PRIVACY POLICY

Please read carefully the Privacy Policy before you accept it. Basic information related to data protection is included below:

Basic information related to data protection
Data Controller	Exeltis Pharmaceuticals Holding, S.L.
Purposes	Identify the user when contacting us through the contact forms.
	User registration.
	Sending commercial communications or invitations.
	Marketing.
	Information about the use of our Website.
	Services Maintenance and optimization.
	Comply with legal obligations.
Legitimation	Consent
	Legal Obligation
	Legitimate Interest
Recipient	Service Providers
	Insud Pharma Group
	Law enforcement agencies or other government authorities, when required by law
Rights	In order to exercise your rights of access, objection, rectification, erasure, restriction of processing and other please contact us through dataprotection@insudpharma.com.
Additional Information	To complete the basic information, please visit our Privacy Policy.

☐ I accept the Privacy Policy.

☐ I accept to receive commercial communications, events and newsletters of Exeltis Pharmaceuticals Holding, S.L. and Insud Pharma Group subsidiaries by any means, including electronic ones.

☐ I confirm I am a healthcare professional qualified to prescribe or dispense medications.

PRIVACY POLICY

General

This Privacy Policy describes how Exeltis Pharmaceuticals Holding, S.L. and all its subsidiaries located in Spain, EU or third countries (hereinafter, jointly referred to as “Exeltis”) manage and process the information collected from you (the “User”) when registering or navigating through the website http://insudpharma.cloudappi.net/slindacom/ (hereinafter, the “Website”), owned by Insud Pharma, S.L.U. Please read carefully this Privacy Policy as it contains important information concerning the personal data of Users and how we use it.

Exeltis and all its subsidiaries located in Spain, EU or third countries are globally known as Insud Pharma Group (hereinafter, “Insud Pharma Group”). Please find additional information about Insud Pharma Group and a non-exhaustive list of Exeltis subsidiaries here.

Exeltis dedicates all its efforts to respect the privacy and security of the Users and undertakes to use personal data in accordance with the General Data Protection Regulation («GDPR«) and national data protection law.

The identification of the data controller is the following:

Corporate name	Exeltis Pharmaceuticals Holding, S.L.
Registered office	Calle Manuel Pombo Angulo, 28 3ª planta 28050 Madrid, España.
Tax Identification Number	B-86841079
Telephone	+34 917711500
Email	dataprotection@insudpharma.com
Companies House Information	Commercial Registry of Madrid, Page M-566737, Volume 31.484, Sheet 160

Categories of personal data and purposes of the processing

Users may use some functionalities of the Website without having to provide Exeltis any personal data. However, for certain functions, Users shall provide personal data in order to register for certain services, receive newsletters or other information of interest. In addition to the information you provide directly to Exeltis, we collect certain information when you visit our Website.

Personal data collected through the Website will be duly incorporated in databases under the responsibility of Exeltis which will be registered in Exeltis’ record of processing activities.

We also inform the Users that fields requested in forms marked with an asterisk are mandatory. In this sense, if the requested information is not provided, we will not be able to carry out the service.

Below, we have specified the categories of personal data we collect, the purposes for which we use such data and how long we will keep the personal data:

Users communications and customer service

This category includes any personal data provided by the User during their communications with Exeltis for the purpose of solving any incident or claim. In this sense, if the User has made any request or suggestion through our contact forms, we will process the personal data in order to answer it.

The legal basis for the processing of these personal data is consent when the Users provide their data through the contact forms.

User registration

In order to access the Website, it is necessary to create a user account. For this purpose, Users should provide Exeltis with certain personal data, such as (i) name and surname; (ii) e-mail address; (iii) country from which User is accessing to the Website; (iv) user name and password; and (v) medical or health speciality.

These personal data are necessary to manage the access to the Website, and in order to properly provide Users with the services and functionalities included in it.

The legal basis for the processing of these personal data is consent, when the User provides his or her personal data spontaneously or through the specific form.

Newsletter and commercial communications

If you subscribe to any of our notification or messaging services, we will use the email address provided by the User to provide the service. If the User has subscribed to any product, service or functionality, we may also communicate with the User to inform him or her of other similar products that may be of interest.

