Privacy policy

1. Data protection at a glance

The protection of your personal data is important to us. On this page, you will learn which personal data we process when you visit our website or contact us, for what purpose we do so and what rights you have.

Our website is deliberately designed to collect as little data as possible:

• We do not use cookies or any analytics or tracking tools.
• Fonts, graphics and program components are loaded exclusively from our own web server. No content from third-party providers is embedded.
• Details entered in our forms are not stored on the website but transmitted to us exclusively by email.

Personal data is any information that can be used to identify you personally, for example your name, email address, phone number or IP address.

2. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Roja Pharmazie GmbH
Siemensstraße 41
12247 Berlin
Germany

Represented by the Managing Director Ph. Tahereh Kermani

Phone: +49 30 37 30 89 29
Email: info@roja-pharmazie.de

Further details can be found in our legal notice. If you have any questions about data protection, you can contact us at any time using the contact details above.

3. Hosting and server logs

Our website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The servers are located in Germany. We have concluded a data processing agreement with STRATO pursuant to Art. 28 GDPR. STRATO processes the data only on our instructions.

Each time you access our website, your browser automatically transmits technical information to the web server. This information is recorded in so-called server logs (log files):

• IP address of the accessing device
• Date and time of access
• Page or file accessed and amount of data transferred
• Notification of whether the access was successful
• Browser type and version, and operating system
• The previously visited page (referrer), if transmitted by your browser

Purpose: This data is technically necessary to display the website to you and serves the security and stability of our website, for example to defend against attacks. It is not combined with other data or analysed for advertising purposes.

Legal basis: Art. 6(1)(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of the website.

Storage period: The log data is automatically deleted after a short period, unless it is required to investigate a specific security incident.

4. Encrypted connection

For security reasons, our website uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the address bar of your browser begins with “https://” and displays a padlock symbol. When encryption is active, the data you transmit to us – for example via our forms – cannot be read by third parties.

5. No cookies, no tracking

Our website does not set any cookies and does not store any information on your device. We do not use any analytics, statistics or marketing services, social media plugins or embedded maps or videos. The choice of language also works without storing anything on your device.

The fonts used on the website are stored on our own server. Therefore, no connection to servers of other providers, such as Google, is established when you visit the website.

6. Product inquiry and contact form

On our website, we offer a form for product inquiries and a contact form, which you can also use to request an online meeting.

Data processed: the details you enter, i.e. depending on the form, company, name or contact person, email address, phone number (optional), details of the requested product including PZN, quantities, delivery date and target price, your message and, if applicable, your preferred date for an online meeting. In addition, we record the language version of the website from which you submitted the form, as well as the date and time of transmission.

Purpose: Processing and answering your inquiry, preparing an offer or arranging an appointment.

Procedure: After you submit the form, your details are transmitted to our web server via an encrypted connection and from there forwarded immediately as an email to our mailbox info@roja-pharmazie.de. The form data is not stored on the web server. We do not send you an automatic confirmation of receipt.

Legal basis: Art. 6(1)(1)(b) GDPR, insofar as your inquiry is aimed at the conclusion or performance of a contract; otherwise Art. 6(1)(1)(f) GDPR (our legitimate interest in answering inquiries) and your consent pursuant to Art. 6(1)(1)(a) GDPR, which you give by ticking the checkbox. You can withdraw your consent at any time with effect for the future, for example by email to info@roja-pharmazie.de.

Required information: We need the details marked as required fields in order to process your inquiry. Without these details, the inquiry cannot be processed via the form; however, you can contact us at any time by other means.

Spam protection: To protect against automated spam submissions, the forms contain a check field that is invisible to humans. No additional personal data is collected for this purpose and no external services are used.

7. Contact by email, phone and fax

If you contact us by email, phone or fax, we process your contact details and the content of your message in order to deal with your request. The legal basis is Art. 6(1)(1)(b) GDPR, insofar as your inquiry is related to a contract or its initiation, otherwise Art. 6(1)(1)(f) GDPR.

Our email mailbox is also operated by STRATO in Germany. Please note that although emails are usually encrypted during transmission, they are normally stored unencrypted on the servers involved. For particularly confidential information, we therefore recommend using postal mail or the telephone.

8. Contact via WhatsApp

On our website, we provide a phone number at which you can also reach us via the messenger service WhatsApp. Its use is voluntary; WhatsApp is not embedded in our website.

If you write to us via WhatsApp, we process your phone number, your profile name and the content of your messages in order to deal with your request. The service is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. According to WhatsApp, message contents are end-to-end encrypted. However, WhatsApp processes metadata (for example the time of the message, phone numbers, device information) and may also transfer it to its parent company Meta Platforms, Inc. in the USA. For transfers to the USA, the provider relies on the EU-US Data Privacy Framework and on standard contractual clauses of the European Commission. Further information can be found in the WhatsApp privacy policy at whatsapp.com/legal/privacy-policy-eea.

