Privacy Policy

Introduction

Trials24 takes the protection of your and your child’s personal data seriously and complies with the applicable data protection laws. With this Privacy Policy, Trials24 is fulfilling the obligations to provide information as required by the applicable data protection legislation and is informing you of the details of how your and your child’s personal data will be processed and of your rights in this regard.

Please note that this Privacy Policy applies only to the processing of your and your child’s personal data by Trials24 GmbH, Denninger Str. 30, 81679 Munich, Germany. This means that this Privacy Policy expressly does not relate to participation in a study.

Please read this Privacy Policy in connection with the General Terms of Use for use of the study platform.

Summary of key points:

Trials24 GmbH is responsible under data protection law for the processing of your and your child’s personal data in the context of the study platform and the database. This means that, in these areas, Trials24 GmbH bears the sole responsibility for ensuring that your and your child’s personal data are securely processed in compliance with data protection requirements.
Participation in the survey on the study platform and inclusion in the database are both entirely commitment-free. There are no associated rights or obligations. In this respect, you or your child are also not entitled to participate in a specific study.
Trials24 GmbH merely supports the search for eligible study participants and is not responsible for conducting the studies themselves. To this end, a questionnaire indicating whether you or your child are eligible for a specific study will be provided to you in the context of the study platform. The questionnaire is voluntary and is generally completed in anonymous form on the study platform. Your anonymity is guaranteed until you provide your contact details to participate in a specific study and/or to be included in the Trials24 GmbH database.
If you or your child are eligible to participate in a study, Trials24 GmbH will share your and your child’s data with a study site that is responsible for conducting the specific study. However, before you or your child can participate in the study, you will first receive more information about the study itself and must submit another data protection consent in this context. Your consent in the context of the study platform therefore expressly does not constitute consent to participation in the study itself. Trials24 GmbH is no longer responsible for the processing of your or your child’s personal data as part of the study. The data protection information you will receive before participating in the study will name the new controller under data protection law.

1. Responsible Entity

As operator of the study platform and database, Trials24 GmbH, Denninger Str. 30, 81679 Munich, Germany, represented by the management (hereinafter “Trials24”), is responsible for the data processing in the context of the study platform and for any further storage of your personal data in the context of a database.

If you have any questions regarding the processing of your personal data by Trials24 or about exercising your rights, you can contact Trials24 at any time via the following contact details:

Email: info@trials24.com

Telephone: +49(0) 89 21537 4990

Please note that, in the event that you assert rights (e.g., requests for information or data erasure), Trials24 must first ascertain your identity by means of a suitable procedure.

Trials24 is no longer responsible for the processing of your personal data as part of the study. The data protection information you will receive before participating in the study will name the new responsible entity under appliable data protection law. In this respect, Trials24 will also not act as a processor or business associate on behalf of the study’s sponsor.

For U.S. residents, please be aware that your data is possibly protected under HIPAA and CCPA. You have the right to request access to your personal data, request the deletion of your data, and to know how your data is being used and shared. Trials24 GmbH is committed to ensuring your data privacy and complying with all applicable data protection regulations.

2. Data Protection Officer

Alternatively, you can also contact the data protection officer of Trials24 with questions about the processing of your personal data. You can reach the data protection officer via the following contact details:

Email: datenschutz@trials24.com

3. Data Security

To ensure the best possible protection of your data, the study platform uses secure sockets layer encryption (SSL encryption) in conjunction with transport layer security encryption (TLS encryption). This encryption ensures that data you transmit to Trials24 the context of the platform (e.g., by completing study-related questionnaires) cannot be read, redirected, or altered by unauthorised third parties during transmission.

Insofar as your data are stored by Trials24, this storage will only take place in appropriately security-certified data centres. Trials24 expressly reserves the right to involve external service providers for the storage and processing of your data, but they will only act as processors or business associate on behalf of Trials24 and in accordance with the instructions issued by Trials24. Processors or business associates will be contractually obligated by Trials24 to take such technical and organisational measures (TOMs) as are appropriate, according to the current state of the art, for ensuring that your data are continuously processed in compliance with applicable data protection requirements.

In no event will your data be shared with or disclosed to third parties by Trials24 or a processor or a business associate without an appropriate legal basis.

4. Your Rights

As a “data subject”, you have certain inalienable rights (data subject rights). Trials24 is obligated to guarantee these data subject rights and must contractually obligate employed processors to assist Trials24 as best they can in enforcing these data subject rights. In this respect, you are entitled to the following data subject rights:

Right of access: You have the right to receive information from us about whether we are processing your personal data and, if so, which data are being processed and for what purpose. You also have the right to request and obtain a copy of your health records and other personal information we hold about you.
Right to rectification: You have the right to have inaccurate or incomplete personal data we have stored about you corrected. You can request corrections to your health records if you believe there is an error or missing information.
Right to erasure: You have the right to request that we erase your personal data. This right exists without the need for any specific justification; your mere request is sufficient. Trials24 may only refuse this request for specific reasons, such as the necessity of using the personal information in the context of a contractual relationship.
Right to restriction of processing: Under certain circumstances, you have the right to restrict the further processing of your personal data. This right exists, for example, if you dispute the accuracy of the data or if the processing is unlawful.
Right to data portability: You have the right to receive a copy of your personal data from us in a structured, commonly used, and machine-readable format. This ensures that you can transfer your information to another company without hindrance. This must be done free of charge within 25 days of your request and applies to data collected in the past twelve months.
Right to opt-out: You have the right to prevent the sale or disclosure of your personal information. If you choose to opt-out, Trials24 must respect this choice and may not request your consent again for twelve months.
Right to equal service and non-discrimination: You have the right not to be discriminated against for exercising any of your data subject rights. This means that Trials24 cannot deny you services, charge you different prices, or provide a different quality of service because you have exercised your rights.
Right to withdraw consent: Insofar as we are processing your personal data on the basis of your consent, you can withdraw this consent at any time. The lawfulness of the processing up to the time of withdrawal will not be affected by this.
Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection regulations.
Right to file a lawsuit: In California, you have the right to file a lawsuit if your unencrypted and nonredacted personal data are unlawfully disclosed and Trials24 fails to ensure an adequate level of security. In other cases, only the Attorney General can bring an action against the company.

