This notice is effective 18 May 2020 and last updated 3 October 2025. 

Almac Group Limited and its affiliates (collectively Almac) are committed to preserving the privacy of all individuals that share their information with Almac as an employer and a global service provider of contract pharmaceutical support services. Almac is committed to ensuring that if we handle information about any individual, we do so with full regard to the individual’s privacy and in full compliance with applicable laws on data privacy and confidentiality. 

Our Global Data Protection and Privacy Policy (Policy) will define the main types of personal information that we may have access to and process within our organisation; how we use any personal information and the steps which are taken to protect the information that you provide to us. The Policy also sets out how Almac complies with data privacy laws and regulations, including but not limited to the EU General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR), the Data Protection Act 2018, the California Consumer Privacy Act (CCPA), and where applicable the principles of the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce and other national laws implementing data privacy and confidentiality requirements. 

Almac has put in place internal policies to ensure that our employees are fully aware of the legal requirements relating to data privacy and confidentiality. 

By registering on any Almac site, you consent to the collection, use and transfer of your information under the terms of this policy. 

TYPES OF INFORMATION THAT WE COLLECT FROM YOU AND HOW IT WILL BE USED 

PERSONAL DATA 

Personal Data means any information or set of information that identifies or can reasonably be used to identify an individual and includes in the context of GDPR all information defined as “Personal Data” within GDPR, comprising any information relating to an identified or identifiable natural person, where an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal Data does not include information that is anonymous. 

SENSITIVE PERSONAL DATA 

References to Sensitive Personal Data in this Policy includes (in the context of GDPR) “Special Categories of Personal Data” (as such term is defined in GDPR) comprising personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation, as well as information about criminal convictions and offences. References to Sensitive Personal Data in the Policy shall also include for the purposes of the Swiss-US DPF ideological views or activities, information on social security measures or administrative or criminal proceedings and sanctions, which are treated outside pending proceedings. Almac will process information as Sensitive Personal Information as appropriate and comply with applicable laws in respect of such processing (see Section 3 below for further details). Additionally, information will be treated as Sensitive Personal Data where it is received from a third party that treats and identifies it as sensitive. 

1. ALMAC AS A DATA CONTROLLER 

Almac as a data controller, will collect, process, and store certain Personal Data and Sensitive Personal Data including, but not limited to, the examples listed below. 

(a) Employee Data 

Almac will collect Personal Data and Sensitive Personal Data of Almac employees, workers, contractors and applicants seeking employment with Almac as well as students or other individuals engaging in Almac programmes (such as STEM outreach initiatives). As a data controller, Almac determines the purpose and means of such processing. Almac collects and processes this employee information primarily for human resource purposes, including payroll, tax and performance reviews and assessments. Almac also collects Personal Data and information from applicants (who may be existing employees or external individuals) who apply to recruitment offers and positions (either directly or through an employment agency). This information may include contact details, professional qualifications, previous professional experience, references and relevant background checks. External advisors and consultants’ information will be collected and processed in the same manner and in accordance with Almac’s standard operating procedures. Almac may process employee and contractor information for other legitimate business purposes, such as: 

– operational and security purposes, including site access and safety monitoring; 

– internal communication and engagement, such as recognition programmes and event participation 

-marketing and client relationship activities, including photography or video during site visits events or promotional activities. 

(b) Clients, Prospective Clients and other Business Contacts 

Almac will collect and process Personal Data, including names and contact details, of clients, prospective clients, and other business contacts in the course of conducting our business, including sales and marketing activities and other legitimate business-related purposes. 

When you visit or register on any Almac website, you may be asked to voluntarily provide certain information about yourself, including your name and contact details. We may also collect information about you from e-mails, letters or business cards you provide to us. We may use your information to contact you for your views on our services and to notify you occasionally about important changes or developments to the site or our services. We may also use your information to let you know about other products and services which we offer which may be of interest to you and we may contact you by post, telephone or fax, as well as by e-mail. If you change your mind about being contacted in the future, please let us know, either by availing of the “unsubscribe” option in our marketing-related correspondence or by contacting us (see Section 8). 

(c) Suppliers, Site Visitors and Virtual Audits 

Almac may be required from time to time to process information relating to consultants, contractors, suppliers and other third parties engaged by Almac to provide services or who otherwise visit our premises (including for example, for the protection of health and wellbeing of personnel on site, site security records and Video Surveillance Systems (VSS) for the purposes of maintaining site security, and which are in accordance with our standard operating procedures). Almac may also be required to process information of individuals on site (including employees) as part of filming for, or otherwise performing, virtual audits. There are prominent notices at the relevant locations throughout our sites where filming for virtual audits occurs and where VSS are in operation. 

