Privacy & Cookie Policy

This page explains how EUMEDIQ AG and its subsidiaries EUMEDIQ GmbH and EUMEDIQ Ltd. collect, process, and store personal data and use cookies, in compliance with the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR), and the Swiss Federal Data Protection Act (nDSG). Where jurisdictions differ in their requirements, the stricter standard applies.

Effective date: 5th August 2026

Responsible body

EUMEDIQ AG
Mike Seidenberg
Grafenauweg 8
6300 Zug, Switzerland

Email: privacy@eumediq.eu
Website: www.eumediq.eu

Additional entities:

European Union
EUMEDIQ GmbH
DE-78739 Hardt, Germany

United Kingdom
EUMEDIQ Ltd.
GB-London N4 3FU, United Kingdom

Scope and applicable law

This privacy policy applies to all data processing activities carried out by EUMEDIQ AG (hereby referred to as "EUMEDIQ") and its subsidiaries EUMEDIQ GmbH and EUMEDIQ Ltd. in connection with www.eumediq.eu. EUMEDIQ processes personal data in compliance with the following legal frameworks:

In the European Union: Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and applicable national data protection laws.

In the United Kingdom: The UK General Data Protection Regulation (UK GDPR) as retained in UK law by the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018.

In Switzerland: The revised Swiss Federal Data Protection Act (nDSG) and the Swiss Data Protection Ordinance (DSV).

Where the requirements of these frameworks differ, EUMEDIQ applies the stricter standard as its default practice across all jurisdictions.

How we process your personal data

Personal data is any information relating to an identified or identifiable natural person. EUMEDIQ processes personal data only where a lawful basis exists under the applicable legal framework. Under GDPR and UK GDPR (Art. 6 GDPR / Art. 6 UK GDPR), the lawful bases we rely on are consent, performance of a contract, compliance with a legal obligation, protection of vital interests, and legitimate interests. Under the nDSG (Switzerland), we process personal data on equivalent lawful bases. Special categories of personal data (Art. 9 GDPR / Art. 9 UK GDPR) are only processed where an additional condition applies, such as explicit consent or a legal obligation under employment or social security law. We process personal data for the duration required for the stated purpose. Where longer retention is required by law, we restrict processing accordingly.

The specific legal basis for each processing activity carried out by EUMEDIQ is as follows:

Newsletter subscription
Purpose: Sending regulatory updates, compliance guidance, and expert content to subscribers.
Legal basis: Consent (Art. 6(1)(a) GDPR / UK GDPR). You may withdraw your consent at any time by using the unsubscribe link in any newsletter email or by contacting privacy@eumediq.eu.

Contact form enquiries
Purpose: Responding to enquiries submitted via the contact form at info@eumediq.eu.
Legal basis: Legitimate interests (Art. 6(1)(f) GDPR / UK GDPR) and, where the enquiry relates to a pre-contractual or contractual relationship, contract performance (Art. 6(1)(b) GDPR / UK GDPR).

Medical device complaint handling
Purpose: Fulfilling EUMEDIQ's Authorised Representative obligations under MDR 2017/745, IVDR 2017/746, MedDO, and UK MDR 2002, including maintaining a medical device complaint register.
Legal basis: Legal obligation (Art. 6(1)(c) GDPR / UK GDPR) and legitimate interests (Art. 6(1)(f) GDPR / UK GDPR).

Data subject requests
Purpose: Handling requests submitted via the data request form at privacy@eumediq.eu to exercise data subject rights under applicable data protection law.
Legal basis: Legal obligation (Art. 6(1)(c) GDPR / UK GDPR).

Website analytics
Purpose: Analysing website usage to measure and improve the performance of www.eumediq.eu using Google Analytics and Wix Analytics.
Legal basis: Consent (Art. 6(1)(a) GDPR / UK GDPR) where cookies are used, and legitimate interests (Art. 6(1)(f) GDPR / UK GDPR) where analytics are cookie-free.