You can assert your data subject rights at any time. To do so, you can send a written or electronic message to Trials24 via the contact details provided. Alternatively, you can also contact Trials24’s data protection officer. In this context, both Trials24 and the data protection officer reserve the right to verify your identity by means of a suitable procedure.

5. Use of the Study Platform, Access Data

As soon as you access the web-based study platform, the browser you are using will automatically transmit access information (known as log files) to the platform’s hosting provider. These log files contain personal and other data.

Processed data:

IP address
Browser type/version
Operating system of the end device
Website from which the request stems (known as referrer URL)
Content of the request (specific page)
Date and time of the request
Time zone
Access status/http status code
Amount of data transferred

Purposes of the processing:

The log files are essential for ensuring the technical functionality of the study platform. In particular, the transmission of the IP address is necessary to display the platform on the end device you are using. Trials24 will neither combine the data stored as part of the log files with other data sources nor use such data to identify individual users of the platform. In particular, the transmitted data will also not be evaluated for marketing purposes.

Recipient of the data:

The recipient of your personal data is the study platform’s hosting provider on whose servers the platform is being run. Trials24 has commissioned Raidboxes GmbH (Hafenstrasse 32, 48153 Münster, Germany, www.raidboxes.io) with organising the hosting of the study platform. The services of Cloudflare Germany GmbH (Rosental 7, c/o Mindspace, 80331 Munich, Germany, www.cloudflare.com) are also used. In this context, both service providers are acting on behalf of Trials 24 and have been obligated, on the basis of a contract, to establish and maintain appropriate technical and organisational measures (TOMs) that protect your personal data.

Duration of storage:

After no more than 14 days, the log files will be automatically erased or modified in such a way that they can no longer be attributed to you.

6. Use of Cookies

In addition to the aforementioned access data (log files), cookies are also used in the context of the study platform. These are small text files that the browser you are using automatically saves and files/stores on the end device you are using. Cookies do not contain viruses, Trojan horses, or other malicious software that would be capable of causing damage to the end device you are using. In this context, please note that the use of certain cookies may be necessary for technical reasons (e.g., to display the study platform on your end device). These “technically essential cookies” are to be differentiated from cookies that are used for other purposes (e.g., analysing user behaviour in the context of the study platform). These are “technically non-essential cookies”.

To begin with, the following text only discusses processing as it relates to the use of technically essential cookies. To the extent that Trials24 uses technically non-essential cookies for the purposes of analysing user behaviour in the context of the study platform, you will be informed of this in separate sections of this Privacy Policy.

Processed data:

Form data (e.g., log-in information)
Language settings
History data (e.g., search terms entered)
Cookie run times
Cookie version
Saved consent information
Individual cookie ID (pseudonym)

Purposes of the processing:

The cookies used allow Trials24 to see that you have already visited individual areas or pages of the study platform and ensure that you do not need to re-enter certain information and settings you have already entered in the context of the study platform. If you have a user account on the study platform, the deployed cookies will also be used, among other things, to recognise you when you visit the study platform again.

Duration of storage:

The deployed cookies will be automatically erased either immediately after you terminate your access to the study platform or after a fixed period of time not to be determined by Trials24.

You can also prevent the use of cookies by disabling or incrementally restricting the automatic placement of cookies in the settings of the browser you are using. In this context, you can also manually erase cookies already stored on the end device you are using. However, please note that partially or completely disabling cookies in your browser’s settings may mean that you can no longer use the study platform or no longer use it in its entirety.

7. Disclosure of your personal data

Trials24 may transfer or disclose Your personal data under certain circumstances, for example in business transactions such as mergers, acquisitions, or asset sales. In such cases, you will be notified before your data is transferred and becomes subject to a different privacy policy.

Trials24 may also be required to disclose your personal data if legally mandated or in response to valid requests from authorities (e.g., a court or government agency). Additionally, Trials24 may disclose your personal data if it believes in good faith that such action is necessary to comply with a legal obligation, protect and defend Trials24’s rights or property, prevent or investigate possible misconduct related to the offered service(s), protect the personal safety of service users or the public, or guard against legal liability. In all instances, Trials24 strives to balance our legal and business obligations with the commitment to protecting your privacy and maintaining your trust. Your consent to this privacy policy followed by your submission of personal data represents your agreement to a transfer.

8. Data Transfers to Third Countries

Trials24 may employ service providers whose place of business is in a third country or who are part of an international organisation with its place of business in a third country. A commonality shared by these third countries is that they may have their own data protection legislation, but this legislation may provide a lower level of protection than the applicable data legislation. Considering this, the transfer of data to third countries is only permitted when certain legal conditions are fulfilled. Your consent to this privacy policy followed by your submission of personal data represents your agreement to that transfer.

