Pursuant to the legislation applicable to the protection of personal data (“Privacy Legislation”) including EU Regulation 2016/679 (“GDPR”), Recordati Industria Chimica e Farmaceutica S.p.A provides some information necessary to illustrate how personal data will be processed through the following domain recordati.com (the “Website”).

1. Legal framework

   In accordance with the to current legal framework on the processing of personal data (“Applicable Data Protection Law”), including Regulation (EU) 2016/679 (“GDPR”), as well as Legislative Decree No. 196/2003 as amended by Legislative Decree No. 101/2018 (the “Privacy Code”), Recordati Industria Chimica e Farmaceutica S.p.A. (“Recordati”, or even the “Data Controller”), as Data Controller, provides to healthcare professionals (the “Data Subjects”) the following information on the processing of their personal data (hereinafter the “Personal Data” or even, simply, the “Data”) collected and processed by the Company in the context of carrying out scientific information activities.

   Personal Data will be processed in compliance with the GDPR, the Data Protection Applicable Law and the related applicable decision issued by the Italian Data Protection Authority.

2. Who processes the Data: the Data Controller, the Data Protection Officer, the authorized persons

   The Data Controller is Recordati Industria Chimica e Farmaceutica S.p.A., with registered office in Milan, Via Matteo Civitali 1, enrolled with the Companies’ Register of Milan under no. 00748210150.

   The Data Controller has appointed the Data Protection Officer (the “DPO”), who can be contacted at the following e-mail address: , to whom the Data Subjects can address any request regarding the processing of their Personal Data.

   All Recordati employees/collaborators who access, or will access, the Data operate/will operate under the direct authority of the Data Controller, are/will be appointed, pursuant to art. 29 of GDPR and art. 2-quaterdecies of the Privacy Code, as subjects authorized to process Personal Data and have/will have received adequate operating instructions.

3. Data Processed

   The Data which will be processed are:

   – personal and identification data (name and surname, date of birth, gender, tax code, professional role);
   – contact details (telephone number, e-mail address, professional address);
   – data relating to medical-scientific information visits and interests, as well as any and all additional information that it may possibly provide to the Data Controller during visits and/or interviews with scientific representatives of the Data Controller (such as, by way of example, interests in the scientific, technological or research fields, interests in medical and tech applications and platforms, therapeutical interests and behaviors, interests about the use of digital communication channels and interests in pharmaceutical products).

4. Data Recipients – Data Transfer to Third Countries/International Organizations

   As part of the data processing for the purpose referred to in paragraph above, the data may be disclosed or otherwise made accessible to the companies belonging to the Recordati Group and to third parties such as.

   Where necessary, the Data Controller will appoint third parties as its Data Processors pursuant to Article 28 of the GDPR.

   Data will not be transferred outside the Economic European Area. This said, any Data transfer outside the Economic European Area will be carried out in compliance with the applicable provisions of GDPR.

5. The purposes, the legal bases of the processing and the retention period of the Personal Data
   Recordati will process the Data in accordance for the following purposes (the “Purposes“):
   

