SPI Pharma Website Privacy Policy
Welcome to SPI Pharma
SPI Pharma is committed to ensuring that your privacy is protected and that we comply with all applicable data protection rules (including applicable marketing and cookies laws, together with associated guidance) (the "Data Protection Laws").
This policy explains how we collect, use, store and share the personal information we collect about you, how you can exercise your rights in respect of that information and the procedures that we have in place to safeguard your privacy. This policy supplements any other fair processing or privacy notice that may be provided to you from time to time. Please contact us if you have any questions, comments or concerns about this policy or how we handle your personal information, or if such information changes at any time. By using the website, you agree to the collection, use, and disclosure of your personal information as described in this Privacy Notice. If you do not agree, please do not use the Site.
This website (the "Website") is run by SPI Pharma, 503 Carr Rd, Suite 210, Wilmington, DE 19809 ("SPI Pharma", "we" and "us"). For the purpose of the Data Protection Laws, we are the controller of the personal information processed for the purposes set out below and we are responsible for looking after it.
When we refer to "processing" in this policy, we mean any activity concerning your personal information, including collecting, using, disclosing, deleting and anonymising.
Please note: this policy does not cover third party websites that we may link to from our Website, unless specifically mentioned in this policy. We are not responsible for the privacy policies and practices (including use of cookies) of such third parties even if you accessed the third party website using links from our Website. We recommend that you check the policy of each website you visit and contact the owner or operator of such website if you have concerns or questions.
Any changes to this policy in the future will be posted on this page and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to this policy.
The information we collect and how we use it
Under the Data Protection Laws, we are required to explain what information we collect from you and how and why we use your personal information (the "processing activity"). We are also required to have a "lawful basis" on which to process your personal information under the data protection laws applicable in certain countries. This is summarised in the table below.
|
Processing activity: Why we use your information? |
What information is collected? |
Lawful basis of processing (where applicable) |
Where is the information collected from? |
How long do we keep the information for? |
|
To notify you about changes to our terms or this policy. |
Names, email address and user account details. |
We process this information because it is necessary to comply with our legal obligations. |
Directly from you via our Website or when you otherwise correspond with us. |
We keep information relating to the management of your account for as long as your account or profile continues to be active. |
|
To send you newsletters, marketing emails, and messages via social media platforms. |
Name, phone number, email address, age, transaction history, geolocation, IP address, and any information we collect about your use of our Website or social media accounts. Unique personal identifiers (device identifiers; cookies, beacons, pixel tags, mobile ad identifiers, or other similar technology; customer number, unique pseudonym or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device) Please see Marketing and Promotional Materials below for further information. Where you have provided the appropriate consent, we also collect website interaction data (such as pages viewed and other interactions with our Website) through the Salesforce Interactions Web SDK, associated with a pseudonymous identifier stored in a first-party cookie and information relating to your tracking consent. |
We process this information only with your consent. Consent to website tracking through the Salesforce Interactions Web SDK is separate from your consent to receive marketing communications, and you may provide one without the other. |
Directly from you via our Website, where you otherwise contact us, or via third party social media platforms. |
We keep information for direct marketing purposes for as long as you continue to be interested in receiving our marketing communications, i.e., until you opt-out. Please refer to our Cookies Policy for further information regarding the use and duration of the cookies used. Website interaction data collected through the Salesforce Interactions Web SDK is stored in Salesforce Data Cloud and retained for no longer than is necessary for the purposes described above, in accordance with our configured Data Cloud retention settings. The related first-party cookie has a maximum lifetime of up to 400 days, which reflects the maximum cookie duration enforced by web browsers rather than a period set by Salesforce. |
|
To use data analytics to improve our Website, products, marketing, customer relationships and experiences. |
Information about your use of our Website, including: duration, frequency and time; pages you have visited, search terms, and use of our check-out process. Technical data, including: internet protocol (IP) address, login data, browser type and version, time zone setting and location, geolocation, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our Website. Unique personal identifiers (device identifiers; cookies, beacons, pixel tags, mobile ad identifiers, or other similar technology; customer number, unique pseudonym or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device) Where you have provided the appropriate consent, we also collect website interaction data (such as pages viewed and other interactions with our Website) through the Salesforce Interactions Web SDK, associated with a pseudonymous identifier stored in a first-party cookie and information relating to your tracking consent. |