If the User no longer wishes to receive e-mails, he or she may unsubscribe at any time by using the opt-out feature enabled in each e-mail message or by contacting us at dataprotection@insudpharma.com.

The legal basis for this processing is consent, when the User checks the box implemented in the specific forms. Likewise, Exeltis, based on its legitimate interest, may send the Users or customers information about our products. We will delete your email address once you have opted-out, unless it is also used for any other purposes listed in this Privacy Policy.

Marketing

Information about Users online searches (clicks and views), settings on our Website, requests for information and / or their contact history may be subject to processing by Exeltis. This information allows us to use different means to manage the relations with our customers and commercialize our products and services through e-mail or online advertising which may include customizing the content of the Website and offers in order to suit User preferences.

Users may at any time object to this processing (for more information on how to do this, please read sections 7 and 8).

We use this personal data based on our legitimate interest in order to improve our products and services. Personal data will generally be deleted or anonymised 1 month after your last visit to our Website, except where we are legally required to keep the personal data or where it is retained for any other purpose.

Information about the use of our Website

Exeltis collects information automatically obtained by the Website related to the identification of the User’s computer equipment, use and navigation habits.

Said information includes data regarding language, pages or sections of the Website, keywords, date, time, amount of time the User expends in certain types of webpages, which section of the page he has visited, and similar information related to the use of the Website. Exeltis may collect this information using cookies. To obtain additional information please visit our Cookies Policy.

We use this personal data based on our legitimate interest in order to improve our products and services. We will keep the Personal Data for 1 month from the date of the last visit to the Website.

Exeltis may combine your personal data with other information provided by the User or collected from the Website as above mentioned. In those cases, all combined information will be processed as personal data during the period the information remains combined.

Website maintenance and optimization

Users’ personal data will also be used for the maintenance and analysis of our Website, solve any problem, improve availability and protect the Website against fraud (e.g. in case of repeated log attempts or non-compliance with our terms and conditions, e.g. by persons under the age of 18). Analytics also allow us to check whether the online services we offer work effectively in order to improve them whenever possible.

The use of User’s personal data for these purposes is necessary based on our legitimate interest and will be retained for a maximum period of 6 months.

Comply with our legal obligation

We may need to process your personal data to comply with legal obligations binding or accepted by us. Likewise, we may need to provide information to and as required by local law enforcement agencies, other government authorities, or otherwise required by law or to protect the rights and safety of our property, company, employees and customers.

How we share personal data

Sometimes it is necessary to share your personal data with other Exeltis subsidiaries, companies of the Insud Pharma Group or third parties in order to guarantee the correct provision of the services. We may share such information with the following:

• Insud Pharma Group companies due to the use of shared computer systems, which may be located in the European Economic Area (EEA) or in third countries, as well as to offer the products and services from the specific country from which the Users access.

• Business partners who offer products or services jointly with Exeltis.

• Service providers, to the extent necessary for the provision of a service.

Such entities may be located in Spain, other countries in the EEA or anywhere else in the world. When we keep personal data outside the EEA, we guarantee an adequate level of protection of the transferred data. To this purpose, we require service providers to take appropriate measures to protect the confidentiality and security of personal data.

For example, for services provided by providers outside the European Economic Area, we use Standard Model Clauses approved by the European Commission.

Exeltis may disclose User’s personal data to any public administration, when required by law and compelled to do so by such authorities. All data communications will always be carried out in compliance with the GDPR and the national data protection law.

Security

Exeltis cares to ensure the security and confidentiality of the Users personal data. Therefore, we have taken several security measures and technical means to prevent the loss, misuse or access to the personal data without the User permission in accordance with GDPR and the national data protection law.

Nevertheless, it is also the User responsibility to control his or her personal information, therefore Exeltis asks and encourages all Users to be careful sharing information and content. Exeltis shall not control the content and information the User chooses to share with other Users and, therefore, Exeltis is not responsible for the consequences of the Users own actions.

Exeltis pledges (i) to act rapidly and in a responsible manner in the event the Users personal data security is deemed at risk, and (ii) to report it if relevant with the greatest diligence.

