Privacy Notice
Roche is an international company engaged in the manufacture and distribution in the fields of Diagnostics, Diabetes Care, and Pharma of various medical products, medicinal products, and the provision of related services.
Roche is aware that the protection of privacy and thus the protection of personal data of patients, customers, and business partners is very important and attaches considerable importance to this. Roche has therefore taken the necessary precautions to meet the globally applicable requirements for data protection and accordingly adheres to the provisions of the European Union, Germany, and all other applicable standards.
Your personal data is processed exclusively to the extent legally permissible and in compliance with relevant laws, in particular the principle of transparency. You can find out how Roche processes your data in different contexts from the following data protection information.
If there is anything you do not understand or if you have any questions, you can contact the controllers responsible for data processing or our Data Protection Officer (see below) at any time.
A. Controllers
Unless otherwise indicated below, the following Roche company (“Roche”) is responsible for the processing of your data on our website www.escape-the-unknown.de and game.escape-the-unknown.de:
Roche Pharma AG
Emil-Barell-Straße 1
D-79639 Grenzach-Wyhlen
The US Supplemental Privacy Notice provides the appropriate channels for contacting Roche with questions, requests, and inquiries in the scope of US state privacy laws.
B. Data Protection Officer
You can reach the Data Protection Officer for the Roche companies in Germany at any of the addresses mentioned above by adding “c/o Data Protection Officer” or by email at germany.privacy@roche.com.
C. Your Rights
As a data subject affected by data processing by Roche, you have the following rights if you data is covered by the GDPR:
- Right to information about the processing of your data This allows you to find out, in particular, what data we have stored about you.
- Right to rectification of your data This allows you to have incorrect data, such as old address details or accidentally incorrect records, corrected by us.
- Right to erasure of data concerning you This allows you to have data that we store about you or process about you erased.
- Right to restriction of processing of your data This allows you to have the processing of your data by us restricted, for example, in cases where it is not yet clear whether data should be erased or not.
- Right to data portability If we process your data based on your consent or a contract, you may, under certain conditions, receive the data you have provided to us in a structured, commonly used, and machine-readable format and transmit it to another controller.
- Right to withdraw consent previously given If you have given us consent to process your data, you can withdraw this at any time with future effect without needing a specific form. Unless otherwise stated, this is particularly possible via an informal email to the controller.
- Right to object If we process your personal data to protect our legitimate interests (Article 6(1)(f) GDPR), you can object to this processing in whole or in part at any time for reasons arising from your particular situation. We will then re-examine the balance of interests and, if necessary, cease processing your data. However, this may mean that we can no longer offer or provide some services or benefits in the usual way.
- Right to lodge a complaint with the data protection supervisory authority You also have the right to lodge a complaint with a competent data protection supervisory authority, such as the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Königstraße 10a, 70173 Stuttgart) or the supervisory authority at your place of residence, workplace, or the place of the alleged infringement.
The rights listed above may be subject to individual restrictions or prerequisites. You can find details on this in Articles 15 to 21 of the General Data Protection Regulation or contact our Data Protection Officer.
Exercising your rights: To exercise your rights, please contact Roche using the contact details provided above under “Controllers” or contact the Data Protection Officer.
Your Rights If Your Data is Covered by California and Certain Other US State Laws
If you are a California or certain other US states resident, you can find a description of these rights that may be available to you covered in the US Supplemental Privacy Notice. That privacy notice contains information on how to contact Roche to exercise any rights you may have under applicable state law.
D. Processing of Your Data
Roche processes your data in various contexts for different purposes. The following describes data processing when visiting our website, during registration, when contacting us, in the context of pharmacovigilance, and for marketing communications. You can also find further information on data protection at Roche and help with individual terms in the “Data Protection Information Portal” under the keyword “Data Protection” on www.roche.de.
For residents of California and other states in the United States, please visit the US Supplemental Privacy Notice for more information about Personal Data processing activities as they relate to US residents.
