This Policy applies to egg donor candidates and egg donors. Its purpose is to explain when and why we collect your personal data, how we use it, the conditions under which we may disclose it to others and how we keep it secure as well as your rights in relation to the processing of your personal data.
We may change this Policy from time to time. You are invited to check our website periodically, in order to keep up to date with any changes. In the exceptional case of a substantial change, we may also attempt individual notification. By using our website, you agree to this Policy, as amended from time to time to the extent relating to information, we collect about you in your capacity as a user of our website. As far as information we are collecting about you in the context of conducting our activities, you are welcome to contact our DPO (the details of whom can be found below) in case you have any related concerns.
In compliance with the law, specifically the EU General Data Protection Regulation (GDPR), our Company, as the data controller of your personal data has appointed a Data Protection Officer (DPO). In case you have any questions regarding this Privacy Policy or any question or complaint as regards to how your personal data is handled, you can contact our DPO as follows:
Name: Stylianos N. Christoforou
Email: [email protected]
Tel.: +357 22007656
Address: 6 Prigkipos Karolou, 2373 Nicosia, Cyprus
Who are we?
Cryos International - Cyprus Limited, a company (HE 381787)
Address: 6 Prigkipos Karolou, 2373 Nicosia, Cyprus
Tel: +357 22007656
Email: [email protected]
Website: https://eggdonor-cy.cryosinternational.com/
When do we collect and process information from you?
We collect information about you:
1. when you submit to us an online Application Form for being a donor,
2. when you undergo the assessment and selection procedure,
3. when you go through the donation process and you are administered as a donor,
4. when you undergo tests for research and study purposes,
5. when you submit a complaint, question, query, or request to us,
6. when you follow or interact with us through our Facebook Page or we communicate, for the purpose of you being assisted or supported in relation to an obligation, either yours or ours, arising from the Law or for purposes relating to the conclusion, execution, or administration of the Donor agreement.
Please note that for the data collected about you in your capacity as mere visitors to the Cryos website for example IP addresses and pages you visit as well as in your capacity as users of the various web or social media features provided by Cryos International or which may be reached through our website and not specifically covered by the present privacy policy, the data controller is our sister company based in Denmark, namely Cryos International ApS, Company Registration Number 29 42 18 38, Vesterbro Torv 3, 5th floor, DK-8000 Aarhus C, Denmark and the privacy policy governing the relevant data processing can be found here.
Please also note that for the processing covered by this Privacy Policy, Cryos International Denmark ApS may act as a joint controller, but we maintain full responsibility for compliance with the obligations under the GDPR.
What type of personal information is processed and how?
General
The personal information we process includes your name, username, identity card number or passport, or driver’s license, date of birth, information about your education, business occupation, telephone number, address, email address, payments made to you, and a donor ID we are creating for you. We also collect any other information you provide to us by filling in our online donor application form or by filling in and send email questionnaires. When you follow us on Facebook, we process information that you have made available to us via settings on said social network, your reactions to our posts and your sharing thereof and any comments made to our posts.
We also collect all personal data you are providing to us by filling in and submitting our online donor application form, as well as when you undergo a special assessment and selection procedure, and when you are administered as a donor if approved. This includes categories of sensitive (or special category) personal data such as information about your physical and mental health, urine and blood samples resulting in data about your health, data relating to your behavior, personality and emotional intelligence (EQ), race and ethnic origin, genetic data resulting from blood and urine testing, lifestyle and sex life, whether you have donated again before, vaccination history, use of medication or other intoxicants, any tattoos and piercings, hereditary diseases in your family, as well as biological, genetic and laboratory test results.
We also collect information such as, your religion, height, weight, hair color, eye color, your photos, voice recording, handwriting and all information provided through a donor profile form, the type of your donor profile (basic or extended), your responses to questions concerning a number of practical matters in connection with you being a donor, all information including the aforementioned sensitive information provided through oral communications with our staff and forms such as, an initial appointment information form, the egg donor candidate consent form, donor candidate questionnaires, the Human Fertilisation and Embryology Authority form, the clinical examination questionnaire, the donor medical and family history, the change in risk behavior form, the Corona, Zika and Ebola virus risk assessment forms and consent forms that may be required for distribution of your egg in other counties, when applicable as well as medical surgery consent forms.
If you are approved as a donor and you will go through the donation process, in the context of which we will collect your gametes, we may also collect further identification information, specifically biometric data, i.e., a fingerprint template arising from finger scanning and health-related information as above described as necessary to ensure the health and safety of the gametes at all stages.