The legal basis is Art. 6(1)(1)(b) GDPR, insofar as your inquiry is related to a contract or its initiation, otherwise Art. 6(1)(1)(f) GDPR. If you would like to avoid communication via WhatsApp, please use our forms, email or phone.

9. Online meetings

At your request, we also hold discussions as online meetings. For this purpose, we use Microsoft Teams, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. You will receive the access link with the appointment confirmation by email. You can take part via your browser without your own Microsoft account.

When you participate, the following data in particular is processed: your name or the display name you enter, your email address, technical connection data (for example IP address, device type, time and duration of participation) and image and audio data if you switch on your camera and microphone. We do not record online meetings.

Microsoft processes this data as our processor on the basis of an agreement pursuant to Art. 28 GDPR. Processing of data in the USA by Microsoft or its sub-processors cannot be ruled out; Microsoft is certified under the EU-US Data Privacy Framework and additionally uses standard contractual clauses of the European Commission. Further information can be found in the Microsoft privacy statement at privacy.microsoft.com.

The legal basis is Art. 6(1)(1)(b) GDPR, insofar as the meeting serves the initiation or performance of a contract, otherwise Art. 6(1)(1)(f) GDPR (our legitimate interest in efficient communication).

10. Our presence on LinkedIn

We maintain a company page on the professional network LinkedIn, operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn is not embedded in our website; no data is transmitted to LinkedIn when you visit our website.

If you visit our LinkedIn page, interact with it or send us messages there, we process the data you provide to us there in order to communicate with you and to present our company. The legal basis is Art. 6(1)(1)(f) GDPR; our legitimate interest lies in presenting our company and communicating with interested parties and business partners.

LinkedIn also provides us with statistical analyses of the use of our page (“Page Insights”). These statistics are aggregated and do not allow conclusions to be drawn about individual persons. We are jointly responsible with LinkedIn for the collection of the data for these statistics (Art. 26 GDPR). The corresponding agreement can be found at legal.linkedin.com/pages-joint-controller-addendum. In it, LinkedIn has assumed primary responsibility for the processing; you can assert your rights directly against LinkedIn, but also against us.

LinkedIn also processes your data for its own purposes, such as advertising, and may transfer it to LinkedIn Corporation in the USA; for this, LinkedIn relies on the EU-US Data Privacy Framework and standard contractual clauses. Details can be found in the LinkedIn privacy policy at linkedin.com/legal/privacy-policy.

11. Links to other websites

Our website contains links to websites of other providers, for example the link “Open route in map” to OpenStreetMap. No data is transmitted to these providers when you merely visit our website. Only when you click on such a link do you leave our website; the respective provider is then responsible for the processing of your data.

12. Recipients of your data

Within our company, your data is only made accessible to those employees who need it to deal with your request. Beyond that, only our technical service providers have access, insofar as this is necessary for their services – in particular STRATO as provider of web hosting and email, and Microsoft as provider of Microsoft Teams for online meetings. These service providers are contractually obliged to maintain confidentiality and to comply with data protection regulations.

Your data is only passed on to other third parties if we are legally obliged to do so or if this is necessary to fulfil a contract with you. We do not sell your data and do not use it for third-party advertising purposes. Apart from the cases described in sections 8, 9 and 10, no data is transferred to countries outside the European Union.

13. Storage period

We store personal data only for as long as is necessary for the respective purpose. We delete inquiries as soon as they have been finally dealt with and no further contact is to be expected.

If your inquiry leads to a contract or if it concerns business correspondence, we retain the data within the scope of the statutory retention obligations. Under German commercial and tax law, these are generally six years (commercial and business letters) or ten years (accounting records and documents relevant for tax purposes). In addition, retention obligations may arise from pharmaceutical law, in particular from the requirements of Good Distribution Practice. After these periods have expired, the data is deleted.

14. Your rights

You have the following rights against us with regard to your personal data:

• Access to the data processed by us (Art. 15 GDPR)
• Rectification of incorrect data or completion of incomplete data (Art. 16 GDPR)
• Erasure of your data, unless statutory retention obligations prevent this (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability, i.e. receiving your data in a common, machine-readable format (Art. 20 GDPR)
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of the processing carried out until the withdrawal remains unaffected

To exercise your rights, an informal message to info@roja-pharmazie.de or to our postal address is sufficient.

Right to lodge a complaint with a supervisory authority: Irrespective of this, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes the GDPR (Art. 77 GDPR). The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59–61
10555 Berlin
Germany
www.datenschutz-berlin.de

15. Further information

No automated decision-making: We do not make any decisions based solely on automated processing within the meaning of Art. 22 GDPR and do not carry out profiling.

Changes to this privacy policy: We will amend this privacy policy as soon as changes to our website, our processes or the legal situation make this necessary. The version published on this page applies.