I. Visiting Our Website
1. Web Server Logs
When you visit our websites without requesting further information (e.g., via contact forms or newsletter subscriptions), we automatically collect and process the following information from you in the web server log with each access:
| Personal Data | Purpose | Legal Basis |
Connection-related data:
Device-related data:
|
Ensuring the security of website use and the integrity of the content offered. | Safeguarding our legitimate interest in the secure provision of the website (Article 6(1)(f) GDPR). |
Storage duration: We process and store your data only for as long as is necessary to achieve the respective purpose and to fulfil our contractual, statutory, or regulatory obligations. On this website, the web server logs are automatically deleted after 90 days, unless longer storage is required in individual cases (e.g., in the event of attacks on system security). After deletion of the IP address, only anonymised information (i.e., without possible personal reference) is stored.
Recipients: We have engaged service providers for the support and maintenance of our websites on the basis of a data processing agreement. These are IT service companies in the area of service and hosting.
- Cookies and Tracking Technologies (Cookie Policy)
Roche’s websites use cookies and comparable technologies that enable various functionalities and allow for pseudonymised traceability of website visitors.
Cookies: A cookie is an entry that is automatically made on your computer’s hard drive. With the help of the cookie, the server can uniquely identify your browser. Cookies may contain information to identify your computer or browser, including a device ID, your IP address, and/or an ad ID, as well as information about your browser history. The information we obtain through the use of cookies may be combined with other personal data relating to you.
Cookies and Technology Used
To give you control over the cookies and other technologies used on our websites, we use a consent management tool (so-called cookie consent management tool). This appears when you visit our websites for the first time in a so-called cookie banner. It allows you to make individual settings and gives you specific information about the cookies used, including further details about the provider and the purposes pursued.
Where the use of cookies and other technologies is necessary, our websites use them even without consent. For all other cookies and comparable tracking technologies, we ask for your consent. You can individually configure for which purpose you consent to the use of cookies and other technologies via the cookie consent management tool and also withdraw your consent. In addition, you can often set in your browser whether cookies are accepted or rejected. Please note, however, that some areas of our sites may not function properly if you reject cookies. Here you can find instructions for common browser types:
For Chrome: https://support.google.com/chrome/answer/95647
For Safari: https://support.apple.com/en-gb/HT201265
For Firefox: https://support.mozilla.org/en-US/kb/block-websites-storing-cookies-site-data-firefox
For Internet Explorer: https://www.google.com/search?q=https://support.microsoft.com/en-gb/topic/delete-and-manage-cookies-168dab11-0753-043d-7c16-ede5947fc64d
The cookies used can be divided into the following categories:
Necessary Cookies: These cookies are necessary for the website to function and cannot be switched off. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but blocking these cookies will prevent the site from working properly. These cookies do not store any personal information.
Performance Cookies: These cookies allow us to analyse visits and their origin so that we can measure and improve the performance of our website. They help us to determine which pages are the most popular and how visitors navigate the website. We may provide these cookies to third-party providers who assist us in carrying out these analyses (e.g., Google Analytics). All information that these cookies collect is aggregated and does not relate to you personally. If you block or refuse these cookies, we will not know when you have visited our website and cannot improve the performance of the site.
Functional Cookies: These cookies enable us to offer enhanced functionality and personalisation on our websites. They may be set by us or by third-party providers whose services we have integrated into our pages. If you refuse these cookies, some or all of these services may not function properly.
In connection with the use of cookies and other technologies, various personal data provided by you (hereinafter also referred to as “data”) are collected and processed, in particular:
| Personal Data | Purpose | Legal Basis |
Connection-related data:
Device-related data:
|
Technically flawless and secure provision of the websites and their functions (Technically necessary cookies) | Safeguarding our legitimate interest in the provision of the website (Article 6(1)(f) GDPR). |
| IDs in cookies
and the information in row 1 |
Statistics/Website analysis (Performance Cookies) | Consent
(Article 6(1)(a) GDPR) |
| IDs in cookies
and the information in row 1 |
Improvement of user experience / Personalisation (Functional Cookies) | Consent
(Article 6(1)(a) GDPR) |
| IDs in cookies
and the information in row 1 |
Interaction with social media
(Social-Media Cookies) |
Consent
(Article 6(1)(a) GDPR) |
Information on the providers and the purposes pursued by them can be obtained via the cookie consent management tool as well as the supplementary information in this privacy notice.
