Privacy Policy

Data controller: GRUPO CANTABRIA LABS

Holder: Industrial Farmacéutica Cantabria, S.A., parent of GRUPO CANTABRIA LABS (hereinafter, “GRUPO CANTABRIA LABS”). Address: Calle Arequipa, 1, 5a pl. – 28043 Madrid CIF tax ID code: A39000914 Registration: Registered in the Commercial Register of Cantabria: Companies Book 22, Folio 105, Sheet 1151, Entry no.1 Email contact: lopd@cantabrialabs.es

Other GRUPO CANTABRIA LABS companies

Baruma, S.L. C/ Arequipa, 1, Madrid CIF: B80592413

Dunar, Srl C/Pirita, 9 Torrejón de Ardoz, Madrid CIF: B81045692

CELLHELIX, S.L. Av/ Cardenal Herrera Oria, 95, Santander, Cantabria CIF: B839772488

Pursuant to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and any other applicable relevant and current legislation, you are hereby informed that the personal data you supply will be processed by the controller for the following purposes, depending on the case:

1.- Contact person data (contact form)

Controller: GRUPO CANTABRIA LABS Purpose: To answer the query in the contact form. We hereby inform you that GRUPO CANTABRIA LABS may send you information that could be of interest to you. You can unsubscribe at any time by writing to lopd@cantabrialabs.es Legitimacy: The express consent to the processing of your data to send you information that you requested by completing and sending the form with your query, expressly declaring that you are aware of and understand this Privacy Policy. Term: The data you supply will be processed for the time strictly needed to attend to your request unless you indicate to GRUPO CANTABRIA LABS that you do not wish to receive commercial information and seek its removal, and without prejudice to it being kept for as long as the legal obligations applicable to GRUPO CANTABRIA LABS persist. Recipients: GRUPO CANTABRIA LABS will not assign your data to third parties unless it needs to disclose them to other GRUPO CANTABRIA LABS companies to attend to your request. Rights: We hereby inform you of your rights to access, rectification, erasure, objection, restriction of processing and portability with respect to your personal data and that you may exercise these rights by writing to: Att Legal Department, C/ Arequipa 1, 5º planta, 28043 Madrid, or emailing: lopd@cantabrialabs.es

2.- Data for training course participants

Controller: GRUPO CANTABRIA LABS Purpose: To manage your registration and participation in the related training course. We hereby inform you that GRUPO CANTABRIA LABS may send you information that could be of interest to you. You can unsubscribe at any time by writing to lopd@cantabrialabs.es Legitimacy: The express consent to the processing of your data to manage your participation in the training course, by completing and sending the form expressly declaring that you are aware of and understand this Privacy Policy. Term: The data you supply will be processed for the time strictly needed to attend to your request unless you indicate to GRUPO CANTABRIA LABS that you do not wish to receive commercial information and seek its removal, and without prejudice to it being kept for as long as the legal obligations applicable to GRUPO CANTABRIA LABS persist. Recipients: GRUPO CANTABRIA LABS will not assign your data to third parties unless it needs to disclose them to other companies for the proper development of the related course. Rights: We hereby inform you of your rights to access, rectification, erasure, objection, restriction of processing and portability with respect to your personal data and that you may exercise these rights by writing to: Att Legal Department, C/ Arequipa 1, 5º planta, 28043 Madrid, or emailing: lopd@cantabrialabs.es

3.- Data concerning customers and/or service providers

Controller: GRUPO CANTABRIA LABS Purpose: Processing required to implement a contract you are a signatory to. We hereby inform you that GRUPO CANTABRIA LABS may send you information that could be of interest to you. You can unsubscribe at any time by writing to lopd@cantabrialabs.es Legitimacy: We hereby inform you that the legal basis for the lawfulness of processing your data with this purpose is GRUPO CANTABRIA LABS’ legitimate interest. Term: The data you supply will be processed for the time strictly needed to attend to your request unless you indicate to GRUPO CANTABRIA LABS that you do not wish to receive commercial information and seek its removal, and without prejudice to it being kept for as long as the legal obligations applicable to GRUPO CANTABRIA LABS persist. Recipients: GRUPO CANTABRIA LABS will not assign your data to third parties unless it needs to disclose them to other GRUPO CANTABRIA LABS companies for correct service provision. Rights: We hereby inform you of your rights to access, rectification, erasure, objection, restriction of processing and portability with respect to your personal data and that you may exercise these rights by writing to: Att Legal Department, C/ Arequipa 1, 5º planta, 28043 Madrid, or emailing lopd@cantabrialabs.es

