Privacy Notice
This page functions as a Privacy Notice explaining how Bavarian Nordic processes your personal data.
You can read more about how we process your personal data on this page, where you can choose the specific situation and processing activity that you want to know more about. You can also learn about your rights as well as how we process personal data in general.
1. Data controller
The entity responsible for the processing of your personal information is:
Bavarian Nordic A/S
Reg. No. 16271187
Philip Heymans Alle 3
DK-2900 Hellerup
Denmark
Bavarian Nordic UK Ltd.
Reg. no. 15504247
C/O Oakwood Corporate Services
3rd Floor, 1 Ashley Road,
Altrincham, Cheshire,
WA14 2DT
United Kingdom
The entity responsible for the processing of your personal information will mostly be Bavarian Nordic A/S, however in some situations it might be another of our group companies, and, in such case, it will be noted as part of the description of the specific processing activities.
If you have any questions, and/or would like to get in touch with us, our contact details are as follows:
Email address: gdpr@bavarian-nordic.com
Telephone number: +45 33 26 83 83
You can also always contact our Group Data Protection Officer on e-mail dpo@bavarian-nordic.com.
2. Description of the processing
Bavarian Nordic Customer Service
Website visitors
Health Care Professionals (HCPs) and other experts
Shareholders of Bavarian Nordic A/S
Clinical trials
Pharmacovigilance & drug safety
Market research
Business partners, consultants and other third parties
Bavarian Nordic’s Ethics Hotline
Third Party Intermediary (TPI’s)
3. Transfers to countries outside the EU/EEA
In some cases, we will be transferring personal data to countries outside the EU/EEA. This will either be to our group company in the United States, Bavarian Nordic, Inc., or to countries where we are in a process of product approval (as it is required to disclose (pseudonymized) results of clinical trials during the process of product approvals).
Such transfers will take place on the basis of the following legal basis:
The country/countries and/or certified companies in the country/countries has/have been deemed by the Commission of the European Union to have an adequate level of protection of personal data.
Appropriate safeguards for the transfer:
through the use of “Model Contracts for the Transfer of Personal Data to Third Countries”, as published by the Commission of the European Union, or any other contractual agreement approved by the competent authorities. You may obtain a copy of the contract/agreement by contacting us.
4. Your rights
You have the following rights:
You have the right to request access to, rectification or erasure of your personal data, and you also have the right to have the processing of your personal data restricted.
If processing of your personal information is based on your consent, you have the right to withdraw your consent at any time. Your withdrawal will not affect the lawfulness of the processing carried out before you withdrew your consent. You may withdraw your consent by contacting gdpr@bavarian-nordic.com.
You have the right to receive your personal information in a structured, commonly used and machine-readable format (data portability).
You may always lodge a complaint with a data protection supervisory authority, e.g. The Danish Data Protection Agency.
You can find a list of the relevant data protection supervisory authorities here: European Data Protection Board.
The Swiss Federal Data Protection and Information Commissioner can be contacted here: Contact.
Furthermore, you have THE RIGHT TO OBJECT to processing of your personal data as follows.
If processing of your personal data is based on article 6(1)(e) or article 6(1)(f), see description of the specific processing activities regarding legal basis, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data.
Where your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data about you for such marketing.
You can take steps to exercise your rights by contacting us at gdpr@bavarian-nordic.com.
Note, that there may be conditions or limitations on these rights. It is therefore not certain for example you have the right of data portability in the specific case – this depends on the specific circumstances of the processing activity.
5. Other information
5.1. Mandatory information
There might be cases where we need to process your personal data either to comply with law, or to perform the terms of a contract we have with you, and the consequence of not providing such personal data to us is that we cannot continue our contact with you or provide you a service.
5.2. Use of personal information for new purpose
We will only use your personal information for the purposes for which we have collected such, unless we reasonably consider that we need to use it for another purpose and such new purpose is compatible with the original purpose.
If we need to use your personal information for a new (compatible) purpose, we will inform you of such.
5.3. Automated decision-making
Your personal data will not be used for automated decision-making, including profiling.
5.4. How we keep your personal data secure
We have put in place appropriate security measures to protect your personal data and prevent it from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed.
We have, among others, limited access to your personal information to those employees and other staff who have a business need to have such access, and all such people are subject to a contractual duty of confidentiality.
Further, we have put in place procedures to deal with any actual or suspected personal data breach. We will of course notify you of any breach, where required.
5.5. Third party links
This site may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share your personal information. We do not control these third-party websites and are not responsible for their privacy statements.
When you leave our site, we encourage you to read the privacy statements of every site you visit.
5.6. Children
This site is not intended for children below 16 years old and we do not knowingly process personal data relating to children.
UK-PORT-0029 Date of preparation June 2025