GDPR INFORMATION NOTICE

for our contractual partners, including suppliers, service providers, sellers and customers

Dear Partner,

  We, SC. BLEU PHARMA SRL, with its registered office in Bucharest, District 2, 201 Barbu Văcărescu Street, 9th floor, registered with the Trade Register under no. J40/10812/2022, Tax Identification No. 46262123, represented by Mr. Tiliuca Bogdan Claudiu Ion, acting as Administrator in our capacity as personal data controller, would like to inform you about the processing of your personal data and the rights you have under the General Data Protection Regulation (“GDPR”).

         This Information Notice applies to the processing of personal data belonging to our contractual partners, including suppliers, service providers, sellers and customers. Our revised practices ensure compliance with the GDPR, and we kindly ask you to review our new Privacy Policy for all relevant information regarding the data we collect, how we use your data and how we keep it secure.

1. What is personal data?

         According to the GDPR, “personal data” means any information relating to an identified or identifiable natural person (referred to as the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular

by reference to an identifier such as a name, identification number, location data, an online identifier or to one or more factors specific to that person’s physical, genetic, mental, economic, cultural or social identity.

2. Information we process

         We process your personal data when you interact with us, for example, information you provide to us through correspondence by telephone, email or any other means, by entering into agreements, submitting requests for quotations, or completing forms such as consent forms.

         The data we process consists only of the information you provide to us and may include your first and last name, correspondence address, email address and telephone number, as well as other information, where applicable

         Customers and other contractual partners who provide us with the personal data of contact persons, such as first name, last name, job title, email address and telephone number, guarantee to our company that they have previously obtained the express and unequivocal consent of those individuals for the processing of their personal data, or that such data has been

provided on the basis of another lawful ground recognized under the GDPR. Our company shall therefore be exempt from any liability in this respect.

We will not process sensitive personal data relating to you, such as information regarding racial or ethnic origin, political opinions, religious beliefs or philosophical beliefs, health, sex life or sexual orientation.

         Furthermore, our company does not process personal data relating to children under the age of 16 without the consent of their parents or legal guardians. Any personal data provided by children under the age of 16 without parental or guardian consent will be deleted immediately.

3. Purposes for which we process personal data

We process your personal data for specified, explicit and legitimate purposes, in compliance with Article 6 of the GDPR, including:

·       performing the agreement concluded with you or taking steps at your request before entering into an agreement;

·       carrying out activities in your interest on the basis of the consent you have granted us;

·       fulfilling our legal obligations arising from applicable legislation concerning accounting, taxation, auditing, health and employment relations;

·       where processing is necessary to protect your vital interests or those of another natural person, or for our legitimate interests

or those of a third party, for example for the detection and prevention of fraud, ensuring IT and network security, or for the possible establishment, exercise or defence of our rights or claims in the event of litigation, except where your fundamental interests, rights and freedoms override those interests;

·       where processing is necessary for the performance of a task carried out in the public interest.

Where we request personal data in order to comply with legal or contractual obligations, providing such personal data is mandatory. This means that if such personal data is not provided, we will not be able to manage our contractual relationship or comply with the obligations imposed upon us. In all other cases, providing personal data is optional and you are under no obligation to provide it.

4. Access to personal data and data security

           We comply with the legal provisions regarding personal data protection and implement technical and organizational measures to protect all operations directly or indirectly involving personal data. These measures are intended to prevent unauthorized or unlawful processing, as well as accidental or unlawful loss or destruction. We will not sell your personal data to third parties and will disclose your personal data only for the purposes described above.

           We work to protect your personal data against unauthorized access, alteration, disclosure or destruction of the information we hold. In particular:

•   We review our information collection, storage and processing practices, including physical security measures, in order to prevent unauthorized access to systems and data stored on physical media.

•   We restrict access to personal data to employees and contractual partners who need to know such information in order to process it on our behalf.

           Within our company, personnel from the following departments may have access to your personal data on a need-to-know basis: management, financial management, administration, legal, accounting and human resources.

These staff members are subject to confidentiality obligations regarding personal data. Appropriate technical and organizational measures are implemented to protect personal data. Staff members are entitled to process personal data only in accordance with our company’s instructions and, where necessary, in connection with their professional duties.

           We may transfer your personal information to institutions that assist us in performing the agreement concluded with you or in carrying out activities in your interest on the basis of the consent you have granted us.

           Your data may also be disclosed to companies that provide us with products, services and works where we consider such disclosure to be in our legitimate interests for internal administrative purposes, the lawful operation of our company, or the auditing and monitoring of our internal processes.

.

           Nevertheless, we guarantee that access to your personal information will only be granted where strictly necessary. Such access will always be limited to employees or third parties who need to know the relevant personal information and may include staff from outsourced departments such as audit, information technology and cybersecurity, as well as other parties such as public authorities and institutions, accountants, lawyers and other external consultants whose activities require access to such data, or where we are legally required to make such disclosure.

           We always ensure that these service providers process personal data in accordance with European data protection legislation in order to guarantee a high level of protection for your personal data.

           We may also disclose personal data to third parties where you provide your express consent for such disclosure, to persons who demonstrate that they are legally acting on your behalf, or where we are required by law to disclose certain information, including in response to lawful requests from government officials, in order to comply with national security or law enforcement requirements, or to prevent unlawful activity.

să respectam cerințele de securitate națională sau de aplicare a legii sau pentru a preveni o activitate ilegală.

