Privacy Policy
Your Privacy Is Important To Us
Privacy Policy
Last Modified: April 17, 2023
The Purpose of This Website & Associated Data Collection
The purpose of this website and associated data collection is to provide information to support engaged and interested parties in ASH RC programs.
Overview & Scope of Privacy Policy
This Privacy Policy (“Privacy Policy”) describes the types of information ASH RC collects and how ASH RC uses the information. We also describe the measures we take to protect the security of the information and how you can contact us about our privacy practices. This Privacy Policy applies solely to the information provided while visiting this website, https://www.ashresearchcollaborative.org (“the Site”). The terms of the Privacy Policy do not govern personal information furnished through any means other than the Site (such as by telephone, mail, or email).
By providing us your information, you acknowledge that you have read this Privacy Policy and that you consent to ASH RC’s privacy practices as described in this Privacy Policy. You affirm your consent when you accept the terms of this document on your initial visit to this site and by submitting content or materials to us through this site.
Changes to this Privacy Policy
ASH RC reserves the right to revise or update this Privacy Policy at any time, and you agree to be bound by those revisions or updates. ASH RC will notify you of any changes to the Privacy Policy by posting the revised or updated Privacy Policy and its “Last Modified” date on the site and will notify you of any material updates via email or pop-up banner. You should check the site regularly for updates. Your continued use of the sites constitutes your consent and acceptance of the new Privacy Policy and its revisions or updates once posted.
Third-Party Links and Websites
The Site may contain links to third-party services. While we endeavor to work with third parties that share our respect for user privacy, we are not responsible for the websites or privacy practices of such third-parties. In addition, this Privacy Policy is not intended to describe data handling procedures for information collected by other linked websites or business partners. You are responsible for knowing when you are leaving our site to visit a third-party website and for reading and understanding the terms of use and privacy policy statements for each such third-party.
Categories of Personal Data Collection on the Site
Generally, we collect the following data elements from you when we process your Personal Data for the purposes we described in this Privacy Policy. We process:
- Your first and last name
- Date of birth
- A description of your professional associations and affiliations
- Your clinical and research interests
- Partial credit card information as part of a tokenized payment transaction
- Your email address
- Your phone number
Automated Information Collection on the Site
We collect certain information by automated means. For example, we collect information that is sent to us automatically by your Web browser when you visit this Web Site. This information typically includes your IP address, the identity of your Internet service provider, the name and version of your operating system, the name and version of your browser, the date and time of your visit, the pages you visit, your location and your mobile device unique identifier. ASH RC also uses “cookies” and other Web technologies to collect information and support certain features of our Web Site. For example, we may use these technologies to collect information about the ways visitors use this Site—which pages they visit, which links they use, and how long they stay on each page. The information we collect from your Web browser and from cookies and other Web technologies does not identify you personally but in some cases, we may link it to personally identifiable information.
Google Analytics. Visitors to the Sites who have JavaScript enabled may be tracked using Google Analytics. Google Analytics collects the following types of Personal information from users of the Sites:
- Type of web browser used, software manufacture, and version number.
- Type of operating system
- Color processing ability of the user’s screen
- JavaScript support
- Flash version
- Screen resolution
- Network location and IP address
- Country, city, state, region, county, or any other geographic data
- Hostname
- Bandwidth (internet connection speed)
- Time of visit
- Pages visited
- Time spent on each page of the website
- Referring site statistics
- The website the user came through in order to arrive at the Sites
- Search engine query used
The Personal Data collected by Google Analytics is primarily used to optimize the Sites for ASH RC’s users; however, ASH RC may also use this data for marketing purposes.
The data Personal Information ASH RC automatically collects using Google Analytics is shared with Google. For more information on Google’s Privacy Policies, visit: https://policies.google.com/privacy. You can also opt-out of having your Personal Data used by Google Analytics by following the instructions located at https://tools.google.com/dlpage/gaoptout/.
To view an overview of the privacy of your Google Analytics cookies please go here: https://support.google.com/analytics/answer/6004245. You may install a Google Analytics opt-out browser add-on by going here: https://tools.google.com/dlpage/gaoptout?hl=en-GB.
Data Protection & Data Security
ASH RC maintains reasonable and appropriate measures to protect personal information from loss, misuse and unauthorized access, disclosures, alterations and destruction taking into account the risk involved in the processing and the nature of personal information. Unfortunately, no site, server or database is completely secure or “hacker proof.” We therefore cannot guarantee that information about you will not be disclosed, misused or lost by accident or by the unauthorized acts of others.
Personal information such as postal and email address may be used internally for record maintenance, analytical, and research purposes carried out by the Data Hub and the CTN. Aggregated or other non-personal information may be shared with third parties. This information does not contain any personal information and may be used to develop website content and services related ASH RC’s data collection, analysis, and research activities.