This Privacy Policy will expressly inform you when a service provider has such a connection to a third country. In this case, by providing your consent, you agree to the transfer of your personal data to such a company.

9. Contacting Trials24

You can contact Trials24 and make enquiries via email at any time, including in the context of the study platform. To handle your request(s), Trials24 will need to take note of the personal data you submit to Trials24 in the context of your request. The following explanations are also applicable in the event that tTrials24 provides a contact form in the context of the study platform or elsewhere.

Processed data:

First name, last name
Email address
Date and time of the request
Content of the request

Purposes of the processing:

The data transmitted by you in the context of contacting Trials24 will be processed by Trials24 solely for the purpose of handling and responding to your request. Please note that Trials24 may use complaints in anonymised form as part of quality assurance to assess the quality and security of service.

Recipient of the data:

The recipient of your personal data is the provider of the email software used by Trials24 for receiving and handling emails. For receiving, handling, and sending emails, Trials24 uses the service Google Mail as part of Google Workspace (Google Ireland Ltd., Google Building Gordon House, 4 Barrow St., Grand Canal Dock, Dublin 4, D04 V4X7, Ireland) and the service Outlook as part of Microsoft365 (Microsoft Ireland Operations Ltd., South County Business Park, One Microsoft Place, Carmanhall and Leopardstown, Dublin, D18 P521, Ireland). In this context, Google and Microsoft have accordingly been obligated by Trials24, on the basis of a contract, to establish and maintain appropriate technical and organisational measures (TOMs) that protect your personal data.

In this respect, please note that Google Ireland Ltd. is a subsidiary of Google LLC and Microsoft Ireland Operations Ltd. is a subsidiary of Microsoft Corporation and that these parent companies have their places of business in the United States. If you’re located outside the United States, the explanations in the section titled “Data Transfers to Third Countries” therefore apply.

If you submit your request to Trials24 via a contact form in the context of the study platform, the study platform’s hosting provider is also a recipient of your personal data.. Trials24 has commissioned Raidboxes GmbH (Hafenstrasse 32, 48153 Münster, Germany, www.raidboxes.io) with organising the hosting of the study platform. The services of Cloudflare Germany GmbH (Rosental 7, c/o Mindspace, 80331 Munich, Germany, www.cloudflare.com) are also used. In this context, both service providers are acting on behalf of Trials24 and have accordingly been obligated by Trials24, on the basis of a contract, to establish and maintain appropriate technical and organisational measures (TOMs) that protect your personal data.

Duration of storage:

The processed data will only be stored by Trials24 for as long as this is necessary to handle and respond to your request. Trials24 will then erase the data, provided that their erasure is not opposed by legal retention obligations.

10. Online Surveys About Potential Study Participation

In the context of the study platform, you or you, as a parent, will be given the opportunity to participate in an online survey about your or your child’s potential study participation. As part of the survey, you will be asked to answer a series of questions related to your or your child’s potential study participation. Your answers will be used to determine if you or your child are interested in study participation and are generally eligible to participate in the study.

Processed data:

Name and date of birth of you and your child
Answers to the questions asked
Data concerning your or your child’s health
Contact details (email address, telephone number, address, postal code, state)

The questionnaire is integrated into the study platform by means of an independent element (iFrame). The online questionnaire itself is completed anonymously to begin with. In this respect, your IP address will not be processed either. The questionnaire service provider will not store your IP address. At the end of the questionnaire, however, you will be given the opportunity to enter your contact information if you or your child would like to participate in the study and/or wish to be informed about other studies in the future. The questionnaire will not be identified with you personally unless you enter your contact details.

Purposes of the processing:

The information you provide about you or on behalf of your child in the context of the survey (answers to the questions asked and data concerning health) must be processed so that Trials24 can assess your or your child’s eligibility for participation in the study. Your contact details will be used to send you information about the study and to verify whether a study site for that study is located in your area. Additional questions may need to be clarified by email or telephone to further verify your or your child’s eligibility for study participation. In this regard, please note the “Telephone Interviews” section of this Privacy Policy. Notes will be taken during the conversation, and documents such as images or diagnostic reports may be requested. If you or your child are interested in participating in the study, Trials24 will share your contact details, conversation notes, and submitted documents with the study site in your area. Your and your child’s data will only be shared for the purpose of clarifying your possible participation in the study.

Recipient of the data:

The recipient of your and your child’s personal data is the service provider that provides the online questionnaire and stores the data related to the online questionnaire. Trials24 employs LamaPoll (Lamano GmbH & Co. KG, Frankfurter Allee 69, 10247 Berlin, Germany) for the purpose of integrating the online questionnaire in the study platform and for storing the data related to the online questionnaire. In this context, the service provider is acting on behalf of Trials24 and has accordingly been obligated by Trials24, on the basis of a contract, to establish and maintain appropriate technical and organisational measures (TOMs) that protect your and your child’s personal data.

Another recipient of your and your child’s personal data is the study site with which Trials24 will share your and your child’s data, provided you have consented to receiving information about study participation and have left your contact details.

