Privacy Policy - Pinewood Healthcare

Pinewood Privacy Policy

1. Purpose

The purpose of this Privacy Notice is to outline how we collect, process and share personal data we hold about you. This Privacy Notice will outline the types of personal data we process about you and the legal basis we rely on to do so.
Pinewood is committed to protecting and respecting your privacy. We wish to be transparent on how we collect, store and share personal data and to ensure that you understand your rights under the General Data Protection Regulation (“GDPR”).

In this Privacy Notice, we outline:

The types of data we collect;
How we use your personal data;
Your rights in relation to the data we hold about you; and
How to contact us if you have any questions about your data.

1.1. Company Information

Pinewood Healthcare (“We”) are an Irish pharmaceutical manufacturer, founded in 1976. We have a diverse portfolio of over 200 prescription and over-the-counter formulations including antibiotics, cardiovascular, dermatological, analgesic, respiratory, hormonal, and CNS products for more than 30 countries. We are a subsidiary of the Wockhardt Group since 2006 and operate two EU GMP certified facilities in Ireland, one in Ballymacarbry, Co. Tipperary, and a distribution centre in Dublin, employing around 320–400 people between both sites.

1.2. Legislation

All personal data we gather will be “processed” in accordance with all applicable data protection laws and principles, including the General Data Protection Regulation, the Data Protection Act 2018 and the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (“ePrivacy Directive”).

1.3. Queries and Complaints

If you are unhappy with the way we have handled your personal data and wish to complain, or if you would like further information about the way your personal data will be used, please contact us at the below:
Data Protection Lead
M50 Business Park,
1 Ballymount Ave,
Ballymount,
Dublin 12,
The Courtyard
By telephone: 353 52 61 86000

By email: DPO@pinewood.ie

If you are unsatisfied with our use of your personal data or our response to any requests by you to exercise any of your rights, then you have the right to complain to the Data Protection Commission. See contact details below:
Data Protection Commission
The best way to contact the Data Protection Commission (DPC) is through their website using the following link: https://forms.dataprotection.ie/contact. Here are some other contacts details:

Postal: 21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland
Email: info@dataprotection.ie
Telephone: +353 57 868 4800 / +353 761 104 800

2. How do we collect your personal data?

We collect personal data about customers to enable the provision of services to support the Pinewood purpose. The following non-exhaustive methods of data collection are an indication of ways in which we may obtain your information:

Through application, website forms, and calls directly from customers or sometimes indirectly from third parties including any witness, other party involved in the accident, drivers, medical clinics etc.
We will collect additional personal data in the course of claim-related activities throughout the period you are associated with us

All data collected during the claims process or additional data collected during this course will be used and stored for rendering service as well as for complying with the legal obligations or legitimate interests of the company. It is important that the personal data you provide to us is up to date and accurate. As outlined in Section 7.2 of this notice, if the personal data we hold about you is inaccurate or incomplete, please contact us and we will update your data.

3. What personal data do we collect?

In order to provide our services, Pinewood needs to collect various types of personal data. The type of personal data we collect on you will vary depending on the nature of our relationship with you. Below we have outlined a non-exhaustive list of the types of data we may collect and our purpose for collecting that data.

Personal details including but not limited to name, title, date and place of birth, gender, age, insurance policy details, occupation, signatures, etc.;
Contact Details including addresses, post code, telephone numbers, mobile number, personal/corporate email addresses;
Health Data including medical condition, treatment details, adverse reactions, medical history context, pharmacy details
Financial information including bank account holder’s name, bank AC number, bank name and address, bank sort code, claims settlement amount.
Work history and relevant information during the recruitment process.