Google Ads
Purpose: Conversion tracking and interest-based advertising via Google Ads through Wix.
Legal basis: Consent (Art. 6(1)(a) GDPR / UK GDPR).

Agency and contractual services
Purpose: Providing regulatory affairs, authorised representation, consulting, auditing, import, and CSV services to clients and processing client data as necessary for the performance of those services.
Legal basis: Contract performance (Art. 6(1)(b) GDPR / UK GDPR) and legitimate interests (Art. 6(1)(f) GDPR / UK GDPR).

Administrative processing
Purpose: Financial accounting, office organisation, contact management, compliance with legal obligations, and archiving.
Legal basis: Legal obligation (Art. 6(1)(c) GDPR / UK GDPR) and legitimate interests (Art. 6(1)(f) GDPR / UK GDPR).

LinkedIn marketing
Purpose: Analysing website usage and serving targeted advertisements via LinkedIn marketing services.
Legal basis: Consent (Art. 6(1)(a) GDPR / UK GDPR).

Security measures

EUMEDIQ implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration, in accordance with Art. 32 GDPR, Art. 32 UK GDPR, and Art. 8 nDSG. Measures include physical and electronic access controls, encrypted data transmission via SSL/TLS, and regular review of security practices. All staff with access to personal data are subject to confidentiality obligations.

Transmission of personal data

Personal data may be transferred to third parties where necessary for the performance of a contract, compliance with a legal obligation, or our legitimate interests. Recipients may include IT service providers, analytics providers, email marketing platforms, and regulatory authorities.

Data processing in third countries

Where personal data is transferred outside the European Union, United Kingdom, or Switzerland to a third country, EUMEDIQ ensures that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission (for EU transfers), International Data Transfer Agreements (IDTAs) or SCCs with UK addendum (for UK transfers), and adequacy decisions or equivalent safeguards under the nDSG (for Swiss transfers).

Within the EUMEDIQ group, personal data may be shared between EUMEDIQ AG, EUMEDIQ GmbH, and EUMEDIQ Ltd. as necessary for the performance of services, internal administration, and compliance with legal obligations. Where such intra-group transfers involve the transfer of personal data between jurisdictions, they are carried out on the basis of intra-group data sharing arrangements that ensure an equivalent level of data protection across all three entities, in accordance with Art. 46 GDPR / UK GDPR and the applicable requirements of the nDSG.

Transfers to the United States are made only where the recipient participates in the EU-US Data Privacy Framework (DPF) or where SCCs or equivalent contractual safeguards apply. Further information on the safeguards applicable to any specific transfer is available on request from privacy@eumediq.eu.

SSL/TLS encryption

This website uses SSL/TLS encryption for all data transmissions. An encrypted connection is indicated by "https://" in the browser address bar and a padlock symbol. Data transmitted via an encrypted connection cannot be intercepted by third parties.

Server log files

The hosting provider of this website automatically collects and stores information in server log files, including browser type and version, operating system, referrer URL, hostname of the accessing device, and time of the server request. This data is not merged with other data sources and cannot be assigned to specific individuals. It is used solely for security and operational purposes.

Forms and data flows

EUMEDIQ operates the following forms on www.eumediq.eu, each with a defined data flow:

Contact form: Data submitted via the contact form is sent to info@eumediq.eu and processed for the purpose of responding to your enquiry. The legal basis is legitimate interests (Art. 6(1)(f) GDPR / UK GDPR). Enquiries submitted via the contact form are stored for the purpose of processing your enquiry and any follow-up questions. Data is not passed on to third parties without your consent. Data is retained for as long as necessary to respond to your enquiry and for any applicable retention period under applicable law.

Medical device complaint form: Data submitted via the complaint form is sent to complaint@eumediq.eu and processed for the purpose of handling the complaint in accordance with applicable regulatory requirements. The legal basis is legal obligation (Art. 6(1)(c) GDPR / UK GDPR). Complaints submitted via the medical device complaint form are processed for the purpose of fulfilling EUMEDIQ's Authorised Representative obligations under applicable medical device regulations, including MDR 2017/745, IVDR 2017/746, MedDO, and UK MDR 2002. Data submitted is sent to complaint@eumediq.eu and retained for as long as required by applicable regulatory requirements.