General Data Protection Regulations (GDPR)
In the event that we collect Personal Data (as defined in the GDPR) that is subject to the GDPR, this section will apply. Terms in this section are to be understood in a manner consistent with GDPR including the definition of such term in the GDPR. Such term may have a different definition or meaning in other portions of this Privacy Policy because GDPR may not apply to those sections.
Identification of Data Controller
The Data Controller is the ASH Research Collaborative (ASH RC). ASH RC is located at 2021 L Street NW in Washington, DC. You may contact the ASH RC by phone, please call 866-828-1231 (U.S. toll free) or 001-202-776-0544 (for international callers), Monday through Friday from 8:30 a.m. to 5:00 p.m. Eastern time.
Identification of Data Protection Officer & Contact Details
You may contact the Data Privacy Officer by phone, 001-202-776-0544, Monday through Friday from 8:30 a.m. to 5:00 p.m. Eastern time, by email: contactdpo@ashrc.org or by mail at 2021 L St., NW, Suite 900, Washington, DC 20036.
Identification of Primary Member State Supervisory/Data Protection Authority
You have the right to lodge a complaint regarding the processing of your Personal Data with us by contacting our Data Protection Officer listed above. You also may lodge a complaint with the Data Protection Authorities in the Member State where you habitually reside, work, or where an infringement occurred. You can find a list of Data Protection Authorities here.
Identification of Data Protection Representative
We have appointed DPR Group as our Data Protection Representative in the European Union so that you can contact our Representative directly in your home country. DPR Group has locations in each of the 28 EU countries.
If you want to raise a question to ASH RC, or otherwise exercise your rights in respect of your personal data, you may do so by contacting our Data Protection Officer listed above or by:
- sending an email to DPR Group at hematology@dpr.eu.com,
- contacting DPR Group on its online webform at www.dpr.eu.com/hematology, or
- mailing your inquiry to DPR Group at the most convenient of the addresses set forth below.
PLEASE NOTE: when mailing inquiries, it is ESSENTIAL that you mark your letters for “DPR Group” and not “ASH Research Collaborative” or your inquiry may not reach us. Please refer clearly to ASH Research Collaborative in your correspondence. On receiving your correspondence, ASH RC is likely to request evidence of your identity to ensure your personal data and information connected with it is not provided to anyone other than you.
If you have any concerns about how DPR Group will handle the personal data it will require to undertake its services, please refer to DPR Group’s privacy notice at https://www.dpr.eu.com/legal-privacy.
Austria
- DPR Group, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria
Belgium
- DPR Group, Place de L’Université 16, Louvain-La-Neuve, Waals Brabant, 1348, Belgium
Bulgaria
- DPR Group, 132 Mimi Balkanska Str., Sofia, 1540, Bulgaria
Croatia
- DPR Group, Ground & 9th Floor, Hoto Tower, Savska cesta 32, Zagreb, 10000, Croatia
Cyprus
- DPR Group, Victory House, 205 Archbishop Makarios Avenue, Limassol, 3030, Cyprus
Czech Republic
- DPR Group, IQ Ostrava Ground floor, 28. rijna 3346/91, Ostrava-mesto, Moravska, Ostrava, Czech Republic
Denmark
- DPR Group, Lautruphøj 1-3, Ballerup, 2750, Denmark
Estonia
- DPR Group, 2nd Floor, Tornimae 5, Tallinn, 10145, Estonia
Finland
- DPR Group, Luna House, 5.krs, Mannerheimintie 12 B, Helsinki, 00100, Finland
France
- DPR Group, 72 rue de Lessard, Rouen, 76100, France
Germany
- DPR Group, 3rd and 4th floor, Altmarkt 10 B/ D, Dresden, 01067, Germany
Greece
- DPR Group, 24 Lagoumitzi str, Athens, 17671, Greece
Hungary
- DPR Group, EMKE Building, Rákóczi Út 42, Budapest, 1072, Hungary
Ireland
- DPR Group, Phoenix House, Monahan Road, Cork, T12 H1XY, Republic of Ireland
Italy
- DPR Group, BPM 335368, Via Roma 12, 10073 , Ciriè TO, Italy
Latvia
- DPR Group, 4th & 5th floors, 14 Terbatas Street, Riga, LV-1011, Latvia
Lithuania
- DPR Group, Vilniaus g.31, Vilnius, LT- 01402, Lithuania
Luxembourg
- DPR Group, BPM 335368, Banzelt 4 A, 6921, Roodt-sur-Syre, Luxembourg
Malta
- DPR Group, Tower Business Centre, 2nd floor, Tower Street, Swatar, BKR4013, Malta
Netherlands
- DPR Group, Cuserstraat 93, Floor 2 and 3, Amsterdam, 1081 CN, Netherlands
Poland
- DPR Group, Budynek Fronton ul Kamienna 21, Krakow, 31-403, Poland
Portugal
- DPR Group, Torre de Monsanto, Rua Afonso Praça 30, 7th floor, Algès, Lisbon, 1495-061, Portugal
Romania
- DPR Group, World Trade Centre, Piata Montreal no 10, Entrance F, 1st Floor, Sector 1, Bucharest, 11469, Romania
Slovakia
- DPR Group, Apollo Business Centre II, Block E / 9th floor, 4D Prievozska, Bratislava, 821 09, Slovakia
