1. Legal references

Pursuant to current legislation on the protection of personal data, including Regulation (EU) 2016/679 (“GDPR“), as well as Legislative Decree 196/2003 (the “Privacy Code“) (collectively referred to as the “Privacy Legislation“), Recordati Industria Chimica e Farmaceutica S.p.A. (“Recordati” or also the “Data Controller“), provides you in your capacity as a healthcare professional (“HCP” or the “Data Subject“) with the following information on the processing of your personal data collected and processed by Recordati as part of the performance of scientific information and promotional activities.

Personal data will be processed in compliance with the Privacy Legislation and the relevant applicable provisions issued by the Data Protection Authority.

 

2. Who processes your personal data

– Data Controller:

The data controller  is Recordati Industria Chimica e Farmaceutica S.p.A., with registered office in Milan, Via Matteo Civitali 1, registered with the Milan Business Register, which can be contacted at +39 02 48 787.

– Data Protection Officer (hereinafter referred to as “DPO“):

Recordati has appointed a DPO, who can be contacted at the following e-mail address: , to whom Data Subjects can address any request regarding the processing of their personal data.

– Authorised personnel:

All Recordati employees/collaborators who access, or will access, the personal data of the Data Subject operate/will operate under the direct authority of the Data Controller, and are appointed, pursuant to Article 29 of the GDPR and 2-quaterdecies of the Privacy Code, as persons authorized to process data having received, in this regard, adequate operating instructions.

 

3. Personal data subject to processing and source

The personal data that will be processed are:

– personal and identification data of the Data Subject (such as, for example, name and surname, date of birth, gender, tax code, professional title of the Data Subject, registration in the register of doctors, specializations, areas of clinical practice, membership of professional associations);
– contact details of the Data Subject (telephone number, e-mail address, address where the Data Subject carries out the professional activity);
– further information relating to the HCP profile (such as, by way of example, interests, aptitude and approach in the scientific, technological or research fields, with respect to (i) technological applications and platforms at the service of medicine, (ii) therapeutic behaviors, (iii) the use of digital communication channels and (iv) interests and/or knowledge of pharmaceutical products) that Recordati may acquire from the Data Subject during visits and/or interviews with its sales representatives or from third-party service providers;

– data relating to the Data Subject’s interaction with Recordati (such as, for example, frequency of visits, products presented and/or content discussed, opening of emails sent, visualization of medical-scientific content shared digitally, interactions of the Data Subject with links and email content, duration of the Data Subject’s “engagement” on Recordati’s web pages, participation in webinars, etc.).

Personal data are collected directly from the Data Subject or indirectly by our medical and scientific sales representatives or service providers, whom we use for the digital management of our promotional activities and medical-scientific information. In addition, we may collect certain information, such as your areas of clinical practice and membership in professional associations, from publicly accessible sources (e.g., websites, professional associations).

 

4. The purposes, legal bases of the processing and the period of storage of personal data

Recordati will process the Data Subject’s personal data for the following purposes (the “Purposes“):

 

Purpose of the processing	Legal basis	Retention period
a)        Carry out scientific information activities on the drugs and products marketed by the Recordati Group and related activities (such as, by way of example, the presentation of medicines, the collection of requests and the supply of samples, as well as any analyses aimed at planning visits, orientation, guidance and monitoring of scientific information activities), at clinics, doctors’ surgeries and hospitals where HCP carries out its professional activity or remotely.	Art. 6, paragraph 1, lett. f) of the GDPR: legitimate interest of the Data Controller to plan and carry out and optimize scientific information activities.	Unless the Data Subject exercises the right to object, personal data will be stored for a period of five (5) years from collection and recording within Recordati’s systems.
b)       Carry out profiling activities based on the needs, interests and professional characteristics of HCPs in the scientific, technological and/or research fields to personalize scientific information communications on the drugs and products marketed by the Recordati Group. In the event of refusal to provide data for personalized scientific information communications or opposition to processing, you may still receive general medical and scientific information and content from Recordati.	Art. 6 (1) (f) GDPR: legitimate interest of the Data Controller to plan and carry out targeted and personalized scientific information activities in favor of HCPs in order to improve their effectiveness.	Unless the Data Subject exercises the right to object, personal data will be stored for a period of five (5) years from collection and recording within Recordati’s systems.
c)        To send scientific information communications on drugs and products marketed by the Recordati Group through e-mail or other digital or web-based communication tools (including sending invitations to participate in congresses, conferences or medical-scientific meetings, webinars and training events organized or sponsored by Recordati).	Art. 6 (1) (a) GDPR: explicit consent of the Data Subject.	Personal data will be stored until the Data Subject exercises the right to revoke the consent given, which may take place at any time by contacting the Data Controller and/or the DPO and, in any case, for a period of five (5) years from the moment of expression of consent.
d)       Share HCP’s data to the other companies of the Recordati Group in the country where the HCP operates, for the performance of their own independent medical, scientific and promotional information purposes on the drugs and products marketed by the latter. The list of Recordati Group companies in each country is available on our website www.recordati.com or accessible here.	Art. 6 (1) (a) GDPR: explicit consent of the Data Subject.	Personal data will be stored until the Data Subject exercises the right to revoke the consent given, which may take place at any time by contacting the Data Controller and/or the DPO and, in any case, for a period of five (5) years from the moment of expression of consent.
e)       Collect requests and send samples of Recordati products, including activities related to the management of shipments, resolution of any problems and verification of the effective fulfillment of the request.	Art. 6 (1) (b) GDPR: execution of a contract to which the Data Subject is a party, i.e. the request to receive samples from Recordati.	Personal data processed for this purpose will be stored for the time necessary to manage the request and its shipment, without prejudice to the longer retention terms indicated to achieve the other processing purposes.