(d) Regulatory and Pharmacovigilance Activities 

Almac may collect and process medical information queries, complaints, and adverse event reports in connection with pharmacovigilance activities that we are required to perform as a legal obligation (e.g., reporting to relevant regulatory bodies) or that we are otherwise contracted to perform on behalf of our clients or commercial partners. 

2. ALMAC AS A DATA PROCESSOR 

Almac may at times process Personal Data (and, if applicable, Sensitive Personal Data) during the provision of its service offering as a data processor, acting on behalf of its clients or other third party sponsors. At all times, Almac shall process the Personal Data and Sensitive Personal Data in accordance with the client/sponsor’s instructions, who are the controllers of such data. Almac does not control the purpose for which the Personal Data or Sensitive Personal Data, is collected, processed or stored. The following are non-exhaustive examples of where Almac acts as a data processor for clients or other third party sponsors: 

a) CONTRACT PHARMACEUTICAL SUPPORT SERVICES 

Almac provides contract pharmaceutical support services on a global scale, which include but is not limited to, formulation and development, analytical testing, manufacture, packaging, labelling and distribution services (and such distribution services may also include direct-to-patient shipments from clinical sites directly to patient’s homes, where Almac act as data processor on behalf of our clients/sponsors who are the data controller). 

b) IXRS SYSTEM 

Almac develops and maintains interactive voice and web response systems (IXRS) on behalf of clients/sponsors. Almac may receive and process Personal Data and Sensitive Personal Data as data processor (on behalf of client/sponsor’s) in relation to patients enrolled in Almac-supported clinical trials. This Personal Data and Sensitive Personal Data may include (but is not limited to) patient initials, date/year of birth, sex, health-related information, telephone numbers and e-mail addresses. 

c) eCLINICAL SOLUTIONS 

Almac provides electronic clinical outcome assessment (eCOA) technology on behalf of client/sponsors to capture clinical outcome data electronically, including patient- reported outcomes, clinical assessments, observer reports and performance outcomes.  Almac’s eClinical technology also comprises an eConsent solution that enables the secure digital capture of informed consent of clinical trial participants on behalf of clients/sponsors. Almac may receive and process Personal Data and Sensitive Personal Data as data processor (on behalf of client/sponsor) in relation to Almac’s eClinical solutions. 

d) DIAGNOSTIC SERVICES 

Almac provides a wide range of services to biopharma companies including pre- clinical biomarker discovery and companion diagnostic development. Almac as a data processor may receive Personal Data and Sensitive Personal Data from client/sponsor’s patients enrolled in clinical trials which may include (but is not limited to) patient initials, date/year of birth, sex, race and ethnicity. Almac shall process the Personal Data and Sensitive Personal Data on behalf of the client/sponsor for the purposes of carrying out biomarker analysis by Almac, at all times in accordance with the client/sponsor’s instructions. 

e) WEBEZ SYSTEM 

Almac develops and maintains a randomization and drug ordering system (WebEZ) on behalf of clients/sponsors. Almac may receive and process Personal Data and Sensitive Personal Data as data processor (on behalf of client/sponsor) in relation to this WebEZ system. 

f)  CLIENT/SPONSOR CONTACT DETAILS 

Almac may also process Personal Data (comprising name and contact details) of client/sponsor’s employees or other individuals acting on behalf of client/sponsor, as an incidental part of providing services to client/sponsor. 

3. LEGAL BASIS FOR PROCESSING (WHERE ALMAC ACTS AS A DATA CONTROLLER) 

Unless we specify at the point of collection that we are relying on a data subject’s consent to process their Personal Data (in which case we will comply fully with all applicable legal requirements in relation to consent, including under GDPR) Almac relies on one or more of the other legal bases available for processing Personal Data, including (from a GDPR perspective): 

(i) the processing is necessary for the purposes of the legitimate interests pursued by Almac or by a relevant third party; 

(ii) the processing is necessary for compliance with a legal obligation; 

(iii) the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or 

(iv) the processing is necessary to protect the vital interests of the data subject or another individual. 