4.- Applicant data

Controller: GRUPO CANTABRIA LABS Purpose: If you have supplied your data to a GRUPO CANTABRIA LABS company as a potential applicant to join one of the group’s companies, we hereby inform you that GRUPO CANTABRIA LABS will use the data exclusively to manage your application for the vacancy that may exist in a GRUPO CANTABRIA LABS company. Legitimacy: The express consent to the processing of your data to manage your application to one of the vacancies that may exist in a GRUPO CANTABRIA LABS company that you provided by completing and sending the form, expressly declaring that you are aware of and understand this Privacy Policy. Term: The data will be kept for twenty-four (24) months, so long as you do not seek its erasure prior to this and without prejudice to it being kept for as long as the legal obligations applicable to GRUPO CANTABRIA LABS persist. Recipients: GRUPO CANTABRIA LABS will not assign your data to third parties except for disclosing it to other GRUPO CANTABRIA LABS companies and only if your profile meets one of the group companies’ needs and exclusively for that purpose. Rights: We hereby inform you of your rights to access, rectification, erasure, objection, restriction of processing and portability with respect to your personal data and that you may exercise these rights by writing to: Att Legal Department, C/ Arequipa 1, 5º planta, 28043 Madrid, or emailing lopd@cantabrialabs.es

5.- Complaints

Controller: GRUPO CANTABRIA LABS Purpose: If you have filed a complaint for any reason regarding any GRUPO CANTABRIA LABS company, we hereby inform you that your data will be used exclusively to settle your complaint. Legitimacy: The express consent to the processing of your data to settle your complaint that you provided by completing and sending the form, expressly declaring that you are aware of and understand this Privacy Policy. Term: The data you supply will be processed for the time strictly needed to attend to your request unless you seek its removal and without prejudice to it being kept for as long as the legal obligations applicable to GRUPO CANTABRIA LABS persist. Recipients: GRUPO CANTABRIA LABS will not assign your data to third parties except for disclosing it to other GRUPO CANTABRIA LABS companies if the complaint makes this necessary and exclusively for that purpose. Rights: We hereby inform you of your rights to access, rectification, erasure, objection, restriction of processing and portability with respect to your personal data and that you may exercise these rights by writing to: Att Legal Department, C/ Arequipa 1, 5º planta, 28043 Madrid, or emailing lopd@cantabrialabs.es

6.- Newsletters

Controller: GRUPO CANTABRIA LABS Purpose: If you signed up to a newsletter delivery service or the sending of commercial information by any of the GRUPO CANTABRIA LABS companies, we hereby inform you that your data will be used for the sole purpose of keeping you informed of this activity. You can unsubscribe at any time by writing to lopd@cantabrialabs.es. Legitimacy: We hereby inform you that the legal basis for the lawfulness of the data processing with this purpose is the consent you provided by completing and sending the form, expressly declaring that you are aware of and understand this Privacy Policy. Term: The data you supply will be processed for the time strictly needed to attend to your request unless you indicate to GRUPO CANTABRIA LABS that you do not wish to receive commercial information and seek its removal, and without prejudice to it being kept for as long as the legal obligations applicable to GRUPO CANTABRIA LABS persist . Recipients: GRUPO CANTABRIA LABS will not assign your data to third parties. Rights: We hereby inform you of your rights to access, rectification, erasure, objection, restriction of processing and portability with respect to your personal data and that you may exercise these rights by writing to: Att Legal Department, C/ Arequipa 1, 5º planta, 28043 Madrid, or emailing lopd@cantabrialabs.es.

7. – Pharmacovigilance, cosmetovigilance and market surveillance (hereinafter “Surveillance”)

CANTABRIA LABS takes the safety of its products and data protection seriously. Industrial Farmacéutica Cantabria, S.A. and its affiliated companies (hereinafter referred to as “CANTABRIA LABS”) develop and market prescription medicines, over-the-counter medicines, medical devices, cosmetics intended for use on humans, as well as food supplements (hereinafter referred to as “CANTABRIA LABS products”). We must monitor the safety of all CANTABRIA LABS products that we develop or market in any country. Our Pharmacovigilance, cosmetovigilance and market surveillance obligations require us to process certain data that directly or indirectly identify the individual (hereinafter “personal data”) in relation to the patients affected by the adverse events we receive and the individuals who report them. This allows us to meet the stringent requirements that require us to continuously assess the benefits and risks of CANTABRIA LABS products and to report suspected adverse events or reactions to the relevant regulatory bodies. This Statement on Data Protection in the field of Pharmacovigilance, Cosmetovigilance and Market Surveillance (hereinafter the “Statement”) contains important information for you on how we process personal data for Pharmacovigilance, Cosmetovigilance and Market Surveillance purposes within the framework of our obligations under the applicable data protection legislation. All personal data are processed exclusively for the purposes of Surveillance and only where relevant and appropriate to properly document, assess and report the adverse event you have submitted in accordance with our Surveillance obligations. If you have any questions about this Statement or how we use your personal data, please contact us using the contact details at the end of this Statement. 7.1. Categories of data We may need to process (including collecting, storing or otherwise using) the following personal data: Relating to the Patient / User: – first name and surname / initials – date of birth / age group, gender, weight, height; – health information, medical history and health status, which, for example, may include:

