INFORMATION OBLIGATION

Prepared in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "GDPR")

In accordance with the provisions of Articles 13 and 14 of the GDPR, Chiesi Poland Sp. z o.o., located at Al. Jerozolimskie 134, Warsaw 02-305 (hereinafter "Chiesi"), as the data controller, wishes to provide you with detailed information on the ways in which it will process your personal data, which will be collected during promotional activities and activities related to the dissemination of medical and scientific information conducted by Chiesi. Therefore, we kindly ask you to thoroughly read the content of this information.

CATEGORIES OF PROCESSED PERSONAL DATA

Personal data that will be processed may be collected directly from you or from external entities providing services related to databases that collect and process data in accordance with legal regulations. The personal data that will be processed may include the following:

• Your name, surname, gender, contact details (e.g., address, phone number, email address);
• Your academic title, additional information about professional qualifications (e.g., specialization details, professional license number, academic degree), professional work, area of expertise, lectures, and publications; as well as information regarding registration in the medical register and the registration date;
• Your business contact details (e.g., address, phone number, email address), office hours; approximate number of patients;
• Your preferences regarding our informational materials.

(hereinafter collectively referred to as "Personal Data")

The Personal Data we process does not include special categories of personal data (such as health information). We may collect your signature using electronic devices, but in such cases, we will not process special categories of personal data as none of the devices collect biometric data.

PURPOSES OF DATA PROCESSING

Personal data will be processed as part of our company's normal activities to achieve the following purposes:

1. Managing relationships resulting from promotional activities and activities related to the dissemination of medical and scientific information in accordance with applicable laws and deontological principles governing such activities;
2. to comply with obligations laid down by law, regulation, European Union legislation, as well as regulations issued by competent authorities or supervisory bodies, in particular in the field of pharmacovigilance (e.g. to inform about the withdrawal of medical products, pharmacovigilance and drug safety, communication on adverse reactions, etc.);
3. for promotional purposes in connection with the provision of information on our medicines and medicinal products as well as events, professional training, seminars, conferences and courses and medical and scientific information that does not relate to our medicinal products, which are transmitted by e-mail or telephone;
4. organizational activities related to informing about our initiatives and programs, also undertaken at the corporate level (e.g., related to corporate social responsibility, scientific research, patient support programs) through email and telephone;
5. to define your areas of scientific and technical interest and your professional profile, based on indicative estimates made by members of our staff who meet with you, also using anonymous market data, with reference to your interest in therapeutic areas of relevance to Chiesa and possible therapeutic choices, taking into account your professional activities and your current and potential patients, in order to: (i) facilitate the scheduling of appointments and improve the effectiveness of scientific information provision and drug promotion activities carried out by our medical representatives and by employees authorised by our company, (ii) optimise scientific information provision services through interactions aimed at genuinely satisfying the need to provide scientific training to the doctor, in order to better protect public health, avoiding any kind of information overload that may impair the perception of the messages communicated about the medicinal product or the periodic training of the doctor;
6. to share your data with other companies in the Chiesi group exclusively for internal administrative and management purposes;
7. to carry out satisfaction surveys in the area of your collaboration with Chiesi, in particular in the field of promotional visits, webinars and conferences. Your data may be processed in the framework of a subsequent contact with you in order to improve the level of satisfaction of your cooperation with Chiesi.

We would like to inform you that the processing of your personal data is based on:

1. Article 6(1)(c) of the GDPR for the processing operations described in points (a) and (b), as necessary for compliance with legal obligations, regulations, and European Union legislation that are incumbent on the controller, particularly concerning pharmacovigilance;
2. Article 6(1)(f) of the GDPR for the processing operations described in points (b), (c), (d), and (g), where our legitimate interest is to send you scientific information, conduct promotional communication, carry out market research, and define your scientific and technical interests;
3. Article 6(1)(f) of the GDPR for the processing operations described in point (e), where our legitimate interest is to transfer personal data within the corporate group in accordance with Recital 48 of the GDPR. Providing the data is voluntary but necessary for optimizing internal administrative and organizational activities.

DATA RECIPIENTS

Personal data provided to us by you or obtained by us in other ways in the course of our activities may be processed in paper form, in an automated manner, or electronically, in accordance with applicable laws and regulations, within procedures strictly related to the purposes described above. These procedures may include any operations described in Article 4(2) of the GDPR, with particular emphasis on the principles of data minimization and storage limitation.

Personal data will be stored for the period necessary to achieve the purposes for which it was collected, but no longer than 8 years. When personal data is no longer needed, we will delete it or anonymize it so that it is no longer possible to identify an individual based on it. An additional retention period may result from applicable legal provisions.

For processing operations based on consent, personal data will be stored until the consent is withdrawn, unless otherwise provided by relevant legal regulations.

RIGHTS OF DATA SUBJECTS

The data controller has appointed a Data Protection Officer, who can be contacted at the following address: dpo@chiesi.com