4. How and why do we use your personal Data

Process	Description	Legal Basis for Processing
Customer Complaints Handling	To handle and resolve any complaints made by customers. he categories of data collected include; • Personal Data • Contact Details • Financial Information	The use of data is necessary for compliance with a legal obligation. The use of the data is necessary for the performance of a contract
Pharmacovigilance	To monitor and ensure drug safety. The categories of data collected include; • Personal Data, • Contact Details • Health Data	The use of data is necessary for compliance with a legal obligation. The use of data is for the interest of the public.
Social Media Communication	To communicate with customers and handle messages related to product inquiries/ complaints. The categories of data collected include; • Personal Data • Contact Details	The data subject has given consent to the processing. The use of the data is in our legitimate interests.
CCTV	We use CCTV to monitor and protect our premises, staff, and visitors for security and safety purposes. The categories of data include; • License plate • Images	The use of data is necessary for compliance with a legal obligation. The use of the data is in our legitimate interests.
Website Monitoring	We monitor website usage to ensure security, detect technical issues, and improve user experience.	The use of the data is in our legitimate interests.
Recruitment and hiring	Table Data	We process certain details in relation to your work history and personal profile in order to assess suitability during the recruitment and hiring process. We use an external platform to assist with this, more information can be found here: https://cezannehr.com /legal/cezanne-recruitment-privacy-policy/

5. How long do we retain your personal data?

We only keep your personal data for as long as is necessary for the purpose for which it was originally obtained, and / or in accordance with any requirements imposed by the law. This means that the period of time for which we store your personal data may depend on the type of data we hold. To determine the appropriate retention period of personal data, we consider the amount, nature and sensitivity of the personal data, the purposes for which we process your personal data and any legal requirements to retain your data. The table below outlines a general summary of our retention periods.

Process	Retention Period
Customer Complaints Handling	Usually, 6 years after resolution.
Pharmacovigilance	Often 10 years after the product is withdrawn from the market.
Social Media Communication	Typically, up to 1 year for routine interactions, unless needed longer for legal or compliance reasons.
CCTV	For number plate recognition at access points, 1 month, for security, health and safety, 3 months, and for drug safety monitoring, 6 months.
Website Monitoring	Security logs and monitoring data is typically retained for 30 days to 6 months.
Recruitment and hiring	Up to 12 months after the position is filled for unsuccessful candidates.

6. Who do we share your personal data with?

We may disclose your personal information to outside the organisation. Below is a list of the categories of recipients we share your personal data (as outlined above) with:

Pharmaceutical providers with whom we have a contractual relationship, including but not limited to sales and marketing vendors, data scanning and shredding agencies, pharmacovigilance etc.
Wockhardt, the Parent company with whom we are a subsidiary of and our other entities within the group for the purpose of legitimate interests, fulfilment of contractual obligation, and internal administrative purposes. We will transfer your personal data outside the EU for processing.

7. International Transfers

On occasion we need to transmit your personal data outside of the European Economic Area, including India where Wockhardt is located. This depends on your interaction with us, in these circumstances, we will ensure that the transfer complies with our data protection obligations, and we will ensure that the transfer agreement is based on an approved transfer mechanism in most cases European Commission’s standard contractual clauses.

8. Data Subject Rights

As a data subject, you will have the following rights in relation to the processing of your personal data. Please note that these rights are not absolute, and restrictions may apply in certain situations.

Please send all requests to DPO@pinewood.ie with as much detail as possible about your requirements to allow us to deal with your request efficiently. Before fulfilling your request, we may ask you to provide identification to enable us to verify your identity.

Upon receipt of a valid request, we will have one calendar month to respond to your request, with the possibility of extending by two further months. If we require more time to deal with your request, we will notify you of the delay and the reasons behind it within one month of the receipt of the request. If we refuse your request, we will also notify you within one month of the receipt of the request accompanied by the reasons for the refusal.

You are entitled to contact the Data Protection Commission using the details found in section 1.3 above if we refuse your request.

8.1. Right of Access

You have the right to know what personal data we hold about you, why we hold the data and how we process your personal data.

When submitting your request, please provide us with information to help us verify your identity and as much detail as possible to help us identify the information you wish to access (i.e. date range, subject of the request).

If the request is submitted by a third party (such as a solicitor) on your behalf, the request will be required to include written authorization from you for the provision of specific data to the third party.

Please note that an access request is free of charge, however, where we determine a request to be unjustified or excessive, we may charge you a reasonable fee.