We process this information on the basis of our legitimate interest of running our business, improving our Website for the benefit of you and other customers. We rely on your consent where the data is collected via a cookie (save for strictly necessary cookies). Consent to website tracking through the Salesforce Interactions Web SDK is separate from your consent to receive marketing communications, and you may provide one without the other. |
Directly from you when you visit our Website. |
We delete browsing data every 14 months. Please refer to our Cookies Policy for further information regarding the use and duration of the cookies used. Website interaction data collected through the Salesforce Interactions Web SDK is stored in Salesforce Data Cloud and retained for no longer than is necessary for the purposes described above, in accordance with our configured Data Cloud retention settings. The related first-party cookie has a maximum lifetime of up to 400 days, which reflects the maximum cookie duration enforced by web browsers rather than a period set by Salesforce. |
|
To help maintain the security of our Website, including troubleshooting, data analysis, testing, system maintenance, and support. |
Technical data, including: internet protocol (IP) address, geolocation, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our Website. |
As necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise). |
Directly from you when you visit our Website. |
We delete browsing data every 400 days. |
|
To respond to your job application or to queries or comments via the "Contact Us" and "Sample Request" forms on our Website or when you otherwise correspond with us. |
Name, email address, and any other information you supply to us when contacting with us. |
For our legitimate business interest in communicating with you in accordance with your wishes and expectations, and for providing good customer service. |
Directly from you via our Website or when you otherwise contact us. |
We maintain a record of routine queries indefinitely unless you ask us to remove them. |
Where we process your personal information on the legal basis of consent (as indicated in the above table), you may refuse consent to our processing and you may also withdraw your consent at any time: (i) in respect of cookies and other tracking mechanisms on our Website, by using the cookie consent manager in our cookie notification banner, (ii) in respect of marketing communications, by clicking 'unsubscribe' in the footer of the relevant emails, or (iii) in respect of other matters, by using the contact details below. This would not affect your ability to use any features of our Website. Withdrawing consent does neither affect any processing carried out without your consent (i.e. where we rely on another legal basis), nor the lawfulness of processing based on consent before its withdrawal.
Cookies
Some of the information identified in the table above, is collected by us through the use of cookies or similar technology when you visit our Website, or other websites or social media sites where we have included a cookie. In some cases, we will need your consent in order to place such cookies on your device. More information on the specific types of cookies we collect, our lawful basis and how to manage them can be found in our Cookies Policy.
Salesforce SDK
We also use the Salesforce Interactions Web SDK to support website interaction tracking. Where you have provided the appropriate consent, this technology uses a first-party cookie stored under our Website domain. The cookie contains a pseudonymous identifier that enables the same browser to be recognised across interactions and visits, together with information relating to the applicable tracking consent. The SDK uses this identifier when sending permitted website interaction data to Salesforce Data Cloud.
The Salesforce tracking technology is treated as non-essential and will only collect website activity where the appropriate consent has been provided through our cookie consent mechanism. Consent to website tracking is separate from consent to receive marketing communications. You may therefore permit website tracking without necessarily consenting to receive marketing emails or other marketing communications from us. You can manage your choices regarding non-essential cookies at any time through the cookie consent controls available on our Website.
Universal opt-out mechanisms
Our Website recognises the Global Privacy Control (“GPC”) signal. If you are using a browser setting or plug-in that sends an opt-out preference signal to each website you visit, we will treat that as a valid request to opt out of our sale and sharing of your personal information. To download and use a browser supporting the GPC browser signal, click here. If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use.
Some internet browsers incorporate a “Do Not Track” feature that signals to websites you visit that you do not want to have your online activity tracked. Given that there is not a uniform way that browsers communicate the “Do Not Track” signal, our Website does not currently interpret, respond to or alter its practices when it receives “Do Not Track” signals.
Marketing and Promotional Materials
We may use your information to provide you with marketing and promotional materials (as stated above). In such instances, we will use your information to deliver promotional information that you have requested, or that we feel may interest you (unless you have previously told us that you do not wish to receive marketing communications from us).
You may opt-out of receiving marketing and promotional materials from us at any time by emailing us at [email protected], using the 'unsubscribe' link in the marketing or promotional email, or Contact Us here any other available contact method. You may also update your preferences to receive marketing or promotional materials by visiting our Website.
Please see below, Sharing your Personal Information, for further information regarding the third parties we share your information with for marketing and advertising purposes.
Security
We have in place appropriate policies, rules and technical and organisational measures to protect your personal information from unauthorised or unlawful processing, and against accidental loss, destruction or damage.
We also have procedures in place to deal with any data security breach. We will notify you and any applicable regulator of a data security breach where we are legally required to do so.
