Privacy Statement
Ambu A/S, Baltorpbakken 13, 2750 Ballerup, Denmark, and its affiliated subsidiaries and companies (referred to as “Ambu”, “we” and/or “our”) is committed to protecting your personal data and privacy and will take care of your personal data and process your personal data pursuant to what is set forth in this Privacy Statement and in accordance with any applicable personal data protection laws.
This Privacy Statement describes the ways in which information about individual persons may be collected, used, disclosed, transferred, and stored by Ambu.
Ambu may at any time change, modify, or otherwise update this Privacy Statement without prior notification. The latest applicable version is available and can always be accessed at this site.
1. Data Controller
The Ambu entity(ies) who are responsible for collecting and processing your personal data is the data controller(s) with respect to the personal data collected and processed.
Contact information on Ambu A/S and the applicable Ambu entity(ies) can be found on the following link:
2. Contact Ambu regarding processing of personal data
Should you have any questions or inquiries in relation to the processing of your personal data, you may contact Ambu at the following email address: dataprotection@ambu.com
3. Description of processing your personal data
Ambu may collect personal data about you in one or several of below cases.
You will always be informed when we collect personal data about you, and it will always be stated whether the submission is voluntary or required for completing the desired action.
3.1 Marketing and newsletters
If you choose to subscribe for Ambu newsletters and/or other marketing material, Ambu will need to collect basic personal data such as your name, e-mail address, telephone number and potentially product of interests and/or any other preferences in terms of the content.
The personal data are provided by you.
The purpose of collecting your personal data is to be able to distribute relevant newsletters and/or marketing material.
If you use your email address in more than one of the above cases, your personal data will only be collected and registered in one place. By this way your information is already stored, and you should not receive the same marketing material from Ambu more than once.
The legal basis for Ambu’s processing of your personal data is the legitimate interest of Ambu (Article 6, para. 1, lit. f of the General Data Protection Regulation, (EU) 2016/679), (“GDPR”)) in conducting marketing activities and communications and distribute newsletters and/or marketing material.
Provided that a consent is required by applicable marketing legislation, Ambu will only collect your personal data and use your personal data to distribute marketing material and/or newsletters subject to your consent.
If you have subscribed to Ambu newsletters and/or other marketing material, we will keep your personal data as long as you wish to receive material from us. You can at any time choose to unsubscribe. If you have provided a consent, you can always withdraw your consent.
3.2. Collaboration related to Ambu products
When Ambu engages with you in relation to a collaboration regarding e.g., evaluation, testing and/or use of Ambu products, Ambu must collect certain personal data depending on the engagement.
The purpose of collecting personal data is to comply with quality and safety requirements, any applicable legislation requiring documentation for collaboration, and maintain and improve our products.
Ambu will only collect the personal data, which is necessary and/or required by any applicable law, e.g., name, title, e-mail address, city and country of residence, place of employment, personal identification number, any Health Care Professional (“HCP”) ID number (or similar), as applicable, CV, product area and interests.
The personal data will be provided by yourself.
In connection with the submission of your personal data it will always be stated whether the submission is voluntary or necessary for completing the desired action.
If you have entered or intend to enter a contract with Ambu regarding the engagement, Ambu will process your personal data based on Article 6(1)(b) of GDPR, as processing is necessary for the entering into or performance of a contract with you about the collaboration and provision of services.
Ambu will also or otherwise process your personal data based on Article 6(1)(c) of GDPR, as processing is necessary to fulfill legal obligations under applicable legislation pertaining to medical devices.
Your personal data will be kept as long as it is necessary for the purpose or purposes for which they were collected and are being processed, and pursuant to any applicable legislation.
3.3 Service and product fulfillment
Ambu will need to collect certain contact information and register information on our contacts to enable service fulfillment, such as delivering products and/or purchasing of services, conducting training events, handle any inquiries, complaints, questions or similar.
Ambu will only collect relevant basic personal data such as name, title, email address, telephone number, place of employment, and potentially product area and product of interest, as applicable. No sensitive personal data will be collected.
The personal data will be provided by yourself.
The legal basis for processing will be Article 6(1)(b) of GDPR if you have entered or are about to enter a contract with Ambu, as processing will be necessary for the entering into or performance of a contract about the services.