Genetic matching
Some recipients of donated eggs would like to know whether the eggs will be an attractive match to the recipients’ own genetic profile, which means that there will be no increased risk of a recessive disease in the child that may be born. Recessive diseases are those that need two copies of a mutated gene (one from each biological parent) to occur, so a donor may be a carrier of a variant in a recessive gene but not suffer from the disease herself. A recipient is given the option to carry out this matching in respect of either only an individual gene identified by the recipient following genetic screening (“Single Gene matching”) or a number of genes (more than 300) known to cause recessive diseases (“Panel Matching”). A Panel Matching will not provide any information on the donor’s carrier status because it does not reveal which specific gene led to the result.
By a Panel Matching you are tested for more than 300 recessive genes that can cause genetic disease in a donor conceived child, but it will not cause disease in the donor. A Panel Matching will not provide any information on the donor’s carrier status.
By a Single Gene Matching you will be tested for a specific recessive gene which the recipient is a carrier of. If you are a carrier of the same recessive gene variant as the recipient, it can cause a genetic disease in a donor conceived child, but it will not cause disease in the donor.
To get your genetic information that will be necessary to perform the genetic matching exercise in case this is requested from the recipient of your eggs, we have to perform a special genetic test on DNA extracted from your blood sample which gives us relevant genetic information.
In order to enable us to carry out the genetic matching exercise, we will need to process special categories of data that we obtain from samples of your blood. This special category data comprises information gathered from certain pieces of your DNA called exons or protein-coding regions (exome data), which we analyse and obtain through a process called exome sequencing for the purpose of identifying whether any pathogenic variants exist in your genes.
How and on what legal basis is your information used?
We use your non-sensitive personal information lawfully, in accordance with,
- Article 6(1)(a), i.e., for purposes you have consented to, if any
- Article 6(1)(b), i.e., as necessary to conclude or perform a contract with you,
- Article 6(1)(c), i.e., to comply with obligations imposed by law and,
- Article 6(1)(f), i.e., as necessary for legitimate interests we pursue as a company.
More specifically:
Article 6(1)(b)
This relates to the processing of basic identity and contact details necessary to:
- respond to, examine, or satisfy applications, claims and related requests or queries submitted by yourself in the context of discussing, concluding, and performing a donor agreement,
- carry out our obligations arising from our agreement, to pay you the compensation you are entitled to.
Article 6(1)(c)
This relates to the processing of identity documents, such as your national ID and all information collected through the aforementioned forms and questionnaires for the purpose of assessing your suitability as a donor, registering you as one if approved and securing spouse/partner consent and in the processing of data associated with the collection and storing of the gametes to ensure their safety and traceability as well as bookkeeping information such as payments made to you and the expenses involved in the donation necessary to:
- comply with or respond to requirements or demands by regulatory authorities and ensure compliance with the Medically Assisted Reproduction Law of 2015 (Law 69(I)/2015), mainly Sections 32, 33 and 35, the Standards of Quality and Safety (donation, procurement, testing, processing, preservation, storage and distribution) of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007), mainly Sections 28, 35, 38, 39 and Appendix III, the Regulations adopted pursuant to these laws requiring us to reliably verify your identity, keep a donor identification register, assess the history of your behavior, maintain a file for every donor and ensure traceability of eggs from donor to recipient and vice versa well as with tax legislation.
Article 6(1)(f)
This relates to the processing of your personal data as necessary to:
- notify you of any changes to our services or our privacy policy, if necessary,
- carry out donor satisfaction surveys and statistics with anonymized data,
- organize our business efficiently, create your basic donor profile, secure required consents to enable the distribution of the gametes and establish our presence as a tissue establishment, for example, by making content available on social media for users who have chosen to follow us or cooperating with other company members of the Cryos Group.
Article 6(1)(a)
This relates to the collection of the gametes and the processing of the information you provide through the initial donor application form or on the phone to our staff, and to the processing inherent in creating your extended donor profile, sending you communications to inform you about the outcome of the examination of your donor application or if applicable, regarding our activities, services and/or events. It also applies in case you agree to donate egg or blood samples for research purposes, such as the carrying out of studies of the levels of anti-Müllerian hormone in women.
