Pursuant to Art. 13 of the EU Reg. No. 679/2016 on the protection of personal data (“GDPR”)

Dear User,

The pharmaceutical company Dompé farmaceutici S.p.A. provides You the following information on the purposes and methods in which we will collect and use Your Personal Data through the website www.exscalate.com (“Website”).

This privacy notice is provided only for the Website and does not apply to other websites that may be accessed through links within the Website.

Identity and Contact Details of the Data Controller and DPO

In this section we indicate to You our references

Dompé farmaceutici S.p.A., with registered office at via San Martino 12, 20122, Milano, Italy, in the person of its pro-tempore legal representative

e-mail: privacy@dompe.com;

DPO: dpo@dompe.com

Purpose and Legal Basis of the Processing

In this section we explain why we collect Your data

Your Personal Data are processed by us:

• without Your consent

ex Art. 6.1 (b), GDPR

(i) for browsing the Website, in relation to the possibility of detecting data necessary at a technical level while browsing the Website itself;

(ii) to respond to Your requests for information and insights regarding the contents of the Website and the projects described therein, as well as for any collaboration requests or partnership opportunities.

ex Art. 6.1 (c), GDPR

for the execution of mandatory legal obligations, deriving from, by way of example, provisions issued by Authorities or by the Judiciary, etc…

Apart from what is specified for the navigation data referred to in the following paragraph, You are free to provide Your Personal Data. However, Your failure to provide it may result in the impossibility of obtaining the information and insights You may have requested.

Categories of Personal Data

In this section we indicate what data we collect

The following categories of data are processed (“Personal Data”):

• navigation data: Internet Protocol Address (IP) or the domain names of the computer used by You that is connected to the Website, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and IT environment.

• data voluntarily provided by You by filling in the “Contact Us” form on the Site, such as (i) personal data (e.g. first name, last name); (ii) contact data (e.g. e-mail address, company/entity of belonging).

• cookies: regarding the cookies processed by the WebSite please refer to the cookie policy available on www.exscalate.com/cookie-policy.

Methods of Data Processing

In this section we indicate how we use Your Personal Data

We process Your Personal Data through the use of supports and / or IT tools, manual and /or telematics, in compliance with adequate technical and organizational security measures.

Recipients or Categories of Recipients of the Data

In this section we indicate who uses Your Personal Data

In relation to the purposes indicated above, Your Personal Data are also processed by:

• as Data Controllers of the processing:

  • police force, whenever this is required by a rule of law or by a provision of a competent authority.

• as Data Processors and Sub-Processors of the processing, appointed pursuant to Art. 28, GDPR:

  • companies of the Dompé Group, located, even outside the EU;

  • companies that provide IT and logistics services functional to the operation of the Website;

  • outsourcing or cloud computing service providers;

  • consultants and professionals used to achieve the purposes described above.

The complete and updated list of data recipients, as well as those authorized subjects pursuant to Art. 29, GDPR, can be requested at the addresses indicated above.

Data Dissemination

In this section we indicate whether Your data is disclosed to indeterminate subjects

Your Personal Data are not subject to disclosure to indeterminate subjects.

Data Transfer Abroad

In this section we indicate if Your data are transferred outside the EU and with what guarantees

Your Personal Data could be disclosed to third parties located in countries outside the European Union. In this case, we guarantee such transfer shall only take place in accordance with the principles expressly established by the GDPR in order to adequately protect the data.

Data Retention Period

In this section we indicate how long we will store Your data

Your Personal Data will be retained for the time necessary to achieve the purposes for which they are processed or to comply with legal obligations.

Your Personal Data will be retained by us for the period of time indicated in the specific collaboration agreement that you may enter into with us or, in the event that Your partnership / collaboration proposals, should not be taken into consideration, Your Personal Data will be deleted within 6 months from when they were collected.

With respect to the navigation data, they will be retained for 30 days.

In the event of a dispute, the retention times indicated above may be extended up to 10 years from the definition of the same.

Rights of the Data Subjects

In this section we indicate which right You enjoy in relation to Your data

At any time, You can obtain confirmation or the existence or not of Your Personal Data with us and to know its content and origin, request its integration or rectification or, in the cases provided for by the law, the portability, limitation of the processing, cancellation of data processed, and to oppose its processing.

The full text of Articles 15 to 22, GDPR can be consulted on the website of the Italian Data Protection Authority (https://www.garanteprivacy.it/web/garante-privacy-en/home_en), or alternatively, is provided by us upon request.

You can exercise Your rights via e-mail at the e-mail address privacy@dompe.com.

Complaint to the Authority

We point out Your rights to be able to contact the Authority

You also have the right to lodge a complaint with the Italian Data Protection Authority if you believe that Your rights have not been respected or that you have not received any response to Your requests according to the law.