Privacy Policy
Last updated: September 2026
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection laws is:
ROBUGEN GmbH & Co. KG Pharmazeutische FabrikAlleenstraße 2273730 Esslingen am NeckarGermany
Phone: +49 (0) 711 136300
E-mail: info@robugen.de
Website: www.robugen.de
2. Data Protection Officer
You can reach our Data Protection Officer at:
ROBUGEN GmbH & Co. KG
Data Protection Officer Alleenstraße 2273730 Esslingen am Neckar
Germany E-mail: datenschutz@robugen.de
You may contact our Data Protection Officer directly at any time with any questions or suggestions regarding data protection.
3. General Information
3.1 Scope of the processing of personal data
We process personal data of our users only to the extent necessary to provide a functional website and our content. Personal data is generally processed only with the consent of the data subject. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing is permitted by law.
3.2 Legal bases for processing
Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis. For the use of cookies and similar technologies that are not technically necessary, Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) additionally serves as the legal basis.
For the processing of personal data required for the performance of a contract or for pre-contractual measures, Art. 6(1)(b) GDPR serves as the legal basis.
Where the processing of personal data is necessary to comply with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
If processing is necessary to protect a legitimate interest of our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis. For technically necessary cookies and storage operations, Section 25(2) No. 2 TDDDG additionally applies.
3.3 Data erasure and storage period
The personal data of the data subject will be erased or blocked as soon as the purpose of storage no longer applies. Data may also be stored beyond this where provided for by European or national legislation in EU regulations, laws or other provisions to which we are subject (e.g. retention periods of 6 or 8 years under commercial and tax law). Data will also be blocked or erased when a retention period prescribed by the aforementioned provisions expires, unless further storage is necessary for the conclusion or performance of a contract.
3.4 Data transfers to third countries
Some of the service providers named in this privacy policy are based in the USA or process data in the USA. Please note that, according to the Court of Justice of the European Union, transfers to the USA do not currently guarantee a level of data protection fully equivalent to that in the EU without additional safeguards.
Transfers are based on an adequacy decision of the European Commission pursuant to Art. 45 GDPR (EU-US Data Privacy Framework, "DPF") where the respective provider is certified under the DPF. In addition, we conclude the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR with the providers. Where processing is based on your consent, the transfer is additionally based on Art. 49(1)(a) GDPR. You can withdraw your consent at any time via the cookie settings (see Section 6).
A list of companies certified under the DPF is available at: https://www.dataprivacyframework.gov/list
4. Provision of the Website, Hosting and Server Log Files
4.1 Hosting by Webflow
This website is hosted on the servers of Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA ("Webflow"). All content of the website, including images, videos and other media files, is delivered via Webflow's Content Delivery Network (CDN). When you access our website, a connection to the servers of Webflow or its sub-processors (including Amazon Web Services and Fastly) is therefore established automatically.
We have concluded a Data Processing Agreement with Webflow pursuant to Art. 28 GDPR. Webflow is certified under the EU-US Data Privacy Framework; the European Commission's Standard Contractual Clauses apply in addition.
Further information can be found in Webflow's privacy policy: https://webflow.com/legal/privacy
4.2 Description and scope of data processing
Each time our website is accessed, our system or the hosting provider automatically collects data and information from the computer system of the accessing device. The following data is collected:
- IP address of the user
- Date and time of access
- Page or file accessed
- Amount of data transferred and access status
- Website from which access was made (referrer URL)
- Browser used, browser version and language
- Operating system and device type
This data is stored in the system's log files. This data is not stored together with other personal data of the user.
4.3 Legal basis and purpose
The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free presentation, optimisation and security of our website. The temporary storage of the IP address is necessary to enable delivery of the website to the user's device. Storage in log files serves to ensure the functionality of the website, to optimise the website and to ensure the security of our IT systems.
4.4 Storage period
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. For data stored in log files, this is generally the case after no more than 30 days.
4.5 Objection and removal options
The collection of data for the provision of the website and the storage of data in log files is strictly necessary for the operation of the website. Consequently, there is no possibility for the user to object.
4.6 SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the address bar of your browser shows "https://" and by the padlock symbol in your browser bar. When encryption is activated, the data you transmit to us cannot readily be read by third parties.
5. Contact by E-mail, Telephone or Post
5.1 Description and scope of data processing
Our e-mail address, telephone number and postal address are provided on our website. If you contact us via one of these channels, the personal data you transmit (e.g. name, contact details, content of your enquiry) will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. This data will not be passed on to third parties unless this is necessary to process your enquiry (e.g. to partner companies involved in handling your request) or you have expressly consented to this.