Duration of storage:

If you have consented to the processing of your and your child’s personal data to receive information about study participation, your and your child’s data will only be stored until the purpose for which your and your child’s data was collected ceases to apply and, at most, for 90 days after the study has ended. This duration of storage is a legal requirement because competent authorities may consider the recruitment of study participants as part of the study and we need the data as part of the documentation for the study. If you have also consented to the processing of your and your child’s personal data to receive information about future studies, you’re and your child’s data will be stored, at most, until you withdraw your previously granted consent.

11. Telephone Interviews

Following the online surveys about health topics and potential study participation, it may be necessary and/or helpful for Trials24 to conduct a brief telephone interview with you to obtain further information that can generally help in gaining insights or can qualify your profile as a potential study participant. Considering this, Trials24 is expressly informing you of the possibility of a telephone interview during which personal data will also be collected and may then be shared with study sites, for example, as part of your profile.

Processed data:

Name and date of birth of you and your child
Answers to the questions asked
Data concerning your or your child’s health
Contact details (email address, telephone number, address, postal code, state)

Purposes of the processing:

The information you provide on behalf of your child in the context of the interview, including your answers to questions asked and data concerning health, will be processed for the purpose of evaluating your child’s eligibility for potential participation in a study or analysing various health topics to obtain findings and develop appropriate measures.

Recipient of the data:

The recipient of your and your child’s personal data is Trials24 to begin with. Trials24 will decide whether the data collected during the telephone interview will be shared with the respective study site in the form of interview records for the purpose of potential study participation, for example. In this regard, please note the “Online Surveys About Potential Study Participation” section of this Privacy Policy.

Duration of storage:

If you have consented to the processing of your and your child’s personal data to receive information about survey results or information about study participation, your and your child’s data will only be stored until the purpose for which the data was collected ceases to apply and, at most, for 90 days after the survey results have been sent or after the study has ended. In the context of a study, this storage period is a legal requirement because competent authorities may consider the recruitment of study participants as part of the study and we need the data as part of the documentation for the study. If you have also consented to the processing of your and your child’s personal data to receive information about future studies, the data will be stored, at most, until you withdraw your previously granted consent.

12. Data Storage for Future Studies

In the course of participating in an online survey on the study platform, you, as a parent, will be given the opportunity to consent to the storage of your and your child’s personal data to receive information about future Trials24 studies. This will require your and your child’s personal data to be stored in the context of a database so that you can be contacted as soon as a new study is announced.

Processed data:

Name and date of birth of you and your child
Answers to the questions asked
Data concerning your child’s health
Contact details (email address, telephone number, address, postal code, state)

Purposes of the processing:

The information you provide on behalf of your child in the context of the survey must be processed so that Trials24 can assess your child’s eligibility for participation in future studies. Your contact details will be used to inform you of future studies in which you are generally eligible to participate. You, on behalf of your child, will then be given the opportunity to participate in the online survey for the respective new study.

Recipient of the data:

The recipient of your and your child’s personal data is the service provider that provides the online questionnaire and stores the data related to the online questionnaire. Trials24 employs LamaPoll (Lamano GmbH & Co. KG, Frankfurter Allee 69, 10247 Berlin, Germany) for the purpose of integrating the online questionnaire in the study platform and for storing the data related to the online questionnaire. In this context, the service provider is acting on behalf of Trials24 and has accordingly been obligated by Trials24, on the basis of a data processing agreement, to establish and maintain appropriate technical and organisational measures (TOMs) that protect your personal data.

Another recipient of your and your child’s personal data may be the survey’s cooperating partner with which Trials24 will share your data, provided you have consented to receiving information about new surveys and clinical studies and have left your contact details. In relation to Trials24, the respective cooperating partner is independently responsible for complying with applicable data protection laws and must ensure the lawful processing of your and your child’s personal data. You will be specifically referred to the respective cooperating partner’s privacy policy, which will apply accordingly.

Duration of storage:

If you have consented to the processing of your and your child’s personal data to receive information about future studies, the data will be stored, at most, until you withdraw your previously granted consent.

13. Receiving Newsletters, Promotional Information

As part of Trials24’s services, you have the option of registering to receive the newsletter. We must process your personal data to create, send, and evaluate our newsletters.

Processed data:

First name, last name
Email address
Anonymised user data (e.g., open and click rates)

Purposes of the processing:

The aforementioned data must be processed so that Trials24 can send you personalised newsletters and information and perform an anonymised evaluation of the newsletters’ success with regard to the click and open rates.

Recipient of the data:

The recipient of your personal data is the service Mailchimp (The Rocket Science Group LLC., 675 Ponce de Leon Ave NE Suite 5000, Atlanta, GA 30308, USA, https://mailchimp.com/de/). In this context, the provider Mailchimp is acting on behalf of Trials24 and has accordingly been obligated by Trials24, on the basis of a contract, to establish and maintain appropriate technical and organisational measures (TOMs) that protect your personal data.

In this regard, please note that The Rocket Science Group LLC maintains its place of business in the United States. A transfer of data to the United States is generally not planned but also cannot be definitively ruled out. If you’re located outside the United States, the explanations in the section titled “Data Transfers to Third Countries” therefore apply.

Duration of storage:

The data processed in this context by Trials24 will be stored, at most, until you withdraw your previously granted consent to receiving Trials24’s newsletter. You can withdraw your previously granted consent at any time in the footer of the newsletter or by sending an email to the contact details listed in the “Trials24” or “Data Protection Officer” section.

