PSI Data Protection Notice: Contractor
Latest revision of 19 November 2025
When PSI CRO AG, the parent company, and the entity that engages you (PSI, we: https://www.psi cro.com/global reach/) interact with you in the context of your services and related administrative matters, PSI needs to collect and use information about your professional qualifications and other personal data.
For some administrative purposes, PSI CRO AG and the PSI entity that engaged you act as joint data controllers with regards to the use of your personal data, which means that they share the responsibility for appropriate use of your personal data. For other purposes, for example vendor management, operating computer systems, facilitation of financial audits, etc., PSI CRO AG shall act as independent data controller which means that PSI CRO AG is independently responsible for the use of your personal data. These are some examples of activities, whereas the complete list of current business activities that involve processing of personal data and the respective role of PSI CRO AG and PSI subsidiaries is available in PSI Library (see current version of NLST-GN-XF-001).
This Data Protection Notice (Notice) is an overview of how we process, namely collect, use, store, and disclose your personal data.
WHICH PERSONAL DATA DO WE PROCESS?
Personal data that we may need to process about you may include:
Identification and contact: name, e-mail address, phone number, signature, position, work address, etc.
Qualification: education, tittle, work experience, language skills, CV, etc.
Passport and business travel: date of birth, gender, birth country, birth city, national ID type, national ID, citizenship status, citizenship country, nationality, travel details, national and international passport, visa applications, visa details.
Images: photos, video recordings, etc.
Payments: bank account number, salary amount, tax deductions, etc.
Training: professional improvement courses, exam certifications, training records, etc.
User data: IP address, device ID, password, user login name and IDs, etc.
WHAT ARE THE PURPOSES AND LEGAL BASES FOR PROCESSING YOUR PERSONAL DATA?
PSI will process your personal data to ensure that we meet our respective contractual obligations in accordance with the service agreement that you concluded with us. The legal basis for this processing is the execution and fulfilment of this service contract.
The following activities are essential to PSI’s business operations. Therefore, PSI has a legitimate interest in processing your relevant personal data to perform these activities.
- Assigning you a role and tasks in a project/study conducted by PSI for a clinical trial sponsor and managing your engagement into this and other projects/studies in accordance with the study contract.
Please note that as soon as your data become part of a study file, study sponsor becomes the data controller for your data for the study-related purposes. In any case, you are welcome to address any enquiries with this regard to PSI Data Protection. - We will need to use your data to arrange project-related and PSI´s corporate trainings as appropriate for the services that you deliver to PSI.
- Monitoring activity of the users accessing to PSI´s corporate network to ensure appropriate cybersecurity.
PSI may need to share photographs picturing you and taken at a team building or other work-related event via PSI public media accounts. For such specific data uses, we will reach out for your consent, in which case your consent will be the legal basis for the processing of your personal data by PSI.
WHO WILL HAVE ACCESS TO YOUR PERSONAL DATA
PSI personnel: As PSI is a global company with worldwide presence, we need to share information, including personal information of our contractors, within PSI, to manage our business operations and comply with the applicable laws. This means that all PSI staff will have access to your PRIMA profile, as well as other personal data as needed to enable them to carry out their job responsibilities.
Third party service providers: When we need to use your personal information to fulfill our contractual responsibilities towards you, like administering the payment for your services, we may need to engage an external company to help PSI carry out its obligations. In this case, PSI will need to share your personal information with such third-party providers. When PSI works to improve internal processes, e.g., to automate manual operations, PSI may need to engage professional service providers and enable access to your personal data for the delivery of their assistance.
Sponsors, study vendors: When your services require you to work as a member of a project team for different clinical studies, PSI will share your contact data, information about your professional qualifications and other relevant personal data with the study sponsors and vendors involved in the study.
Authorities: When we collect information for some of the purposes, we may do so in response to a statutory requirement. In such cases, to comply with the law, we will have to share your data with the authorities. In addition, regulatory authorities will have access to your personal information when these data make part of the study file. There may be other cases when disclosure of your data will be required. We will follow the applicable laws in this regard.
HOW DO WE PROTECT YOUR DATA?
Whenever we process data, including disclosing your data to business partners who deliver services or/and collaborate with PSI, we implement technical and organizational measures to safeguard your data. Such efforts include technical and organizational measures, as well as certain contractual protections. Among such safeguards are de-identification and aggregation of data in case the collaborator does need to know your identity; as well as access control, data minimization, etc. You can ask PSI to tell you more about these safeguards in application to a particular process or/and activity.
When the parties with whom we need to share your data are located abroad, information about you will need to be sent or/and accessed from abroad, including to/from countries where the personal data protection laws may be less strict as compared to the countries of the European Economic Area, Switzerland, and the UK. When PSI shares your data with such entities, we ensure that these external recipients, regardless of their location, commit to protect your personal information.
FOR HOW LONG DO WE RETAIN YOUR DATA?
PSI will retain your personal data for as long as the services agreement is in force. After the termination of the agreement, we may keep your data during the legally established timeframes, including as necessary to comply with the legal obligations to which PSI is subject.
When you are engaged in a study as a project team member, some of your personal data contained in your CV(s), study-related communication, etc., shall be retained as part of the study file in accordance with the laws applicable to clinical trials.
HOW TO EXERCISE YOUR RIGHTS REGARDING YOUR PERSONAL DATA?
You have the right to request access to, rectification or erasure of your personal data, restriction of processing, as well as object to processing in some cases. You can also request a digital copy of the personal data that you provided to PSI. You can also withdraw your consent to processing for some purposes, if you initially consented to have your data processed, however please note that in such case the use of your data before you changed your mind, remains lawful.
Please note that the lists of processed personal data, processing activities and the respective legal bases laid down in this Notice are not complete. You may obtain more information about how we use your personal data, including the complete list of purposes for which your data are processed, categories of personal data processed by PSI entity that employed you, etc., as well as file any other enquiry via sending you request at privacy@psi cro.com.
If you are based in the EU, you have the right to lodge a complaint to the supervisory authority. You will find your national data protection authorities and their contact details following this link: https://edpb.europa.eu/about-edpb/about-edpb/members_en.
If the national data protection authority is not on the list, please e-mail at privacy@psi cro.com to receive the address of the data protection authority in your country.
HOW WILL YOU KNOW THAT PSI REVISED THIS NOTICE?
PSI reserves the right to modify this Notice as needed to reflect changes in laws, PSI practices and procedures, or requirements imposed by data protection authorities. If changes occur, PSI will notify you of the changes to this Notice that can have an impact on your obligations and rights.