The provision of personal data processed for the purposes indicated above (except for letter e)) is optional. In the event of refusal to provide your data, opt-out from processing or withdrawal of the consent previously given, Recordati will not be able to carry out the scientific information activities towards the HCP or communication, as described above.

The provision of personal data for the purposes referred to in letter e) is necessary, otherwise it will not be possible to follow up on the HCP’s request of samples.

At the end of the storage periods identified above, the personal data of the Data Subjects will be deleted, unless there are further legitimate interests of the Data Controller and/or legal obligations that make their storage necessary, subject to minimization.

The Data Controller also informs the Data Subject that at the time of collection and on the occasion of sending each communication made for the pursuit of the aforementioned Purpose, he/she has the possibility to: (i) withdraw, at any time, any consent given, it being understood that the revocation of consent does not affect the lawfulness of the processing based on consent before the revocation; (ii) object to the processing of their personal data based on the legitimate interest of the Company, in the manner better described in point 9 below.

In the event that Recordati intends to use personal data for any other purpose incompatible with the Purposes for which they were originally collected or authorised, Recordati will inform the Data Subject in advance and, where required, request his/her consent for such processing activity.

 

5. Profiling

The Data Controller informs the Data Subjects that, with reference to the Purpose referred to in Paragraph 4 letter b) above (i.e. profiling activities), this activity has the sole purpose of identifying, on the basis of specific parameters identified by Recordati, in a precise and effective manner the professional and scientific profiles of the Data Subjects, as well as their specific professional needs.

Through profiling, Recordati intends to avoid the forwarding of mass medical-scientific communications and spamming to Data Subjects and to encourage a personalized communication system that is more relevant and adherent to the needs, interests and professional characteristics of the Data Subjects, which, moreover, will also indirectly benefit the patients of the individual Data Subjects.

In any case, the profiling mentioned above:

• will not take place on the basis of an automated decision-making process from which legal or similarly significant effects derive for the Data Subjects pursuant to art. 22 of the GDPR;
• will not affect the rights of the Data Subjects;
• will not have any prolonged and permanent impact for the Data Subjects, considering that the personal data collected through its medical representatives are periodically updated.

Furthermore, considering that the processing in question is based on the legitimate interest of the Data Controller, the Data Controller guarantees that it has previously carried out an assessment aimed at ensuring the proportionality of the processing so that the rights and freedoms of the Data Subjects are not prejudiced, taking into account their reasonable expectations in relation to the specific processing activity carried out (so-called “Legitimate Interest Assessment” or “LIA”“).

Data Subjects may request further information on the LIA referred to above, by contacting the Data Controller or the DPO at the addresses indicated below.

This is without prejudice to the right of the Data Subject to object to the performance of profiling activities at any time, in accordance with the procedures better described in point 9 below.

 

6. Processing methods

In relation to the Purposes listed above, the processing of personal data will consist of some of the activities indicated in Article 4, paragraph 1, no. 2) of the GDPR, namely: collection, recording, organization, consultation, processing, combination, deletion and destruction of personal data.

The processing of personal data will be based on the principles of lawfulness, fairness, transparency, proportionality and minimization and will be carried out both on paper and electronically, and will take place through suitable tools, as far as reasonable and state-of-the-art, to guarantee security and confidentiality through the use of appropriate procedures that avoid the risk of loss, unauthorized access, unlawful use and dissemination.