5.2 Note on enquiries relating to health
If you send us enquiries about our medicinal products or your personal use of them, this information may contain health data within the meaning of Art. 9 GDPR. We process such data exclusively to respond to your enquiry, on the basis of the consent you have given by contacting us (Art. 9(2)(a) GDPR). Please only send us health data that is necessary to answer your enquiry.
5.3 Reporting of adverse reactions (pharmacovigilance)
As a pharmaceutical company, we are legally obliged to record and document reports of adverse reactions to our medicinal products and to forward them to the competent authorities (e.g. the Federal Institute for Drugs and Medical Devices, BfArM). If you report an adverse reaction to us or such a report is contained in your enquiry, we process the data required for this purpose (including health data) on the basis of Art. 6(1)(c) and Art. 9(2)(i) GDPR in conjunction with Section 63c of the German Medicinal Products Act (AMG) and the European pharmacovigilance regulations. This data is subject to special statutory retention obligations and is kept for the duration of the marketing authorisation of the medicinal product and for at least 10 years after its expiry.
5.4 Legal basis
The legal basis for processing the data is Art. 6(1)(a) GDPR where consent has been given. If contact is made in connection with the initiation or performance of a contract, the legal basis is Art. 6(1)(b) GDPR. Otherwise, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in responding to your enquiry.
5.5 Storage period
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected, i.e. when the respective conversation has ended and the matter has been conclusively resolved. Statutory retention obligations (in particular in the area of pharmacovigilance and under commercial and tax law) remain unaffected.
5.6 Objection and removal options
You may withdraw your consent to the processing of personal data or object to the processing at any time. To do so, please contact info@robugen.de or our Data Protection Officer. In this case, all personal data stored in the course of contacting us will be erased, unless statutory retention obligations prevent this.
6. Cookies and Consent Management (Cookiebot)
6.1 General information on cookies
Our website uses cookies and similar technologies (e.g. local storage, pixels, tags). Cookies are small text files that are stored on your device and saved by your browser. Some cookies are technically necessary to make the website functional. Other cookies are used to analyse user behaviour or for marketing purposes and are only set with your consent.
We use technically necessary cookies on the basis of Art. 6(1)(f) GDPR and Section 25(2) No. 2 TDDDG. All other cookies are used exclusively with your consent on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
6.2 Consent management with Cookiebot
To obtain and manage your consent, we use the consent management platform "Cookiebot" provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark ("Cookiebot").
When you access our website, a cookie banner is displayed through which you can give or refuse consent to the use of non-essential cookies. Cookiebot stores your decision in a cookie ("CookieConsent") on your device so that the consent request does not appear on every page view. The following data is processed:
- Your anonymised IP address (the last three digits are set to "0")
- Date and time of your consent
- Browser information (user agent)
- URL of the page on which consent was given
- An anonymous, random and encrypted key
- Your consent status
The anonymous key and the consent status are stored in a log at Cookiebot for 12 months as proof of consent. The "CookieConsent" cookie has a lifetime of 12 months.
The legal basis for the use of Cookiebot is Art. 6(1)(c) GDPR (fulfilment of our legal obligation to obtain and demonstrate consent, Art. 7(1) GDPR) and Art. 6(1)(f) GDPR. Setting the consent cookie is technically necessary within the meaning of Section 25(2) No. 2 TDDDG.
We have concluded a data processing agreement with Usercentrics A/S pursuant to Art. 28 GDPR. Further information: https://www.cookiebot.com/en/privacy-policy/
6.3 Changing or withdrawing your consent
You can change or withdraw your consent at any time with effect for the future. To do so, click the cookie setting banner on the bottom left.
6.4 Overview of cookies used
An up-to-date overview of all cookies used on this website, including provider, purpose and storage period, can be found in the automatically generated cookie declaration.
7. Google Tag Manager
We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Tag Manager is a tool that allows us to manage and integrate so-called tags (small code elements) on our website, in particular the tags for Google Analytics and Google Ads.
Tag Manager itself does not set cookies and does not collect personal data for its own purposes. However, when Tag Manager is loaded, your IP address is technically transmitted to Google. Tag Manager also ensures that the integrated tags are only triggered once you have given your consent for the respective category via Cookiebot (Google Consent Mode v2). As long as no consent has been given, no cookies are set and no analytics or marketing data is transmitted to Google.
The legal basis for the use of Google Tag Manager is Art. 6(1)(f) GDPR. Our legitimate interest lies in the simple and centralised management of the services used on our website. Where the services integrated via Tag Manager require consent, the legal basis is the consent given pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
Further information: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/ and https://policies.google.com/privacy
8. Google Analytics 4
8.1 Description and scope of data processing
This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics enables us to analyse user behaviour on our website.
Google Analytics uses cookies and similar technologies that enable an analysis of your use of the website. The information generated about your use of this website is generally transmitted to and stored on a Google server. In particular, the following data may be processed:
- Pages visited, time spent on the site, bounce rate
- Clicks, scrolling behaviour, downloads and other interactions (events)
- Approximate location (region, derived from the truncated IP address)
- Device type, operating system, browser, screen resolution
- Origin of the visit (referrer, campaign parameters)
- A pseudonymous user ID (client ID)
In Google Analytics 4, IP address anonymisation is activated by default. Your IP address is truncated by Google within the European Union or the European Economic Area before it is stored. The full IP address is not stored.
We have also activated the "Google Signals" function. This allows Google, provided you have consented to ad personalisation in your Google account, to record your usage across devices and to provide us with aggregated demographic reports (age, gender, interests). We do not receive any data from this that would enable us to identify individual persons.
On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide us with other services relating to website and internet usage.
8.2 Legal basis
Google Analytics is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you give via our cookie banner. Without your consent, no analytics cookies are set and no data is transmitted to Google Analytics. You can withdraw your consent at any time via the cookie settings (Section 6.3).
8.3 Data processing agreement and transfer to third countries
We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR (Google Ads Data Processing Terms). When using Google Analytics, data may be transferred to servers of Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. The European Commission's Standard Contractual Clauses apply in addition. Further information can be found in Section 3.4.
8.4 Storage period
User- and event-level data stored in Google Analytics is automatically deleted after 14 months. Aggregated reports without personal reference remain unaffected. The cookies set by Google Analytics have a lifetime of up to 2 years (_ga) or 24 hours (ga*, session cookie).
8.5 Further information
Google privacy policy: https://policies.google.com/privacyGoogle Analytics terms of service: https://marketingplatform.google.com/about/analytics/terms/gb/Information on how Google uses data: https://policies.google.com/technologies/partner-sites
Independently of our cookie banner, you can also prevent the collection of your data by Google Analytics on the browser side by installing the Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout?hl=en
9. Google Ads (Conversion Tracking and Remarketing)
9.1 Description and scope of data processing
We use the online advertising programme "Google Ads" provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Ads enables us to place advertisements in Google Search and the Google advertising network. Within Google Ads, we use the following functions:
Conversion tracking: If you reach our website via an advertisement placed by Google, Google sets a conversion cookie on your device. This cookie expires after 30 days and is not used for personal identification. If you visit certain pages of our website and the cookie has not yet expired, we and Google can recognise that you clicked on the advertisement and were redirected to that page. Each Google Ads customer receives a different cookie; cookies therefore cannot be tracked across the websites of different Ads customers. We only receive statistical evaluations from Google (e.g. the total number of users who clicked on an advertisement), but no information that would allow users to be personally identified.
Enhanced Conversions: Where you provide us with contact details in the course of an interaction, these may be transmitted to Google in hashed (encrypted) form to attribute conversions more accurately. Google cannot convert these hashed data back into plain text; matching takes place exclusively against equally hashed data of Google users.
Remarketing: The remarketing function allows us to show interest-based advertisements to users who have already visited our website on other websites within the Google advertising network (e.g. in Google Search, on YouTube or on partner websites). For this purpose, a cookie is set during your visit that recognises your browser. If you have consented to cross-device ad personalisation in your Google account, Google may also attribute your usage across multiple devices.
The following data may be processed as part of these functions: IP address (truncated), cookie ID, pages visited, interactions with advertisements, device type, browser, time of visit and – for enhanced conversions – hashed contact details.
9.2 Legal basis
Google Ads, including conversion tracking, enhanced conversions and remarketing, is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you give via our cookie banner (category "Marketing"). Without your consent, no marketing cookies are set and no data is transmitted to Google for advertising purposes. You can withdraw your consent at any time via the cookie settings (Section 6.3).
9.3 Joint controllership and transfer to third countries
For processing within the scope of Google Ads, we and Google are partly joint controllers within the meaning of Art. 26 GDPR. The relevant agreement can be found at: https://business.safety.google/controllerterms/. When using Google Ads, data may be transferred to servers of Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. The European Commission's Standard Contractual Clauses apply in addition. Further information can be found in Section 3.4.
9.4 Storage period
The cookies set by Google Ads have a lifetime of between 30 days (conversion cookie) and a maximum of 13 months (remarketing). Data stored on Google servers is deleted by Google in accordance with the retention periods applicable there.
9.5 Objection options
In addition to withdrawing consent via our cookie banner, you can also deactivate personalised advertising by Google via your Google account settings: https://adssettings.google.com/. You can also deactivate third-party cookies via your browser settings or via the website of the Digital Advertising Alliance (https://www.youronlinechoices.com/).
Further information can be found in Google's privacy policy: https://policies.google.com/privacy
10. Links to External Websites
Our website contains links to external third-party websites, in particular:
- Online pharmacies and retailers where our products are available (e.g. DocMorris, Shop Apotheke, dm, Medpex and others)
- The pharmacy finder of aponet.de
- ROBUGEN's company profile on LinkedIn (LinkedIn Ireland Unlimited Company)
- The website of ROBUGEN GmbH & Co. KG (robugen.de)
These are simple links only; no data is transmitted to these providers merely by visiting our website. Only when you click on a link do you leave our website, and the privacy policy of the respective provider then applies. We have no influence on the data processing carried out by these providers. Please note that some of the retailer links contain parameters that allow the respective retailer to recognise that you reached them from our website. Please consult the privacy policies of the respective providers.
11. Rights of the Data Subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis us:
11.1 Right of access (Art. 15 GDPR)
You have the right to obtain confirmation from us as to whether personal data concerning you is being processed by us. If such processing is taking place, you may request access to this data as well as information about the purposes of processing, the categories of data, the recipients, the envisaged storage period, the existence of your further rights, the origin of the data and the existence of automated decision-making.
11.2 Right to rectification (Art. 16 GDPR)
You have the right to request the immediate rectification of inaccurate personal data concerning you and the completion of incomplete personal data.
11.3 Right to erasure (Art. 17 GDPR)
You have the right to request the immediate erasure of your personal data if one of the grounds listed in Art. 17(1) GDPR applies and the processing is not necessary for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims.
11.4 Right to restriction of processing (Art. 18 GDPR)
You have the right to request the restriction of processing of your personal data under the conditions set out in Art. 18 GDPR.
11.5 Right to data portability (Art. 20 GDPR)
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller, insofar as the processing is based on consent or a contract and is carried out by automated means.
11.6 Right to object (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where your personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such purposes.
11.7 Right to withdraw consent (Art. 7(3) GDPR)
You have the right to withdraw any consent you have given under data protection law at any time with effect for the future. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. Consent to cookies can be withdrawn via the cookie settings (Section 6.3); other consents can be withdrawn by e-mail to info@robugen.de or to our Data Protection Officer.
11.8 Automated individual decision-making, including profiling (Art. 22 GDPR)
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on our website.
11.9 Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.
The supervisory authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg(State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)Lautenschlagerstraße 2070173 StuttgartGermanyPhone: +49 (0) 711 615541-0E-mail: poststelle@lfdi.bwl.deWebsite: https://www.baden-wuerttemberg.datenschutz.de
11.10 Exercising your rights
To exercise your rights, please contact:
ROBUGEN GmbH & Co. KG, Alleenstraße 22, 73730 Esslingen am Neckar, GermanyE-mail: info@robugen.de
or our Data Protection Officer: e-mail: datenschutz@robugen.de
Exercising your rights is free of charge.
12. Obligation to Provide Personal Data
Our website can generally be used without providing personal data. When contacting us or concluding a contract, it may be necessary to provide personal data in order to process your enquiry or perform the contract. Failure to provide such data may mean that we are unable to process your enquiry or conclude the contract. In some cases, the provision of personal data is required by law (e.g. in the context of pharmacovigilance or under tax law).
13. Data Security
In accordance with Art. 32 GDPR, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These measures include, in particular, encryption of data transmission (see Section 4.6), access restrictions and the selection of service providers that offer an adequate level of data protection.
14. Changes to this Privacy Policy
We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy, e.g. when introducing new services. The current version of the privacy policy will then apply to your next visit.
This English version is provided for convenience. In the event of any discrepancy, the German version shall prevail.