Where Sensitive Personal Data is processed, GDPR requires us to have (as well as one of the legal grounds described above), an additional legal ground to justify using this sensitive information. The appropriate additional legal ground will depend on the circumstances and includes (a) processing that is necessary for carrying out obligations and exercising specific rights in the field of employment or social security, (b) processing in connection with the establishment, exercise or defence of legal claims, (c) processing that is necessary for reasons of public interest in the area of public health, such as ensuring high standards of quality and safety of health care and of medicinal products or medical devices, and (d) explicit consent of the data subject – where we choose to rely on consent to process Sensitive Personal Data we or the client/sponsor always obtain the explicit consent of the individual data subjects concerned. 

Almac will also conduct Data Protection Impact Assessments (DPIA) as and when required, and in accordance with applicable law, taking into account, inter alia the nature, scope, context and purposes of the processing. Such DPIAs include a description of the processing operations and purposes of processing, the necessity and proportionality of the processing operations in relation to the purposes, the risks to the rights of data subjects and controls to mitigate the risks. 

4. DISCLOSURE OF INFORMATION 

The information you provide to Almac may be held on our computer systems in the UK (or in respect of information provided to our affiliates outside the UK, in the jurisdictions where those affiliates are established). This information may be accessed by or given to our staff or other third parties (including third party service providers) working either within or outside the UK, for the purposes set out in this policy or for other purposes approved by you. At times, personal information will be shared by Almac with companies working as agents of Almac and third parties strictly on a “need to know” basis and to satisfy business requirements. Almac does not trade or sell any personal information. Under certain circumstances, Almac may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. Finally, if our business enters into a joint venture with or is sold to or merged with another business entity, your information may be disclosed to our new business partners or owners. 

5. SECURITY AND DATA RETENTION 

Almac has implemented both organisational and technological measures to protect Personal Data and Sensitive Personal Data against accidental or unlawful destruction, loss, alteration, disclosure or access including, but not limited to, documented policies, procedures, and instructions, documented training, physical and logical secure access, role based access to minimum level required for job functionality, and data encryption. Your information will only be retained for as long as necessary for the purposes of the processing. 

6. TRANSFERS OUTSIDE OF THE EUROPEAN UNION AND COMPLIANCE WITH THE EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF 

Almac is a global service provider with sites and operations worldwide. Almac has put in place measures to ensure that adequate protection is provided to such data where legally mandated.  Almac will always take steps as a data controller to ensure that your information is used by third parties in accordance with this policy, and applicable laws (including GDPR). For example, Almac has entered into EU approved Model/Standard Contractual Clauses for the purpose of transferring personal information from the European Union. Almac Clinical Technologies complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Almac Clinical Technologies has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Almac Clinical Technologies has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/. Almac Clinical Technologies is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC). 

Almac’s accountability for Personal Data and Sensitive Personal Data that it receives under the DPF and subsequently transfers to a third party is described in the DPF Principles. In particular, Almac remains responsible under the DPF Principles for third-party agents that it engages to process Personal Data on its behalf. As further explained in Section 8 below, we encourage you to contact us in the first instance should you have a DPF-related (or general privacy-related) complaint. 

7. ACCESSING AND UPDATING YOUR INFORMATION 

Almac respects your privacy and is committed to protecting your Personal Data and Sensitive Personal Data. We collect and process such data only for the purposes for which it was originally collected and to which you have consented. 

In accordance with applicable laws, including the GDPR and the DPF Principles, you have the right to: Access your Personal Data/Sensitive Personal Data held by Almac; Request correction, amendment, or deletion of data that is inaccurate, incomplete, or no longer necessary for the purposes for which it was collected; Limit the use and disclosure of your Personal Data/Sensitive Personal Data, including opting out of: Disclosure to non-agent third parties; Use for materially different purposes than originally authorised. 

Where Sensitive Personal Data is involved, Almac will obtain your explicit opt-in consent before sharing it with third parties or using it for new purposes. 

You may exercise these rights by contacting Almac via email or in writing using the contact details provided in Section 8. Employees may also contact Almac’s HR Department. Almac will respond to all reasonable requests in a timely manner and in accordance with applicable law, including the DPF Principles. A nominal fee may be charged to cover administrative costs, where permitted by law. 

If Almac is acting as a data processor, we will direct you to the relevant data controller (client/sponsor) responsible for your data. 

For more information about your rights under the DPF, please visit the Data Privacy Framework website. https://www.dataprivacyframework.gov/  

U.S STATE PRIVACY RIGHTS 

If you are a resident of certain U.S States, you may have specific privacy rights under applicable state laws. These rights may include the ability to: 

• Request access to the personal information we collect about you; 

• Request correction or deletion of your personal information; 

• Receive a portable copy of your personal information; 

• Opt out of the sale or sharing of personal information and of targeted advertising; and 

• Limit the use and disclosure of sensitive personal information (California only). 