14. Usage Data Analytics Services

14.1 Usage Analysis, Google Analytics

To analyse user behaviour in the context of the study platform, Trials24 uses the service Google Analytics (Google Ireland Ltd., Google Building, Gordon House, 4 Barrow St., Grand Canal Dock, Dublin 4, D04 V4X7, Ireland). The usage analysis involves the collection, storage, and evaluation of anonymised usage data that are collected via one or more technically non-essential cookies.

Processed data:

Anonymised IP address
Browser type/version
Operating system of the end device
Website from which the request stems (known as referrer URL)
Content of the request (specific page or platform)
Date and time of the request
Time zone
Access status/http status code
Amount of data transferred
Usage data (e.g., time spent on pages, click rate, scrolling behaviour)

By truncating your IP address, Google Analytics anonymises your data before they are evaluated, which means they can no longer be attributed to you after they are collected.

Purposes of the processing:

Processing the aforementioned data allows Trials24 to evaluate the use of the study platform and thus to determine which areas of the study platform are still in need of improvement. Trials24 does so not least out of the desire to adapt the study platform as much as possible to users’ needs.

Recipient of the data:

The recipient of your personal data is the service Google Analytics (Google Ireland Ltd., Google Building, Gordon House, 4 Barrow St., Grand Canal Dock, Dublin 4, D04 V4X7, Ireland). In this context, the provider Google Analytics is acting on behalf of Trials24 and has accordingly been obligated by Trials24, on the basis of a contract, to establish and maintain appropriate technical and organisational measures (TOMs) that protect your personal data.

In this regard, please note that Google Ireland Ltd. is a subsidiary of Google LLC, which has its place of business in the United States. A transfer of data to the United States is generally not planned but also cannot be definitively ruled out. If you’re located outside the United States, the explanations in the section titled “Data Transfers to Third Countries” therefore apply.

Duration of storage:

Although your personal data will only be processed in anonymised form after they are collected and can therefore no longer be attributed to you personally, Trials24 has nonetheless decided to limit the duration of storage for these data to 14 months. After the 14 months have elapsed, the usage data stored as part of Google Analytics will be automatically erased. You can make later adjustments to your chosen settings regarding the use of technically non-essential cookies related to Google Analytics at any time in the context of the cookie banner on the study platform.

You can also prevent the use of the technically non-essential cookies by disabling or incrementally restricting the automatic placement of cookies in the settings of the browser you are using. In this context, you can also manually erase cookies already stored on the end device you are using. However, please note that partially or completely disabling cookies in your browser’s settings may mean that you can no longer use the study platform or no longer use it in its entirety.

14.2 Google Tag Manager

In order integrate Google’s tracking and analytics tools in the context of the study platform, Trials24 uses Google Tag Manager (Google Ireland Ltd., Google Building, Gordon House, 4 Barrow St., Grand Canal Dock, Dublin 4, D04 V4X7, Ireland).

Processed data:

IP address

Purposes of the processing:

The aforementioned data must be processed so that Trials24 can use Google Tag Manager to integrate Google’s tracking and analytics tools.

Recipient of the data:

The recipient of your personal data the service Google Analytics (Google Ireland Ltd., Google Building, Gordon House, 4 Barrow St., Grand Canal Dock, Dublin 4, D04 V4X7, Ireland). In this context, the provider Google Analytics is acting on behalf of Trials24 and has accordingly been obligated by Trials24, on the basis of a contract, to establish and maintain appropriate technical and organisational measures (TOMs) that protect your personal data.

Duration of storage:

The data processed in the context of this processing activity will be stored by Trials24, at most, until you withdraw your consent to the use of technically non-essential cookies related to Google Tag Manager. You can make later adjustments to your chosen settings regarding the use of technically non-essential cookies related to Google Tag Manager at any time in the context of the cookie banner on the study platform.

14.3 Hotjar

Trials24 uses the service Hotjar in the context of the study platform. This is an analytics service provided by Hotjar Ltd. (Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta). Hotjar allows Trials24 to record movements in the form of what are known as heatmaps in the context of the study platform.

Processed data:

Anonymised IP address
Device type/version
Screen size of the device used
Browser type/version
Operating system of the end device
Website from which the request stems (known as referrer URL)
Content of the request (specific page)
Date and time of the request
Time zone
Access status/http status code
Amount of data transferred
Mouse movements and clicks
Scroll distance

The aforementioned data will be collected in anonymised form and cannot be attributed to any specific person. Should personal data be visible in the context of the heatmap used (e.g., within text boxes), Hotjar will automatically render these data unrecognisable.

Purposes of the processing:

The aforementioned data must be processed so that the study platform can be evaluated and better adapted to users’ needs.

Recipient of the data:

The recipient of your anonymised data is the service Hotjar (Hotjar Ltd., Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta). In this context, the provider Hotjar is acting on behalf of Trials24 and has accordingly been obligated by Trials24, on the basis of a contract, to establish and maintain appropriate technical and organisational measures (TOMs) that protect your personal data.

Duration of storage:

Because only anonymised usage data without any personal reference will be processed, these data will be stored for an unlimited period of time but are expected to be erased after one year.

14.4 Varify

Trials24 uses the service Varify.io in the context of the study platform. This is a service provided by Varify GmbH (Südliche Münchner Strasse 55, 82031 Grünwald). Varify.io enables the quick adaptation of the study platform, without the involvement of web developers, and the performance of what are known as A/B tests. A/B testing (also called split testing) is an online-marketing method in which two or more versions of a website or app are compared. The goal is to find out which version of the website or app users like better.

