertising partners to personalise advertisements for visitors to sites of their advertising networks (i.e. websites other than GSK’s). On these pages, you may be shown advertisements that refer to your interactions with GSK previously. To turn off personalisation for advertisements served by Google click here. To turn off personalisation for advertisements served by Facebook click here. Many companies that display interest-based advertising are members of the Network Advertising Initiative ("NAI"), the Digital Advertising Alliance ("DAA") or the European Interactive Digital Advertising Alliance (“EDAA”). To opt-out of interest-based advertising by members of these initiatives, you can visit their websites at https://optout.networkadvertising.org, https://optout.aboutads.info and https://www.youronlinechoices.com.

We may use the data you share with us to make decisions about your interests and preferences so we can make the marketing materials we send you more relevant. We may also combine the information we hold about you with data about your interests or demographics that third parties have collected from you online and offline, to make your experience more personalised and further tailor our marketing materials. You have certain rights in relation to this – please see 'What are your rights regarding your personal information?' above for further information.

We use Facebook custom audience tools. This allows us to provide personalised advertising to you when you use Facebook’s platforms by matching the email address we hold for you with the email address Facebook holds for you, to show you the most relevant GSK advertisements. We only do this where you have given us consent. Sometimes we may also use information about you to build lookalike models. This allows us to generate similar audiences of prospective customers (who may have similar interests or demographics to you) through advertising platforms like Facebook or Google, based on data that the advertising platform holds about other people. Usually this means sharing your email address with our advertising partners. If you wish to opt out of similar audiences in Google, you can do so here.