We get your personal data from you directly when you send an email to us from:

• Contact us
• Report a product issue

We process personal data about you to respond to your request for information.

You are not required to provide us with your personal data. If you do not want Novo Nordisk to use your personal data, we will not be able to respond to your request accurately.

For the purposes described above in Section 2, we may process the following types of personal data if provided by you:

• Contact information (name, address, telephone number, email address)
• Data concerning your health (which will be categorized as sensitive personal data and handled accordingly pursuant to the Personal Data Protection Act 2010) 

Our processing of your personal data requires a legal basis.

By law, we are allowed to process your personal data if:

• You gave consent for us to process your personal data. In the Contact us form you have to accept this notice to be able to submit your request.
• The processing can be necessary for our compliance with a legal obligation depending on the type of data you provide

We may share your personal data with:

• Public authorities (to the extent that these are required by law or by a specific instruction from these authorities)
• Suppliers or vendors that assist our company (e.g., customer services, consultants, IT service providers, financial institutions, law firms) subject to them having a strict data privacy processing and retention policy.
• With your prior consent, other Novo Nordisk entities (e.g. Novo Nordisk global safety reporting databases in Denmark).

·

• Public authorities 
• Suppliers or vendors that assist our company (e.g., customer services, consultants, IT service providers, financial institutions, law firms)

For the purposes described above in Section 2, we may transfer your personal data to countries outside Malaysia.

The level of data protection in certain countries outside Malaysia does not conform to the level of data protection for personal data currently applied and enforced within Malaysia.

We therefore use the following safeguards, as required by law, to protect your personal data in case of such transfers:

• The transfer is to a Novo Nordisk entity covered by Novo Nordisk’s Binding Corporate Rules, available here.
• The destination countries are deemed by Malaysia to have an adequate level of protection of personal data. 

We will keep your personal data:

• For as long as needed to provide you with the services requested by you or for as long as required by applicable law.

In general, you have the following rights:

• You can get an overview of what personal data we have about you
• You can get a copy of your personal data in a structured, commonly used and machine-readable format
• You can get an update or correction to your personal data
• You can have your personal data deleted or destroyed
• You can have us stop or limit processing of your personal data
• If you have given consent for us to process your personal data (see Section 5), you can withdraw your consent at any time. Your withdrawal will not affect the lawfulness of the processing carried out before you withdrew your consent
• You can submit a complaint about how we process your personal data to a Data Protection Authority.
   

Under applicable law, there may be limits on these rights depending on the specific circumstances of the processing activity. Contact us if you have questions or requests relating to these rights.