Privacy Policy
1. Introduction
EFBA ("we", "us" or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, transfer and safeguard personal data when you use our website efbapharma.pk and its enquiry and quote request forms.
We process personal data on the basis of your explicit consent and in line with the principles set out in this policy — a stated purpose, only the data we need, a fixed retention period, transparency about transfers, and your right to withdraw — together with any data protection law that applies to the processing.
2. Data Controller
The data controller responsible for your personal data is:
EFBA
Enquiries and data requests: contact form
Web: efbapharma.pk
3. Personal Data We Collect
3.1 Data You Provide in the Forms
- Contact details: full name, company or clinic name, country, telephone number and email address.
- Enquiry details: your area of interest, the message you write and, in the quote request form, your type of business, the IVIXIR products you select, your expected annual volume and your preferred next step.
- Which fields are required: fields marked with an asterisk are required for us to be able to answer you; your message, your product selection and your expected annual volume are optional.
- Consent record: the version of the consent text you agreed to and the time you submitted the form.
Please do not include patient information, health data or national identity (CNIC) numbers in your message. We do not need them and do not want them.
3.2 Data Collected Automatically
- Request source: the first page you visited, the referring site and the page a form was sent from, kept in your browser's sessionStorage for the current visit and sent with your enquiry so that we know how you found us.
- Technical data: IP address, browser type, device information and pages visited (server logs), used to operate and secure the Site.
4. Purpose of Processing
We use the data above only to respond to your enquiry or prepare your quotation, to assess a registration and distribution partnership, to contact you about it, and to keep a record of the enquiry. We do not use your data for marketing lists, profiling or automated decision-making, and we do not sell it.
5. Legal Basis: Your Explicit Consent
We process your personal data on the basis of your explicit consent, which you give separately by ticking the consent box in the form before sending it. The consent box is unticked by default and your enquiry cannot be sent without it. You may withdraw your consent at any time (see section 9).
6. Retention
Enquiry records are kept for 24 months after our last contact with you and are then deleted, unless a longer period is required by law. You may ask us to delete them earlier.
7. Storage, International Transfer and Recipients
The Site is hosted on our hosting provider's servers in Germany (European Union), and the record of each form you send is stored there. Each enquiry is also sent by email to EFBA's team outside Pakistan, where it is read and answered. When you submit a form, your personal data is therefore stored in Germany and transferred to EFBA's team outside Pakistan. This transfer is based on your explicit consent, which the consent text asks for separately when you tick the consent box.
Your data is accessed by EFBA's authorised team members who handle enquiries, including an internal tracking copy of each enquiry, and by the hosting and email service providers that process it on our behalf and on our instructions. We do not share your data with third parties for their own purposes.
8. Cookies and Browser Storage
The Site does not use cookies, analytics or tracking pixels. It keeps three small items in your browser, and nothing else:
- efba-hcp-ok (localStorage): records that you confirmed on the Catalogue page that you are a healthcare professional or licensed distributor, so that the question is not repeated.
- efba-quote-basket (localStorage): the products you added to your quote list.
- efba-src (sessionStorage): the request source described in section 3.2, for the current visit only.
These items stay in your browser unless you send a form, in which case the quote list and the request source are sent with it. You can clear them at any time in your browser settings. Web fonts are loaded from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so your browser transmits your IP address to Google whenever a page loads, independently of any form you send.
9. Your Rights
You have the right to:
- Access the personal data we hold about you and obtain a copy.
- Request correction of inaccurate or incomplete data.
- Request deletion of your data.
- Withdraw your consent at any time.
- Ask us to restrict or end the processing of your data.
To exercise any of these rights, send us a note through the contact form: choose "Other" as your area of interest, begin your message with "Data request" and state the name and email address you used. Withdrawing consent does not affect processing carried out before the withdrawal.
10. Security and Incidents
We protect personal data with appropriate technical and organisational measures. If a failure in the protection of personal data occurs that is likely to affect you, we will notify the affected individuals without undue delay.
11. Consent Text Versions
The consent text shown in each form has a version number, which we store with your enquiry. If the text changes materially, the version number changes and you will see the new text before your next submission.
12. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision.
13. Contact
For any privacy-related enquiries, please use the contact form.