Slovenia
- DPR Group, Trg. Republike 3, Floor 3, Ljubljana, 1000, Slovenia
Spain
- DPR Group, Puerta de las Naciones, Ribera del Loira 46, Madrid, 28042, Spain
Sweden
- DPR Group, S:t Johannesgatan 2, 4th floor, Malmo, SE – 211 46, Sweden
United Kingdom
- DPR Group, BPM 335368, 372 Old Street, EC1V 9AU, London, United Kingdom
Processing Purposes
ASH RC processes your Personal Data for the following lawful purposes and based upon the legal justification set forth in the parenthetical:
Your submission of Personal Data to register for a webinar or webcast.
(CONSENT).
Your submission of Personal Data for Registration to access the ASH RC Central Area, if applicable.
(CONSENT).
Your submission of Personal Data to our third party vendors for services like our Data Request Portal.
(CONSENT).
Your submission of Personal Data to complete a contact form or sign up for via the Site.
(CONSENT).
Your submission of Personal Data to request information from us, if applicable.
(CONSENT).
Your submission of Personal Data to purchase products or make a donation (CONSENT, CONTRACT, LEGITIMATE INTEREST).
Your submission of Personal Data to market and advertise our Site and underlying services to you (CONSENT, LEGITIMATE INTEREST).
Legal Basis for Processing
We process your Personal Data with your consent or subject to the performance of a contract to which you as the data subject are a party or alternatively in order to take steps at your request to enter into an agreement with ASH RC. For data which we process based solely on your consent and subject to legal exceptions, you have the right to withdrawal your consent at any time. The Personal Data collected by ASH RC originates from the individual providing his/her Personal Data (either directly or through a clinical site) or, in the cases of the submission of abstract data, from such individual and other publicly available sources.
Recipients of Personal Data
We share your Personal Data with our third-party vendor partners on the basis of the consent you provide to us or in order to fulfill our contractual obligations as part of the services we provide to you when you decide to engage with us. The recipients of your Personal Data include our third-party data processors, which include but are not limited to our software as a service partners consisting of our third-party database administrators, lead management vendors, third party application developers, attendee, exhibitor and registration vendors, and third-party digital content managers. When we share your Personal Data with these third-party vendors, we do so subject to a Data Protection Agreement to ensure that they are in compliance with the requirements of the GDPR.
These recipients process Personal Data for the below purposes:
Processing Purposes
- To fulfill a service to you in furtherance of your choices in order to fulfill the terms of a contractual agreement between you and ASH RC.
- Subject to your choices, in order to offer you products from our affiliates, strategic partners, agents, or from third-party marketers and other unaffiliated parties that we believe may be of interest to you, or to assist such parties for research, administrative, and/or business purposes.
- Subject to the execution of a data protection agreement, to unaffiliated third-party service providers, agents, or independent contractors who help us maintain our services and with other administrative services (including, but not limited to, order processing and fulfillment, providing customer service, maintaining and analyzing data, sending customer communications on our behalf, and entry collection, winner selection and prize fulfillment for contests, sweepstakes, and other promotions).
- To comply with law, or in the good faith belief that such action is necessary to conform to the requirements of law, or comply with legal process served on us, and to protect and defend our rights or property, including our rights and property and our services, or act in urgent circumstances to protect the personal safety of you and our other visitors. To the extent permitted, ASH RC will inform Data Subjects before making such disclosure and provide it with a reasonable opportunity to object to such disclosure.
- To third parties as part of a corporate reorganization process including, but not limited to, mergers, acquisitions, and sales of all or substantially all of our assets. To the extent permitted, ASH RC will inform Data Subjects before making such disclosure and provide it with a reasonable opportunity to object to such disclosure.
- Enforce our Terms of Service, this Privacy Policy, and/or other agreements or policies;
- Respond to claims that the content(s) of a communication violates the rights of another.