We use your sensitive or special category personal data, such as data relating to your health, ethnicity or sex life, lawfully, for the above purposes, additionally in accordance with,
- Article 9(2)(a), i.e., on the ground that you have given us your explicit consent. This legal condition applies to the collection of the gametes and the processing of any sensitive data provided through the initial donor application form and consent form and in the context of assessing your suitability as a donor and registering you as one if approved, to the extent not covered by Article 9(2)(h) below as well as in the context of building your donor profile including you taking an EQ test and distributing your eggs to foreign countries.
This ground also applies for the personal data we process when you agree to undergo additional testing for genetic matching. - Article 9(2)(h), i.e., on the ground that processing is necessary for the purposes of preventive or occupational medicine, the provision of health or social care or treatment or the management of health or social care systems and services. This legal ground applies to the processing of your sensitive data, such as data relating to health provided in the context of assessing your suitability as a donor and/or approving and registering you as one through the aforementioned questionnaires and forms as well as blood and urine samples and the results produced out of their testing and collecting and storing the gametes. It also applies to the processing of your biometric data in order to accurately verify your identity at donation. More specifically, your sensitive or special category personal information is used to ensure your suitability as a donor, verify your identity at donation and ultimately high standards of health, quality and safety of the egg, investigation and reporting of undesirable events relating to the health and safety of the gametes, keeping of donor files and registers as required by law, mainly the Standards of Quality and Safety (donation, procurement, testing, processing, preservation, storage and distribution) of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007), mainly Sections 28, 31, 35-38, 39 and the Appendixes referred to therein and the Regulations issued in the context of said Laws namely Regulation 438 / 2008 Annex I, Part E, Annex V, Articles 6 και 7 και Annex III & IV, as well as the Medically Assisted Human Reproduction Law of 2015, Law 69(I) of 2015, mainly Sections 33 and 35. After your gametes are used in IVF, the retention of your data is only based on Article 6(1)(c) & Article 9(2)(h) and not consent.
This legal basis also applies to the processing inherent in your preparation for and the conducting of the medical surgery of the egg extraction performed by a medical doctor and/or other healthcare professionals. - Article 9(2)(f), i.e., where necessary for the exercising, defending and pursuing of legal claims if a relevant dispute arises.
- Article 10, which relates to data relating to whether you have spent time in a correctional facility, processing which is relevant to comply with our legal obligation to assess the history of your behavior under the Standards of Quality and Safety (donation, procurement, testing, processing, preservation, storage and distribution) of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007), Section 38 and Appendix III.
If you need further explanation on how your information is used, you are welcomed to contact our DPO, the details of whom are stated at the beginning of this Privacy Policy.
Where and how long we retain your information for?
Your information is stored in physical files in our premises in Cyprus and also in electronic form in servers located in the EU.
Please be aware that, different retention periods apply for different types of personal data. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
We generally keep information for as long as it is necessary for us to perform our obligations or to comply with legal obligations to which we are subject in accordance with the applicable law or as necessary for the purpose of the processing.
More specifically, the data processed through our Facebook Page, is deleted when the post is deleted, or when you choose to withdraw your reaction to our posts (like, sharing etc.). Private messages are deleted when the communication and its subject is over.
We retain your information you provided in the context of applying for and being assessed for your suitability as a donor for a period of up to ten (10) years, in case we have rejected a donor application submitted to us. This is to enable us to have a relevant history in our files so that we can take this rejection into account, in case you re-submit a relevant application to us in the future and to be able to defend ourselves in the event of a dispute.
If you become a donor, Cryos has a legal obligation to ensure traceability of your egg in all phases, from donation to distribution to the recipient (from the donor to the recipient and vice versa), for at least thirty (30) years from the time of last clinical use or the expiry date. We therefore keep your personal data, including sensitive data, (such as the data concerning your identity and medical health, history and results) for at least thirty (30) years.
If your egg is provided to a customer in a different country than Cyprus, national rules for ensuring traceability may apply in the receiving country, which necessitate that Cryos keeps your information for a period exceeding thirty (30) years from the last clinical use of your egg. In such cases and to the extent permitted by applicable laws, the retention period will depend on any requirements in the relevant legislation of the receiving country.
The gametes are stored for a maximum of ten (10) years as per Article 29, Law 69(I)/2015, although we may retain personal data for longer as specified above.
As for the fingerprint template, if you are an approved donor, it is retained for at least thirty (30) years from the time of last clinical use and in case you are rejected as a donor, it will be retained for ten (10) years after your rejection.
We will store bookkeeping information for six years after the end of the financial year to which they refer pursuant to the rules on documentation in the Cypriot Assessment and Collection of Taxes Law of 1978 (L.4/1978), Article 30 unless the tax authorities instructs us to do so for longer pursuant to the same provision. This data includes any information needed to document our bookkeeping, e.g. documentation of compensation paid to you during your time as a donor.