5. Your rights

           The GDPR provides the following rights to data subjects: the right to be informed (Articles 13 and 14); the right of access (Article 15); the right to rectification (Article 16); the right to erasure (Article 17); the right to restriction of processing (Article 18); the right to data portability (Article 20); the right to object (Article 21); the right not to be subject to automated decision-making, including profiling (Article 22).

Right to be informed This allows you to know who the data controller is, the legal basis upon which the controller is entitled to process your data, the purposes for which the data will be processed, what data is used, the period for which the data will be processed, the rights guaranteed to you, how these rights may be exercised and the third parties to whom the controller may disclose the data, where applicable.

Right of access: This refers to your right to obtain from the controller the information mentioned above, as well as a copy of the personal data being processed.

Right to rectification:

You have the right to obtain from us, without undue delay, the rectification or completion of inaccurate personal data concerning you.

Right to be forgotten / Right to erasure: You may request the deletion of your personal data at any time where the data is no longer necessary, where you withdraw your consent, where you object to the processing, where the processing is unlawful, or where deletion is required in order to comply with a legal obligation imposed by national or European Union legislation.

There are, however, exceptions to this rule, including where certain data is processed in order to ensure the public’s right to information, for statistical or archiving purposes, to comply with a legal obligation,

or for the establishment, exercise or defence of legal claims.

Right to restriction of processing: This is a temporary right, and you may request that the controller restrict the processing of your personal data:

- where you contest the accuracy of the data, for the period necessary to verify and rectify it; where processing is unlawful and you oppose deletion; - where processing is no longer necessary, but you request that the data be retained for the establishment, exercise or defence of legal claims; - where you have objected to processing, for the period during which it is being determined whether the controller’s legitimate grounds override your rights.

Right to data portability: In exercising your right to data portability, you may request that your personal data be transmitted to you

so that you can subsequently transfer it to another controller without hindrance from the first controller, where the data has been processed on the basis of a contract or your consent and where the processing has been carried out by automated means.

Right to object: You may exercise this right at any time, and the controller is required to stop processing unless there are compelling legitimate grounds that justify continued processing despite your objection. Where personal data is processed for advertising or direct marketing purposes, the controller shall stop processing without exception.

Right not to be subject to profiling: You have the right not to be subject to automated processing for the purpose of creating profiles, except where such automated processing is necessary for the performance of a contract concluded with you, is authorized under national or European Union legislation, or where you have given your explicit consent.

6. Data retention period

           We will retain your personal data only for as long as necessary and for no longer than the period required to fulfil the purposes for which the data was processed. Where data is processed on the basis of a contract, it will be retained until the contractual relationship ends.

           Where data is processed on the basis of your consent, it will be retained for the period indicated in the consent form or until you withdraw your consent.

           An exception applies where legislation requires us to retain the data for a statutory minimum period. In such circumstances, we will comply with the retention period imposed by law, as well as where retaining the data is necessary for the exercise of our legitimate rights or those of other persons.

Contact

As a data subject, you may contact us at any time, free of charge, in order to exercise your rights, by sending a notification using the contact details provided in this Information Notice.

           We will respond to your requests within 30 days. This period may be extended only for justified reasons and

for a reasonable period depending on the complexity of your request. In any event, if this period is extended, we will inform you of the extended deadline and the reasons for the extension.

           If you are dissatisfied with our response and believe that your rights have been infringed, you may submit a complaint to the National Supervisory Authority for Personal Data Processing, headquartered at 28–30 General Gheorghe Magheru Boulevard, District 1, postal code 010336, Bucharest, telephone/fax: +40 318 059 211 / +40 318 059 212, email: anspdcp@dataprotection.ro anspdcp@dataprotection.ro.

           If you have any questions regarding the information presented in this Information Notice, or if you wish to submit a request in order to exercise your GDPR rights, you may contact us by email at:

E-mail: office@bleupharma.ro.

           This Information Notice represents an update to our Privacy Policy and has been provided to inform you about the personal data protection rules established under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC.

CONSENT TO THE PROCESSING OF PERSONAL DATA FOR ADVERTISING PURPOSES

The protection of your personal data is important to us.

For this reason, we want to ensure that the new European regulations concerning personal data protection (GDPR) are complied with.  

If you give your consent regarding the manner and methods by which we communicate with you for advertising purposes, the data you provide will be used to send advertising messages regarding the product offers available on www.bleupharma.com or regarding activities/events organized by us.

You may withdraw or modify your consent to receive advertising messages at any time by:

• sending a request to 201 Barbu Văcărescu Street, 9th Floor, District 2, Bucharest, marked “For the attention of the DPO”;
• visiting our company’s registered office, where you may ask our employees to update your preferences using the dedicated consent

form for the processing of personal data for advertising purposes.

We assure you that we take your preferences into account and will use your data for advertising purposes only as permitted by you. You can find further details on how BLEU PHARMA processes personal data in the Privacy Policy regarding the processing and protection of personal data available online https://bleupharma.com/

When withdrawing consent previously given through BLEU PHARMA forms, please note that it may take up to a maximum of 5 business days for us to remove your data from ongoing campaigns. During this period, you may still receive advertising messages in accordance with your previous preferences.

Please note that the preferences expressed through this form, regardless of what they are, do not apply to notifications or messages sent by BLEU PHARMA regarding ongoing purchases.

For further details, you may consult the Policy on the Processing and Protection of Personal Data within BLEU PHARMA’s activities available on the company website. https://bleupharma.com/termeni-si-conditii/