1. Introduction
Ethyx Pharmaceuticals takes the utmost care to protect the personal data it collects and considers the protection of personal data to be of fundamental importance to the operation of its business. The personal data we collect is protected and processed with the utmost care, in compliance with applicable legislation, in particular the General Data Protection Regulation (EU) 2016/679 of April 27, 2016, known as the “GDPR”.
This Privacy Policy is intended for individuals outside our organization with whom we interact, including visitors to our website www.ethyxpharmaceuticals.com (hereinafter referred to as the “Website”), our prospects, customers, partners, healthcare professionals, patients, or candidates (collectively, “you”).
As part of our commitment to protecting your personal data in a transparent manner, we wish to inform you:
– how and for what purposes Ethyx Pharmaceuticals uses and stores your personal data;
– the legal basis on which your personal data is processed;
– the categories of recipients of your personal data;
– your rights and our obligations in relation to such processing.
2. Who is responsible for processing your data?
The data controller responsible for processing your personal data is ETHYX PHARMACEUTICALS, a simplified joint stock company with a capital of €10,000, registered with the Nanterre Trade and Companies Register under number 882 632 565, with its registered office at 7 avenue du Fort, 92120 MONTROUGE, France (hereinafter referred to as “Ethyx Pharmaceuticals”).
3. What personal data do we process and for what purposes?
Ethyx Pharmaceuticals collects and processes only personal data about you for which it has legal grounds. Legal grounds include your consent (when you have given your consent to the processing of data), contract (when data processing is necessary for the performance of the contract between Ethyx Pharmaceuticals and yourself), compliance with a legal obligation, and the “legitimate interests” of Ethyx Pharmaceuticals.
In the context of personal data processing, Ethyx Pharmaceuticals collects and processes the following data for the purposes detailed below:
| Purpose of processing | Categories of personal data processed | Legal basis of processing |
| Sales prospecting management | Last name, first name, company name, address, telephone number, email address, position within the company, data relating to prospecting activities carried out. | Processing is necessary for the performance of steps prior to entering into a contract with you, or because we have a legitimate interest in processing in order to contact you. |
| Managing relationships with our customers, suppliers, and partners | Last name, first name, company name, address, telephone number, email address, position within the company, data relating to the business relationship, billing information. | The processing is necessary for the performance of the contract between us or for taking steps prior to entering into a contract with you, or because we have a legitimate interest in processing in order to contact you. |
| Website management and audience measurement | IP addresses, browser type, language, operating system, device information (including application and device identifiers), referring webpage, pages visited, location, and other cookie information. (depending on the permissions you have granted us) | We have a legitimate interest in processing your data in order to allow you to access the Website and to compile audience statistics when you have given us your consent. |
| Application and recruitment management | Last name, first name, email address, postal address, telephone number, current position, level of experience, field of activity, interview reports, connection logs and, in general, all personal data appearing on your resume, cover letter or any other document to which you give us access in connection with your application. | We have a legitimate interest in processing data in order to handle the applications we receive and recruit candidates who meet our requirements. |
| Management of requests received via the contact form | Last name, first name, email address, status, subject, and content of your message. | We have a legitimate interest in processing your data so that we can process your request and contact you. |
| Management of the pharmacovigilance system | Surname, first name, position, postal address, telephone number, email address, or fax number of the person who reported the adverse event;
Initials of the person exposed to the adverse event (unless they are the reporter), age, gender, treatment administered, medical history (health data) |
The processing is based on compliance with a legal obligation (Articles L. 5121-22 et seq. and R. 5121-150 et seq. of the Public Health Code). |
4. which categories of recipients are your data transmitted?
Ethyx Pharmaceuticals guarantees the confidentiality of your personal data. The personal data we collect, as well as any data collected subsequently, is intended for us in our capacity as data controller. It may be disclosed to the categories of recipients listed below for the purposes set out in this privacy policy. These operations are carried out using tools that comply with applicable regulations and are designed to ensure the protection and respect of your rights.
