Introduction
This is the privacy notice of GH Research Ireland Limited. In this document, "we", "our", or "us" refer to GH Research Ireland Limited.
This privacy notice informs you of how we, acting as controller of your personal data, process your personal data (i) when you visit our website at www.ghres.com (the “Website”); (ii) if you are a service provider or an employee of a service provider we do business with, for example CROs, clinical trial sites, IT service providers, consultants (“Vendor”); or (iii) if you apply for a job with us (“Candidate”). In this document, “you” refers to any individual whose personal data we collect, that is within the scope of this privacy notice.
Please note that this privacy notice does not cover how we process personal data when conducting clinical trials. Please refer to the informed consent form that has been provided to you for information in that regard.
1. Information We Collect
We may collect and receive the following personal data about you:
- Contact information: This information may include your name, email address and any other contact information you share when you initiate contact with us;
- Automatically collected information: We collect information about your device and connection when you access the Website such as your IP address, browser (type/version) and screen resolution.
- Cookies: We collect information using cookies to operate and provide our Website.
- Website usage data: We collect information on usage of the Website including which subpages of the Website were accessed or how often and for which period of time a subpage was viewed.
- Whistleblowing reports: Personal information about you or others may be submitted as part of a whistleblowing report. We may receive this information from our service providers if you choose to submit your report through our third-party reporting platform.
We ask that you do not provide or share any health-related or sensitive information with us via the Website or through the contact details contained in this privacy notice.
If you are a Vendor engaging in business with us, we collect and receive the following personal data:
- Vendor Basic Information: Your name, the name of your company, company address, telephone number, email contact details, nationality (where related to patent applications only) name and contact details of your staff that engage with us, details of the sector in which you work, what services you carry out, prior relevant experience, particular job specifications;
- Vendor Application Information (if applicable): Details of applications or tenders including information on key personnel, CVs of your staff, job descriptions, training records and outcomes of any debarment checks;
- Vendor Remuneration Information: Your bank details, tax information, and similar payment details.
(together “Vendor Information”)
We collect and receive the following personal data when you apply for a job with us:
- Candidate Basic Information: Your name, address, telephone number, and email;
- Candidate Application Information: The information you provide as part of your application for a position, including your CV and references, your nationality / right to work information, work history and education background;
- Candidate Interview Information: Details of your interviews with us, including informal meetings and interviews;
- Candidate Sensitive Data: Details of any health issues or information on disability you might provide to us in the course of your application.
(together, “Candidate Information”)
2. How and Why We Process Your Information and Our Legal Basis for Doing So
We rely on different legal bases to process your personal data for the purposes described in this Privacy Notice.
A. Information we process for the purposes of legitimate interests
We rely on our legitimate interests or the legitimate interests of a third-party where they are not outweighed by your interests or fundamental rights and freedoms (“legitimate interests”):
| Why And How We Process Your Information | Legitimate Interests Relied On | Information Categories Used |
|---|---|---|
| Website users: | ||
To communicate with you, we:
|
It is in your interest that we respond to communications from you to which we believe you require a response. It is in our and your interest for us to facilitate your receipt of email alerts you have subscribed to. |
|
| All categories of data subjects: | ||
We preserve and share information in response to legal requests or when we seek to protect ourselves in the context of litigation and other disputes.
|
It is in our interest and in the interest of all individuals to prevent and address harmful or illegal activity. It is in our interest to seek legal advice and protect ourselves (including our rights, personnel, or property), or others, including as part of legal claims, investigations, regulatory inquiries and litigation or other disputes. |
|
We preserve and share information when insuring against or obtaining professional advice that is required to manage business risk.
|
It is in our interest to insure against and seek professional advice relating to managing business risk. |
|
Analytics and website improvement:
|
It is in our interest to measure the use of our website and count the people who interact with our website in order to inform and improve the website and to enable provision of accurate and reliable reporting. It is in our interests to compile statistics regarding whistleblowing reports to assess our operations. |
|
| Vendors: | ||
Arranging training sessions:
|
It is in our interest to receive information / training from our Vendors to improve our knowledge of their business / to train and upskill our staff (as applicable). |
|
Vendor management:
|
It is in our interest to ensure compliance with our onboarding processes and internal policies, including relating to compliance with anti-bribery and corruption laws and guidelines relating to interactions with healthcare professionals and organisations. |
|
Patent applications:
|
It is in our interest to protect our business and inventions. |
|
You have the right to object to, and seek restriction of, processing based on legitimate interests. To exercise your rights, visit the “Your Rights in Relation to Your Personal Data” section of this Privacy Notice.
B. Information we process to comply with a legal obligation
| Why And How We Process Your Information | Information Categories Used The actual information used depends on the specific legal obligation, but could include any of the following: |
|---|---|
| Candidates: | |
| We will process your Sensitive Candidate Information if you inform us that you need any reasonable accommodations made for you to complete the interview process, in compliance with our obligations under the Employment Equality Act 1998 (as amended). We rely on Article 9(2)(b) GDPR for this processing which allows for the processing of sensitive data where such processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law. |
|
| All categories of data subjects: | |
|
To investigate whistleblowing reports: In compliance with our obligations under the Protected Disclosures Act 2014 (as amended) or our group obligations as a Nasdaq-listed entity, we will review and investigate your report and, where possible, take steps to resolve the issue you have identified. |
|
|
We will access, preserve or disclose certain information if there is a valid legal request from a regulator, law enforcement or others. For example, a search warrant or court order to provide information about you. Examples of Irish and EU laws enforceable in Ireland that could give rise to an obligation requiring us to process information we hold about you are:
|
The actual personal data used depends on the specific legal obligation, but could include any of the following:
|
| Vendors: | |
|
We will collect and store certain information where required to comply with our obligations as a sponsor of clinical trials. Examples of Irish and EU laws enforceable in Ireland that could give rise to an obligation requiring us to collect and store such information are:
|
Personal information required for this purpose includes:
|
C. Information we process to perform our contract with you
Where applicable, we process information as necessary to conclude and perform our contract with you, or in certain circumstances the processing may be necessary in order to take steps prior to entering into a contract with you. The categories of information used and why and how they are processed is set out below.