Data request form: Data submitted via the data request form is sent to privacy@eumediq.eu and processed for the purpose of fulfilling your data subject rights request. The legal basis is legal obligation (Art. 6(1)(c) GDPR / UK GDPR).

Newsletter subscription form: Data submitted via the newsletter subscription form is processed by Mailchimp (The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA), linked to marketing@eumediq.eu. Mailchimp transfers data to the United States under Standard Contractual Clauses. The legal basis is consent (Art. 6(1)(a) GDPR / UK GDPR). You may withdraw your consent and unsubscribe at any time using the unsubscribe link in any newsletter email or by contacting privacy@eumediq.eu.

Third party services

This website may use the following third party services, which may involve the transfer of data to the service provider:

Google Invisible reCAPTCHA: For protection against bots and spam. Data is transferred to Google LLC (USA) under Standard Contractual Clauses. Further information on Google's data processing practices is available at https://policies.google.com/privacy.

Analytics

This website uses Google Analytics and Wix Analytics to analyse website usage and improve our online offering.

Google Analytics is provided by Google Ireland Limited (for EU users) and Google LLC (for users outside the EEA or Switzerland). Google Analytics uses cookies to collect information about your use of the website. IP addresses are anonymised using the "_anonymizeIp();" function. The legal basis for the use of Google Analytics is consent (Art. 6(1)(a) GDPR / UK GDPR), obtained via our cookie consent tool. You can opt out of Google Analytics tracking by downloading the Google Analytics opt-out browser plugin at https://tools.google.com/dlpage/gaoptout. Wix Analytics is provided by Wix.com Ltd. and collects anonymised usage data to help us understand how visitors interact with our website. The legal basis for Wix Analytics is consent (Art. 6(1)(a) GDPR / UK GDPR) where cookies are used, and legitimate interests where analytics are cookie-free.

Google Ads

This website uses Google Ads conversion tracking via Wix. Where you have reached our website via a Google ad, Google Ads may set a cookie on your device. Conversion tracking cookies expire after 30 days and are not used for personal identification. The legal basis for Google Ads is consent (Art. 6(1)(a) GDPR / UK GDPR), obtained via our cookie consent tool. You can opt out of interest-based advertising at https://adssettings.google.com.

Mailchimp

Where you have subscribed to the EUMEDIQ newsletter, your data is processed by Mailchimp (The Rocket Science Group LLC, USA) under Standard Contractual Clauses. Mailchimp acts as a data processor on our behalf. Data processed includes your email address. You may withdraw your consent and unsubscribe at any time. Further information on Mailchimp's data processing practices is available at https://mailchimp.com/legal/privacy/.

Agency services

EUMEDIQ processes client data in accordance with the nDSG, EU GDPR, and UK GDPR within the scope of its contractual services as a regulatory affairs and medical device consulting service provider. Data processed in the context of agency services may include inventory data such as names and addresses, contact data such as email addresses and telephone numbers, content data such as regulatory documentation and correspondence, contract data such as subject matter and term, and usage and metadata in the context of evaluating the performance of regulatory services.

Data subjects include our clients, interested parties, and their employees and representatives. The purpose of processing is the provision of contractual regulatory affairs services, billing, and client service. The legal basis is Art. 6(1)(b) GDPR / UK GDPR (contract performance) and Art. 6(1)(f) GDPR / UK GDPR (legitimate interests).

We process only the data necessary for the performance of our services and disclose data to third parties only where necessary in the context of an engagement. When processing data provided by clients within the scope of an engagement, we act in accordance with the client's instructions and the legal requirements for commissioned processing pursuant to Art. 28 GDPR / Art. 28 UK GDPR.

Data is deleted after the expiry of applicable legal warranty and retention obligations. In the case of data provided by the client within the scope of an engagement, data is deleted in accordance with the specifications of the engagement, generally after its conclusion.