Almac does not sell or trade any personal information and does not discriminate in response to privacy rights requests. 

Almac outlines our privacy practices in this Privacy Policy, including what personal information is collected, the source of the personal information, and the purposes of use, as well as whether Almac discloses that personal information and if so, the categories of third parties to whom it is disclosed.  To exercise these rights, please submit a request by contacting us at the contact details at Section 8 below. 

8. CONTACT 

Please contact us at the address below if you have any comments, queries, requests or complaints relating to our use of your information. 

Almac Data Protection Officer  

Almac House 

20 Seagoe Industrial Estate Craigavon 

BT63 5QD 

Email address: dataprotectionofficer@almacgroup.com 

9. DISPUTE RESOLUTION 

Almac has put in place mechanisms to verify our ongoing adherence to these privacy principles. We encourage individuals covered by this policy to raise any concerns that they have about the way that we process their Personal Data/Sensitive Personal Data by contacting us at the Almac Data Protection Officer contact address above in the first instance, and we will endeavour to resolve them promptly. Please contact the Almac Data Protection Officer with any concerns about the use of your Personal Data/Sensitive Personal Data. Almac will respond in a timely manner to such complaints, and in accordance with applicable law and in any event within 30 days or receiving a complaint.   

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF,  Almac commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner’s Office (ICO), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. 

You also have the possibility, under certain conditions, to invoke binding arbitration for complaints regarding EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF compliance not resolved by any of the other mechanisms set out in the DPF Principles – see the following link for additional information: https://www.dataprivacyframework.gov/ 

10. CHANGES TO OUR PRIVACY POLICY 

We keep our privacy policy under regular review. Any changes to our Policy in the future will be posted to our website at almacgroup.com. 

11. ALMAC – COOKIE POLICY 

Almac may from time to time collect information from you by using “cookies”. At Almac, we are strongly committed to protecting your privacy and as such we want to ensure that you are always aware of how we are using cookies on our websites and how this may affect you. 

You can navigate around our websites without giving us any personal information. However, the cookie policy in this section sets out a brief explanation explaining our practices for the occasions where cookies are used. 

WHAT ARE COOKIES? 

A cookie is a text file that is placed on your computer, mobile phone or tablet by the websites. Cookies cannot be used to run programs or deliver viruses to your computer. Cookies are uniquely assigned to you and can only be read by a web server in the domain that issued the cookie to you. 

HOW WE USE COOKIES 

Almac uses cookies to improve services for you by: 

1. Measuring how many people are using the different areas of the websites so that popular sections can be improved. 

2. Analysing anonymous data to help us understand how visitors interact with the websites so we can improve the services offered. 

3. Enabling a service to recognise your computer so you don’t have to give the same information several times during one task. 

Cookies may be used on our client facing applications, and although we are not actively storing any information pertaining to the user in a form of a cookie, some of the application servers which Almac uses may write temporary files to enable them to perform as part of their normal usage. This data is not recorded by Almac. 

Cookies do not usually contain personally identifiable information, and if at times Almac requires you to register your information, the cookie which is associated with your registration information is used in a limited manner to allow Almac to offer increased functionality of our websites. The personal or system information is not stored in the cookie. 

Some cookies are essential for the website to function properly and cannot be disabled. These cookies do not store any personal information and are deleted when you close your browser. Other cookies are non-essential and can be controlled by you through your cookie settings. You can opt-out of these cookies at any time by changing your preferences. 

To allow you to control your own use of cookies, you will need to reset your web browser to either (i) accept cookies, (ii) accept only essential cookies; or (iii) reject cookies. Please note you can change your preferences and decline certain types of cookies; however, some cookies are essential for the website to function properly and cannot be disabled. If you block or delete these cookies, some parts of the website may not work as intended. To find out more about cookies, and how to actively manage how they are used on your computer, please visit www.allaboutcookies.org. 

Almac uses industry standard web analytics to track web visits via Google Analytics 4. The information generated by the cookie about your use of our websites will be transmitted to and stored by Google on servers. Google will use this information for the purpose of evaluating your use of our websites, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf.  Google uses cookies that do not require user consent to transmit data, however, you can still opt-out of these cookies if you wish.  

CHANGES TO OUR COOKIE POLICY 

We keep our Cookie Policy under regular review and any changes in the future will be posted to our website at www.almacgroup.com.