Legal conditions

In order to process your personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation or "GDPR") and the complementary legislation on the protection of personal data in force in the countries in which it operates, ROXALL will act under a condition of lawfulness in accordance with Articles 6 (Lawfulness of processing) or 9 (Processing of special categories of personal data) of the GDPR.

Throughout this document reference is made to the following conditions of lawfulness, depending on the purpose and context of the data processing:

• • Consent: where the data subject has previously consented, through a positive action, to the processing of personal data relating to them.
  • Pre-contractual procedures or performance of contract: whenever the processing of data is necessary in the context of the provision of services or the purchase of products.
  • Legitimate interest: whenever ROXALL processes personal data on the basis of a legitimate interest which, in a balancing test, is not outweighed by the rights and interests of the data subjects.
  • Legal obligation: whenever the processing of personal data is necessary for the fulfillment of a legal obligation to which ROXALL is subject.
  • Important public interest or public interest in the field of public health: where the processing of special categories of personal data (such as health data) is necessary to ensure a high level of quality and safety of health care and medicinal products or medical devices, providing for appropriate and specific measures to safeguard the rights and freedoms of the data subject.

Purposes

ROXALL processes personal data, i.e. the collection, recording, organization, structuring, storage, consultation, use, disclosure by transmission, dissemination or any other form of making available, among others, of information that can be associated with a natural person (the "data subject") and is responsible for such processing, determining which operations are carried out on it, whenever an adequate condition of lawfulness is met.

The website www.ROXALL.pt is an informative site that aims to communicate to those who visit us who we are, what our mission is, what our commitments are, where we are present, as well as our activities and career opportunities within the ROXALL Group.

For informational use of our website, you do not need to provide any personal data. However, we do provide various communication channels so that you know how to contact us. It is through these voluntary contacts that we may need to process some personal data provided directly by those who visit our site, for one of the following purposes:

• Managing contacts, information or requests.
• Pharmacovigilance and safety information.
• Recruitment of human resources.

This privacy policy applies to personal data provided directly through our website and our online resources and communications (such as other websites under the direct responsibility of ROXALL, mobile applications (apps), e-mail and other communication tools) that present a link to this policy.

This privacy policy does not apply to personal information collected through offline resources and communications, except in cases where such personal information is consolidated with personal information collected online by ROXALL or by a subcontractor acting on behalf of ROXALL. This policy also does not apply to other third-party websites and online resources to which our websites may link, where ROXALL does not control and is not responsible for the content or data processing of such resources.

Managing contacts, information or requests

If you wish to contact the ROXALL Group, you can do so by telephone, e-mail or fill in the form available on the website, indicating the subject and reason for contact.

Through the form available on the website we will collect a set of personal data, which will be processed in order to respond to your request, question or suggestion. To this end, the following personal data is collected on the contact form: first and last name, e-mail address and the subject of your request. This information must be provided, otherwise we will not be able to process your request and respond to you.

In this context, an open message box is also available where you can submit your request, question or suggestion, and where other personal data can be provided spontaneously.

Any personal data provided to ROXALL in connection with a request for information may be processed in order to respond to your request. Such processing is based on ROXALL's legitimate interest and is essential for us to be able to respond appropriately to your request. In this case, ROXALL will retain this information for up to two years from the date on which the request was made.

Updates to the Privacy Policy

The information in this document may need to be changed over time.

We therefore advise you to check the website www.roxall.pt, where this information will be up to date.

Whenever there are changes regarding the processing of your personal data, ROXALL will inform you through the website or through the other communication channels normally used.

Data Protection Officer and Point of Contact

Whenever you have any questions about ROXALL's processing of your personal data or the information provided to you, you can contact ROXALL using the usual communication channels indicated above.

Last updated: March 2025.

How to exercise your rights

You can exercise your rights with ROXALL through the following channels:

• E-mail: by e-mail to the Data Protection Officer at:
  • Roxall Medicina España, S.A. CIF: A48956445 Parque Científico y Tecnológico de Bizkaia, edificio 401 48170 Zamudio - Bizkaia Telf: 944 438 000 Contact person for Data Protection : DPD@roxall.es
• Telephone: by calling Tel: +351 220 150 580.

The exercise of your rights is free of charge, without prejudice to the fact that, whenever there are repeated, manifestly unfounded and repetitive requests, ROXALL may demand payment of a reasonable fee, due to the administrative costs of providing the information or taking the measures requested, or even refuse to comply with the request.

Where ROXALL has reasonable doubts as to the identity of the natural person submitting the request, it may request that they be provided with the additional information necessary to confirm their identity.

List of ROXALL Group companies

• ROXALL ARISTEGUI PORTUGAL S.A (Portugal);
• ROXALL MEDICINA ESPANHA S.A (Spain);
• ROXALL ARISTEGUI ITALIA S.r.l. (Italy);
• ROXALL MEDICINE TURKEY (Turkey);
• ROXALL AUSTRIA (Austria)
• ROXALL MEDIZIN GERMANY (Germany)

Information on Data Protection for Health Professionals.

Through the following policy, we would like to inform you about the processing of personal data by ROXALL GROUP.

Responsible for treatment

ROXALL ARISTEGUI PORTUGAL S.A. with registered office at Rotunda Eng. Edgar Cardoso, 23 - 13º F ,4400-676 Vila nova de Gaia, Portugal, is responsible for processing your personal data.

Origin of your personal data

We obtain your personal data directly from you or through our medical information delegates.