   Purposes of the processing	Legal basis of the processing	Nature of the provision of Data	Retention period
   a) Managing of scientific information activities related to products and related activities (such as conducting scientific information visits to clinics and hospital facilities, presentations of medicines, sending of pharmaceutical samples and the activities aimed at planning visits, guiding, guide and monitoring scientific information activities).	Art. 6.1, lett. b) GDPR: performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.	The provision of personal data for the Purposes referred to in Paragraph 4 letter a) is essential for the establishment and performance of the contract stipulated and/or to be stipulated with the Data Subject. Therefore, any refusal by the Data Subject to provide Personal Data, in whole or in part, for the pursuit of the indicated Purposes, will result in the impossibility of establishing and continuing the contractual relationship.	The Data processed for the Purpose referred to in Paragraph 4 letter a) will be stored and processed for the entire duration of the contract and, following its termination, for any reason, for a period not exceeding: – ten (10) years (i.e. the ordinary limitation period), with reference to the Personal Data necessary for any legal and fiscal obligations connected to or deriving from the conclusion of the contract; – five (5) years, for the other Personal Data processed by the Data Controller and for whom a different retention period is provided by law.
   a)b) Managing of scientific information activities via e-mail, Microsoft Teams or other digital or web-based communication tools (including sending invitations to congresses, conventions or medical-scientific meetings organized or sponsored by Recordati).	Art. 6.1 lett. a) GDPR: explicit consent of the Data Subject.	The provision of Data for the Purpose referred to in paragraph 4 letter b) is optional and in the absence or in the event of withdrawal of consent by the Data Subject, Recordati will not be able to manage scientific information by e-mail, SMS, Microsoft Teams or other web-based communication tool.	The Data processed for the Purpose referred to in paragraph 4 letter b) will be kept until the Data Subject exercises the right to revoke the consent given which can take place at any time by contacting the Data Controller and, in any case, for a period of five (5) years from registration within Recordati’s systems.
   a)c) Communicate the Data to the other Recordati Group companies for the performance of their autonomous purposes of providing medical, scientific and promotional information on the products marketed by the Recordati Group.	Art. 6.1 lett. a) GDPR: explicit consent of the Data Subject.	TThe provision of Data for the purpose referred to in Paragraph 4 letter c) above is optional and in the absence or in the event of withdrawal of consent by the Data Subject, Recordati will not communicate the Data to the other companies belonging to the Recordati Group.	The Data processed for the Purpose referred to in paragraph 4 letter c) will be kept until the Data Subject exercises the right to revoke the consent given which can take place at any time by contacting the Data Controller and, in any case, for a period of five (5) years from registration within Recordati’s systems.
   a)d) Managing of profiling activities aimed at improving the medical-scientific information through visits from medical-scientific representatives and/or the sending of communications in line with the interests expressed by Data Subjects and the reporting of scientific events.	Art. 6.1 lett. f) GDPR:legitimate interest of the Data Controller, considered prevailing over the rights and freedoms of Data Subjects, to manage and organize scientific information on medicines aimed at guaranteeing the safe, appropriate and effective use of Recordati medicines. Without prejudice to the right granted to the Data Subject to oppose the performance of profiling activities at any time, reaching the Data Controller using the contacts indicated in paragraph 2 above.	The provision of Data for the Purpose referred to in paragraph 4 letter d) above is optional and in the event of opposition, Recordati will not be able to carry out profiling activities with respect to the Data Subject.	The Data processed for the Purpose referred to in paragraph 4 letter d) will be kept for a period of five (5) years from registration within Recordati’s systems.

   In the event that Recordati intends to process Personal Data for any other purpose incompatible with the Purposes for which they were originally collected or authorized, Recordati will inform the Data Subject in advance and, where required, will request his/her consent for this processing activity.

    

6. Methods of personal data processing
   In relation to the above Purposes, the processing of Personal Data will consist of some of the activities indicated Art. 4.1, no. 2) GDPR, namely: collection, registration, organization, consultation, processing, cancellation and destruction of Personal Data.

   The processing of Personal Data will be based on the principles of lawfulness, correctness, transparency, proportionality and minimization and will be carried out through automated methods and will take place using suitable tools, as far as reasonable and state of the art, to guarantee security and confidentiality through the use of suitable procedures that avoid the risk of loss, unauthorized access, illicit use and dissemination.

   With specific reference to the profiling purposes referred to in paragraph 4 letter d) above, the Data Controller informs the Data Subjects that this activity has the sole purpose of creating specific profiles of the Data Subjects through the analysis and processing of their behavior trends and preferences relating to the medicines produced and marketed by Recordati, as well as the preferences of digital communication channels in order to create homogeneous categories of Data Subjects to whom to address and propose specific promotional activities in line with their preferences.

   Moreover, the aforementioned activity:

   – will not take place on the basis of an automated decision-making process from which legal or similarly significant effects derive for Data Subjects pursuant to art. 22 of the GDPR;
   – will not prejudice the behavior and purchasing choices of the interested parties;
   – will not have a prolonged and permanent impact on Data Subjects, considering that the personal data collected by the Data Controller through its scientific representatives can be updated at any time at the request of the Data Subjects.