Processed data:

IP address
Anonymous interactions in the context of the displayed website
Anonymous usage information organised by user group

Purposes of the processing:

The aforementioned data must be processed so that the respective website can be displayed for you and the use of the respective website can be evaluated in anonymised form by means of cookies. The IP address is only needed to place the cookies required for the analysis.

Recipient of the data:

The recipient of the anonymous usage data is the service Varify.io (Varify GmbH, Südliche Münchner Strasse 55, 82031 Grünwald, Germany). Because no personal data are transferred to Varify.io and no personal data are processed on our behalf by Varify.io, the conclusion of a contract is not necessary.

Duration of storage:

Because only anonymised usage data without any personal reference will be processed, these data will be stored for an unlimited period of time but are expected to be erased after one year.

15. Plugins and Embedded Features and Content

15.1 Use of Local Google Web Fonts

To improve the presentation of the study platform, Trials24 uses locally hosted Google web fonts (Google Webfonts). To display these fonts, the browser you are using will need to send your data to the hosting provider on whose servers the study platform is being hosted. This includes personal and other data.

Processed data:

IP address
Browser type/version
Operating system of the end device
Website from which the request stems (known as referrer URL)
Content of the request (specific page or platform)
Date and time of the request
Time zone
Access status/http status code
Amount of data transferred

Purposes of the processing:

The processing of the aforementioned data, in conjunction with the use of the locally hosted Google web fonts, allows Trials24 to display the contents of the study platform in a uniform manner in different browsers and on different end devices.

Recipient of the data:

The recipient of your personal data is the study platform’s hosting provider on whose servers the platform is being run. Trials24 has commissioned Raidboxes GmbH (Hafenstrasse 32, 48153 Münster, Germany, www.raidboxes.io) with organising the hosting of the study platform. The services of Cloudflare Germany GmbH (Rosental 7, c/o Mindspace, 80331 Munich, Germany, www.cloudflare.com) are also used. In this context, both service providers are acting on behalf of Trials24 have accordingly been obligated by Trials24, on the basis of a data processing agreement, to establish and maintain appropriate technical and organisational measures (TOMs) that protect your personal data.

Duration of storage:

The stored data will be erased immediately after your access to the study platform has ended.

15.2 Google Maps

Trials24 integrates Google Maps in the context of the study platform. This is an online map service provided by Google Ireland Ltd. (Google Building, Gordon House, 4 Barrow St., Grand Canal Dock, Dublin 4, D04 V4X7, Ireland) and integrated into the study platform via an interface (API). In this context, your personal data will be processed via the use of a technically non-essential cookie.

Processed data:

IP address
Latitude and longitude coordinates
Cookie ID

Purposes of the processing:

The aforementioned data must be processed so that the maps can be displayed for you in the context of the study platform. In this respect, Trials24 uses the maps to show you the location of one or more study sites involved in conducting the study in which you are interested in participating.

Recipient of the data:

The recipient of your personal data is the service Google Maps (Google Ireland Ltd., Google Building, Gordon House, 4 Barrow St., Grand Canal Dock, Dublin 4, D04 V4X7, Ireland). In this context, the provider Google Maps is acting on behalf of Trials24 and has accordingly been obligated by Trials24, on the basis of a contract, to establish and maintain appropriate technical and organisational measures (TOMs) that protect your personal data.

Duration of storage:

The data collected by the technically non-essential cookies related to Google Maps will be stored for a period of 9–18 months. The data will then be automatically erased. You can make later adjustments to your chosen settings regarding the use of technically non-essential cookies related to Google Maps at any time in the context of the cookie banner on the study platform.

15.3 Google reCAPTCHA

Google reCAPTCHA is used in the context of the study platform. This is a service designed to ensure that the data entered in the context of the study platform are being entered by a human being. The service provider is Google Ireland Ltd. (Google Building, Gordon House, 4 Barrow St., Grand Canal Dock, Dublin 4, D04 V4X7, Ireland).

Processed data:

IP address
Operating system of the end device
Website from which the request stems (known as referrer URL)
Time spent on the study platform
Movements on the study platform
Date and time of the request

Purposes of the processing:

The aforementioned data must be processed so that the service Google reCAPTCHA can verify whether the study platform is being used by a human being or an automated programme. The purpose of the tool is thus to prevent misuse of the study platform and spam.

Recipient of the data:

The recipient of your personal data is the service Google reCAPTCHA (Google Ireland Ltd., Google Building, Gordon House, 4 Barrow St., Grand Canal Dock, Dublin 4, D04 V4X7, Ireland). In this context, the provider Google reCAPTCHA is acting on behalf of Trials24 and has accordingly been obligated by Trials24, on the basis of a data processing agreement, to establish and maintain appropriate technical and organisational measures (TOMs) that protect your personal data.

Duration of storage:

The data collected by the technically non-essential cookies related to Google reCAPTCHA will be stored for a period of 9–18 months. The data will then be automatically erased. You can make later adjustments to your chosen settings regarding the use of technically non-essential cookies related to Google reCAPTCHA at any time in the context of the cookie banner on the study platform.

15.4. YouTube

Trials24 provides video content on the study platform and uses YouTube embedding and/or plugins in this context; YouTube is a video platform provided by Google Ireland Ltd. (Google Building, Gordon House, 4 Barrow St., Grand Canal Dock, Dublin 4, D04 V4X7, Ireland).