Blood, saliva and urine samples will be destroyed as soon as the required tests have been made, at the latest 7-14 days after the sample has been taken. In case you have agreed to participate in a study or research program, you will be informed about how your personal data is being processed before you consent to participating in the study.
When there are no specified maximum retention periods above, we will retain data relating to health for up to 2 years after the last recording of personal data about you.
Who has access to your information?
We will never sell your information to third parties and we will not share it with third parties for marketing purposes.
We may pass your information to our third party service providers and sub-contractors for the purposes of assisting us in performing our duties and/or providing our services. Such third parties may be technical service providers providing us with the software systems or cloud storage space necessary to contact administrative tasks inherent in the provision of our services to you or in the conducting of our business, and courier or transport companies who we engage to deliver donated eggs to storage facilities, customers, clinics or laboratories. We only disclose to them the personal information that is absolutely necessary to deliver the service or perform the task and when legally required, we have a contract in place that requires them to keep your information secure and in accordance with the principles and rules of the General Data Protection Regulation.
Moreover, the recipients of personal data will mainly be companies in the Cryos Group and their employees, who are processing data on behalf of the Company or providing to us administrative and technical and/or web support services, or with whom we collaborate and share systems, or who provide storage services to us. In case you participate in any of our study or research programs which we carry out with other companies in the Cryos Group, we may anonymously send the results of your tests to such companies for publication purposes.
Additional recipients are persons who are interested in receiving or are receiving treatment with your egg and access donor profiles through their user account on Cryos’ website, maternity units, IVF clinics, assessors, experts or other independent professionals, such as doctors, clinics, diagnostic centers and psychologists who help us evaluate your donor application.
We also engage accredited test laboratories and hospitals to do the relevant tests of samples submitted to us. We only disclose to them the personal information that is absolutely necessary for them to perform the relevant necessary tasks and when legally required, we do not disclose information that may reveal your identity, and we have a contract in place that among others, requires them to keep your information secure and in accordance with the principles and rules of the General Data Protection Regulation.
In the event you agree to undergo genetic matching testing, we will share with recipients and potential recipients of your eggs the following information:
a) the “match”/”no-match” result is shared with the potential recipient once the matching exercise is carried out;
b) with your consent, in case of a no-match result, and provided that we have information on the specific gene that led to the result, which will be the case only in single gene matching, we make your carrier status (which includes the relevant gene and variant) available to all future potential recipients by including it on your non-identifying donor profile.
We may also pass your information to our lawyers and accountants/auditors to the extent necessary to defend or institute legal claims and to comply with legal obligations with regards to the preparation of financial accounts and tax reasons respectively.
We may disclose your information to public and/or regulatory authorities, if disclosure is required by law such as to report an undesirable reaction or event, or an order issued by a court of law.
In some countries, it is a legal requirement that the donor is alive at the time the egg is shipped from Cryos and at the time the egg is used for treatment. When we deliver donor gametes to such countries, we will contact you by phone or e-mail, to verify that you are alive.
What are your rights?
For a detailed description of the personal data collected about you, how and why as well as where it may be disclosed (in some cases, in non-identifiable form), you can click here and/or contact our DPO for any questions you may need.
You may at any time, send us any of the following requests and we will meet them the earlier possible and in any case, within a month from the date of receipt of your request and inform you about the action we have taken. If your request is for any reason complex to examine or meet, we will ask you for an extension, before the aforementioned one-month period expires.
If we have legitimate reasons to refuse to satisfy your request, we will inform you accordingly and in this case, you have the right to submit a relevant complaint to the Cyprus data protection authority, namely, the Commissioner for Personal Data Protection (http://www.dataprotection.gov.cy/) if you believe that our decision is unjustified.
These are your rights and the relevant requests you can submit to us:
A request that we permanently delete all or some of your information from our records (right to be forgotten or to erasure), for example, in case we no longer have reasons to have it. Please note that there may be cases, especially when your egg has been used in which we are legally required to retain your data as explained above and in such a case your request for erasure will not be possible to be met.
A request from you to access your information that we keep in our records (right of access)
A request that we provide you with a copy of your information that exists in our records, in digital or hard copy form. If you require additional copies, we may charge you with a maximum of EUR 40,00 per copy, as administrative costs, depending on the volume of the data involved. (right to a copy)
A request that we update or correct personal information that we keep in our records (right to rectification), for example, in case it is outdated or contains errors or inaccuracies.