| Why And How We Process Your Information | Information Categories Used |
|---|---|
| Candidates: | |
Processing your job application:
This processing is necessary in order to take steps prior to entering into a contract with you. |
|
| Vendors: | |
Processing business proposals:
This processing is necessary in order to take steps prior to entering into a contract with you. |
|
| In order to fulfil our contract with Vendors we will process personal information (for example, payment details). |
|
3. How We Share and Disclose your information
This section sets out how we may share and/or disclose the personal data described under ‘Personal Data we Collect’ section above. Except as set out below, we do not sell, trade, or otherwise transfer to outside parties your personal data.
We may share your information with:
- Our affiliated companies – we will share your information with our affiliated companies as part of our regular reporting activities and facilitating company business. The information shared with our affiliated companies may include Contact Information, Automatically collected information, Cookies, Website usage data, Whistleblowing reports, Vendor Information and Candidate Information.
- Our service providers – we will share your information with service providers that we appoint to assist us in carrying out the processing activities described in this Privacy Notice. Our service providers will process your information in accordance with our instructions. Our service providers include, for example, IT service providers such as Notified, that assist us in maintaining and providing our website. Notified may process Contact Information, Automatically collected information, Cookies and Website usage data. Our payment providers will process Vendor Remuneration Information to facilitate Vendor payments. Recruitment agencies that we engage to assist us in finding suitable candidates will process Candidate Basic Information and Candidate Application Information. We also engage service providers to assist us in carrying out regulatory required compliance checks (such as debarment checks).
- Patent offices – if you work with one of our Vendors and are involved in a patent application, your Vendor Basic Information will be shared with patent offices on a controller-to-controller basis.;
- Regulators, law enforcement, other government agencies - we will share your information if we believe that it is necessary to comply with applicable law, legal process or government requests; and
- Our advisors such as external lawyers or insurers - we will share your information on a controller-to-controller basis with our external advisors if / when necessary, for example to defend our legal rights and resolve disputes. The information shared with our advisors will include Contact Information, Automatically collected information, Whistleblowing reports, Vendor Information and Candidate Information, as appropriate in the circumstances.
- Other entities as part of an investment, restructure or business transfer – we will share your information with counterparties on a controller-to-controller basis in the context of any possible investments, restructure, reorganisation or sale of the business. The information shared as part of an investment, restructure or business transfer will include Contact Information, Automatically collected information, Cookies, Website usage data and Vendor Information.
4. International Data Transfers
The disclosure of your personal data outlined above may involve transferring your data abroad, which may include transfers to countries outside the European Economic Area including the United Kingdom and the United States.
When we transfer your personal data outside of the European Economic Area, we ensure it benefits from an adequate level of data protection by relying on:
- Adequacy decisions. These are decisions from the European Commission under Article 45 GDPR (or equivalent decisions under other laws) which recognise that a country outside of the European Economic Area offers an adequate level of data protection. For example, when we transfer your information to our external advisors based in the UK (as described above), we do so on the basis of the EU-UK adequacy decision.
- Standard contractual clauses. The European Commission has approved contractual clauses under Article 46 GDPR that allows companies in the European Economic Area to transfer data outside the European Economic Area. These are called standard contractual clauses. For example, we rely on standard contractual clauses to transfer personal data as described above to our IT service providers such as Notified, that are based in the United States.
You may obtain a copy of these standard contractual clauses by contacting us as outlined in the “Contact Us” section below.
While transfers to countries that don’t have an adequacy decision typically take place on the basis of the standard contractual clauses, in certain circumstances, transfers can also take place on the basis of exemptions provided for under data protection law. For example, sharing with law enforcement or government agencies.
5. Your Rights in Relation to Your Information
A. Your rights
If you are located in the European Economic Area or the United Kingdom, you have the right to request from us access to personal data we hold about you and information about how we process it, rectification of inaccurate personal data and erasure of your personal data for certain reasons, restriction of processing concerning your personal data for certain reasons and to object to processing of your personal data where we are relying on legitimate interests for the processing as well as a right to data portability, each in accordance with applicable data protection law.
B. Right to complain
You have the right to lodge a complaint with GH Research Ireland Limited’s supervisory authority under the GDPR, the Data Protection Commission, or your local supervisory authority. You can contact the Irish Data Protection Commission at 21 Fitzwilliam Square South, Dublin 2, email: info@dataprotection.ie or by using the following online form: https://forms.dataprotection.ie/contact.
C. How to exercise your rights
To exercise your rights in respect of your personal data, you may send us a request at privacy@ghres.com.
6. Retention Periods for Your Information
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for or to satisfy any legal or reporting requirements.
After these periods have elapsed your personal data will be deleted unless there is a good reason to keep it (or any part of it) for longer (for example, if the information is relevant to a legal dispute or claim that has arisen).
7. Contact Us
If you have any question regarding our Privacy Notice, please contact us at:
By email: privacy@ghres.com
By post: GH Research Ireland Limited, Joshua Dawson House, Dawson Street, Dublin 2, Ireland.
You may reach our data protection officer at GH Research Ireland Limited, Attn: The Data Protection Officer, Joshua Dawson House, Dawson Street, Dublin 2, Ireland, or at privacy@ghres.com, “FAO: GH DPO”.