The following cookies are used in connection with our site:
Necessary Cookies:
Borlabs Cookie
Name: Borlabs Cookie
Provider: Owner of this website, Legal Notice
Purpose: Stores the settings of visitors selected in the Borlabs Cookie Box.
Cookie Name: borlabs-cookie
Cookie Duration: 1 year
Performance Cookies:
Matomo
Name: Matomo
Provider: Escape the Unknown
Purpose: Cookie from Matomo for website analysis. Generates statistical data on how the visitor uses the website.
Privacy Policy: https://www.escape-the-unknown.de/datenschutz/
Cookie Name: pk*.*
Cookie Duration: 13 months
Withdrawal: You can withdraw your consent by configuring the settings in the cookie consent management tool used and restricting it to the purposes you desire.
[borlabs-cookie type=”btn-cookie-preference” title=”Change settings”/]
Storage duration: We process and store your data only for as long as is necessary to achieve the respective purpose and to fulfil our contractual, statutory, or regulatory obligations. The storage duration of cookies varies. You can find details on this (in particular regarding the storage duration) in the cookie consent management tool used.
Recipients: Some cookies are used exclusively by Roche (so-called first-party cookies). Others are used by third-party providers (so-called third-party cookies). In this process, the aforementioned personal data is transferred to the third-party providers. A list of the names of the third-party providers can be found in the consent management tool.
3. Services Used
As can also be seen in the cookie consent management tool, the following services are also used on our websites:
Matomo Our website uses the analysis tool Matomo. Matomo is an open-source project that is hosted locally by us. We use Matomo on the basis of your consent (Article 6(1)(a) GDPR) to analyse how you and other users use our website and to be able to create corresponding reports. In particular, your IP address is processed and cookies are used. You can prevent the use of Matomo by not giving your consent.
Further information can be found in Matomo’s privacy policy: https://matomo.org/privacy-policy/
Borlabs.io
Our websites use the cookie consent management tool from the provider Borlabs – Benjamin A. Bornschein (registered office at Rübenkamp 32, 22305 Hamburg, Germany). We use the tool on the basis of our legitimate interest (Article 6(1)(f) GDPR) to give you and us the opportunity to adapt and manage the use of cookies, optimised caching, and comparable technologies according to your preferences. In particular, your IP address is processed and cookies are used to remember your chosen preference.
Further information can be found in Borlabs.io’s privacy policy: https://www.google.com/search?q=https://borlabs.io/privacy-policy/
Data Processing by Social Media Platforms (Twitter, Facebook and LinkedIn)
You have the option to share the content of our website via the social media buttons on our website. Please note that by registering on the respective social media platform, you have agreed to the data policies of the respective platform. We generally have no influence on the data processing of the platforms. We would particularly like to point out that the platforms create profiles about your use of our social media pages under their own responsibility. For this purpose, the platforms use their own analysis tool. Here you can find the data policies of LinkedIn, Facebook, and Twitter respectively.
- Twitter: https://twitter.com/en/privacy
- Facebook: https://en-gb.facebook.com/policy.php
- LinkedIn: https://www.linkedin.com/legal/privacy-policy
4. Minors
Our websites are aimed at an adult audience. If we learn that someone is not yet 16 years old, we will not collect personal data from that person until verifiable consent from their legal guardian is available. Such a legal guardian can, upon request, view the information provided by the child and/or request the erasure of this data.
5. Data Security
Roche and its service providers and cooperation partners take reasonable steps to protect personal data that we access or receive via this website from loss, misuse, and unauthorised access, disclosure, alteration, or destruction. Nevertheless, Roche does not guarantee the security of your personal data and disclaims, to the extent permitted by law, any liability and damages arising from loss, misuse, and unauthorised access, disclosure, alteration, or destruction. We recommend that you take all available precautions to protect your personal data that you enter on this website.