Contractual services

EUMEDIQ processes data of its contractual and business partners, including clients and interested parties, in the context of contractual and comparable legal relationships and related measures. We process this data to fulfil our contractual obligations, to secure our rights, and for the purposes of the administrative tasks associated with this information. Within the framework of applicable law, we disclose contractual partner data to third parties only to the extent necessary for the fulfilment of legal obligations or with the consent of the individuals concerned.

Data is deleted after the expiry of legal warranty and comparable obligations, generally after four years, unless the data must be retained for legal archiving purposes, for example for tax purposes for generally ten years.

Analyses and market research: For business planning purposes, EUMEDIQ may analyse data relating to business transactions, contracts, and enquiries to identify market trends and client requirements. Such analyses are conducted for internal purposes only and are not disclosed externally, except in anonymised and aggregated form.

Administration, financial accounting, office organisation, and contact management

EUMEDIQ processes personal data in the context of its administrative operations, financial accounting, and compliance with legal obligations such as archiving requirements, in accordance with the nDSG, EU GDPR, and UK GDPR. The legal basis is Art. 6(1)(c) GDPR / UK GDPR (legal obligation) and Art. 6(1)(f) GDPR / UK GDPR (legitimate interests).

Data processed in this context includes contact details of suppliers, service providers, and business partners stored for the purpose of ongoing business communication and relationship management. In this context, data may be disclosed to tax advisors, auditors, and other professional advisors as required.

COOKIE POLICY

General Information

This Cookie Policy explains how EUMEDIQ AG and its subsidiaries EUMEDIQ GmbH and EUMEDIQ Ltd. use cookies and similar technologies on www.eumediq.eu. This policy applies across the EU, UK, and Switzerland and complies with the EU ePrivacy Directive, the UK Privacy and Electronic Communications Regulations (PECR), and the Swiss nDSG. For information on how we handle your personal data more broadly, please refer to the Privacy Policy section above.

What are cookies

Cookies are small text files stored on your device by your browser when you visit a website. They are used to store information about your visit, such as language preferences, login status, or browsing behaviour. The term cookie also covers similar technologies such as pixel tags, web beacons, and local storage identifiers.

Types of cookies we use

Strictly necessary cookies

These cookies are essential for the website to function and cannot be switched off. They are set in response to actions you take, such as setting privacy preferences, logging in, or completing forms. No consent is required for strictly necessary cookies.

Analytics cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our website. We use Google Analytics and Wix Analytics for this purpose. All analytics cookies require your consent under EU GDPR and UK PECR.

Marketing cookies

These cookies are set by our advertising partners, including Google Ads via Wix, to build a profile of your interests and show you relevant advertisements on other sites. All marketing cookies require your consent under EU GDPR and UK PECR.

Functional cookies

These cookies enable enhanced functionality and personalisation, such as remembering your preferences. They may be set by us or by third-party providers whose services we use on our pages.

Legal basis for cookies

Under EU GDPR and UK PECR, we require your consent before placing any non-essential cookies on your device. Strictly necessary cookies do not require consent. Consent is obtained via our cookie consent tool when you first visit www.eumediq.eu. You may change your preferences at any time. Under the Swiss nDSG, equivalent requirements apply for cookies that process personal data. EUMEDIQ applies the EU and UK standard as its default across all jurisdictions.

Storage period

Session cookies are deleted when you close your browser. Permanent cookies remain stored until they expire or you delete them. Where we do not provide explicit information on the storage period of a specific cookie, the maximum storage period is two years.

Processing of cookie data on the basis of consent

We use a cookie consent management procedure through which your consent to the use of non-essential cookies can be obtained, managed, and revoked. The declaration of consent is stored to avoid repeating the consent request and to demonstrate compliance with applicable law. Consent is stored on the server side and/or in a cookie and assigned to your device. The duration of stored consent is up to two years. A pseudonymous user identifier is created and stored with the time of consent, the scope of consent, and information about the browser, system, and device used.

