Avantor Commercial Data Privacy Statement
Last Updated: May 15, 2019
Your privacy is important to you and therefore, it is important to Avantor. This Commercial Data Privacy Statement, referred to throughout as the Privacy Statement, provides three important pieces of information:
Avantor, Inc. and all of its affiliated organizations are referred to in this Privacy Statement as “Avantor” and also as “we,” “us,” or “our.” We may refer to a particular affiliate by name, but unless we do that, this Privacy Statement applies to all of Avantor’s affiliates. The term “personal data” is used in this Privacy Statement to refer to any information that can be used, alone or in combination with other information, to identify an individual.
Avantor offers many products and services so we can be a trusted partner to you, supporting your goals by providing discovery‐to‐delivery solutions for the global life sciences and advanced technology industries. This Privacy Statement applies to Avantor’s interactions with you, the products and services described in this Privacy Statement, and other Avantor products and services that display this Privacy Statement.
How We Collect Personal Data
Avantor collects personal data from you so that we can operate effectively and provide you the best services and products. You provide some of this personal data directly, such as when you create an account on our websites or our mobile applications, when you browse or order products or services through our websites, when you interact with our customer contact centers or our sales representatives, when you order products or services on your own behalf or on behalf of your organization, upload information to SciTivity.com or similar websites, respond to our direct mail solicitations, electronic and Internet marketing campaigns, newsletters, and promotional campaigns, when you contact us to request literature, information, or support, and when you respond to satisfaction surveys. We also collect some personal data by recording how you interact with us by using different technologies, such as through small text files stored on your device(s) that are commonly known as “cookies,” and by collecting your personal ordering history to better predict the products and services that you might purchase in the future.
Personal Data We Collect
You have choices about the personal data we collect. The data we collect depends on the context of your interactions with Avantor, the choices you make, including your privacy choices, and the products and services you use. When you are asked to provide personal data, you may decline. If you choose not to provide personal data that is necessary to provide a product or service, we may not be able to provide that product or service to you.
Name and Contact Data. We collect your first and last names, e‐mail address, job title or role, billing and delivery addresses, name of the organization you represent, telephone and fax numbers, and other similar contact data.
Credentials. We collect passwords, password hints, user names, account numbers, and similar security information used for authentication and account access.
Demographic Data. We collect personal data about you such as the country where you live or work, your department in the organization you represent, your industry, your professional interests, and your preferred language.
Payment Data. We collect personal data necessary to process your payment if you make purchases, such as your payment instrument number (for example, a credit card number or purchase order number), the security code associated with your payment instrument, if required, and the expiration date of your payment instrument.
Usage Data. In addition to the data we collect both directly and from third parties about your usage of our websites and mobile applications, we collect personal data about how you and your organization purchase and use our products and services. For example, we collect:
Interests and Affiliations. We collect data about your professional interests, such as the industry where you work, the categories and types of products and services that you are or might be interested in, and our publications that you subscribe to. In addition to the personal data you explicitly provide to us, we may infer your interests from other data that we collect.
Contacts and Relationships. We collect data about your contacts if you use one of our laboratory management websites or applications, such as SciTivity.com and communicate or interact with other people or organizations through those platforms.
Location Data. We collect data about your location when you provide your billing and delivery addresses. We also collect data about your location when you use our websites and mobile applications or certain location‐based products or features in our mobile applications through Global Navigation Satellite System (GNSS) data. Your IP address as well as city, country, and postal code information also provides us with imprecise location data about you.
Personal Content. We collect the content of your files and other communications when necessary to provide you with information about products and services and support for those products and services. For example, if you transmit a file containing picture of a damaged shipment, we collect the content of that file to assess your claim. For example, if you upload a list of laboratory equipment and personnel to SciTivity.com, we collect that list of equipment and personnel to provide equipment scheduling services. Other data we collect to provide communication services to you include the:
Video Images. If you enter our corporate, manufacturing, or distribution locations or other facilities, or attend an Avantor event, your image may be captured by our security cameras.
How We Use Personal Data
Avantor uses the personal data we collect from you or about you for two primary purposes:
In carrying out these purposes, we use the personal data that we collect to provide you with a better customer experience and to provide you with access to our products and services. For example, if you are logged into your account and browse certain types of laboratory equipment or a certain grade of chemicals, we can use that information and other information associated with your account to make recommendations or inform you when new products that you may be interested in are available. We may also use provide information about the products you viewed on our website to our sales personnel so they can determine if you are interested in purchasing those products. As another example, if you and other customers in the same geographic area order a high volume of a certain product or service, we can make sure that we have adequate stocks of that product or adequate resources to fulfil that service in that geographic area.