6. Links to Third-Party Websites
Our website may also contain links to third-party websites. We do not endorse the content of third-party websites or resources and are not responsible for their content, and our privacy notice does not apply to websites that are not affiliated with Roche, even if you access them via a link on our website. You should review the privacy notices of third-party websites before providing any information.
II. Contacting Roche
You can contact us in various ways, for example by email or by filling in a contact form.
In this context, we collect and process various personal data provided by you (hereinafter also referred to as “data”), in particular:
| Personal Data | Purpose | Legal Basis |
| The data you provide in your email or in the contact form (e.g., first and last name, company,email address, content of the message) | Processing the respective request | Depending on the content of the request: Performance of pre-contractual measures / contract fulfilment (Article 6(1)(b) GDPR) or safeguarding our legitimate interest in processing your request (Article 6(1)(f) GDPR).
If the request concerns a reportable incident, we process your data on the basis of fulfilling legal obligations (Article 6(1)(c) and Article 9(2)(i) GDPR) |
Storage duration: We process and store your data only for as long as is necessary to achieve the respective purpose and to fulfil our contractual, statutory, or regulatory obligations. The duration of data storage depends essentially on the content of your request. If longer data storage is not required for regulatory reasons (e.g., for reportable incidents), data is generally deleted three years after its collection.
III. Reporting and Follow-up of Suspected Adverse Events (Pharmacovigilance), Medical Enquiries and Product Complaints
Controller for data processing: The Roche company to which you send your message or which operates the website on which you fill in the contact form is responsible for data processing.
We would like to inform you that Roche has a legal obligation to collect adverse events that become known to it in connection with the use of a Roche medicinal product (pharmacovigilance) or in connection with medical devices and, if necessary, to report them to the health authorities and to answer medical questions. In this context, personal data is processed by the Roche company to which you send corresponding reports and, if necessary, passed on to other Roche companies as well as third parties such as authorities.
Further information on this can be found in the following privacy notice, the contents of which apply accordingly to the Roche company responsible in Germany: https://www.google.com/search?q=https://www.roche.com/privacy-notice-pv-mi.htm
IV. Data Recipients
Your data may be passed on to third parties for specific purposes if this is necessary for the implementation or fulfilment of the purposes mentioned above. In addition to the providers explicitly listed in this privacy notice, this particularly concerns the transfer to other Roche group companies (a list of the companies belonging to the Roche Group in Germany and worldwide can be found at https://www.roche.com/worldwide), for example, when specialist experts employed by another Roche company are consulted. All these companies are obliged to comply with the provisions of our data protection guidelines. Furthermore, your data may be passed on in individual cases, e.g., in connection with legal disputes, to specialised service providers (such as consultancies and law firms) and, if required by law or by court or official order, to authorities or other third parties.
We also use various service providers who process your data within the scope of so-called data processing (Article 28 GDPR), i.e., on our behalf and solely according to our instructions. These are, in particular, technical service providers who carry out IT technical maintenance and service work for us, as well as providers of cloud services or representatives who assist us in handling business transactions, for example, by providing customer services, sending marketing information about our products, services, and offers. Please also note that some of the recipients are named in this privacy notice in the respective context.
If you register directly with one of our service providers or create a user account, these service providers may collect and process additional data. Roche has no influence on this, as this is data processing by the respective service provider itself. You can obtain further information on data protection from the respective providers.
V. Data Transfer to Third Countries
To fulfil the purposes mentioned above, your data may be transferred to countries within and outside the EU or the European Economic Area, in particular to Switzerland, the USA, and India. For some of these countries, an adequate level of data protection has been established by an adequacy decision of the EU Commission (currently, for example, Switzerland). For transfers that are not based on an adequacy decision, compliance with an adequate level of data protection is ensured by appropriate safeguards, in particular EU standard contractual clauses, and, if necessary, additional measures. Further information on the safeguards can be obtained from the Data Protection Officer.
Updating of the Privacy Notice
From time to time, we may revise this privacy notice. Any such changes to this privacy notice will be reflected on this page. We recommend that you regularly review this privacy notice for any changes.
Date of last amendment: 08/05/2025