In case of a personal data breach, Exeltis undertakes to notify the Spanish Data Protection Agency or the relevant data protection authority without undue delay after becoming aware of such breach. Likewise, when the personal data breach is likely to result in a high risk to the rights and freedoms of Users, Exeltis will communicate the personal data breach and the measures taken to mitigate the risks and adverse effects to Users.

Cookies

Much of the information referred to in this Privacy Policy is collected through the use of cookies. Cookies are small text files containing small amounts of information that are downloaded and can be stored on your user device, for example, your computer, smartphone or tablet. These cookies are sometimes necessary to remember your account settings, language and country, but they also allow us to track and analyse Users behaviour on our Website and to display personalised advertisements on our Website or on third party websites. Where necessary, you will be asked to consent to the use of cookies. To obtain additional information on how cookies are used in the Website and its deactivation please visit the Cookies Policy.

Minors

The Website is not intended to be used by persons under the age of 18. Under no circumstances Exeltis will voluntarily collect personal data from persons under the age of 18.

Users rights concerning data protection

At any time, Users may exercise before Exeltis their data protection rights, in particular the right of access, rectification, restriction of processing, erasure, objection and portability pursuant to the applicable legislation. This means Users can ask what personal data we have about them, update, or they can request that Exeltis stops using data for a specific purpose, or simply require Exeltis to delete all personal data from our files and databases among other.

In the event the User decides to object to the processing of the personal data, Exeltis will no longer process personal data in connection to such User. Personal data may still be processed for the purposes established in data protection legislation or bring defence against legal claims.

After the User exercises any of the abovementioned rights, and during Exeltis verification period, all personal data will be kept blocked. The blocking procedure will prevent Exeltis from processing or erasing such personal data.

For the exercise of any of the abovementioned rights, the User shall contact Exeltis by email, addressing the request to dataprotection@insudpharma.com, indicating as reference: “EXERCISE OF RIGHTS – Name of website” and identifying at the right to be exercised. In addition, Users may also lodge a claim before the Spanish Data Protection Agency (www.aepd.es) or the relevant data protection authority if they consider that we have not processed their personal data in accordance with the regulations.

Users erasure right

As User, at any time you have the possibility to exercise your right to object to the processing of your personal data by sending an email todataprotection@insudpharma.com with the subject “DATA ERASURE”.

Privacy policy updates

Exeltis reserves the right, at our sole discretion, to modify or replace this Privacy Policy. Your continued use of the Website after any such changes constitutes your acceptance of the new Privacy Policy.

Please review this agreement every so often in order to acknowledge any possible modifications. If you do not accept this document, partially or as a whole, or any subsequent modification, please refrain from the use, access or continue to access the Website or discontinue any use of the Website immediately.

Contact

If you have any further questions about the use of your personal data or about our Privacy Policy, you can contact Insud Pharma’s Group DPO by email through dataprotection@insudpharma.com.

COOKIES POLICY

We inform you that Exeltis uses a technology called “Cookies” with the purpose of facilitating User’s navigation and providing him information during their use of our Website.

In Exeltis we fulfil with the national electronic communications law and in particular with those provisions related to the use of Cookies. Users will be able to find in this Cookies Policy information related to the types of Cookies that we use, the purpose for their use and the different options for managing or deleting them. If you require additional information on Cookies that are used in the Website, please contact by email dataprotection@insudpharma.com.

What are cookies?

A Cookie is a file that may be stored on your computer or mobile device with the purpose of storing data that may be updated and recovered by the company responsible for its installation, this is Exeltis. This may include pages you have visited, choices you have made from menus, any specific information you have entered forms and the time and date of your visit. Depending on their use and content, cookies may be used to recognize the User.

What types of cookies do we use and for what purpose?

When navigating through the Website, Users are using cookies from Exeltis and from third parties. Third party cookies are those that are managed by service providers external to Exeltis. Our Website uses the following Cookie types:

1. Technical and Personalization Cookies are required to allow the User to use different options or services offered in the Website. If these Cookies are disabled, you will not be able to properly receive our contents or services.

1. • Login Cookies designed to collect and store data while the User accesses the Website. They are usually used in the context of the provision of a service requested by the User on a single occasion.