Providing and improving our products and services. We use data to provide and improve the products and services that we offer and to perform operations that are essential to our business. This includes sourcing, manufacturing and distributing the products, maintaining and improving the performance of the products, developing new products, conducting research, providing customer support, and developing and improving services. Examples of such uses include the following:
Communications. We use the data that we collect from you to communicate with you and personalize our communications with you. For example, we may contact you by e‐mail or other means to remind you that you placed products in your online shopping cart and those products are ready for purchase, to notify you when a product that you frequently purchase has been updated or improved or when we have special pricing on products you have shown an interest in, to update you on the status of your order, to invite you to participate in a survey, or to send you a publication relevant to your areas of professional interest.
Marketing. We use data we collect through our business interactions with you and through our websites to market products and services. For example:
The marketing and promotional items that you see may be selected based on data we have collected about you, such as your professional interests, your transactions, or the content you view while logged into our websites. For example, if you are interested in chromatography, we may market chromatography products and services to you.
Why We Share Personal Data
We share your personal data with your consent or as necessary to complete the transactions that you initiated with us so that we can provide the products and services that you requested or authorized. For example, we share your name, delivery address, and other relevant contact information with third parties, such as our suppliers, when you order products from us that are shipped directly from the supplier’s facility to you. We also share your name, delivery address, and other relevant information with our subcontractors that provide services to you that you ordered through us. Also, when you provide payment data to make a purchase, we will share payment data with banks and third‐party payment processors so that we can receive payment and to protect you and us from fraud and credit risk.
In addition, we share personal data among Avantor‐controlled affiliates and subsidiaries so that we can provide products and services to you or your organization across the globe. We also share personal data with our vendors or other third parties that work on our behalf in ways that are consistent with the purposes described in this Privacy Statement. For example, we have entered into contracts with companies to store and secure data in their facilities or to provide software to help us run and manage the data generated by our business. The data that these companies store, secure, and help us manage contains your personal data. These companies must agree to follow data privacy protections and security requirements imposed by law and by the contracts that we have signed with these companies, and they cannot use the personal data that they receive from us for any other purpose other than the specific purposes related to our business. We may also disclose personal data as part of a corporate transaction such as a merger or sale of assets.
Finally, we will access, transfer, disclose, and preserve personal data when we have a good faith belief that doing so is necessary to comply with applicable law or respond to a valid legal process, including from law enforcement or other government agencies; to help prevent the loss of life or serious injury of anyone; and other reasons permitted by data privacy laws.
Many processing activities that we conduct on your personal data are done with your consent. You may revoke your consent at any time with future effect. We request that you send an e‐mail to the e‐mail address in this Privacy Statement in order to revoke your consent. The data processed before we receive your request may still be legally processed, and any data processed as part of performance of a contract to which you are a party or that is processed for the purposes of legitimate interests will also still be processed.
How to Access and Control Your Personal Data
You always have the right to request information about the personal data that we store and process, its origin, its recipients, and the purpose of its collection. This information will be provided to you at no charge. You also have the right to request that your personal data be corrected, blocked, or deleted. You can contact us at any time using the e‐mail addresses provided in this Privacy Statement, or by writing to our Data Protection Officer at the address provided below. You may also, of course, file a complaint with the data protection authority in your country.
You can also make choices about Avantor’s collection and use of your data. How you can access or control your personal data will depend on which websites you use. For example:
If you cannot access certain personal data collected by Avantor via our websites, you can always contact Avantor, VWR, or NuSil, or any of our affiliated companies, using the e‐mail address below. We will take action on your request or notify you that we need an extension of time to take action on your request without undue delay and in any event, within one month of receipt of your request.
Your Communications Preferences
You can choose whether you wish to receive promotional communications from Avantor by e‐mail, physical mail, and telephone. If you receive promotional e‐mails from us and would like to opt out, you can do so by following the directions in that message. You can also make choices about the receipt of promotional e‐mail, telephone calls, and postal mail by signing into your account and viewing your communication and mailing preferences where you can update contact information, manage contact preferences, opt out of subscriptions, and choose whether we can share your contact information with third parties for promotional and marketing purposes. If you do not have an account through one of our websites, you can manage your contact preferences by speaking with our customer service teams. These choices do not apply to mandatory communications that are part of certain Avantor businesses, such as order acknowledgement, shipping notices, or order approval requests, or to other informational communications that have their own unsubscribe method.
Your Right to File Complaints with European Union Regulatory Authorities
Citizens of the European Union Member States have the right to initiate a complaint with a supervisory authority in the EU Member State where they live, where they work, or where they think the alleged infringement of their data privacy rights occurred. Citizens of the European Union Member States also have the right to initiate a complaint and to receive an effective judicial remedy if they think that their data privacy rights were infringed because we did not comply with data privacy laws when processing of their personal data. European Union citizens can initiate a claim for a judicial remedy in the courts of the EU Member State where we are established or where a citizen lives.