Therefore, for the purposes set out above, Ethyx Pharmaceuticals may share your personal data with third parties, but only in the following cases:
- Ethyx Pharmaceuticals may use service providers, agents, or suppliers to support and assist in the management of its internal operations. These third parties must at all times guarantee the same levels of security as Ethyx Pharmaceuticals with regard to your personal data and are bound, where applicable, by a legal agreement under which they are required to maintain the confidentiality and security of your personal data and to process it only in accordance with Ethyx Pharmaceuticals’ specific instructions ;
Ethyx Pharmaceuticals ensures that it acts responsibly and only interacts with partners who have a policy governing their own processing of personal data and who provide an adequate level of protection in accordance with the requirements of European data protection regulations. In all cases, Ethyx Pharmaceuticals implements contractual mechanisms and binding legal processes to legally transfer personal data beyond the borders of the EEA and to secure these data flows ;
- Ethyx Pharmaceuticals may disclose your personal data to certain of its employees, who are also subject to confidentiality obligations, strictly and solely for the purposes mentioned above;
- In order to fulfil its contractual obligations, Ethyx Pharmaceuticals may transmit this data to third parties provided that such third parties are subject to confidentiality rules that guarantee adequate data protection;
More specifically, in terms of pharmacovigilance, Ethyx Pharmaceuticals may transmit information relating to reported adverse events containing pseudonymized data on the person affected by the adverse event to partners operating the drug concerned outside the European Economic Area. These partners are located in a country that provides a level of protection adequate to that required by the GDPR or have been contractually bound by obligations equivalent to those set out in the GDPR. In any event, the transfer of such data is only carried out with appropriate safeguards, as required by personal data regulations;
- In the event of a merger or acquisition of Ethyx Pharmaceuticals, in whole or in part, by another company, or if Ethyx Pharmaceuticals were to sell or transfer all or part of its business, the purchaser would have access to the information collected by Ethyx Pharmaceuticals, including personal data, subject to applicable laws. Similarly, personal data may be transferred in the context of a corporate restructuring, insolvency proceedings, or any other similar event, if permitted by and in accordance with applicable law;
- Ethyx Pharmaceuticals may also disclose your personal data when required to do so by law to legally authorized authorities in order to comply with its legal, regulatory, or contractual obligations, particularly with regard to pharmacovigilance.
In all cases, Ethyx Pharmaceuticals will make every effort to ensure the confidentiality and security of personal data collected during its transmission to the aforementioned persons.
5. How long do we keep your data?
The retention periods we apply to your personal data are limited and proportionate to the purposes for which they were collected. The length of time our services retain personal data varies and is determined by various criteria, including:
- the purpose for which we use them: Ethyx Pharmaceuticals must retain the data for the period necessary to fulfill the purpose related to the processing; and
- Legal obligations: legislation or regulations may stipulate a minimum period during which we must retain personal data.
We organize our data retention policy according to these criteria and are available to answer any questions you may have.
Furthermore, your data will be stored until you request its deletion. If you request deletion, all your data will be permanently deleted within thirty (30) days of your request, provided that such deletion is permitted by applicable regulations.
6. What rights do you have over your data?
Your right to information – This privacy policy informs you of the identity of the data controller, the purposes and legal bases for which your data is processed, the retention period for your data, and the recipients or categories of recipients with whom your personal data is shared, as well as your rights. If we decide to process data for purposes other than those indicated, all information relating to these new purposes will be communicated to you.
Your right to access and rectify your data – You have the right to access and rectify your personal data. As such, you have the right to confirm whether or not your personal data is being processed and, if so, you have the right to access the data we hold about you.
You may also ask us to correct or complete your personal data if it is inaccurate, incomplete, ambiguous, or out of date.