However, the internet and email are not secure. Your communications may route through a number of countries before being delivered, may be intercepted by third parties and may not always reach the intended recipient – this is the nature of the World Wide Web/Internet. We cannot accept responsibility for any such unauthorised access or loss of personal information that is beyond our control.
You are responsible for protecting your username and password and must not share it with, or disclose it, to anyone.
Sharing your personal information
We will only disclose your personal information to:
- companies within our group for internal business purposes such as management, accounting and marketing;
- other third-party suppliers, including business partners and sub-contractors for business administration, support, processing, services, or IT purposes;
- our third-party logistics and delivery providers who deliver products to you on our behalf;
- analytics or search engines, that enable us to optimise and improve your experience of our Website;
- third-party suppliers for marketing and advertising purposes (including (but not limited to) those as set out below), and agents who (on our behalf) tailor our marketing communications and offer you products we believe you would be interested in, which may include cross-context behavioural advertising and/or targeted advertising;
- our regulators, law enforcement or fraud prevention agencies, as well as our legal advisers, courts, the police and any other authorised bodies, for the purposes of investigating any actual or suspected criminal activity or other regulatory or legal matters;
- our professional advisors (including without limitation tax, legal, insurance, or other corporate advisors who provide professional services to us); and
- regulators or other tax bodies or agencies to comply with our legal and regulatory obligations.
To the extent authorised by applicable laws, we will disclose your personal information to third parties:
- in the event that we consider selling or buying any business or assets, merging with another business, financing our business, granting a charge over our assets or leasing or licensing our assets, we may disclose your personal information to any prospective sellers or buyers of such business or assets;
- in the event we are the subject of any insolvency situation (e.g., the administration or liquidation);
- if we, or substantially all of our assets, are acquired by a third party, in which case personal information held by us about our customers will be one of the transferred assets;
- in order to enforce or apply our terms and conditions;
- to protect our rights, property, or safety, or that of our staff, our customers, or others. This includes exchanging information with other companies and organisations (including without limitation regulators, the local police or other local law enforcement agencies) for the purposes of staff and customer safety, crime prevention, fraud protection and credit risk reduction; and
- if we are under a duty to disclose or share your personal information in order to comply with any legal obligation or regulatory requirements, or otherwise for the prevention or detection of fraud or crime.
Salesforce
We use the Salesforce Interactions Web SDK and Salesforce Data Cloud to collect and analyse information about how visitors interact with our Website, where you have provided the appropriate consent. Permitted website interaction data, associated with a pseudonymous identifier, is sent to Salesforce Data Cloud, where it is processed on our behalf to help us understand engagement, improve our Website and marketing activities, develop audience segments and, where permitted and in accordance with your marketing preferences, deliver more relevant or personalised marketing communications. Salesforce processes this information as our service provider and in accordance with Salesforce's Privacy Statement.
The parties to which we may disclose your personal information may be located in countries outside of the United States, including the United Kingdom and countries within the European Economic Area.
International transfers of your personal information
We may transfer personal information to countries other than the country in which the data was originally collected (for example, outside the United States) in order to provide you with our products. These countries may not have the same data protection laws as the country in which you initially provided the information and may not provide the same level of protection. Your personal information may be subject to the laws of such foreign jurisdiction and may be accessible without notice to you by the courts, law enforcement and national security authorities of such foreign jurisdiction.
If we transfer personal information to countries outside of your usual place of residence, we will ensure (in accordance with applicable laws) an adequate degree of protection is afforded to your personal information in accordance with applicable data protection laws.
Your rights
Depending on the jurisdiction in which you reside, you may have certain privacy rights regarding the personal information we hold about you, including:
|
Right |
Description |
|
The right to confirmation of processing |
A right to receive confirmation as to whether or not we process any personal information about you. |
|
Of access |
A right to access the personal information we hold about you and obtain a copy of this in a portable and, to the extent technically feasible, readily usable format. |
|
To rectification |
A right to require us to rectify any inaccurate personal information we hold about you. |
|
To erasure |
A right to ask us to delete the personal information we hold about you. |
|
To complain |
A right to lodge a complaint with a supervisory authority, in particular in your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes applicable data protection laws. Please see below for further details. |
|
To opt out |
A right, if applicable, to opt out of the processing of your personal information for the following purposes:
|
|
To exercise your rights |
A right not to receive discriminatory treatment by us for the exercise of your privacy rights. |
We do not discriminate against you for exercising any of your rights.