 

7. Recipients

The Data Controller informs the Data Subjects that their personal data may be communicated or made accessible for the pursuit of the Purposes to additional recipients or categories of recipients, as independent data controllers or, where necessary, data processors specifically selected and appointed pursuant to Article 28 of the GDPR, which include:

• suppliers of platforms for customer relationship management (CRM) and related technical assistance and maintenance services;
• medical sales representatives of Innova Pharma S.p.A.;
• communication and/or event organization agencies;
• competent authorities by virtue of legal provisions or secondary or community legislation;
• other companies of the Recordati Group, subject to the consent of the Data Subject.

The complete list of recipients, including more details on their headquarters, is kept at the Data Controller’s registered office and can be consulted upon request to be sent to the addresses indicated in section 2 of this document.

In any case, the personal data of the Data Subjects will not be disseminated.

 

8. Transfer of data abroad

The data will not be transferred outside the European Economic Area.

Any transfer of personal data pertaining to Data Subjects to non-EU countries may only take place within the terms and with the guarantees provided for by the Privacy Legislation and, in particular, pursuant to art. 44 – 49 of the GDPR.

 

9. The rights of the Data Subject

The Data Controller informs the Data Subject that, in accordance with the law, he/she will always have the right to withdraw his/her consent at any time, if given, as well as to exercise, at any time, the following rights (collectively, the “Rights“):

1. the “right of access” and specifically to obtain confirmation of the existence or otherwise of personal data concerning him/her and their communication in intelligible form;
2. the “right to rectification“, i.e. the right to request the rectification or, if interested, the integration of personal data;
3. the “right to erasure“, i.e. the right to request the cancellation, transformation into anonymous form of personal data processed in violation of the law, including those whose retention is not necessary in relation to the Purposes for which the personal data were collected or subsequently processed;
4. the “right to restriction of processing“, i.e. the right to obtain from the Data Controller the limitation of processing in certain cases provided for under the Privacy Legislation;
5. the “right to data portability“, i.e. the right to receive (or to transmit directly to another data controller) personal data in a structured, commonly used and machine-readable format;
6. the “right to object“, i.e. the right to object, in whole or in part:

• to the processing of personal data carried out by the Data Controller for its own legitimate interest;
• to the processing of personal data carried out by the Data Controller for marketing or profiling purposes.

In the above cases, where necessary, the Data Controller will inform the third parties to whom the Data Subject’s personal data are communicated of the possible exercise of the rights, except in specific cases in which this is not possible or is too burdensome and, in any case, in accordance with the provisions of the Privacy Legislation.

It is expressly understood, as provided for in Article 21 of the GDPR, that in the event of the exercise of the right to object by the Data Subject, the Data Controller will refrain from further processing the personal data unless the Data Controller demonstrates the existence of compelling legitimate reasons for proceeding with the processing that prevail over the interests, rights and freedoms of the Data Subject or for the ascertainment,  the exercise or defence of a right in court.

The exercise of the foregoing rights is not subject to any formal constraint and is free of charge. the Data Controller may possibly require Data Subjects to verify their identity before taking further action following the request to exercise the aforementioned rights.

In any case, as provided for by Article 38 of the GDPR, the Data Subject may freely contact the DPO for all matters relating to the processing of his/her personal data and/or if he/she wishes to exercise his/her Rights:

• by ordinary mail, to the address of the registered office of Recordati Industria Chimica e Farmaceutica S.p.A., with registered office in Milan, Via Matteo Civitali 1;
• by e-mail to the DPO: .

In the event of the death of the Data Subject, the rights relating to his/her personal data may be exercised by anyone who has a personal interest, or acts to protect the Data Subject as his/her representative, or for family reasons worthy of protection. The Data Subject may expressly prohibit the exercise by its assignees of some of the above rights by written communication to be sent to Recordati at the addresses described above. You can revoke or change this intention at any time, following the same procedure.

 

10. Complaint

The Data Controller informs the Data Subject that, pursuant to the Privacy Legislation, he/she has the right to lodge a complaint with the competent Supervisory Authority (in particular in the Member State of his/her habitual residence, place of work or place of the alleged violation), if he/she is of the opinion that his/her personal data are processed in such a way as to involve violations of the GDPR. In addition, the Data Subject may contact the competent Supervisory Authority in the event that the exercise of his/her rights is subject to delay, limitation or exclusion by the Data Controller.

In order to facilitate the Data Subject, the name and contact details of the European Union Supervisory Authorities are available at the following link: Our Members | European Data Protection Board (europa.eu).

Finally, if the Data Subject intends to lodge a complaint with the competent Supervisory Authority for the Italian territory (i.e. Garante per la Protezione dei Dati Personali), the complaint form is available at the following link: Garante – Complaint form.

 

11. Update and revision

This information may be subject to amendments and additions.

Last updated: January 2026