Privacy notice — art. 14 GDPR

Commercial Intelligence

21/07/2026

Version 1.0

 

This notice covers

Processing of professional identification data of executives, managers and key personnel of PLG’s clients, prospects and market participants, collected from publicly available sources for commercial intelligence and market monitoring purposes.

 

1. Purpose of this notice and who it is for

This notice is addressed to any individual whose professional details — name, job title, employer and institutional role — may appear in PLG’s commercial intelligence systems as a result of being mentioned in the context of a business event (appointment, departure, acquisition, merger, reorganisation) that is relevant to PLG’s clients or prospects.

For any matter not expressly provided for herein, reference is made to PLG’s general privacy policy addressed to Customers, Prospects and Suppliers. It is specifically designed to explain how PLG processes professional information collected from public sources as part of its market monitoring and commercial intelligence activity — and to ensure that the individuals whose names appear in that context are fully informed of their rights.

If you are an executive, director, manager or key personnel at a company that is, has been, or may become a client or prospect of PLG, or if you have been identified in connection with a transaction, reorganisation or leadership change affecting such a company, this notice applies to you.

 

2. Who we are

Data controller: The data controller may be Groupe ProductLife, a simplified joint stock company registered with the Company Registry of Nanterre under the number 392 639 266, whose head office is located at 8-14, avenue de l’Arche, 92400 Courbevoie, France or any one of its affiliates, whose contact details you can find here https://www.productlifegroup.com/worldwide-presence/

DPO contact: [email protected] 

 

3. What we do and why

PLG monitors publicly available information about its clients, prospects and the broader life sciences and regulatory services market in order to understand the economic and strategic context of the companies it works with or seeks to work with. This monitoring activity covers, in particular:

    • mergers, acquisitions, divestitures and strategic partnerships involving PLG’s clients or prospects;
    • changes in senior leadership, including appointments, departures and promotions of executives, directors and key decision-makers;
    • corporate reorganisations, restructurings and strategic pivots;
    • regulatory or commercial developments that may affect clients’ operating environments;
    • publicly reported information about clients’ pipeline, product launches or therapeutic focus areas.

The purpose of this monitoring is not to build individual profiles of the persons mentioned. It is to understand the institutional context of PLG’s client and prospect organisations so that PLG can provide relevant, timely and commercially intelligent services. Any reference to an individual is incidental to the analysis of the entity with which they are associated.

 

4. What personal data we collect and from where

Categories of personal data

    • Name and surname: First name and family name as they appear in public sources.
    • Job title and function: Professional title and organisational role (e.g. Chief Executive Officer, Vice-President Regulatory Affairs, General Manager).
    • Employer: The name of the company, entity or organisation with which the individual is associated in their professional capacity.
    • Institutional context: The nature of the event in which the individual is mentioned (e.g. appointment, departure, acquisition announcement, board composition).

 

We do not collect: email addresses, telephone numbers, postal addresses, biographical data, financial data, health data, or any data relating to the individual’s private life. The processing is limited to professional identification data in an institutional context.

 

Sources of the data

All personal data processed under this notice is collected exclusively from publicly available sources. These include:

    • press releases and corporate announcements published by the companies themselves;
    • regulatory filings, company registers and official administrative databases (e.g. Registre du Commerce et des Sociétés, Companies House, SEC EDGAR);
    • financial and business news publications (e.g. Les Échos, Financial Times, Reuters, Bloomberg);
    • industry publications, trade press and sector databases relevant to the life sciences and regulatory services markets;
    • publicly accessible professional profiles where the individual has made their professional information available in a professional context;
    • public corporate websites and investor relations sections.

PLG does not acquire personal data from data brokers or from providers of contact enrichment services. Data is collected through structured monitoring of the sources listed above and is used only in the institutional analytical context described in this notice.

 

5. Legal basis for the processing

The processing is based on PLG’s legitimate interests within the meaning of Article 6(1)(f) of the GDPR. PLG has a legitimate commercial interest in understanding the economic and strategic context of its clients and prospects in order to provide relevant services and to develop its business responsibly and in an informed manner.

 

6. How long we keep the data

Personal data is retained only for as long as it remains relevant to PLG’s monitoring purposes:

    • Active commercial intelligence: Data relating to current clients and active prospects is retained for the duration of the commercial relationship, plus a period of up to two (2) years after its conclusion.
    • Historical market events: References to individuals in the context of historical transactions or leadership changes are retained for a maximum of five (5) years from the date of the event, unless the event remains materially relevant to an ongoing commercial situation.
    • Superseded information: Where an individual has changed role, left a company or the information is otherwise superseded, the data is updated or deleted promptly upon PLG becoming aware of the change.
    • Following exercise of right to object: Data is deleted without undue delay following a valid objection (see Section 8 below).

 

7. Who has access to the data

Access to the commercial intelligence data is strictly limited to PLG personnel with a professional need to use it — primarily business development, client relationship management, and senior management teams. Data is not sold, licensed or transferred to third parties for their own commercial purposes.

PLG may use dedicated commercial intelligence platforms or CRM systems operated by technology providers acting as data processors under contract. These processors are bound by GDPR-compliant data processing agreements and may not use the data for their own purposes.

Where data is processed by providers established outside the European Economic Area, PLG ensures that appropriate safeguards are in place in accordance with Chapter V of the GDPR (Standard Contractual Clauses or adequacy decisions).

 

8. Your rights

As a data subject under the GDPR, you have the following rights with respect to your personal data processed under this notice:

    • Right of access (Art. 15): You may request confirmation of whether PLG holds personal data about you and, if so, a copy of that data together with information about how it is processed.
    • Right of rectification (Art. 16): You may request correction of inaccurate or incomplete data about you.
    • Right to erasure (Art. 17): You may request deletion of your data in certain circumstances, including where the data is no longer necessary for the purposes for which it was collected.
    • Right to restriction (Art. 18): You may request that processing be limited in certain circumstances, for example while the accuracy of data is being verified.
    • Right to object (Art. 21): You have the right to object at any time to the processing of your personal data on grounds relating to your particular situation. Because PLG’s processing is based on legitimate interest, PLG must stop processing unless it can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims. To exercise your right to object, please contact: [email protected]. PLG will respond without undue delay and in any event within one month.

 

How to exercise your rights: Send a written request to [email protected]. Please describe the nature of your request and indicate your name and professional context so that PLG can identify the data concerned. PLG will respond within one (1) month. There is no charge for exercising your rights.

 

9. Right to lodge a complaint

If you consider that PLG’s processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority in your country of habitual residence, your place of work, or the place where the alleged infringement occurred.

In France, the competent authority is the Commission Nationale de l’Informatique et des Libertés (CNIL) — www.cnil.fr. A list of all EU supervisory authorities is available at: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

 

10. Updates to this notice

PLG may update this notice from time to time to reflect changes in its processing activities or in applicable law. The current version is always available at www.productlife-group.com/privacy. The date of the most recent update appears at the top of this document.