To exercise your rights, please submit a request by emailing us at [email protected] or Contact Us here. If legally required, we will comply with your request upon verification of your identity and, to the extent applicable, the identity of the individual on whose behalf you are making such request. To do so, we will ask you to verify data points based on information we have in our records. If you are submitting a request on behalf of another individual, please use the same contact methods described above. If we refuse to take action regarding your request, you may appeal our decision by contacting us here.
We welcome your views about our Website and this policy. If you would like to contact us with any queries or comments, request further information or exercise any of your available rights set out above, please contact us.
If you would like this notice in another format (for example audio, large print, braille) please contact us using the details above.
We encourage you to contact us first if you have any queries, comments, complaints or concerns about the way we handle your personal information. We will take any privacy complaint seriously and any complaint will be assessed with the aim of resolving any issue in a timely and efficient manner. We request that you cooperate with us during this process and provide us with any relevant information that we may need.
However, if you are not satisfied with our handling of any request by you in relation to your rights or concerns, you may also have the right to make a complaint to the competent authority in the country in which you reside.
Notice to California Residents
The California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (“CCPA”), requires that we provide California residents with a privacy policy that contains a comprehensive description of our online and offline practices regarding the collection, use, disclosure, sale, sharing, and retention of personal information and of the rights of California residents regarding their personal information. This section of the Privacy Policy is intended solely for, and is applicable only as to, California residents. If you are not a California resident, this section does not apply to you and you should not rely on it.
The CCPA defines “personal information” to mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. Personal information does not include publicly available, deidentified or aggregated information or lawfully obtained, truthful information that is a matter of public concern.
Notice at Collection of Personal Information
We currently collect and in the 12 months prior to the last updated date of this policy, have collected the categories of personal information as described in the section “The information we collect and how we use it.”
We collect personal information directly from California residents.
In addition to the purposes stated above in “The information we collect and how we use it,” we currently collect and have collected the above categories of personal information for the following business or commercial purposes.
- Auditing related to unique visitors on the website, and auditing compliance with this specification and other standards;
- Helping to ensure security and integrity to the extent the use of your personal information is reasonably necessary and proportionate for these purposes;
- Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling order and transactions, verifying customer information, or providing similar services; and
- Advancing our commercial or economic interests, such as by inducing another person to buy, subscribe to, provide, or exchange products, goods, or enabling or effecting, directly or indirectly, a commercial transaction.
Sales, sharing, and disclosure of personal information
We shared your unique personal identifiers (device identifier; cookies, beacons, pixel tags, mobile ad identifiers, or other similar technology; customer number, unique pseudonym or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device) data analytics providers in the 12 months preceding the last updated date to advance our commercial and economic interests.
We disclosed your personal information to recipients for business purposes in the 12 months preceding the last updated date of this policy as set forth in the “Sharing your personal information” section above.
As a general matter, we do not knowingly collect, sell, or share personal information of consumers under 16 years of age. We do not use sensitive personal information for purposes other than those allowed by the CCPA and its regulations.
Retention of personal information
We retain your personal information for as long as necessary to fulfil the purposes for which we collect it and in accordance with the retention periods set forth in the “The information we collect and how we use it” section above.
Your rights
If you are a California resident, you have the following rights with respect to your personal information:
- The right to know what Personal Information we have collected about you, including the categories of personal information, the categories of sources from which we collected personal information, the business or commercial purpose for collecting, selling or sharing personal information (if applicable), the categories of third parties to whom we disclose personal information (if applicable), and the specific pieces of personal information we collected about you;
- The right to require us to delete personal information that we collected from you, subject to certain exceptions;
- The right to correct inaccurate personal information that we maintain about you;
- If we sell or share personal information, the right to opt out of the sale or sharing;
- If we use or disclose sensitive personal information for purposes other than those allowed by the CCPA and its regulations, the right to limit our use or disclosure; and
- The right not to receive discriminatory treatment by us for the exercise of privacy rights the CCPA confers.
How to submit a request to know, delete, and/or correct
You may submit a request to know, delete, and/or correct by contacting us here or by calling us toll free at 1-800-789-9755.
If you are submitting a request on behalf of a California resident, please submit the request through one of the designated methods set out above. After submitting the request, we will require additional information to verify your authority to act on behalf of the California resident.
Our process for verifying a request to know, delete, and/or correct
We will comply with your request upon verification of your identity and, to the extent applicable, the identity of the California resident on whose behalf you are making such request.
We verify your identity either to a “reasonable degree of certainty” or a “reasonably high degree of certainty” depending on the sensitivity of the personal information and the risk of harm to you by unauthorized disclosure, deleting, or correction as applicable. To do so, we will ask you to verify data points based on information we have in our records concerning you.
Last updated: 22nd October 2026