Data Privacy Information for Specific Processing Activities

Welcome to this information page on specific processing activities conducted by Bayer AG, Kaiser Wilhelm Allee 1, 51368 Leverkusen (Germany) and all of its affiliates based in the European Economic Area (hereinafter “us” or “we”).

What you get

You might be visiting this information page:

• because we invited you to visit this information page in order for you to be able to obtain further information on a specific data processing activity because at the time when we obtained your personal data, we were not able to provide you with all necessary information or

• because you are searching for publicly available information on how we process personal data not obtained directly from you but, for example, from publicly available sources, where informing each individual proves impossible or would involve a disproportionate effort (Art. 14(5)(b) GDPR).

• because you have been in contact with / addressing requests to HR Operations. Depending on the recipient of your request to HR Operations, your current or former employer as legal entity within Bayer Group, respectively the Bayer-Beistandskasse VVaG, Bayer-Unterstuetzungskassse GmbH, Bayer-Pensionskasse VVaG or Rheinische Pensionskasse VVaG (hereinafter “us”, “our” and “we”), each in its capacity as controller for the processing of your personal data, wishes to provide you with information on the processing of your personal data.

Personal Data We Process about You, if …

… you hand over your business card to us

When you hand over your business card to us, we might copy it and enter the personal data contained therein into one of our contact management systems.

… you communicate with us via email

When you communicate with us via email, we process your email address, the information you provide in your emails (e.g. your name, further contact information from your signature, the content of your emails or any attachments) as well as the email meta data (e.g. time stamp, sender’s IP address, mail user agents, servers used in transit, etc.).

Additionally, we may process your email address for cyber security purposes. In order to protect Bayer’s data assets from unauthorized disclosure to third parties, we use a Data Loss Prevention (“DLP”) tool to prevent possible data leakage incidents by detecting and blocking certain data flows of sensitive information. In the case your email address is included in a detected incident, the data is stored as long as necessary to assess and resolve the incident or keep the data as evidence. This data processing is based on our legitimate interest to protect the Bayer group against loss of intellectual property and other sensitive information.

… you are, or work for, one of our customers, suppliers or contract partners

We process contact information (like name, email address, telephone number, position and role in the company) of employees of our customers, suppliers or contract partners (like key account managers, consultants, business partners or legal counsels) or of individuals who directly act as our customers, suppliers or contract partners (such as freelancers). We also might process individuals’ payment data (like bank account information), if applicable.

… you reach out to HR Operations

You can reach out to HR Operations via different channels (e.g. telephone / email / fax / Communication Center in myServices) for various different purposes. We will process personal data that you provide us in the context of your request (e.g. name, date of birth, CWID, address, request) for identification and authentication purposes and to process your request.

… you ask us a medical inquiry

When you ask us a medical inquiry we will enter the personal data contained therein into our Medical Information database.

We will process the following personal data for the purpose to manage your medical inquiry and to deliver a respective response:

• Contact information (e.g. your name, address, phone/fax/mobile phone/email/ or other online contact information)
• Demographic data (e.g. age/age group, date of birth, gender)

Should such information be part of your request, we furthermore may process information which qualifies as sensitive personal data like

• information about your health status,
• your religious beliefs, 
• your sex life/sexual orientation or 
• your ethnicity.

An example where this could be the case is a request whether a Bayer product would be suitable for a Kosher diet.
 

… you report a complaint or counterfeit to us 

When you report a complaint or counterfeit to us, we will enter the personal data contained therein into our Complaint Management database.

We will process the following personal data for the purpose to manage your report and, if necessary, to deliver a respective response:

• Contact information (e.g., your name, address, phone/fax/mobile phone/email/ or other online contact information)
• Information about the treating hospital or supplying pharmacy (or internet purchasing source) if needed

Should such information be part of your complaint, we furthermore may process information which qualifies as sensitive personal data like:
Information about your health status

… you or others publish your personal data on the internet

We search the internet for information for various purposes that are explained in more detail below. This information may contain personal data. We also use active online listening services. Active online listening is the process of identifying and assessing what is being said about a company, individual, product, brand or topic with business relevance to the company on the internet. We process the personal data we collect from publicly accessible areas on the internet and in public media by, for example:

• performing keyword searches across the web (e.g. websites, social media platforms, social network communities, blogs, mainstream news sources, forums or photo and video sites);
• searching, filtering and analyzing conversation streams;
• viewing visual analytic displays of conversation trends over a specified time range;
• monitoring publicly available opinions, statements or other interactions on the internet from certain individuals or entities that are important for us and our business (so called thought leaders).

Following categories of personal data may be processed:

• Name, gender, job title/position within an organization/company (e.g., manager, spokesperson, editor, contributor), topic focus
• Social media accounts (e.g., Twitter) and website addresses 
• Information on published articles or statements (e.g., date of publication, author, information on media reach, tone on relevant topics, article content)

Transfer of Personal Data for Commissioned Processing

We might use specialized service contractors to some extent in processing your personal data. Such service contractors are carefully selected and regularly monitored by us. Based on relevant data processing agreements, they will only process personal data upon our instruction and strictly in accordance with our directives.

Third party transfer

For requests addressed to HR Operations, if your request cannot be answered or processed by us directly, the personal data required for this purpose will be forwarded to the relevant departments in the Bayer Group for further processing (e.g. for reported technical access problems to the IT service or for requests for shift flat rates to the responsible HR Business Partner). Depending on your concerns, it may also be necessary for us to e.g. get in contact with the relevant tax office or your health insurance company.

Processing of Personal Data outside the EU / the EEA

Your personal data may in part also be processed in countries outside the European Union (“EU”) or the European Economic Area (“EEA”), which may have lower data protection standards than European countries. In such cases, we will ensure that a sufficient level of protection is provided for your data, for example, by concluding specific agreements with our contractual partners (copy available on request), or we will ask for your explicit consent to such processing.