California Consumer Policy

1. General

This California Policy describes how Exeltis USA, Inc. as part of Exeltis Pharmaceuticals Holding, S.L. and all its subsidiaries located in third countries (hereinafter, jointly referred to as “Exeltis”) processes the information collected from users located in California (the “California Consumer”) when registering or navigating through the website https://hcp.tyblume.com (hereinafter, the “Website”), owned by Insud Pharma, S.L.U. In case users not located in California, this California Policy does not apply to them.

Exeltis and all its subsidiaries located in the EU or third countries are globally known as Insud Pharma Group (hereinafter, “Insud Pharma Group”). Please find additional information about Insud Pharma Group and a non-exhaustive list of Exeltis subsidiaries here.

Please read carefully this Privacy Policy as it contains important information concerning the personal information of California Consumers and how we use it in accordance with the California Consumer Privacy Act of 2018 (CCPA). This Policy supplements our Privacy Policy.

Exeltis dedicates all its efforts to respect the privacy and security of the Users and undertakes to use personal data in accordance with applicable data protection laws.

2. Categories of personal information and purposes of the processing

California Consumer may use some functionalities of the Website without having to provide Exeltis any personal information. However, for certain functions, California Consumer shall provide personal information in order to register for certain services, receive newsletters or other information of interest. In addition to the information provided directly to Exeltis, we collect certain information when you visit our Website.

California User has the right to know what personal information is collected, how it is used and business purposes. Below we make available this information for each of our business purpose.

A. Users communications and customer service

The categories or Personal Information collected through these business purposes may include:

• contact and identity information;
• relationship information;
• health or other sensitive information;
• online or technical details;
• as well as any other type of personal information that California Customer may consider necessary to communicate with us.

Personal Information shall be processed for the sole purposes of solving any incident, claim, suggestion or request made by California Customer.

The legal basis for the processing of these personal information is consent when the California User provide their data through the contact forms.

B. Pharmacovigilance

The Personal Information provided by California Customer for pharmacovigilance purposes will be used solely to manage any incident regarding adverse effects that may be communicated by California Customer. This Personal Information is based in the consent shown when California Consumer fulfil and send specific form available on our web.

This Personal Information may include:

• contact and identity information;
• relationship information;
• health or other sensitive information;
• online or technical details;
• transaction information;
• as well as any other type of personal information needed to manage adverse effects and pharmacovigilance purposes.

C. Newsletter and commercial communications

If case California Customer subscribes to any of our notification or messaging services, we will use the email address provided by the California Customer to provide the service.

If the California Customer has subscribed to any product, service or functionality, we may also communicate with the User to inform him or her of other similar products or candidatures that may be of interest.

The California Customer can at any time unsubscribe of these communications by using the opt-out feature enable in e-mail messages or contacting dataprotecion@insudpharma.com

The legal basis for this processing is the consent, when the California Customer checks the box enabled in specific forms. Likewise, Exeltis, based on its legitimate interest, may send the California Customer information about similar products and services. We will delete your email address once you have opted out, unless it is also used for any other purposes listed in this Privacy Policy.

D. Marketing

Information about California Customer online searches (clicks and views), settings on our Website, requests for information and/or their contact history may be subject to processing by Exeltis. Personal Information collected for these purposes will be:

• Contact information;
• Online and tracking information;
• Cookie data;
• IT and navigation information.

This Personal Information allows us to use different means to manage the relations with our customers and commercialize our products and services through e-mail or online advertising which may include customizing the content of the Website and offers in order to suit user preferences. Marketing communication shall be made in accordance with Electronic Communications Privacy Act and any other applicable law. You may at any time object to this processing.

We use this personal data based on our legitimate interest to improve our products and services. Personal data will generally be deleted or anonymised 1 month after your last visit to our Website, except where we are legally required to keep the personal data or where it is retained for any other purpose.

E. Information about the use of our Website

Exeltis collects information automatically obtained by the Website related to the identification of the California Customer’s computer equipment, use and navigation habits. Said information includes:

• Online information regarding language, pages or sections of the Website, keywords, date, time, amount of time the User expends;
• IP Address;
• Information related to the use of the Website;
• Cookie data;

We use this Personal Information based on our legitimate interest to improve our products and services. We will keep the Personal Information for 1 month from the date of the last visit to the Website.

Exeltis may combine your Personal Information with other provided by the California Customer or collected from the Website as above mentioned. In those cases, all combined information will be processed as Personal Information during the period the information remains combined.

F. Information provided in “Join us” section

When completing the registry process included in the section “Join us”, the California Customer will provide the following categories of Personal Information:

• CV, academic and professional information;
• Contact and identity information.

Personal Information provided will be processed in order to take part in the recruitment procedure, as well as for commercial communication in case the California Customer has shown express consent. Personal Information for these purposes shall remain for 1 year from the end of the recruitment process. The legal basis for the processing of these personal data is consent, when California Customer provide their Personal Information for the management of the job vacancy.

G. Services maintenance and optimization

Personal Information related to identifiers; IT and online information; inferred or derived information; etc. will also be used for the maintenance and analysis of our Website, solve any problem, improve availability and protect the Website against fraud.

Analytics also allow us to check whether the online services we offer work effectively in order to improve them whenever possible. California Customer Personal Information for these purposes is based on our legitimate interest and will be retained for a maximum period of 6 months.

H. Comply with our legal obligation

We may need to process your Personal Information to comply with legal obligations binding or accepted by us. Likewise, we may need to provide information to and as required by local law enforcement agencies, government authorities, or otherwise required by law or to protect the rights and safety of our property, company, employees and customers.