A request that we provide you with information of yours we keep in our records in a structured, commonly used and machine-readable format or forward it in such form to another provider of your choice, if such forwarding or transfer is technically possible (right to portability). Please note that this right applies only in relation to data that you yourself has provided to us with and which we process by electronic means, in the context of a contract between you and our Company or because you have consented to us doing so.
A request that we stop doing anything with your information without however deleting it from our records (right to restriction of processing). In this case, we will restrict access to your personal data without deleting it if we are to satisfy your request.
A request that we stop processing your information for direct communications if applicable, or on the basis of legitimate interests pursued by our Company, as explained under the fourth question of this Privacy Policy by reference to Article 6(1)(f) or in the name of the public interest (right to object). In the case of the former, we will stop processing your information. In the rest of the cases, we will do so the same unless we have compelling reasons to refuse to do so about which you will be informed within the relevant time-limit.
In the case in which the decision as to whether you will be approved as a donor by our Company or not is taken solely on the basis of automated processing, you have the right to express an opinion on and dispute the decision, as well as to request that it be reviewed by a member of our personnel. Please note that for the time being such decisions are not taken solely on the basis of automated processing.
In relation to the processing based on your consent or explicit consent, you can always withdraw your consent at any time by contacting our DPO by email or otherwise, the details of whom are stated at the beginning of this Privacy Policy. You can also withdraw your consent as an egg donor through our website here https://www.cryosinternational.com/en-gb/cy-shop/donor/apply/withdrawal-of-consent-egg-donor/. A withdrawal of your consent does not affect the lawfulness of Cryos’ processing of your information on the basis of your previously granted consent until the time when such consent is withdrawn. Accordingly, if you withdraw your consent, this will not take effect until from the time it is withdrawn. Moreover, withdrawing your consent will not prevent any processing that is required under the law in connection with the traceability and other legal requirements as explained above by reference to Articles 6(1)(c) and 9(1)(h) GDPR, particularly if you withdraw consent after your gametes have been used.
If you wish to exercise any of the above rights, you will be able to do so by contacting our DPO at any of the contact details stated at the beginning of this Privacy Policy.
Please note that before acting upon any of your above requests, we may require you to prove your identity, if we are in doubt about your true or correct identity. If we cannot identify you, we will inform you accordingly and we will not act upon your request. The personal data relating to the handling of any of your requests will be retained up to nine (9) months after the completion of any procedure relating to the request.
You have the right to submit a relevant complaint to the Cyprus data protection authority, namely, the Commissioner for Personal Data Protection (http://www.dataprotection.gov.cy/) if you believe that we do not handle your personal data in compliance with the Regulation.
What security measures do we apply to protect your information?
When you give us personal information, we take organizational and technical measures to ensure that it is kept secure and protected against unauthorized disclosure or access, alteration, accidental loss or other violation or unlawful processing. Such measures, amongst others, aim at restricting access to personal information, ensuring secure storage, limiting the risk of viruses and other harmful events, keeping secure back-ups and effectively destroying unnecessary data. In the event of a data breach or a relevant allegation, the personal data relating to its handling will be retained up to twelve (12) months after the completion of any procedure relating to the breach.
Transferring your information outside European Union
We do not generally transfer your personal information to a country that is not a Member State of the EU except from intra-group transfers in the form of access to some of your data that our US affiliated company (Cryos International USA) may have or because certain service providers we use may use servers outside the EU. We take measures so that your personal information will be given analogous protection to EU standards, specifically by signing with the party based outside the EU, when a country for which there is no adequacy decision by the Commission pursuant to Article 45 GDPR, an agreement with the standard contractual clauses approved by the European Commission as per Article 46 GDPR committing them to affording your personal data sufficient data protection. Your personal data may also be transferred to non-EU countries, specifically to IVF clinics or other similar entities in case your eggs are distributed for use in the context of assisted reproduction on a person based outside the EU. In case that we have to transfer your data to any third country, for which there is no adequacy decision pursuant to Article 45 GDPR we have a procedure for applying the transfer tool ensuring analogous protection and supplementary measures of protection where necessary. Moreover, interested persons based outside the EU who have created a user account on Cryos website will have access to your donor profile, basic or extended. This access may entail data protection risks if the country concerned in one of which there is no adequacy decision to Article 45 GDPR, as there will no appropriate safeguards pursuant to Article 46 GDPR.
Updated 24-02-2023