Lilly Third Party Provider Privacy Notice
Your privacy is important to us. This Notice will let you know what Personal Information (PI) the Lilly controllers or affiliates identified in the How to Contact Us section below (“Lilly” or “we”) may process (e.g., collect, record, organize, structure, store, adapt or alter, retrieve, consult, use, disclose by transmission, disseminate or otherwise make available, align or combine, restrict, erase or destroy), how we protect it, and your rights and choices with respect to your PI.
PI We Collect and How We Use It
The Lilly controllers or affiliates identified in the How to Contact Us section below may collect PI necessary for our business purposes, including:
Basic Personal Details (e.g., name, alias, signature)
Criminal/Conviction Records
Education & Skills (e.g., educational background, qualifications/certifications)
Employment Details (e.g., start and end date, job title/role, office location, previous work history)
Government Identifiers
Professional Contact Information (e.g., online identifiers (e.g., personal IP [Internet Protocol] address, email address, postal address, telephone number)
Professional Details (e.g., payment information, professional license number/status, professional memberships, reference/background checks)
Some of this PI may be considered Sensitive Personal Information (SPI) under applicable laws, such as information related to Government Identifiers and Financial Information. We may process your sensitive PI with your consent, or as otherwise permitted by law for the purposes provided in this notice.
We may de-identify certain information described above. To the extent we maintain and use de-identified information in its de-identified form, and do not re-identify such information except as permitted by law, this de-identified information is not PI and is not subject to this Notice.
Lilly and/or entities or persons that work on behalf of, or in partnership with, Lilly but are not Lilly employees (“Third Parties”), may process PI under the bases of your consent,
to perform a contract, or to pursue Lilly’s legitimate interest as part of its normal course of business, provided there are no overriding interests of the person for the following purposes:
Administration of our business processes
Responding to requests for information
Regulatory and legal compliance
Data analytics
To meet legal or regulatory obligations, inclusive of company record retention, that are in the legitimate interest of Lilly
We may share your PI with:
Business partners
Lilly employees and affiliates
Vendors, suppliers, and contractors
We also value your input about the quality of the services you receive and may also contact you to ask for your opinion.
You may choose not to share your PI, but we may not be able to:
Include you in future business opportunities via RFIs, RFPs, RFQs, auctions
Onboard you as a supplier, to provide goods or services to Lilly
Provide you with certain information, products or services
Reasons We Share PI
We may share your PI with the recipients listed above for purposes consistent with those identified in this notice. These Third Parties have agreed to protect the information and to process it as directed by us (if acting on our behalf) or as required by law.
We may also be required to disclose your information in response to lawful requests by public authorities, including to comply with national security or law enforcement requests.
Where We Transfer and Process Your PI
We may transmit your PI to other Lilly affiliates and Third Parties worldwide, which may in turn transmit your PI to other Lilly affiliates and/or Third Parties. These affiliates and/or Third Parties may be located in countries that do not ensure the same level of data protection but are required to treat PI in a manner consistent with this notice. To obtain additional information regarding the basis for transfers that Lilly has in place for cross-border transfers of PI, please contact us at privacy@lilly.com or visit https://www.lilly.com/privacy .
Eli Lilly Australia is bound by the Australian Privacy Principles contained within the Privacy Act 1988 (as amended from time to time).
Eli Lilly New Zealand is bound by the Privacy Act 1993 (as amended from time to time).
Eli Lilly Japan is bound by the Act on the Protection of Personal Information (Act No. 57 of May 30, 2003, as amended from time to time) and please visit https://www.lilly.co.jp/privacy .
We may also provide your PI to a Third Party in connection with the merger, sale, assignment, divestiture or other means of transfer of the business, in which case PI may be shared with, sold, transferred, rented, licensed or otherwise in connection with the contemplated transaction to the Third Party. We will require any such Third Party to agree to treat PI in accordance with this notice.
How Long We Keep PI
PI will be saved for the period of time needed to fulfill legitimate and lawful business purposes in accordance with Lilly’s records retention policies and applicable laws and regulations.
How We Secure PI
We provide reasonable physical, electronic and procedural safeguards to protect PI we process and maintain. We limit access to PI to authorized employees and Third Parties who need access to perform the business activities described in this notice. Although we strive to protect the PI we process and maintain, no security system can prevent all potential security breaches.
Your Rights and Choices
Upon verification of your identity, and as applicable by law, you have the right to:
Request:
information from us on how your PI is being processed, and with whom it is being shared;
to see and get a copy of the PI that we have about you;
that we correct, restrict the processing of, and/or erase/delete your PI;
to have your information transmitted to another entity or person in a machine-readable format, in limited circumstances;
a copy of the Standard Contractual Clauses (SCCs) and Appendix for European Economic Area, Swiss, and United Kingdom data transferred pursuant to SCCs.
Change or withdraw your consent at any time
Object to the processing of your PI;
Set expectations for the handling of your PI after your death
There may be exceptions that apply to your request. To exercise your rights, you or your authorized representative may submit a request to:
Additional entitlements:
For China: Upon your death, your next of kin may, for the sake of their own lawful, legitimate interests, exercise the rights to access, copy, correct, or delete your personal information, except where you have arranged otherwise before your death.
For US: You may be entitled, in accordance with applicable law, to appeal a refusal to take action on your request. To do so, please contact us by using one of the methods listed in the How to Contact Us section.
You will not be discriminated against for exercising your rights.
California Privacy Disclosures
California residents who have an established business relationship with Lilly may have the right to request information regarding Lilly’s disclosure of certain PI to Third Parties for their direct marketing purposes. To make a request for such information, you may contact us using the information in the “How to Contact Us” section below.
California law entitles California residents to certain rights with regard to their PI. Those rights have been incorporated into this Notice under “Your Rights and Choices” section above.
Sale and Sharing of Personal Information
Sensitive Personal Information
How to Contact Us
If you have any questions about this Notice, you may contact us from one of the resources listed in Annex 1 below.
For more information about Lilly’s privacy practice, please view the Privacy Statement at https://www.lilly.com/privacy.
How to Submit a Complaint
If you wish to raise a complaint on how we have handled your PI, and are located within the United States, United Kingdom, European Economic Area, Serbia, or Switzerland you can contact the Global Privacy Office and Data Protection Officer at privacy@lilly.com who will investigate the matter. All other countries should utilize the contacts in the Rights and Choices section above or the Annex 1 to identify the appropriate contact.
If you are not satisfied with our response or believe we are processing your PI out of accordance with the law, you can register a complaint with a relevant regulatory authority (e.g., a Data Protection Authority [DPA] or Attorney General).
Changes to our Privacy Practices
We may update this Notice from time to time.
