Social Media Privacy Policy

SOCIAL MEDIA MONITORING ACTIVITY MADE BY BOSTON SCIENTIFIC

Information Notice
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

1. Data Controller
The Data Controller is Boston Scientific International S.A., with registered office at 2, Rue René Caudron
78960 Voisins-le-Bretonneux
France
Tel.: + 33 1 39 30 97 00
Fax: + 33 1 39 30 97 99

2. Purpose and legal basis of processing
Boston Scientific aims to understand public sentiment towards its brand and monitor the perception of its products, services or campaigns, through researches carried out on information in the public domain. In pursuit of this interest, Boston Scientific has no intention of processing personal data referring to users of Social Media (hereinafter the "Data Subjects"), but in monitoring Social Media, Boston Scientific may still process personal data referring to Data Subjects.
The legal basis of the processing is the legitimate interest of Boston Scientific as a company interested in understanding public sentiment towards its brand and monitoring the perception of its products, services or campaigns, through research carried out on information in the public domain.
Processing is carried out using manual, IT and electronic tools with logic strictly related to the aforementioned purposes and, in any case, in order to guarantee the security and confidentiality of the data.

3. The categories of personal data concerned
Boston Scientific collects and analyses data contained in social media and in various online sources, including forums, blogs and online news sites (hereinafter "Social Media"), intentionally made publicly available by the Data Subjects, among which there may however be personal data referring to same Data Subjects. Therefore, only publicly available information will be processed, which could also include individual citations or personal data such as, for example, name, surname, address, etc. or image data (e.g. photo of the Data Subject) or other personal data.
Although the external supplier, referred to in the following par. 4 (hereinafter "External Supplier") collects this list of personal data on behalf of Boston Scientific, the analysis of Boston Scientific uses only a part of it and mainly uses aggregated data. However, it is possible that individual citations will be resumed and used to describe a general attitude towards Boston Scientific in Social Media.
Therefore, the areas subject to monitoring have been strictly circumscribed and it is ensured that the Boston Scientific personnel, appointed as "authorised person for processing", to access and use the External Supplier's platform, appointed by Boston Scientific Data Processor, will pertains to precise instructions and obligations of confidentiality and security. Boston Scientific ensures that personal data of individual Data Subjects are not intentionally processed.

4. Recipients or recipients' categories of personal data
The procedure used by Boston Scientific to carry out research into its public sentiment is managed by the Talkwalker S.à r.l. Supplier, which is based in 12-16, avenue Monterey, 2163 Luxembourg which acts as Data Processor pursuant to Art. 28 Regulation (EU) 679/2016. Furthermore, only a limited number of persons authorised. can access the personal data of the Data Subjects.

5. Data Subjects' rights
The General Data Protection Regulation ("EU Regulation 679/2016") assign to the Natural Persons, Individual Companies and Freelancers (the "Data Subjects") specific rights, among which the one to know what personal data are held by Boston Scientific and how they are used (Right of access), to obtain the update, the correction or, if interested, the integration, as well as the cancellation, transformation into anonymous form or limitation. Since Boston Scientific does not interact directly with the Social Media Data Subjects and since, in principle, Boston Scientific does not have access to the data of the Data Subjects, it would be impossible to Boston Scientific, or would involve a disproportionate burden, to reach such Data Subjects individually. This privacy notice is therefore the way by which Boston Scientific brings users of social media to the attention of the facts.

5.1. Data retention period and right to erasure (i.e. right to be forgotten)
The External Supplier will delete the results of Boston Scientific's queries that may contain personal data of Data Subjects, after a maximum period of six months.
Even the automatic backups of the aforementioned research will be deleted from the electronic systems used by the External Supplier, after a maximum period of six months.
The statistical reports produced by the External Supplier procedure, which contain aggregated data, are archived for a maximum period of six months, after which they will also be destroyed or canceled by the persons authorised to process of Boston Scientific .

6. Procedures to exercise the rights and Data Protection Officer
Each interested Data Subject has the right to access his personal data that may be contained in the research carried out by Boston Scientific and to correct them, to limit their processing and, under certain conditions, to request their cancellation.
Each Data Subjects can exercise these rights by contacting:

Please direct privacy-related issues, questions, comments or complaints to one of the following:
Email: Globalprivacy@bsci.com
Postal Mail:
Boston Scientific Corporation
Global Privacy Office/Legal
300 Boston Scientific Way
Marlborough, MA 01752 (USA)
EU/EEA/Switzerland countries :
Email: EuropePrivacy@bsci.com or through our Data Subject Request Form
Postal Mail:
Boston Scientific
c/Ribera del Loira, 46 Edificio 2
28042 Madrid (Spain)

The deadline for the reply is one (1) month, that may be extended by two (2) further months in cases of particular complexity; in these cases, Boston Scientific provides at least one interim communication within one (1) month.
The rights' excercise is, in principle, free of charge; Boston Scientific reserves the right to request a fee in the event of manifestly unfounded or excessive requests (even repetitive).
Boston Scientific has the right to request information necessary for identification purposes of the applicant.

7. COMPLAINT OR REPORTING TO THE SUPERVISORY AUTHORITY FOR THE PROTECTION OF PERSONAL DATA
Finally, in the EU/EEA and Switzerland Boston Scientific informs Data Subjects that they have the right to lodge a complaint with or make a report to the Data Protection of your country where you believe that your rights have been violated [see EU list, Switzerland].