• • Permanent Cookies or persistent Cookies are data files capable of providing services with user preferences, settings and information for future visits. Persistent cookies provide convenient and rapid access to familiar objects, which enhances the user experience.

1. Analytics Cookies, these Cookies are used to tracking and analysing user’s behaviour. If these Cookies are disabled, the Website will continue functioning, notwithstanding the information collected by these Cookies allows us to improve our Website.

Cookie Type	Description	Company	Third party services
TECHNICAL	These Cookies are essential to improve your navigation experience and the proper functioning of our Website. The Cookies are essential for remembering previous settings so you do not have to reconfigure them every time you visit us.	[*]	[To complete by IT*]
LOG	These Cookies are created when you register or log in into our Website.	[*]	[To complete by IT*]
ANALYTICS	These Cookies collect information related to your navigation experience in our Website anonymously. We are able to quantify how many visitors reach the Website or the most viewed contents.	[*]	Google Analytics [To complete by IT*]]
SOCIAL	Each social network uses its own cookies so that you can click on “Like” or “Share” buttons.	[*]	[To complete by IT*]]
BEHAVORAL ADVERTISING	They allow the management of Website advertising spaces. They store information on the behaviour of users obtained through continuous observation of their browsing habits, which allows the development of a specific profile to show advertising according to it.	[*]	[To complete by IT*]]

When do I consent to the use of cookies?

When Users reach our Website and before starting their navigation, they will be warned about the use of Cookies, so that Users can give their consent in relation to our Cookies Policy, by clicking on accept the installation of cookies. If the Users do not accept the use of Cookies they must stop navigating and leave the Website or follow the browser instructions to disable Cookies, as explained below.

Data protection and Cookies

Exeltis by automatically obtaining information from the Website through cookies, may collect personal data from Users, relating to their computer device, use of the Website or their patterns of behaviour. This information may include data concerning the language, keywords, date, time, how long the User spends on certain types of pages, IP address, advertising identifier, what section of the page the User has visited and similar information concerning the use of the Website. Exeltis may collect such information using cookies.

In this sense, regarding information that identifies or makes identifiable Users, the provisions of the Privacy Policy shall apply. For any questions about how long we keep the personal data obtained through Cookies, or if Users wish to exercise the rights of access, rectification, erasure or objection, they may consult the Privacy Policy or contact us at the following address dataprotection@insudpharma.com.

How may I disable and block cookies?

At any time, the User will be able to disable Cookies and continue navigating, although navigation will be limited and could be blocked at some point. The User may be able to block or disable them in the browser settings, which permits to reject the installation of all the Cookies or part of them. Most browsers allow the possibility of informing of the existence of Cookies or reject them automatically. If you reject Cookies, you will be able to continue using our Website, although some functionality will be limited negatively impacting on your experience in our Website.

In order to not being tracked by Google Analytics in the Website, visit the following link:

https://tools.google.com/dlpage/gaoptout?hl=es.

Unless Users have adjusted the settings of your browser, our systems will create Cookies when accessing to the Website and accept our Cookies Policy. Please note that all browsers allow the possibility of adjusting their settings for that matter.

In order to obtain more information related to the way of adjusting the settings of each browser, please visit the following links:

Internet Explorer:

http://support.microsoft.com/kb/196955

http://support.microsoft.com/kb/283185

http://www.allaboutcookies.org/manage-Cookies/internet-explorer7- plus.html

http://www.allaboutcookies.org/manage-Cookies/internet-explorer8- plus.html

http://windows.microsoft.com/is-IS/windows7/How-to-manage-Cookies-in-Internet-explorer-9

Firefox:

http://support.mozilla.org/en-US/kb/cookies

Chrome:

http://support.google.com/chrome/bin/answer.py?hl=en&answer=95647

Safari:

http://support.apple.com/kb/PH5042

iOS:

http://support.apple.com/kb/HT1677)

How may I revoke my consent?

User will be able, at any moment, to revoke his or her consent related to use of Cookies, in order to do so User will have to delete all Cookies stored in his or her computer or mobile device through the settings menu of the Internet browser.

Nevertheless, we inform you that deleting or disabling Cookies may affect to the functionalities of our Website and limit the access to certain areas or functionalities provided through the Website.