NUA Surgical Privacy Notice

---

We are committed to protecting your privacy and ensuring that your personal data is handled with care and integrity. This Privacy Notice outlines how we collect, use, and protect your personal information when you interact with us, particularly through our website and during our recruitment process.

1. Who We Are

Nua Surgical is an Irish company specialising in the development of innovative medical devices. Although we do not process patient data, we take our responsibility to safeguard your personal information seriously. For the purposes of the GDPR, Nua Surgical is the data controller with regard to the Personal Data described in this Privacy Notice. 

2. Types of Personal Data We Collect

We may process the following personal data:

• Contact Information: Name, email address, phone number, and postal address.

• Recruitment Data: CVs, cover letters, employment history, qualifications, and other details provided by job applicants.

• Technical Data: IP addresses, browser type, operating system, and usage data related to your interaction with our website.

• Information about others: You may also provide to us personal data relating to third parties, such as people who you work with, or your referees. Information about third parties should only be provided if you have demonstrable permission to do so or if the information is available in the public domain.

3. How We Use Your Personal Data

We use your personal data for the following purposes:

• Communication: To respond to your queries, requests and other communications 

• Recruitment: To process job applications and manage our recruitment process.

• Website: To enable our suppliers and service providers to carry out certain functions on our behalf in order to provide the Website and related services, including webhosting, data storage, technical, logistical and other functions, as applicable. To analyse website usage and improve our services and user experience.

• Formative Assessments: To conduct formative assessments, capture feedback and record video footage with Physicians as a requirement of ISO15485 and MDR 2017

4. Legal Basis for Processing

Our processing of your personal data is based on:

• Contract: For processing necessary to fulfil a contract that we have in place with you;

• Consent: For processing personal data when you have provided consent (e.g., submitting a CV for job applications or for the purpose of marketing*).

• Legitimate Interests: For purposes such as improving our website and managing recruitment processes.

• Legal Obligation: Where we are required to comply with legal obligations.

*Marketing

If you choose to submit your personal data to us, we may use this data to contact you with newsletters, marketing or promotional materials and other information about the exciting things Nua Surgical is doing. You will be able to opt-out of our messages through every communication. If you opt out of receiving these communications, we will still contact you, if necessary, in relation to any work we are doing with you.

5. Sharing of Personal Data

We do not sell or share your personal data with third parties for marketing purposes. However, we may share your data with:

• Suppliers & Service Providers: To facilitate the provision related services including IT consultants, webhosting providers, recruitment services providers, solicitors, accountants, consultants and similar third parties;

• Legal Authorities: If required by law or in response to legal requests.

• Other third parties: Where you have provided your consent.

6. Data Retention

Generally, we will only retain your Personal Data for as long as necessary to fulfil the purposes we collected it for and for up to seven (7) years afterwards (for purposes related to Revenue requirements) or otherwise permitted by applicable laws. We may also retain your information during the period of time needed to complete our legitimate business operations, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Formative Assessments: Video footage and feedback provided by Physicians are retained for the lifecycle of the medical device plus 15 years as required by ISO15485 and MDR 2017

Recruitment Data: CVs and related documents are retained for up to 12 months after the conclusion of the recruitment process, unless you request us to delete your information sooner.

7. Security of Your Data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, or destruction. Our security measures are regularly reviewed and updated to ensure the highest level of protection.

8. Sale of Organisation

Situations may arise where it is necessary to transfer information (including your Personal Data) to a third party in the event of a sale, merger, liquidation, receivership or transfer of all or substantially all of the assets of our organisation provided that the third party agrees to adhere to the terms of the Data Protection and Privacy Notice and provided that the third party only uses your Personal Data for the purposes that you provided it to us. The Personal Data transferred will be limited to that which is absolutely necessary. Where possible, you will be notified in the event of any such transfer and you will be afforded an opportunity to opt-out.

9. Your Data Protection Rights

You have the following rights regarding your personal data:

Access: The right to request a copy of the personal data we hold about you.

Rectification: The right to request correction of inaccurate or incomplete data.

Erasure: The right to request deletion of your personal data under certain conditions.

Restriction: The right to request a restriction on processing your data.

Portability: The right to request the transfer of your data to another organization.

Objection: The right to object to certain types of processing.

To exercise any of these rights, please contact us at info[@]nuasurgical.com

You have the right to lodge a complaint at any time to a data protection supervisory authority in relation to any issues related to our processing of your Personal Data. As our organisation is located in Ireland and we conduct our data processing here, we are regulated for data protection purposes by the Irish Data Protection Commissioner.

You can contact the Data Protection Commissioner as follows:

Website: www.dataprotection.ie

Phone: +353 57 8684800 or +353 (0)761 104 800

Email: info@dataprotection.ie

9. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. We will notify you of any changes by posting the new notice on our website and updating the effective date at the top of this notice. Please review it periodically to stay informed about how we are protecting your data.

Last Updated: 19 July 2024