Privacy policy (v3.0 dated 12-Dec-2025)
Revised Privacy Statement
Effective Date: 12 December 2025
Version: 3.0
Introduction
Harmony Clinical Research BV (“HarmonyCR”, “we”, “us”, or “our”) respects your right to privacy. Your ability to make informed choices about the use of your information is important to us.
This Privacy Statement details how and why we collect, use, and store your personal information within HarmonyCR. If you have any comments or questions about this Privacy Statement or the collection and use of your personal data, please contact our data protection officer at privacy@harmony-cr.com.
Note regarding Clinical Trial Participants: If you are participating in a clinical trial managed by HarmonyCR, your personal data is governed by the specific Informed Consent Form (ICF) provided to you by the study doctor or site staff, rather than this general website privacy policy.
Personal Information that we may collect
As used in this Privacy Statement, “Personal Information” or “Personal Data” refers to information that can (directly or indirectly) identify a specific person such as a name, address, telephone number, e-mail address or other information.
Depending on your relationship with us, we may process the following:
- Online visitors: Online identifiers (IP address, browser type), interaction data and cookies.
- Job applicants: Full name, contact details (phone, email, residence), CV/Resume, motivation letters, references and interview notes.
- Vendors & customers: Full name, business email address, business phone number, job title, payment/billing details and correspondence history.
How we use your personal Information & Legal Basis
Under the General Data Protection Regulation (GDPR), we must have a legal basis for processing your personal data. We rely on the following:
Relationship |
Purpose of Processing |
Legal Basis |
| Online Visitor | To perform analytical and statistical analysis of our website usage and security. | Legitimate Interest (to improve and secure our services). |
| Applicant | To process your application and assess your suitability for a role. | Legitimate Interest (recruitment) and Consent (for long-term retention). |
| Vendor | To manage the supply chain, orders, and payments. | Performance of Contract and Legal Obligation. |
| Customer | To deliver services, manage client relationships, and communicate regarding projects. | Performance of Contract and Legitimate Interest. |
| All | To comply with legal requirements (e.g., tax, audit, regulatory). | Legal Obligation. |
How we may share your personal information
We treat your data with care and do not sell your personal information to third parties. We may share personal data only in the following circumstances:
- Legal requirements: if by law and/or regulations or governmental request
- Service providers: With trusted third-party vendors that carry out functions or services on our behalf that enable our operations. This includes our IT applications and systems, website analytics and search engine providers. This also includes the protection and securing of our systems and services.
- Corporate transactions: If HarmonyCR is involved in a merger, acquisition or sale of all or a portion of its assets, your data may be transferred as part of that transaction.
International transfers of personal data
HarmonyCR performs research in collaboration with partners located across the world. HarmonyCR is committed to complying with European and other applicable Data Protection Laws regarding information that is transferred outside the European Economic Area (EEA).
The laws in countries outside the EEA may not be as strict as the laws in within the EEA. Considering this, HarmonyCR has taken measures to protect your privacy and fundamental privacy rights when your personal data is transferred outside the EEA and to other countries where no adequacy decisions of the European Commission apply.
This includes the use of appropriate safeguards such as standard contractual clauses and safe transfer protocols to ensure adequate protection. We may also inform you about a proposed data transfer and ask you for your explicit consent. When we do this, we will always inform you of the possible risks to your personal data.
How we Protect your personal Information
HarmonyCR uses appropriate technical and organizational measures to ensure that the personal data we process is protected from unauthorized access, use, destruction, alteration, or disclosure in accordance with applicable laws and regulations. Please note that no data transmission or IT storage system can be 100% secure and we cannot fully guarantee the security of personal data. However, when data transmission or IT storage problems arise, we have appropriate procedures in place to protect your personal information and privacy.
Retention of your personal information
We will retain your personal data for as long as is necessary to fulfill the purposes for which we have collected your personal information, including any legal requirements. When the personal information is no longer needed for its original processing goal, and there are no further legal requirements, we will delete your personal information.
For applicants submitting their CV via the website, we ask your explicit consent to retain your CV and other data related to your application for a period of 10 years. This allows us to interact with you in the future about potential vacancies. In case you don’t provide your explicit consent for this long-term storage, your CV and other data related to your application will be deleted after 2 months. Your refusal for long-term storage will not have any influence on your current application.
How to exercise your Privacy Rights
Under the GDPR, you have the following rights regarding your Personal Information:
- Right to access information about how we process your personal data, including the categories of personal data we process, recipients of your personal information, and purposes for our processing.
- Right to rectification of inaccurate personal information concerning you, as well as, considering the purposes of the processing, the right to have incomplete personal information completed.
- Right to erasure (deletion) of personal information concerning you where:
- the personal information is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- you withdraw your consent and there are no other legal grounds for the processing;
- you exercise your right to object (see below) and there are no compelling legitimate grounds for the processing;
- the personal information has been unlawfully processed; or
- the personal information must be erased for compliance with a legal obligation applicable to us.
- Right to restriction of processing (i.e., data will be blocked from normal processing but not erased) where:
- you contest the accuracy of the personal information, for a period enabling us to verify the accuracy;
- the processing is unlawful, and you oppose the erasure of the personal information and requests the restriction of their use instead;
- we no longer need the personal information for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims;
- you exercise your right to object (see below) pending the verification of whether our legitimate grounds override yours.
- Where processing is based on your consent, the right to withdraw consent at any time, without affecting the lawfulness of the processing prior to such withdrawal.
Please note that even after you have chosen to withdraw your consent, we may be able to continue to process your personal information in some limited circumstances.
- Where processing is based on your consent, or on a contract, the right to data portability, i.e., the right to obtain a copy of the data concerning you in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from us.
- Right to object to the processing of personal information based on our legitimate interests, if there are no compelling legitimate grounds for the processing that would override your interests, rights, and freedoms or for the establishment, exercise or defense of legal claims.
If you wish to exercise any of your rights above, please contact us using the information in the section ‘How To Contact Us’ at the end of this Privacy Statement. To be able to identify you, we ask for a combination of personal data which allows us to confirm your identity. If you have a request, you will normally receive a reply within 30 days. If the procedure takes longer, it can be extended once to 60 days. You will then receive a message within 30 days.
Automated individual decision-making
HarmonyCR does not use automated individual decision-making.
Complaints
If you have any question or complaint about how we handle your personal data, please contact our Data Protection Officer at privacy@harmony-cr.com.
If you remain dissatisfied, you have the right to lodge a formal complaint with the Belgian Data Protection Authority (or your local supervisory authority). For an overview of the contact details of the European Data Protection Authorities, please visit https://edpb.europa.eu/about-edpb/about-edpb/members_en.
Amendments to this Privacy Statement
HarmonyCR reserves the right to modify this Privacy Statement at any time by posting changes on our website. We encourage you to review it periodically.
How to contact us
If you have any questions about our Privacy Statement, if you wish to exercise your rights or if you wish to lodge a complaint, please contact us.
Harmony Clinical Research BV
Brusselsesteenweg 159
B-9090 Merelbeke-Melle
Belgium
Registered with the Belgian Chamber of Commerce under number: 0842 518 145.
Via email: info@harmony-cr.com or privacy@harmony-cr.com