7. Data recipients

   Data Controller informs Data Subjects that their Personal Data may be shared or made accessible for the pursuit of the Purposes to further recipients or categories of recipients, as independent data controllers or, where necessary, data processors specifically appointed pursuant to Art. 28 GDPR, which include:

   • suppliers of CRM and related technical assistance and maintenance services;
   • medical sales representatives of Innova Pharma S.p.A.;
   • companies that carry out market analyses/research;
   • communication and event planning agencies;
   • competent authorities by virtue of of law;
   • other companies of the Recordati Group, subject to the consent of the Data Subject.

   The complete list of recipients, including more details on their headquarters, is kept at the headquarters of the Data Controller and can be consulted upon request to be sent to the contact details indicated in the epigraph of this information notice.

   In any case, Personal Data will not be disseminated.

8. Data recipients

   The Data Controller informs the Data Subject that he/she will always have the right to revoke his/her consent at any time, where given, as well as exercise, at any time, the following rights (collectively, the “Rights”):

   a) the “right of access” and specifically obtain confirmation of the existence or otherwise of Personal Data concerning him/her and their communication in an intelligible form;

   b) the “right of rectification” or the right to request the rectification or, if interested, the integration of Personal Data;

   c) the “right to cancellation”, i.e. the right to request cancellation, transformation into anonymous form of Data processed in violation of the law, including data whose retention is not necessary in relation to the Purposes for which the Personal Data were collected or subsequently processed;

   d) the “right to limitation of the processing” or the right to obtain from the Data Controller the limitation of the processing in some cases provided for in accordance with the Data Protection Applicable Law;

   e) the right to request the Data Controller to indicate the recipients to whom he/she has notified any corrections or cancellations or limitations of processing (carried out pursuant to articles 16, 17 and 18 GDPR, in fulfillment of the notification obligation with the exception where this proves impossible or involves a disproportionate effort);

   f) the “right to data portability” i.e. the right to receive (or to transmit directly to another data controller) Personal Data in a structured format, commonly used and readable by an automatic device;

   g) the “right to object”, i.e. the right to object, in whole or in part:

   • to the processing of personal data carried out by the Data Controller for its own legitimate interest;
   • to the processing of personal data carried out by the Data Controller for marketing or profiling purposes.

   In the above cases, where necessary, the Data Controller will inform the third parties to whom the Personal Data of the interested party are communicated of the possible exercise of the rights, with the exception of specific cases in which this is not possible or is too onerous and, in any case, according to the provisions of the Applicable Data Protection Law.

   The exercise of the above rights is not subject to any form constraint and is free of charge. Recordati may possibly ask Data Subjects to verify their identity before taking further actions following the request to exercise the aforementioned rights.

   In any case, as provided for by Art. 38 GDPR, Data Subjects can freely contact the DPO for all questions relating to the processing of their Personal Data and/or if they wish to exercise their rights referred to in paragraph 8 of this information notice:

   – by e-mail to the DPO: .

   The Data Controller informs the Data Subject that, pursuant to the Applicable Data Protection Law, he/she has the right to lodge a complaint with the competent Supervisory Authority (in particular in the Member State of his/her habitual residence, place of work or place of the alleged violation), if he/she is of the opinion that his/her Personal Data are processed in a way in contrast with GDPR.

   In order to facilitate the exercise of the right to lodge a complaint, the name and contact details of the Supervisory Authorities of the European Union are available at the following link: https://ec.europa.eu/justice/article-29/structure /data-protection-authorities/index_en.htm.

   Finally, if the Data Subject intends to lodge a complaint with the competent supervisory authority for the Italian territory (i.e. the Italian Data Protection Authority), the complaint form is available at the following link: https://www.garanteprivacy.it /home/docweb/-/docweb-display/docweb/4535524.

9. Revising and updating
   This information notice may be subject to changes and additions.

   *The European Economic Area (EEA) consists of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Republic of Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain and Sweden.