• details of the CANTABRIA LABS product that is suspected to have caused the adverse event, such as the dose administered or prescribed,
• the reason for the administration or prescription of the CANTABRIA LABS product and any changes to your usual dosing schedule;
• details of other medicines or products you are currently taking or were taking at the time of the adverse event, including the doses administered or prescribed, how long you have been taking the medicine, why you were taking it and any changes to your usual dosing schedule;
• details of the adverse event experienced, the treatment received in relation to the adverse event and any possible long-term effects on his/her health as a result of the adverse event;

Concerning the Notifier: – name and surname; – contact details (e.g. name, e-mail address, telephone number, fax number); profession (this may determine the questions to be asked in relation to an adverse event, depending on the degree of medical expertise assumed); – relationship with the subject of the report. 7.2.- Purpose Within the framework of the fulfilment of our obligations under the Oversight obligations, we may process personal data in order to: – investigate the adverse event; – contact you to obtain further information about the adverse event reported; – cross-check the adverse event information with information on other adverse events received by CANTABRIA LABS to analyse the safety of a production batch, a CANTABRIA LABS product or an active substance as a whole; and – to submit the mandatory reports to national or regional regulatory bodies to enable them to analyse the safety of a production batch, a CANTABRIA LABS health product, a generic product or an active substance as a whole; 7.3.- Transfer of personal data In the context of fulfilling our Surveillance obligations, we may share or disclose personal data: – within the CANTABRIA LABS group, in order to analyse and process a reported adverse event; – with the competent regulatory bodies, in relation to suspected adverse events; – with external service providers of the CANTABRIA LABS group, such as safety database providers, call centre operators and, in the event that you have communicated the details of your suspected adverse reaction to our sales representatives, the sales network service company concerned. We maintain appropriate data protection safeguards with those service providers with whom the CANTABRIA LABS group shares personal data and who perform services or tasks on our behalf; – with other pharmaceutical companies that have marketing or distribution agreements or other licensing agreements with the CANTABRIA LABS group, in the event that FV obligations relating to a CANTABRIA LABS product require such exchange of security information. Please note that we maintain appropriate data protection safeguards with those business partners with whom the CANTABRIA LABS group shares personal data and who perform services or tasks on our behalf; – with a third party in the event of the sale, assignment or transfer of a particular CANTABRIA LABS product or related project or therapeutic area, in which case we would require the purchaser, assignee or transferee to handle the personal data in question in accordance with applicable data protection legislation; – where adverse event information (e.g. clinical case studies or abstracts) is published. In such cases we will remove any identifiers from the publication in order to keep your identity confidential. – Third countries. CANTABRIA LABS hosts its Surveillance databases in Spain. However, we may need to transfer your personal data to other members of the CANTABRIA LABS group or to external business partners and regulatory bodies. These may be located in countries for which the European Commission has not decided to ensure an adequate level of data protection (hereinafter “third countries”). Whenever we need to transfer your personal data for monitoring purposes to an external business partner located in a third country we will apply standard data protection clauses adopted by the European Commission as adequate safeguards. 7.4.- Security of your personal data We have implemented appropriate advanced technical and organisational measures to protect the security of personal data processed for Oversight purposes. These measures include safeguards and procedures designed to restrict access to personal data to those employees who need access to it in the performance of their responsibilities. We have physical, electronic and procedural measures in place to protect personal data against accidental loss, destruction or damage and against unauthorised access, use or disclosure. Where reasonably possible we will process personal data in encrypted or pseudonymised form. 7.5.- Retention periods We will use and store your personal data in accordance with legally required requirements for the retention and reporting of Surveillance information. These requirements oblige us to store Surveillance information, which may include personal data, for at least the entire life cycle of the product and until 10 years after the relevant medicinal product or medical device has ceased to be marketed. 7.6.- Legal basis for processing your personal data CANTABRIA LABS processes personal data relevant for the purposes of Surveillance, which includes special categories of personal data and for the purpose of: – investigating the adverse event; – comply with the legal obligations arising from the applicable laws and regulations on Surveillance and its legitimate interests for the purposes of Surveillance, considering that – the legislation on vigilance has been enacted for reasons of substantial public interest in the field of public health and safety of medicinal products or medical devices. 7.7.- Information about your rights You have the right to: – request information about your personal data processed by CANTABRIA LABS; – request correction of your personal data if it is incorrect or incomplete. During the evaluation of such a request, you have the right to restrict the processing of your personal data; – request the transfer of your personal data to you or to another person in a commonly used format; – lodge a complaint with a data protection authority; – object to the processing of your personal data provided that such processing is based solely on the legitimate interest of CANTABRIA LABS; – request the erasure of your personal data if it is no longer necessary for the purposes of processing or if there is no legal basis for further processing. However, these rights may be limited in compliance with Surveillance obligations. Your rights are limited where there is a legal basis for processing your personal data; for example, we cannot delete information collected as part of an adverse event report unless that information is incorrect. We will ask you to identify yourself in a timely manner before granting any request for access to or correction of your personal data. 7.8.- Origin of the data In the event that the personal data have not been obtained from the data subject, CANTABRIA LABS will inform about the source of information through which the data have been received at the time of contacting the data subject. 7.9.- Contacting us If you have any questions regarding surveillance data protection or data protection in general, please use the contact form provided or contact our company’s data protection officer at the following address: Industrial Farmacéutica Cantabria, S.A. Calle Arequipa, nº1, 5ª planta, 28043, Madrid España lopd@cantabrialabs.es Tlf.: 913824022