Votre droit à l’effacement de vos données – Vous pouvez nous demander l’effacement de vos données personnelles lorsque l’un des motifs suivants s’applique :
- les données personnelles ne sont plus nécessaires au regard des finalités pour lesquelles elles ont été collectées ou traitées d’une autre manière ;
- vous retirez le consentement préalablement donné ;
- vous vous opposez au traitement de vos données personnelles lorsqu’il n’existe pas de motif légal audit traitement ;
- le traitement de données personnelles n’est pas conforme aux dispositions de la législation et de la réglementation applicable ;
- vos données personnelles ont été collectées dans le cadre de l’offre de services de la société de l’information aux enfants âgés de moins de 16 ans.
Your right to erasure of your data – You may request that we erase your personal data when one of the following grounds applies:
- the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
- you withdraw your previously given consent;
- you object to the processing of your personal data when there is no legal basis for such processing;
- the processing of personal data does not comply with the provisions of applicable laws and regulations;
- your personal data has been collected in connection with the provision of information society services to children under the age of 16.
However, you will not be able to exercise this right when the retention of your personal data is necessary in accordance with legislation or regulations, and in particular, for example, for the establishment, exercise, or defence of legal claims or the monitoring of pharmacovigilance events.
Your right to restrict data processing – You may request that the processing of your personal data be restricted in the cases provided for by law and regulations.
Your right to object to data processing – You have the right to object to the processing of your personal data when the processing is based on the legitimate interest of the data controller.
Your right to data portability – You have the right to the portability of your personal data. This right is limited to processing based on consent or a contract. This right does not include derived data or inferred data, which is data created by Ethyx Pharmaceuticals.
Your right to withdraw your consent – When the data processing we carry out is based on your consent, you may withdraw it at any time. We will then stop processing your personal data without calling into question the previous operations for which you had given your consent.
Your right to obtain a copy of the safeguards put in place in the event of transfers outside the EU – When we transfer personal data to a third country or an international organization located in a territory that does not benefit from an adequacy decision by the European Commission, you can obtain a copy of the safeguards we have put in place with the third-party recipient.
Your right to lodge a complaint – You have the right to lodge a complaint with the CNIL in France, or with any other supervisory authority, without prejudice to any other administrative or judicial remedy.
Your right to define post-mortem guidelines – You have the option of defining guidelines for the storage, erasure, and communication of your personal data after your death with a trusted, certified third party responsible for enforcing the wishes of the deceased in accordance with the requirements of the applicable legal framework.
How to exercise your rights – All of the above rights may be exercised by sending an email to gdpr@ethyxpharmaceuticals.com or by writing to the following address: Ethyx Pharmaceuticals, 19 rue Duquesne 69006 LYON, France.
7. How do we protect your personal data?
All necessary precautions are taken to ensure the security and confidentiality of your personal data, in particular to prevent its loss, alteration, destruction, or use by unauthorized third parties. We follow generally accepted standards, including the use of appropriate administrative, physical, and technical safeguards, to protect the personal data submitted to us and implement adequate technical and operational security measures. These measures take into account the sensitivity of the personal data we collect, process, and store, and the current state of technology.
In addition, we require our service providers and subcontractors who may have access to personal data to implement appropriate technical and organizational security measures with regard to such personal data.
Furthermore, Ethyx Pharmaceuticals employees who may have access to your personal data due to their duties are subject to the strictest confidentiality requirements in this regard.
However, although we strive to use reasonably acceptable means to protect your personal data, we cannot guarantee its absolute security or confidentiality, but we guarantee that we will make every reasonable effort to prevent any misuse or loss.
8. Cookies
A cookie is a small file stored on your device when you visit a website. It records information about your device, your browser, and, in some cases, your preferences and browsing habits.
We may process your personal data using cookie technology or other trackers, in accordance with our Cookie Management Policy.
9. Any questions ?
If you have any questions about this privacy policy or our data collection and cookie management practices, please contact us by sending an email to: gdpr@ethyxpharmaceuticals.com or by mail to the following address: Ethyx Pharmaceuticals, 19 rue Duquesne 69006 LYON, France.
10. Update
We reserve the right to modify this policy to reflect changes in applicable regulations and practices.
Any changes we make to our policy will be posted directly on this page of our website. To ensure that you have the latest version, we encourage you to consult it online.
Last update : September 2025