8.2. Right to Rectification

You have a right to request that the personal data held in relation to you is up to date and accurate.

Where information is inaccurate or incomplete, we encourage you to contact us to have this information rectified. Upon receipt of your request, we will ensure that the personal data is rectified and as up to date as is reasonably possible.

8.3. Right to Erasure

You have the right to seek the erasure of personal data by on you in the following circumstances:

Personal data is no longer required for the purposes for which it was obtained.
Where the use of the data is only lawful based on consent, you withdraw consent to the processing and no other lawful basis exists.
The personal data is being used unlawfully.
You object to the use of your personal data and there are no overriding legitimate grounds for the use of the data.
Your personal data requires deletion in line with legal requirements.

However, we will be unable to fulfil an erasure request if the personal data is required for any of the below activities:

Compliance with a legal obligation, such as the performance of a contract or compliance with certain legislation.
For the performance of a task carried out in the public interest.
Archiving, research or statistical purposes in the public interest.
The establishment, exercise or defence of legal claims.

8.4. Right to Restriction

You have the right to restrict the extent for which your personal data is being used by us in circumstances where:

You believe the personal data is not accurate (restriction period will exist until we update your information).
The processing of personal data is unlawful, but you wish to restrict the use of the data rather than erase it.
Where personal data is no longer required by us, but you require the retention of the data for the establishment, exercise, or defence of a legal claim.
You have a pending objection to the future use of your personal data.

When the use of your data has been restricted, your personal data will only be further used:

With your consent.
For the establishment, exercise or defence of legal claims.
For the protection of the rights of other people.
For reasons important to the public interest, such as for the protecting against cross-border threats or ensuring high standards of quality and safety of health care.

We will contact you to confirm where the request for restriction is fulfilled and will only lift the restriction after we have informed you that we are doing so.

8.5. Right to Data Portability

You have the right to the provision of all personal data, which you provided to us, provided to you in a structured, commonly used and machine-readable format where:

The lawfulness of the use of your personal data by us is reliant on the basis of a contract.
The lawfulness of the use of your personal data by us is reliant on the provision of your consent.
The data is being utilized by fully automated means.

You may also request that we send this personal data to another legal entity where technically feasible.

We will only refuse such a request if the data being requested may adversely affect the rights and freedoms of others.

8.6. Right to Object

You have the right to object to the further use of your personal data where:

The lawfulness of the use of your personal data by us is reliant on the basis of our legitimate interests.
Where the data is non-sensitive and being used for reasons in the public interest.
Where the data is being used for direct marketing purposes.

If you wish to object to the use of your data, please contact us with your request. We will then stop using the data or personal data unless it is required for legal proceedings.

8.7. Right to Withdraw Consent

Where we are processing your personal data based on your consent, you will have the right to withdraw your consent at any time. If you wish to withdraw your consent, please contact us with your request. We will then stop the further processing of your personal data.

8.8. Right to Object to Automated Decision Making

You have a right not to be subject to a decision based solely on automated processing or profiling, where such decisions would have a legal effect or significant impact on you.

Currently, we do not employ any systems which use automated decision making or profiling on data relating to our candidates.

Where we (or one of our third-party processors) use profiling, which produces legal effects for you or otherwise significantly affects you, you will have the right to object to such processing.

9. Marketing

Pinewood may contact you with information about products and services of ours that we think may be of interest to you.

You have the right at any time to stop Pinewood from contacting you for marketing purposes.

If you no longer wish to be contacted for marketing purposes, you can use the unsubscribe button in the footer of every marketing communication or by contacting customerservicem50@pinewood.ie

10. Cookies

Pinewood respects the privacy of all visitors to our website. This website employs cookies in order to operate effectively. More information on how this website uses cookies can be found https://pinewood.ie/cookie-policy/

11. Changes to our Privacy Notice

We will review this Privacy Notice regularly and reserve the right to make changes at any time to take into account changes in our business, legal requirements, and the manner in which we process personal data. This Privacy Notice was last updated on 22/12/2025.

+ 353 52 61 86000

9:00am - 5:00pm