Personal Information that may be needed to collect for comply with requirements and legal obligations may include:

• Contact and identity information;
• Compliance details;
• Relationship information;
• Commercial information;
• Customer’s identifiers;
• Health or other sensitive details;
• Any other that may be required by authorities.

The User undertakes to use the services and utilities provided by the Website in accordance with current legislation, these Terms and Conditions and moral standards, good practice and public order.

3.              HOW WE SHARE YOUR PERSONAL INFORMATION

Sometimes it is necessary to share your Personal Information with other Exeltis subsidiaries, companies of the Insud Pharma Group or third parties in order to guarantee the correct provision of the Website. We may share such information with the following:

• Insud Pharma Group companies due to the use of shared computer systems, which may be located in the European Economic Area (EEA) or in third countries.
• Business partners who offer products or services jointly with Exeltis.
• Service providers, to the extent necessary for the provision of a service.

Such entities may be located in Spain, other countries in the EEA or anywhere else in the world. When we keep Personal Information outside the EEA and territories where CCPA applies, we guarantee an adequate level of protection of the transferred Personal Information. To this purpose, we require service providers to take appropriate measures to protect the confidentiality and security of Personal Information.

For example, for services provided by providers outside the European Economic Area, we use Standard Model Clauses approved by the European Commission.

Exeltis may disclose California Customer’s Personal Information to any public administration, when required by law and compelled to do so by such authorities. All data communications will always be carried out in compliance with the applicable data protection law in.

4.     SECURITY

Exeltis cares to ensure the security and confidentiality of your Personal Information. Therefore, we have implemented several security measures and technical means to prevent the loss, misuse or access to the personal data without the California Customer permission in accordance with the national data protection laws and the GDPR.

Nevertheless, it is also the California Customer responsibility to control his or her Personal Information, therefore Exeltis asks and encourages all users to be careful sharing information and content. Exeltis shall not control the content and information the California Customer chooses to share with other users and, therefore, Exeltis is not responsible for the consequences of the California Customer own actions.

Exeltis pledges (i) to act rapidly and in a responsible manner in the event the California Customers Personal Information security is deemed at risk, and (ii) to report it if relevant with the greatest diligence.

In case of security incidents, Exeltis undertakes to notify the relevant Privacy agency or authority without undue delay after becoming aware of such breach. Likewise, when the personal data breach is likely to result in a high risk to the rights and freedoms of California Customer, Exeltis will communicate the personal information breach and the measures taken to mitigate the risks and adverse effects to California Customer.

5. COOKIES

Much of the information referred to in this California Privacy Policy is collected through the use of cookies. Cookies are small text files containing small amounts of information that are downloaded and can be stored on your user device, for example, your computer, smartphone or tablet. These cookies are sometimes necessary to remember your account settings, language and country, but they also allow us to track and analyse the California Customer’s behaviour on our Website and to display personalised advertisements on our Website or on third party websites. Where necessary, you will be asked to consent to the use of cookies. To obtain additional information on how cookies are used on the Website and its deactivation please visit the Cookies Policy.

6. Minors

The Website is not intended to be used by minor children. Under no circumstances will Exeltis voluntarily collect Personal Information from minors.

7. WE DO NOT SELL YOUR PERSONAL INFORMATION

According to the CCPA, you have the right to know whether your Personal Information is being sold or share with other purposes. Through this Policy Exeltis informs you that any Personal Information provided or collected will be sell or share with third parties for monetary purposes.

8. CALIFORNIA CUSTOMER RIGHTS

As California Customer you have the rights, among other, to know, receive or delete your Personal Information.

Exeltis enables California Customers to exercise their Personal Information’ rights recognized by the CCPA. Therefore, the California Customer may have the following right concerning the use of Personal Information:

• Right to Know and Access Personal Information. You have the right to request:
  • The categories of Personal Information we have collected, the business purposes for its collection, the categories of third parties with whom we share it and the categories of Personal Information we have shared.
  • A copy of specific pieces Personal Information we have collected from you.
• Right to Correct inaccurate Personal Information. You have the right to request the modification and correction of inaccurate Personal Information collected.
• Right to Delete. You have the right to ask for the deletion of your Personal Information. However, in certain situation this deletion will not be possible, such as when it is necessary to complete transactions, comply legal obligations or requirements, provide goods or services requested by you; or to otherwise use your personal information in a lawful manner that is reasonable aligned with your relationship with us and compatible with the context in which you provided your information.
• Right Not to Be Subject to Discrimination.
• Right to Limit Use and Disclosure of Sensitive Personal Information. You have the right to limit the use of Personal Information provided and request Exeltis not to disclosure for different and subsequently purposes unless you provide your consent.

Notwithstanding above-mentioned, California Customer may exercise at any time any other right recognized by the CCPA. Should you exercise any of your privacy rights under the CCPA, Exeltis will not discriminate against you by offering different pricing or products, level of quality or other consequences arising from the request.

For the exercise of any of the abovementioned rights, the California Customer shall contact Exeltis by email, addressing the request to dataprotection@insudpharma.com, indicating as reference: “EXERCISE OF RIGHTS” and identifying at the right to be exercised. If we are successful in validating your identity, we will respond to you within the time and in the manner required by the CCPA. In case we cannot validate your identity, Exeltis will attempt to contact you to inform.

9. PRIVACY UPDATES

Exeltis reserves the right, at its sole discretion, to modify or replace this California Privacy Policy. When this happens, a notice will be included on the Website indicating and informing Users that modifications have been made.

Please review this agreement every so often in order to acknowledge any possible modifications.

10. CONTACT INFORMATION

If you have any further questions about the use of your personal data or about our Privacy Policy, you can contact Insud Pharma’s Group DPO by email through dataprotection@insudpharma.com