8.- Draws

Controller: GRUPO CANTABRIA LABS Purpose: To manage your participation in a GRUPO CANTABRIA LABS draw or promotion. We hereby inform you that GRUPO CANTABRIA LABS may send you information that could be of interest to you. You can unsubscribe at any time by writing to  lopd@cantabrialabs.es Legitimacy: The express consent to the processing of your data for this purpose that you provided by completing and sending the form, expressly declaring that you are aware of and understand this Privacy Policy. Term: The data you supply will be kept so long as you do not seek its erasure, without prejudice to it being kept for as long as the legal obligations applicable to GRUPO CANTABRIA LABS persist. Recipients: GRUPO CANTABRIA LABS will not assign your data to third parties. Rights: We hereby inform you of your rights to access, rectification, erasure, objection, restriction of processing and portability with respect to your personal data and that you may exercise these rights by writing to: Att Legal Department, C/ Arequipa 1, 5º planta, 28043 Madrid, or emailing lopd@cantabrialabs.es”>lopd@cantabrialabs.es

9.-Image capture

Controller: GRUPO CANTABRIA LABS Purpose: Images may be used for institutional, training or professional purposes and we guarantee they will never impact your right to honour under the terms provided for in Organic Law 1/1982 of 5 May 1982 on Civil Protection of the Right to Honour, Personal and Family Privacy and One’s Own Image. Legitimacy: The express consent to the processing of your data for this purpose that you provided by completing and sending the form, expressly declaring that you are aware of and understand this Privacy Policy. Term: The data you supply will be kept so long as you do not seek its erasure, without prejudice to it being kept for as long as the legal obligations applicable to GRUPO CANTABRIA LABS persist. Recipients: GRUPO CANTABRIA LABS will not assign your data to third parties. Rights: We hereby inform you of your rights to access, rectification, erasure, objection, restriction of processing and portability with respect to your personal data and that you may exercise these rights by writing to: Att Legal Department, C/ Arequipa 1, 5º planta, 28043 Madrid, or emailing lopd@cantabrialabs.es”>lopd@cantabrialabs.es

Exercise of rights common to all personal data

We also inform you of your rights of access, rectification, erasure, objection, restriction of processing and portability with respect to your personal data and the possibility of revoking consent. To exercise your rights, please write to: Att Legal Department, C/ Arequipa 1, 5º planta, 28043 Madrid, or email  lopd@cantabrialabs.es

Remember you can withdraw your consent at any time.

GRUPO CANTABRIA LABS undertakes to address the requests sent to it either by email or postal mail. GRUPO CANTABRIA LABS will respond within one month starting from receipt of the request. However, there is the possibility of extending this to two months depending on the complexity of the request and the number of requests. We will inform you of this extension within one month of receiving your request.

Data veracity and updating

GRUPO CANTABRIA LABS assumes that the personal data you supply over the different channels is true, is being supplied by you personally, that you are who you say you are, that the data is up to date and that you will report any change to your data when it occurs.

Use of cookies

Click here for information on our use of cookies.

Data on minors

The services provided by GRUPO CANTABRIA LABS are aimed at persons of legal age in accordance with Spanish law. GRUPO CANTABRIA LABS assumes that the individuals who supply data over the different channels (electronic, website, social media) are aged 18 or above.

Data security

GRUPO CANTABRIA LABS has implemented the security measures required by law in its work centres, premises, systems, communication infrastructure, etc. It has also adopted the logical, physical, organisational and contractual measures to prevent unauthorised third-party access, destruction, modification, reproduction, disclosure, transmission or reuse of data.

Privacy policy term and modification

The privacy policy established by GRUPO CANTABRIA LABS is in force from the date of its publication and you are invited to file and/or reproduce it. GRUPO CANTABRIA LABS is authorised to change its privacy policy at any time.