FULL Privacy notice for REMOTE CALL VALUE MARKET RESEARCH SURVEY

Gedeon Richter Plc. (seat: H-1103 Budapest, Gyömrői út 19-21, Hungary)

and

Gedeon Richter Marketing ČR, s.r.o. (seat: Poland, 5. Poniatowskiego, 05-825 Grodzisk Mazowiecki), are the joint controllers of your data

(together hereinafter referred to as ‘Richter’, ‘we’, ‘our’ or ‘us’).

Gedeon Richter Plc. and Gedeon Richter Marketing ČR, s.r.o. entered a joint controller agreement and designated Gedeon Richter Marketing ČR, s.r.o. as your single point of contact.

1. Survey: we contact you, as a health care professional to send and fill out an online survey. Participation in the survey is entirely voluntary and has no negative consequences for you.
2. Respondent segmentation: if you complete the survey, based on your feedback, we will categorize respondents into different segments and will determine the way we keep in contact with you via digital channels, which data processing is based on our legitimate interest.

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, we will provide you with a new notice explaining all conditions relating to the new processing prior to the new processing takes place. If required, we will seek your consent before commencing the new data processing activity.

1. Contact and Digital Communication Data: including your name, address your digital contact details, such as your email address or other online identifier, Health Care Professional ID, GR MedRep ID and name, your specialization, and data about your responses and feedback to our questions and surveys.
2. Segmentation data: we created preference groups in our CRM system and based on your feedback we may classify you into one of these preference groups.

Providing your data is entirely voluntary and will not affect our relationship with you as a Healthcare Professional in any way.

To process your personal data, we may rely on the legal bases below:

• Your consent provided to us under the EU Regulation 679/2016 („GDPR“) Article 6 (1) a) (“Consent”)
• The processing of your personal data is possible based on our legitimate interest under the GDPR Article 6 (1) f) (“Legitimate Interest”).

We may process your personal data for the purposes and legal bases indicated below:

When we process personal data to meet our legitimate interests, we put in place robust safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.

We conducted the balancing test to conclude our prevailing legitimate interests. We considered the extent to which your interests, rights and freedoms may be impacted by our data processing activities, as well as the organizational structure and operation of the Companies and the privacy guarantees provided by us. On this basis, we have concluded that our relevant data processing activates (as outlined below) do not disproportionately restrict your interests, personal rights and freedoms.

For more detailed information regarding our legitimate interests and the results of the balancing tests, please contact us at dataprotection@richter.hu.

We process your personal data for the time required consistent with the purposes set out in this Privacy Notice or for the period of limitation prescribed in the relevant laws.

Richter, in the course of its operation, may utilise the services of various data processors and external service providers to handle and process your personal data for specific purposes, on behalf of and in accordance with the instructions of Richter. In addition, under the applicable aviation laws Richter is required to share your personal data with governmental bodies, authorities and other enforcement bodies.

We may disclose your personal data to the following categories of third parties (recipients) for the purposes described below:

• Gedeon Richter Group: Your personal data may be shared within the Richter Group as far as such is necessary to provide you our services and information about our products. The name and contact of Richter Group entities are available here: https://www.gedeonrichter.com/en/richter-group
• Richter Service Providers: Richter engages certain third parties to provide assistance to our operations, such as:
  • Inspira Research Kft. (Hungary, H-1132 Budapest, Váci út 18.)
  • IT support services
  • provision of customer care services
  • third parties, such as law firms or service providers located in your country of habitual residence.

Government authorities and enforcement bodies: government authorities or enforcement bodies such as the police and regulatory authorities, upon their request and only as required by the applicable law or to protect our rights or the safety of our customers, staff and assets.

We may transfer your personal data to government authorities or enforcement bodies such as the police and regulatory authorities, upon their request and only as required by applicable law; or to protect our rights or the safety of our customers, staff and assets.

You can freely withdraw your consent at any time. The withdrawal of your consent does not affect the lawfulness of the prior data processing.

1. Right of access: you have a right to ask whether or not we have personal data about you and, if that is the case, request information on what personal data we have.
2. Right to rectification: we are required to rectify inaccurate personal data, or to complete personal data that is incomplete, upon your request.
3. Right to erasure (right to be forgotten): we are in some circumstances required to erase personal data on your request.
4. Right to restriction of processing: we are in some circumstances required to restrict our use of personal data on request by the person concerned. In such cases, we may only use the data for certain limited purposes set out by the law.
5. Right to data portability: you may have the right to receive your personal data to which we have access, in a structured, commonly used and machine-readable format and you have the right transmit those data to another data controller. (vi) Right to object:
6. Right to object:

As a single point of contact, you may contact Gedeon Richter Marketing ČR, s.r.o. to exercise your rights against us. However, you may also freely contact directly Gedeon Richter Plc. to exercise your data subject rights.

You can also contact the Hungarian National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa utca 9-11.; Telephone: +36 (30) 683-5969, +36 (30) 549-6838 or +36 (1) 391 1400; Fax +36 (1) 391-1410; E-mail address: ugyfelszolgalat@naih.hu) as the lead supervisory authority or You can also contact the competent data protection regulatory authority located in the European Union’s relevant Member State where your habitual residence, place of work or place of the alleged infringement is.

If you are located in the Czechia, you can contact the Office for Personal Data Protection; Phone: +420 234 665 800 (GDPR infoline), +420 234 665 111 (Phone), +420 234 665 555, +420 234 665 444, http://www.uoou.cz, E-mail: posta@uoou.cz, Address: The Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic