Privacy Notice

This privacy notice describes how Novartis Pharma AG (located at Lichtstrasse 35, 4056 Basel, Switzerland) and/or the relevant Novartis affiliate in the country where you place your order (hereinafter referred to as “Novartis”), uses and otherwise processes your personal information when you register, access or otherwise use the Cell Chain Online Ordering platform for CAR-T (in this notice referred to as the “Platform”). Novartis, as a “controller”, is responsible for the processing of your personal information. In this Privacy Notice, references to “we” or “us” means Novartis. A list of local Novartis affiliates can be found here.

What personal data do we collect?

The types of personal information we collect, and otherwise process, will depend on the specific website function that you use, and may include:

  • your contact data such as your name, work email address, work address, and phone number, which we collect when you sign up for using the Platform;
  • a record of your activities in the Platform, such as placing your orders;
  • other information required for the technical operation of the platform.

For which purposes does Novartis use your personal data and why is this justified?

We will use your personal information for the following purposes:

  • to process your order on the Platform;
  • to operate the Platform and administrate and support our business activities related to CAR-T, including (without limitation) its ordering, manufacturing, distribution;
  • to monitor and prevent of fraud, infringement, and other potential misuse of the Platform; and
  • to comply with any legal and regulatory obligations and any other purposes imposed by law and authorities.

We process your personal information primarily to fulfill our contractual obligations with respect to the ordering of Novartis products, and for complying with legal and regulatory obligations. In addition we may process your personal information where the processing is necessary for our legitimate interest and does not unduly affect your interests or fundamental rights and freedoms. When processing your personal information on this latter basis, we maintain a balance between our legitimate interests and your privacy.

Who has access to your personal data and to whom are they transferred?

We may share your personal information with other affiliates of the Novartis Group of Companies and with third parties acting on behalf and under the instructions of Novartis, such as for example IT service providers. Such third parties are contractually obliged to protect the confidentiality and security of your personal information, in compliance with applicable law. For transfers of personal information between our group companies, Novartis Group has adopted Binding Corporate Rules, a system of principles, rules and tools, provided by European law, in an effort to ensure effective levels of data protection relating to transfers of personal information outside the EEA, UK and Switzerland.

Your personal data can also be accessed by or transferred to any national and/or international regulatory, enforcement, public body or court where we are required to do so by applicable law or regulation or at their request.

The personal data we collect from you may also be processed, accessed or stored in a country outside the country where Novartis is located, which may not offer the same level of protection of personal data. When we transfer your personal information to recipients in other jurisdictions, we will apply the level of protection required under law and in accordance with our policies and standards.

How do we protect your personal data?

We have implemented appropriate technical and organizational measures to provide an adequate level of security and confidentiality to your personal data, taking into account the state of the art of the technology, the costs of its implementation, the nature of the data, and the risk of its processing.

Data Storage

We will retain your personal data in line with applicable laws and regulations and only as long as necessary to fulfil the purpose for which it was collected and/or to comply with legal or regulatory requirements.

What are your rights and how can you exercise them?

You may exercise your privacy related rights in accordance and within the limits of applicable laws, which may include the right to request to access your personal data, its correction, erasure, restriction of its processing by Novartis, and to withdraw your consent to the extent consent is required.

If you have a question or want to exercise the above rights, you may use our webform on You also have the right to file a complaint with the competent data protection authorities.

If you want to learn more about the protection and processing of personal data at Novartis, you may also visit

Last update: January 2024