Processed data:

IP address
Details of the integrated YouTube account, if applicable

All videos are integrated in what is known as “privacy-enhanced mode”. This ensures that your personal data (especially your IP address) are only transmitted to YouTube if you actually play the video.

Purposes of the processing:

The aforementioned personal data must be processed so that the video content can be displayed and played in the context of the study platform. We incorporate video content to provide you with informational videos about specific studies, for example.

Recipient of the data:

The recipient of your personal data is the video service YouTube (Google Ireland Ltd., Google Building, Gordon House, 4 Barrow St., Grand Canal Dock, Dublin 4, D04 V4X7, Ireland). In this context, the provider YouTube is not acting on behalf of Trials24 and therefore does not need to be obligated by Trials24, on the basis of a contract, to establish and maintain appropriate technical and organisational measures (TOMs) that protect your personal data.

Duration of storage:

Because the browser you use to access the study platform automatically establishes a connection to YouTube’s servers after the video is played in privacy-enhanced mode, we cannot provide any information on the duration of storage. In this regard, please refer to YouTube’s Privacy Policy, which can be accessed at https://policies.google.com/privacy?hl=en.

16. Online Marketing

16.1 Facebook Ads

To analyse user behaviour and adapt the marketing activities in the context of the study platform, Trials24 uses the “Custom Audiences” remarketing feature and the “Facebook Conversions API”, or, collectively, “Facebook Remarketing” (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). Anonymous usage data collected via one or more technically non-essential cookies (“Facebook pixels”) are recorded, stored, and evaluated as part of the usage analysis if you have been forwarded to the study platform via a Facebook ad.

In this respect, Trials24 can only see that someone clicked on an ad in the context of the social network Meta, was forwarded to the study platform, and reached a previously defined target page of the study platform (conversion page). Trials24 is only informed of the total number of users who have clicked on the advertisement, and none of your personal data will be processed.

You can prevent the usage analysis described above by not clicking on any of the ads that Trials24 has placed in the social network Meta or by disabling or incrementally restricting the automatic placement of cookies in the settings of the browser you are using. In this context, you can also manually erase cookies already stored on the end device you are using. However, please note that partially or completely disabling cookies in your browser’s settings may mean that you can no longer use the study platform or no longer use it in its entirety.

In this regard, please note that Meta Platforms Ireland Ltd. is a subsidiary of Meta Platform Inc., which has its place of business in the United States. A transfer of data to the United States is generally not planned but also cannot be definitively ruled out. If you’re located outside the United States, the explanations in the section titled “Data Transfers to Third Countries” therefore apply.

16.2 Google Ads

To analyse user behaviour and adapt the marketing activities in the context of the study platform, Trials24 uses the “Google Ads” remarketing feature (Google Ireland Ltd., Google Building, Gordon House, 4 Barrow St., Grand Canal Dock, Dublin 4, D04 V4X7, Ireland). Anonymous usage data collected via one or more technically non-essential cookies are recorded, stored, and evaluated as part of the usage analysis if you have been forwarded to the study platform via a Google ad.

In this respect, Trials24 can only see that someone clicked on an ad in the context of Google Search, was forwarded to the study platform, and reached a previously defined target page of the study platform (conversion page). Trials24 is only informed of the total number of users who have clicked on the advertisement, and none of your personal data will be processed.

You can prevent the usage analysis described above by not clicking on any of the ads that Trials24 has placed in Google Search or by disabling or incrementally restricting the automatic placement of cookies in the settings of the browser you are using. In this context, you can also manually erase cookies already stored on the end device you are using. However, please note that partially or completely disabling cookies in your browser’s settings may mean that you can no longer use the study platform or no longer use it in its entirety.

In this regard, please note that Google Ireland Ltd. is a subsidiary of Google Inc., which has its place of business in the United States. A transfer of data to the United States is generally not planned but also cannot be definitively ruled out. If you’re located outside the United States, the explanations in the section titled “Data Transfers to Third Countries” therefore apply.

16.3 Bing Ads

To analyse user behaviour and adapt the marketing activities in the context of the study platform, Trials24 uses the “Bing Ads” remarketing feature (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland). Anonymous usage data collected via one or more technically non-essential cookies are recorded, stored, and evaluated as part of the usage analysis if you have been forwarded to the study platform via a Bing ad.

In this respect, Trials24can only see that someone clicked on an ad in the context of Bing Search, was forwarded to the study platform, and reached a previously defined target page of the study platform (conversion page). Trials24 is only informed of the total number of users who have clicked on the advertisement, and none of your personal data will be processed.

You can prevent the usage analysis described above by not clicking on any of the ads that Trials24 has placed in Bing Search or by disabling or incrementally restricting the automatic placement of cookies in the settings of the browser you are using. In this context, you can also manually erase cookies already stored on the end device you are using. However, please note that partially or completely disabling cookies in your browser’s settings may mean that you can no longer use the study platform or no longer use it in its entirety.

In this regard, please note that Microsoft Ireland Operations Ltd. is a subsidiary of Microsoft Corporation, which has its place of business in the United States. A transfer of data to the United States is generally not planned but also cannot be definitively ruled out. If you’re located outside the United States, the explanations in the section titled “Data Transfers to Third Countries” therefore apply.

16.4 TikTok Ads

To analyse user behaviour and adapt the marketing activities in the context of the study platform, Trials24 uses the “TikTok Ads” remarketing feature (TikTok Technology Ltd., 10 Earlsfort Terrace, Dublin, D02 T380, Ireland). Anonymous usage data collected via one or more technically non-essential cookies are recorded, stored, and evaluated as part of the usage analysis if you have been forwarded to the study platform via a TikTok ad.