- Subject to your choices and your consent to track and analyze non-identifying, aggregate usage and volume statistical information from our visitors and customers and provide such information to third parties.
Onward Transfer
ASH RC will not disclose Personal Data to a third party except as stated below:
ASH RC may disclose Personal Data to subcontractors and third-party agents. Before disclosing Personal Data to a subcontractor or third-party agent, ASH RC will obtain assurances by contractual agreement from the recipient that it will: (i) transfer such data only for limited and specified purposes; (ii) ascertain that the subcontractor or third-party agent is obligated to provide at least the same level of privacy protection as is required by the GDPR; (iii) take reasonable and appropriate steps to ensure that subcontractors and third-party agents effectively process the personal information transferred in a manner consistent with the organization’s obligations under the GDPR; (iv) require subcontractors and third-party agents to notify the organization if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the GDPR; (v) upon notice, including under (iv), take reasonable and appropriate steps to stop and remediate unauthorized processing; and (vi) provide a summary or a representative copy of the relevant privacy provisions of its contract with subcontractors and third-party agents to the Supervisory Authorities upon request.
ASH RC may also be required to disclose, and may disclose, Personal Data in response to lawful requests by public authorities, including for the purpose of meeting national security or law enforcement requirements, or in the event of a merger or acquisition.
Data Integrity
ASH RC is responsible for ensuring that (a) Personal Data collected is accurate, complete, current and reliable for its intended uses; and (b) Personal Data is retained only for as long as is necessary to accomplish the legitimate business purposes disclosed to the Data Subject and for any compatible purposes. ASH RC will cooperate with reasonable requests for assistance in meeting these obligations.
Retention of Personal Data
Personal Data obtained by ASH RC is adequate, relevant and not excessive in relation to the purposes described in this Privacy Policy. The Personal Data is processed for purposes specified herein and will only be processed consist with these purposes described herein. ASH RC will request only the minimum amount of information required to perform the applicable services and will retain such information only for as long as necessary to provide the services or for compatible purposes, such as to provide additional services, to comply with legal requirements, or to preserve or defend ASH RC’s legal rights.
Right of Access to your Personal Data
Data Subjects have the right to access the Personal Data an organization holds about them. If such Personal Data is inaccurate or processed in violation of the GDPR, a Data Subject may also request that Personal Data be corrected, amended, or deleted. When ASH RC receives Personal Data, it does so on behalf of the individual submitting such Personal Data. To request access to, or correction, amendment or deletion of, Personal Data, Data Subjects should contact ASH RC’s Data Protection Officer. ASH RC will cooperate with all reasonable requests to assist Data Subjects to exercise their rights under the GDPR.
Choice
Data Subjects have the right to opt out of (a) disclosures of their Personal Data to third parties not identified at the time of collection or subsequently authorized, and (b) uses of Personal Data for purposes materially different from those disclosed at the time of collection or subsequently authorized. Data Subjects who wish to limit the use or disclosure of their Personal Data should submit that request to ASH RC’s Data Protection Officer. ASH RC will cooperate with the Data Subjects’ instructions regarding Data Subjects’ choices.
Security
See “Data Protection and Data Security” above for further information about our security practices.
Transfers to the United States from the European Union
In using the Sites, your Personal Data will be transferred to the United States. In December 2022, The European Commission published its draft adequacy decision recognizing the essential equivalence of U.S. data protection standards and is working towards finalizing a Data Privacy Framework. ASH RC relies on Article 49 of the GDPR for transfers of data collection from Data Subject in the EU and EEA. Transfers are made to ASH RC only if the data subject has explicitly consented to the proposed transfer after having been informed of the possible risks of such transfers. Additionally, ASH RC transfers data as necessary for the performance of a contract between you as the data subject and ASH RC as the Controller, to data processors who have an agreement with ASH RC that includes protecting your privacy and the security of your data, and in cases where your Personal Data is necessary for the implementation of pre-contractual measures taken in accordance with your requests. Finally, ASH RC transfers Personal Data in order to advance the science of Hematology, which is important to the interests of the public.
How To Contact Us
For more questions regarding this Privacy Policy, please contact ASH RC Staff at info@ashrc.org.
Updates to this Privacy Policy
We reserve the right to update it periodically to reflect changes in those policies and practices. When we do, we will provide notice to you in accordance with any legal obligation to do so and post the revised version behind the link marked “Privacy Policy” at the bottom of each page of our Web Site. We will also indicate at the top of the policy when it was most recently updated.
ASH RESEARCH COLLABORATIVE
The ASH Research Collaborative (ASH RC) is a non-profit organization established by the American Society of Hematology (ASH) in 2018 to improve the lives of people affected by blood diseases by fostering collaborative partnerships to accelerate progress in hematology.