Types of data processed: Usage data (e.g. pages visited, time of access), technical data (e.g. device information, IP addresses).

Data subjects: Website visitors and users of online services.

Legal basis: Consent (Art. 6(1)(a) GDPR / UK GDPR), Legitimate Interests (Art. 6(1)(f) GDPR / UK GDPR).

Managing and withdrawing consent

You may withdraw or change your cookie consent at any time by accessing our cookie settings via the cookie consent tool on www.eumediq.eu. You may also manage cookies through your browser settings by blocking or deleting cookies, though this may affect the functionality of the website.

Third-party cookies

The following third-party services set cookies on www.eumediq.eu:

Google Analytics
Provider: Google Ireland Limited / Google LLC
Purpose: Website analytics and performance measurement
Legal basis: Consent
More information: https://policies.google.com/privacy

Wix Analytics
Provider: Wix.com Ltd.
Purpose: Website analytics and performance measurement
Legal basis: Consent / Legitimate interests (where cookie-free)
More information: https://www.wix.com/about/privacy

Google Ads
Provider: Google Ireland Limited / Google LLC
Purpose: Conversion tracking and interest-based advertising
Legal basis: Consent
More information: https://policies.google.com/privacy

Google Remarketing

This website uses the Google Remarketing function to present interest-based advertisements to website visitors across the Google advertising network. A cookie is stored in your browser to recognise you when you visit other websites in the Google network. You may opt out of Google Remarketing at http://www.google.com/settings/ads or via the Network Advertising Initiative opt-out at http://www.networkadvertising.org/managing/opt_out.asp.

Google Tag Manager

This website uses Google Tag Manager to manage tracking tags. Google Tag Manager itself does not process personal data but enables the deployment of other tools, such as Google Analytics and Google Ads, which may set cookies subject to your consent.

We use LinkedIn marketing services within our online offer, which may set cookies to analyse website usage and serve targeted advertisements. Data is transferred to LinkedIn Ireland Unlimited Company (Dublin, Ireland) under applicable data transfer safeguards. You may opt out of LinkedIn tracking at https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. The legal basis is consent (Art. 6(1)(a) GDPR / UK GDPR).

RIGHTS OF DATA SUBJECTS

Right to confirmation

Every data subject has the right to request confirmation from the website operator as to whether personal data concerning him or her are being processed. If you wish to exercise this right of confirmation, you may contact the Data Protection Officer at any time.

Right of access

Every person affected by the processing of personal data has the right to receive information free of charge from the operator of this website about the personal data stored about him or her and a copy of this information. Furthermore, information may be provided on the following, if applicable:

the purposes of processing
the categories of personal data processed
the recipients to whom the personal data have been or will be disclosed
if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration
the existence of the right to obtain the rectification or erasure of personal data concerning him or her, or the restriction of - processing by the controller, or the right to object to such processing
the existence of a right of appeal to a supervisory authority
if the personal data are not collected from the data subject: Any available information on the origin of the data.

Furthermore, the data subject has the right to be informed whether personal data have been transferred to a third country or to an international organisation. If this is the case, the data subject also has the right to obtain information on the appropriate safeguards in connection with the transfer. If you would like to make use of this right to information, you can contact our data protection officer at any time.

Right of rectification

Every person affected by the processing of personal data has the right to demand the immediate rectification of any inaccurate personal data concerning him or her. Furthermore, the data subject has the right to request that incomplete personal data be completed, including by means of a supplementary declaration, taking into account the purposes of the processing.

If you would like to make use of this right of rectification, you can contact our data protection officer at any time.