Ambu will also or otherwise process your personal data based on Article 6(1)(f) of GDPR, as processing is necessary to protect the legitimate interest of Ambu in registering our contacts to fulfill obligations and interests.
If you have provided a consent to the processing of your personal data, Ambu will process your personal data based on Article 6(1)(a) of GDPR.
Ambu will only keep your information as long as necessary and/or required by any applicable legislation.
If you are registered with Ambu as a customer of Ambu products and have not purchased products from Ambu during a period of two successive years, your personal data will be deleted.
3.4 Job applications
If you submit a job application to Ambu to apply for a job within Ambu, Ambu will process your personal data for evaluating your job application as part of the recruitment process.
All job applications must be submitted, registered, and handled within Ambu’s HR system, which can be accessed via Ambu websites on the following link: Career - Can you help Ambu make a difference?
Only designated employees within the HR department in Ambu have access to the HR system.
Any job applications received by Ambu outside of the HR system will generally be deleted immediately, and you as the job applicant/sender will be notified by email of the deletion and referred to submit the job application through Ambu’s HR system.
The personal data will be provided by you.
The legal basis for processing your personal data is Article 6, para. 1, lit. b of the GDPR, as the processing of personal data will be necessary to take steps at your request for our evaluation of your job application and CV prior to the potential execution of an employment contract as well as your consent for certain processing (Article 6, para. 1. lit. a, of the GDPR).
Processing is also necessary to fulfil and protect the legitimate interest of Ambu (Article 6, para. 1, lit. f of the GDPR).
If you provide any sensitive personal data in your job application, the legal basis for processing the sensitive personal data will be Article 9, para. 1, lit. b (in Denmark also the Danish Data Protection Act, Section 12 (Databeskyttelsesloven § 12).
The job applications from applicants who are not hired will generally be deleted after 180 days, or as otherwise required by any local legislation.
3.5 Cookies
Ambu uses cookies on Ambu websites but will not collect any of your personal data (such as your IP address or other identification factors) as it is anonymized. Accordingly, Ambu will not be able to see where you come from or where you are going on the internet after you leave our websites site.
We do not sell or otherwise disclose information about how our users navigate and use our website. We do not sell or disclose information about your purchase history to third parties.
You can read more about Ambu’s use of cookies in our cookie policy on Ambu websites.
3.6 Tracking of customer behaviour for marketing purposes
If you are a customer of Ambu, Ambu may in the marketing material provided to you be tracking your customer behaviour for the purposes of obtaining knowledge of the specific customer needs and preferences in terms of Ambu products. The tracking of the customer behaviour will not always include processing of your personal data. If personal data is collected, your name, email, and title may be processed.
The processing of personal data is necessary to fulfil and protect the legitimate interest of Ambu (Article 6, para. 1, lit. f of GDPR) in investigating our customers’ needs and preferences in terms of Ambu products.
We will delete your personal data when no longer necessary to keep it and/or pursuant to applicable legislation.
3.7 Processing of personal data for other purposes
Your personal data may only be processed for other purposes than stated above if necessary to comply with legal or regulatory obligations (e.g., transfer to courts or criminal prosecution authorities), if you have provided a consent to the respective processing, or if the processing is otherwise lawful under applicable law. If processing for any other purposes should take place, we may provide you with additional information.
4. Recipients of personal data
Data processors
Your personal data may be disclosed to external suppliers, such as IT service providers, who deliver services on behalf of Ambu. For example, in relation to distribution of newsletters and/or marketing material, invitations to events, product information etc.
Ambu has entered into data processing agreements with any external suppliers who are acting as data processors on behalf of Ambu (see below regarding any transfers outside of EU/EEA).
Transfers outside of EU/EEA
Your personal data may be transferred to countries outside of EU/EEA. Ambu ensures that such transfer will be carried out in accordance with the applicable data protection laws, which include that Ambu will ensure only to transfer your personal data outside of EU/EEA when an adequate level of protection can be ensured. Ambu has in place EU’s standard contractual clauses and for US relies on the EU-US Data Privacy Framework, as applicable, to ensure sufficient safeguards with respect to the protection of the privacy and fundamental rights and freedoms. In addition, supplementary measures are established, where applicable, to ensure sufficient protection of your personal data.