Filing a complaint with a supervisory authority or seeking a judicial remedy does not prevent a citizen of the European Union from seeking any other remedies for in infringement of his or her data privacy rights. You can find ways to contact supervisory authorities in the European Union here.
Cookies and Similar Technologies
In addition to the cookies Avantor sets when you visit our websites, third parties may also set cookies when you visit our websites. In some cases, that is because we have hired the third party to provide services on our behalf, such as site analytics.
How to Control Cookies
Our Use of Analytics Services
Our websites often contain technologies from third‐party analytics providers, which help us compile aggregated statistics about the effectiveness of our website, marketing efforts, or other operations. These technologies enable the analytics providers to set or read their own cookies or other identifiers on your device, through which they can collect information about your online activities across applications, websites or other products. The analytics of your activity while on our website is usually anonymous, but third parties may have the capability to combine this information with other information collected about you from other websites or from other third parties to identify you and develop a profile about your activities on the Internet.
Third Party Services
Some of our websites and applications contain plug‐ins or other features that connect you to websites or other platforms owned or operated by third parties. We have listed those third parties, provided some information about the services those third parties provide to us and how those third parties may access or collect your personal data, and provided you with information about how to contact those third parties below. Connecting to such third‐party websites could result in those third parties collecting your personal data and you will be subject to those third party’s privacy policies when you are on those platforms.
Our websites use services and features provide by subsidiaries of Alphabet Inc., namely Google Inc. and YouTube LLC. Descriptions of these services and their relationship to your personal data are further described below.
Google Analytics Remarketing allows advertising to be displayed based on your personal interests, identified based on your previous usage and website usage behavior on your devices. Google Inc. will associate your web and application browsing history with your Google Inc. account for the purposes of advertising across your devices. Google Inc. collects and authenticates identifying information of users that are temporarily linked to our Google Analytics data to define and create audiences for cross‐device advertising.
We also use Google Adwords, an online advertising program provided by Google Inc. In connection with Google Adwords, we use conversion tracking, which sets a cookie when you click on an advertisement served by Google. If you visit certain websites while that cookie is still effective, Google and the website can tell that you clicked on the advertisement and proceeded to that website. We receive information from Google Inc. about the number of users that clicked on our advertisements and were redirected to a conversion tracking page. We do not obtain any information that can be used to personally identify users through this process.
Some of our websites use plugins developed by YouTube LLC. If you visit one of our websites featuring a YouTube plugin, a connection to the YouTube servers is established and the YouTube server is informed about which of our website pages you have visited. If you are logged in to your YouTube account, YouTube allows you to associate your browsing activity directly with your account profile.
A number of our sites use Google Maps, a map service developed by Google Inc., via an application programming interface. Google Maps saves your IP address and transmits it to a Google server to determine location data to provide geographic information. We use Google Maps on our websites to make our websites more appealing and facilitate the location of our facilities.
Google reCaptcha is used on some of our websites to determine if the user of a website is an individual or an automated computer program. Various information, including your IP address, how long you have been on the website, and cursor movements, are collected, forwarded to Google Inc., and used to determine if you are a human or computer program. Your ability to perform certain functions on the website is limited by the determinations made by reCaptcha.
Notice to End Users
Many Avantor products and services are purchased and intended for use by businesses and other organizations and are purchased by your employer, school, agency, or other organization. Your use of Avantor’s websites may be subject to your organization's policies, if any, and may also be subject to your organization’s (or a third party selected by your organization) business‐to‐business platform. If your organization controls your access to the Avantor websites, either directly or through a third‐party platform, please direct your privacy inquiries to your organization’s administrator. The privacy and security practices of your organization may differ from those set forth in this Privacy Statement.
If you use an e‐mail address provided by an organization, such as an employer or school, to access Avantor websites, the owner of the domain (e.g., your employer) associated with your e‐mail address may control and administer your Avantor account and access and process your data.
Security of Personal Data
Avantor is committed to protecting the security of your personal data. We use a variety of security technologies and procedures to help protect your personal data from unauthorized access, use or disclosure. For example, we store the personal data you provide on computer systems that have limited access and are in controlled facilities. When we transmit highly confidential data (such as a credit card number) over the Internet, we protect it through the use of measures required by the Payment Card Industry Data Security Standard. Our websites use SSL or TLS encryption for the protection of the transmission of confidential information and personal data. You can recognize an encrypted connection in your browser's address line when it changes from "http://" to "https://" and the lock icon (or a similar indicator, depending on the browser you choose to use) is displayed in your browser's address bar. If SSL or TLS encryption is activated, the information you transfer to via our websites cannot be read by third parties.