Right to erasure (right to be forgotten)

Any person affected by the processing of personal data has the right to obtain from the controller of this website the erasure without delay of personal data concerning him or her, where one of the following grounds applies and insofar as the processing is not necessary:

The personal data have been collected or otherwise processed for such purposes for which they are no longer necessary.
The data subject withdraws his or her consent on which the processing was based and there is no other legal basis for the processing
The data subject objects to the processing on grounds relating to his or her particular situation and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing in the case of direct marketing and related profiling
The personal data have been processed unlawfully
The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject
The personal data has been collected in relation to information society services provided directly to a child

If one of the above reasons applies and you wish to arrange for the deletion of personal data stored by the operator of this website, you can contact our data protection officer at any time. The data protection officer of this website will arrange for the deletion request to be complied with immediately.

Right to restriction of processing

Any person concerned by the processing of personal data has the right to obtain from the controller of this website the restriction of processing if one of the following conditions is met:

The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data
The processing is unlawful, the data subject objects to the erasure of the personal data and requests instead the restriction of the use of the personal data
The controller no longer needs the personal data for the purposes of the processing, but the data subject needs it to assert, exercise or defend legal claims
The data subject has objected to the processing on grounds relating to his or her particular situation, and it is not yet clear whether the legitimate interests of the controller override those of the data subject

If one of the aforementioned conditions is met, you can request the restriction of personal data stored by the operator of this website at any time by contacting our data protection officer. The data protection officer of this website will arrange the restriction of the processing.

Right to data portability

Every person affected by the processing of personal data has the right to receive the personal data concerning him or her in a structured, common and machine-readable format. He or she also has the right to have this data transferred to another controller if the legal requirements are met. Furthermore, the data subject has the right to obtain that the personal data be transferred directly from one controller to another controller, insofar as this is technically feasible and provided that the rights and freedoms of other persons are not affected thereby. To assert the right to data portability, you may at any time contact the data protection officer appointed by the operator of this website.

Right of objection

Any person concerned by the processing of personal data has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her. The operator of this website shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or if the processing serves the assertion, exercise or defence of legal claims. To exercise the right to object, you may directly contact the Data Protection Officer of this website.

Right to withdraw consent under data protection law

Every person affected by the processing of personal data has the right to revoke a given consent to the processing of personal data at any time. If you wish to exercise your right to withdraw consent, you can contact our data protection officer at any time.

DATA PROTECTION

Data protection declaration for objection advertising e-mails

We hereby object to the use of contact data published within the scope of the imprint obligation to send advertising and information material that has not been expressly requested. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example by spam e-mails.

GENERAL DISCLAIMER

All information on our website has been carefully checked. We make every effort to ensure that the information we provide is up-to-date, correct and complete. Nevertheless, the occurrence of errors cannot be completely ruled out, which means that we cannot guarantee the completeness, correctness and up-to-dateness of information, including journalistic and editorial information. Liability claims regarding damage caused by the use of any information provided, including any kind of information which is incomplete or incorrect, will therefore be rejected. The publisher may change or delete texts at his own discretion and without notice and is not obliged to update the contents of this website. Use of or access to this website is at the visitor’s own risk. The publisher, its principals or partners are not responsible for damages, such as direct, indirect, incidental, consequential or punitive damages, allegedly caused by the use of this website and consequently assume no liability for such damages.

The publisher also accepts no responsibility or liability for the content and availability of third-party websites that can be accessed via external links on this website. The operators of the linked sites are solely responsible for their content. The publisher thus expressly distances itself from all third-party content that may be relevant under criminal or liability law or that may offend common decency.

Copyrights

The copyright and all other rights to the content, images, photos or other files on the website belong exclusively to the operator of this website or to the specifically named rights holders. The written consent of the copyright holder must be obtained in advance for the reproduction of any files. Anyone who commits a copyright infringement without the consent of the respective copyright holder may be liable to prosecution and possibly to damages.

Changes

We may amend this data protection declaration at any time without prior notice. The current version published on our website shall apply. Insofar as the data protection declaration is part of an agreement with you, we will inform you of the change by e-mail or other suitable means in the event of an update.

Questions to the data protection officer

If you have any questions about data protection, please write to us by e-mail or contact the data protection officer in our organisation listed at the beginning of this privacy statement directly.

Source: SwissAnwalt