Distributors
Some data relating to your purchase of Ambu products, including your contact information and which products you have purchased or shown interest in, may be shared with your local distributor. The list of Ambu distributors can be found on following link: List of Ambu distributors
Ambu legal entities
Your personal data may be shared with group entities within Ambu, if necessary.
You can find information on Ambu A/S and affiliates on the following link: Ambu Addresses
Mergers & Acquisitions
In the case of a re-organization, full or partial sale of Ambu, any disclosure in such connection will be in accordance with current legislation for the processing of personal data.
Other disclosure
Other authorised third parties may need to access or store personal data if required or permitted by applicable law (e.g., governmental authorities, courts, external advisers and similar third parties that are public bodies).
Your personal data will apart from the above, not be sold, shared, or otherwise distributed to third parties without your consent, except where Ambu is required to do so because of an applicable law, court order or governmental regulation, or if such disclosure is otherwise necessary in supporting any criminal or other legal investigation or proceeding here or abroad.
5. Deletion of your personal data
Ambu will delete your personal data when no longer necessary for the purpose(s) for which it was collected. However, the data may be processed and stored for a longer period in anonymized form. Personal data may be kept for a longer or shorter period where required by any applicable local legislation.
6. Security
We have implemented security measures to ensure that our internal procedures meet our high security policy standards. This website has security measures in place to prevent loss, misuse, or alteration of the information under our control. Accordingly, we strive to protect the quality and integrity of your personal data. The network is operated and maintained by Ambu outsourcing partner according to their quality procedures. Monthly reports are reviewed for status and yearly audits and penetration tests are carried out by an external auditor. Any patient information will be processed in accordance with requirements following from applicable legislation and mainly in a pseudonymized form, with strict access controls. In addition, policies on data breach have been implemented.
7. Links to other websites etc.
Ambu’s website may contain links to other websites or to integrated sites. We are not responsible for the contents of the websites of other companies or for the practices of such companies regarding the collection of personal data. When you visit other websites, you should read the owners' privacy policies on the protection of personal data and other relevant policies. On some Ambu websites you will find forums, message boards, news groups etc. The information you may disclose in these areas becomes public, and you should always exercise caution when disclosing personal information.
8. Your rights and how you can access your Personal Data
Under applicable data protection legislation, you have various rights as a data subject as listed below (subject to the conditions set out in applicable law).
If you would like to know more about the processing of your personal data or wish to utilize any of your below listed rights, you can always contact us by using e-mail: dataprotection@ambu.com
- Right to information. You are at any time entitled to be informed of the personal data about you that we process, but with certain legislative exceptions.
- Right to access to your personal data. You are entitled to get access to the personal data we are processing about you. The access information includes, e.g., the purposes of the processing, and the categories of personal data concerned. The right is not absolute as the interests of other individuals and applicable law may restrict your right of information. You may have the right to obtain a copy of the personal data undergoing processing. For further copies requested by you, we may charge a reasonable fee based on administrative costs.
- Right to Erasure ("right to be forgotten"). You have the right to request from us the erasure of personal data concerning you and we may be obliged to erase such personal data.
- Right to Rectification. You are entitled to have your personal data rectified if inaccurate, or have incomplete data completed considering the purposes of the processing.
- Right to Restriction. You are entitled to have the processing of your personal data restricted so Ambu may only use within specific restrictions.
- Right to Object. You are entitled to object to the processing of your personal data. In particular, you have an unconditional right to oppose the processing of your personal data for direct marketing purposes.
- Automated processing. Ambu will not perform any automated processing concerning you or significantly affecting you based on your Personal Data.
Your above listed rights may be subject to conditions or restrictions.
There is no certainty that you will be entitled to exercise the rights as it will depend on the situation and circumstances of the processing.
9. Filing of complaints
You always have the right to lodge a complaint to the applicable local Data Privacy Authority within your country/jurisdiction: Data Privacy Authority in the EU overview
In Denmark
The Danish Data Privacy Agency (Datatilsynet)
CVR no. 11883729
Carl Jacobsens Vej 35
2500 Valby, Denmark
E-mail address: dt@datatilsynet.dk
Last updated: May 2022