In this respect, Trials24 can only see that someone clicked on an ad in the context of TikTok, was forwarded to the study platform, and reached a previously defined target page of the study platform (conversion page). Trials24 is only informed of the total number of users who have clicked on the advertisement, and none of your personal data will be processed.

You can prevent the usage analysis described above by not clicking on any of the ads that Trials24 has placed on TikTok or by disabling or incrementally restricting the automatic placement of cookies in the settings of the browser you are using. In this context, you can also manually erase cookies already stored on the end device you are using. However, please note that partially or completely disabling cookies in your browser’s settings may mean that you can no longer use the study platform or no longer use it in its entirety.

In this respect, please note that TikTok Technology Ltd. is a subsidiary of Beijing Bytedance Technology Ltd., which has its place of business in China. A transfer of data to China is generally not planned but also cannot be definitively ruled out. The explanations in the section titled “Data Transfers to Third Countries” therefore apply.

17. Management, Organisation, and Tools

17.1 Calendly

Trials24 uses the Calendly online scheduling tool provided by Calendly LLC (115 E. Main Street, Suite A1B PMB 123, Buford, Georgia, 30518, USA) to arrange and organise appointments (e.g., for telephone calls or virtual meetings). Calendly enables Trials24 to easily and efficiently schedule and organise appointments. Processed data:

Name
Email address
Telephone number, if applicable
Additional information that may be provided in the context of an open-ended text box, if applicable
Appointment information

Purposes of the processing: The processing of the aforementioned data allows Trials24 to quickly and efficiently arrange and organise appointments and to send you the information needed to attend the appointment in question. Recipient of the data: The recipient of your personal data the Calendly service provider (Calendly LLC., 115 E. Main Street, Suite A1B PMB 123, Buford, Georgia, 30518, USA). In this context, the provider Calendly is acting on behalf of Trials24 and has accordingly been obligated by Trials24, on the basis of a contract, to establish and maintain appropriate technical and organisational measures (TOMs) that protect your personal data. In this respect, please note that Calendly LLC maintains its place of business in the United States. A transfer of data to the United States is generally not planned but also cannot be definitively ruled out. If you’re located outside the United States, the explanations in the section titled “Data Transfers to Third Countries” therefore apply. Duration of storage: The processed personal data will be erased no later than 60 days after the respective appointment.

18. Updates to this Privacy Policy

Trials24 reserves the right to update this Privacy Policy with future effect to be able to adequately respond to changes in legislation, jurisdiction, or economic circumstances.

19. Definitions

For the purposes of this privacy policy:

Business, for the purpose of the CCPA (California Consumer Privacy Act), refers to the Company as the legal entity that collects Consumers’ personal information and determines the purposes and means of the processing of Consumers’ personal information, or on behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumer’s personal information, that does business in the State of California.
Company (referred to as either “Trials24”, “We”, “Us”, or “Our” in this policy) refers to Trials 24 GmbH.
Consumer, for the purposes of the CCPA, means a natural person who is a resident. A resident, as defined in the law, includes (1) every individual who is in the USA for other than a temporary or transitory purpose, and every individual who is domiciled in the USA who is outside the USA for a temporary or transitory purpose.
Personal Data is any information that relates to an identified or identifiable individual. For the purposes of the CCPA, Personal Data means any information that identifies, relates to, describes or is capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual.
Service Provider (also referred to as “Hosting Provider” in this policy) means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service(s), to provide the Service(s) on behalf of the Company, to perform services related to the Service(s) or to assist the Company in analyzing how the Service(s) is/are used.
Usage Data refers to data collected automatically, either generated by the use of the Service(s) or from the Service(s) infrastructure itself (e.g., the duration of a page visit).
Processing means all possible types of data processing. This includes, in particular, the collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, transmission, dissemination, linking, restriction, erasure, or destruction of personal data.
Recipient is the entity to whom personal data are disclosed, whether or not this is a third party.
Third Party is any entity other than you, the company, the service providers, and persons who, under the direct authority of the company or service providers, are authorised to process personal data.
Consent means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes in the form of a statement or other clear affirmative action (e.g., ticking a box provided for this purpose) signifying the data subject’s agreement to the processing of his or her personal data.

20. Notice regarding CCPA

We collect personal data directly from you, indirectly from your activity as part of our service(s), automatically via cookies, and from third-party service providers. We do not collect sensitive personal information such as precise geolocation, biometrics, or information about protected classifications.

We may use your personal information for business and commercial purposes, such as:

Operating and providing our services;
Responding to your requests and inquiries;
Auditing and security detection; and
Complying with legal obligations.

We will not use your information for unrelated purposes other than stated in this privacy notice without providing notice. We do not knowingly sell personal information to third parties. Here is a rewritten section on children’s privacy:

21. Children’s Privacy

Our services are not directed to children under the age of 13. We do not intentionally collect personal information from children under 13. If you are under 13, do not use our services or provide us with any personal information. If we learn that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information as soon as possible. If you believe we may have collected information from a child under 13, please contact us immediately.

If you are a parent or guardian and you believe your child has provided personal information to us, please contact us to request deletion. Note that if we require parental consent for certain services in your jurisdiction and you provide consent for your child to use those services, we will collect and use their information as described in this privacy policy.