Legal information and policy

RECORDATI AG is constantly committed in respecting the privacy of individuals with whom it comes into contact, in accordance with the provisions of Regulation (EU) no. 679/2016 (“GDPR”).

Pursuant to Article 13 of the GDPR, below are provided some information necessary to illustrate how RECORDATI AG, RARE DISEASES Branch will process the personal data through the www.cn.thisiscushing.com (the “Website”).

1. Data Controller

RECORDATI AG, RARE DISEASES Branch (“Recordati”), a company making part of the Recordati Group, with registered office at Uferstrasse 90, 4057 Basel – Switzerland is the Data controller.

The Data Protection Officer of the Recordati Group can be contacted using the following contact details: Data Protection Officer – DPO, Recordati S.p.A., Via Matteo Civitali 1, Milan – Italy; e-mail: GroupDPO@recordati.com.

2. Data processed

The data which will be processed include:

Navigation data:
1. that includes selection by user to view specific section (public or HCP section) of website, and language preference. This data are being collected by the technical cookie is stored on the user’s browsers which allows the website’s server to recognise re repeat visit from that user and serve pages based on their preferences stored in the cookie. The information is stored by the cookie for up to 30 days, but can be set to any length of time.
2. navigational data that is collected by Google Analytics with the help of its analytics cookie that is stored on the users browser. This information is processed by Google and stored on Google’s servers. This can include time, date and length of user session; location of user session; browser, device operating system and internet provider used during that session; source/media that directed user to the website, navigation within the website, and exit page from the website during that session. Note: Google Analytics will not record some person-identifiable data within EU.
name, surname, e-mail as well as any and all additional information that it may possibly provide through the “Contact” section of the Website. To this end, please note that the website does not store any information submitted through the contact form on the website. The form is designed to send information to a Recordati email address, for processing and storing within Recordati’s servers.

The Website contains links to websites of third parties, which have no connection with the Website. If you were to use one of these links, by “clicking” on them, your browser may send some personal data concerning you (e.g. IP address) to the third party owners of these plug-ins or websites. Such data will be processed exclusively by the aforementioned third parties in accordance with their respective privacy policies, with the exclusion of any responsibility of Recordati. For more information, please consult the following links:

Recordati websites
- Recordati RD website: https://www.recordatirarediseases.com/home
- Recordati media centre: https://www.rrdendomediacentre.com
Recordati social media
- LinkedIn – https://www.linkedin.com/company/recordati-rare-diseases/
- Twitter – https://twitter.com/RecordatiD
- YouTube: https://www.youtube.com/@recordatirarediseases
Professional bodies
- European Society of Endocrinology – https://www.ese-hormones.org
Patient advocates:
- Cushing’s Support and Research Foundation – https://csrf.net
- World Alliance of Pituitary Organizations – https://www.wapo.org
- Portal for rare diseases and orphan drugs - https://www.orpha.net

DISCLAIMER. Unless you voluntarily interact with links to the third-party sites on the Website, Recordati will not share or communicate any of your personal data to such third parties.

3. Purposes and legal basis of the processing

Personal data will be recorded, processed, managed and filed for the following purposes.

The data referred to in paragraph 2.A above are used to allow the navigation of the Website and use its features, as well as to obtain anonymous statistical information on the use of the Website, to check its correct functioning and to identify anomalies and/or abuses.

The legal basis of the processing is our legitimate interest to allow the proper functioning of the Website and to constantly improve its quality and attractiveness for users (Article 6.1. lett. f) GDPR). Based on our assessments, we believe that no interest, right or fundamental freedom of yours prevails over this legitimate interest.

The data referred to in paragraph 2.B above are used to manage your requests submitted through the “Contact” section of the Website;

The legal basis for the processing of the data for this purpose is represented by the need to give execution to a request from the data subjects pursuant to Article 6.1 letter b) of the GDPR. The provision of the data for this purpose is optional and, failing that, Recordati will not be allowed to manage your requests.

Data recipients - data transfer to third countries/international organizations

As part of the processing for the purposes referred to in paragraph 3 above, personal data may be disclosed or otherwise made accessible to companies which carry out technical and organizational activities on behalf of Recordati, including IT consultants and web agencies which develop and manage the Recordati Group’s websites.

Where necessary, the Data Controller will appoint third parties as its Data Processors pursuant to Article 28 of the GDPR.

Data may be transferred outside the Economic European Area. Any Data transfer outside the Economic European Area will be carried out in compliance with the applicable provisions of GDPR.

Data retention period

The data referred to in paragraph 2.A will be deleted after 5 years from the relative registration. Only in the event of a request by the Public Authorities, the data may be stored for a longer period, in accordance with what will be ordered to the Data Controller.

The data referred to in paragraph 2.B will be processed and store only for the time necessary to manage and answer to the request submitted through the Website.

Where necessary, the Data Controller will appoint third parties as its Data Processors pursuant to Article 28 of the GDPR.

Data may be transferred outside the Economic European Area. Any Data transfer outside the Economic European Area will be carried out in compliance with the applicable provisions of GDPR.

Data subject rights

Pursuant to Article 13, paragraph 2, letters b), c) and d), 15, 16, 17, 18, 19, 20 and 21 of the GDPR, we inform you that:

you have the right to request access to personal data together with information on the processing purpose, category of data processed, subjects or categories of subjects to whom they have been or will be communicated;
you also have the right to obtain:
- the correction of your data, if they are incorrect or incomplete;
- the erasure of the personal data, given one of the conditions set out in Article 17 of the GDPR;
- the restriction of the processing of personal data;
- the personal data is in a structured, commonly used and readable by an automatic device, also in order to send the personal data to another data controller if the processing is based on consent or on a contract and is carried out by automated means (so-called data portability right). If you are interested, you can ask Data Controller to send the personal data directly to the other data controller if this will be technically feasible.
You have the right to object to the processing of the personal data, if such processing is carried out pursuant to Article 6.1 letter e) (i.e. to fulfil a legal obligation to which the Data Controller is subject) or letter f) (i.e. to pursue a legitimate interest of the Data Controller) of the GDPR, unless there are legitimate reasons for the Data Controller to proceed with the processing, pursuant to Article 21 of the GDPR.
You have the right to revoke the consent given at any time for the purpose described in point 3 (c) above, without prejudice to the lawfulness of the personal data processing based on consent and carried out before the revocation.
If you are not satisfied with the processing of the personal data, you may lodge a complaint with the Data Protection Authority. In order to facilitate the exercise of the right to lodge a complaint, the name and contact details of the Supervisory Authorities of the European Union are available at the following link: https://ec.europa.eu/justice/article-29/structure /data-protection-authorities/index_en.htm.
Any correction or erasure of the personal data or processing restrictions made upon request – unless this proves impossible or involves a disproportionate effort – will be communicated to each of the recipients to whom the personal data may have been transmitted in accordance with this policy.

The exercise of the previous rights is not subject to any form of constraint and is free of charge. We may only ask you to verify your identity before taking further action upon your request.

In any case, as provided for by Art. 38 GDPR, you can freely contact the DPO for all questions relating to the processing of your personal data and/or if you wish to exercise your rights:

– by e-mail to the Recordati Group DPO: groupDPO@recordati.com.

The Data Controller reserves the right to modify or simply update the content of this Privacy Policy, in part or in full, also due to changes in applicable legislation. We, therefore, invite you to regularly visit this section for the most recent and updated version of the Privacy Policy.

Edition 08^th April 2023.