Once the data that we obtain from third parties is received in our systems, it is treated the same way that we treat data that we collect directly from you, and also according to any restrictions or special circumstances required by those third parties.
Where We Process Personal Data
Personal data collected by Avantor may be processed in your country, in the United States, and in any other country where Avantor or its affiliates, subsidiaries or service providers operate. Avantor or its affiliates, subsidiaries or service providers maintain major data centers in the United States, India, Mexico, Canada, Switzerland, and the countries of the European Economic Area and the European Union. Typically, the primary storage location is in your region or in the United States, often with a backup to a data center in the same or another region. The storage location(s) are chosen in order to operate efficiently, to improve performance, and to create redundancies in order to protect the data in the event of an outage or other problem.
E.U.-U.S. and Swiss-U.S. Privacy Shield Notice
With respect to personal data received or transferred pursuant to the Privacy Shield Frameworks, Avantor is subject to the investigatory and enforcement powers of the Federal Trade Commission.
We provide an individual with the opportunity to opt-out before we share your personal data with third parties other than our agents, or before we use it for a purpose materially different from which it was originally collected or subsequently authorized. To request to limit the disclosure of such personal data, please submit a written request to DPO@vwr.com, with the subject line, “Privacy Shield.”
We will not disclose your sensitive personal data to any third party without first obtaining your opt-in consent and shall also obtain your opt-in consent before we use sensitive data for a purpose other than which it was originally collected or subsequently authorized.
Avantor’s accountability for personal data that it receives in the United States under the Privacy Shield and subsequently transfers to a third party is described in the Privacy Shield Principles. In particular, Avantor remains responsible and liable under the Privacy Shield Principles if third-party agents that it engages to process the personal data on its behalf do so in a manner inconsistent with the Principles, unless Avantor proves that it is not responsible for the event giving rise to the damage.
In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We may also disclose personal data to other third parties when compelled to do so by government authorities or required by law or regulation including, but not limited to, in response to court orders and subpoenas.
In compliance with the Privacy Shield Principles, Avantor commits to resolve complaints about your privacy and our collection or use of your personal data transferred to the United States pursuant to Privacy Shield. European Union and Swiss individuals with Privacy Shield inquiries or complaints should first contact Avantor by email at DPO@vwr.com.
Avantor has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD, operated by the Council of Better Business Bureaus. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit www.bbb.org/EU-privacy-shield/for-eu-consumers for more information and to file a complaint. This service is provided free of charge to you.
If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-introduction.
In addition to Avantor, Inc., our U.S. subsidiaries listed below are also subject to the Privacy Shield Principles, including the dispute resolution mechanisms described above.
Our Retention of Personal Data
We retain personal data for as long as necessary to provide the products and services and fulfill the transactions you have requested, or for other essential purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. Because these needs can vary for different data types in the context of different products and services, actual retention periods will vary significantly. The criteria used to determine the retention periods include:
In many cases, we maintain the data until you actively delete it or until deletion is permitted by our records retention policies.
Collection of Personal Data of or from Children
Avantor websites do not knowingly collect personal information relating to a customer’s age, and we do not knowingly collect any personal information from children under the age of thirteen through or websites. If you are under thirteen years of age, please do not give us any personal information. We encourage parents and legal guardians to monitor their children's Internet usage. If you have reason to believe that a child under the age of thirteen has provided personal information to us, please contact us at any one of our privacy e-mail addresses in this Privacy Statement.
Changes to This Privacy Statement
We will update this Privacy Statement when necessary to reflect your feedback and changes in our products, services, and the law. When we post changes to this statement, we will revise the "last updated" date at the top of this Privacy Statement. If there are material changes to this Privacy Statement or in how Avantor will use your personal data, we will notify you either by prominently posting a notice of such changes before they take effect or by directly sending you a notification. We encourage you to periodically review this Privacy Statement to learn how Avantor uses and is protecting your information.
How to Contact Us
If you have a privacy concern, complaint, or a question for Avantor’s Data Privacy Officer, please contact us via e‐mail at DPO@vwr.com. We will respond to questions or concerns or notify you that we need an extension of time to take action on your request without undue delay and in any event, within one month of receipt of your request.
Unless otherwise stated, Avantor is a data controller for personal data we collect through the marketing and delivery of products and services subject to this Privacy Statement. Our mailing address is Avantor Data Privacy, c/o VWR International, LLC; One Radnor Corporate Center, Suite 200; 100 Matsonford Road; Radnor, Pennsylvania, USA. Telephone: (+1) 610‐386‐ 1700.
VWR International Management Services GmbH & Co. KG, Hilpertstrasse 20 A, D ‐ 64295 Darmstadt, Germany is the mailing address of our data protection representative for the European Economic Area, the European Union, and Switzerland.