Privacy Statement

Centrient Pharmaceuticals (Centrient) is the global leader in sustainable antibiotics, next generation statins and anti-fungals. We develop, produce and sell generic intermediates, active pharmaceutical ingredients (API) and finished dosage forms (FDF). At Centrient, we process personal data about our suppliers, customers, visitors (of our websites, offices and plant sites), and other contacts.

In this Centrient Privacy Statement, we inform you about the use of your personal data. You will find the answer to the following questions:

• Which parties collect and process your personal data?
• Which types of personal data do we collect?
• Which are the purposes of the collection and use of your personal data?
• What is the legal ground for the processing of your personal data?
• Which parties have access to your personal data?
• For which period do we keep hold of your personal data?
• How are your personal data protected?
• What are your rights regarding the processing of your personal data (and how can you exercise them)?
• What about any unsolicited messages you may receive from Centrient?
• Do we use any cookies on our websites?

OUR GLOBAL PRIVACY POLICY

Please note that we only use your personal data in accordance with the applicable laws and regulations and in accordance with our Global Privacy Policy. The basic principles of our Global Privacy Policy are:

We always inform the person concerned about the use of their personal data (principle of transparency);

We only use the personal data for the purpose for which it has obtained the personal data;

We do not process more personal data than we need and only if there is no other way to achieve the purpose;

We only use the personal data if there is a legal ground for it;

The more sensitive the data, the less we use it;

We take security measures to ensure an appropriate level of security to protect the personal data from the risks of loss or unauthorized access; and

We have procedures in place to facilitate the rights of the data subjects concerned (such as the right of access and objection).

 This Privacy Statement may be changed from time to time. We will inform you about any changes in this Privacy Statement on Centrient’s website.

THE PARTIES WHO COLLECT AND PROCESS YOUR PERSONAL DATA

 Centrient Holding B.V., headquartered at Weena 798A, 3014 DA in Rotterdam, the Netherlands, is the (main) controller of your data. This means that Centrient Holding B.V. determines the purposes and means for the processing of your personal data (of course in accordance with the applicable law). Furthermore, the local entity of Centrient which collects your data, acts as the (co-)controller of your data.

We may provide your personal data to our Centrient group companies for the same purposes as referred to in this Privacy Statement. Our group companies will also process your data in accordance with this Privacy Notice.

Your personal data may also be provided to (or used on behalf of) third parties for direct marketing purposes after you have been offered the opportunity to object thereto.

Centrient uses several systems for the processing of its customers’ data, its vendors’ data and the data of website visitors. The suppliers of those systems also share data with other systems and databases hosted by or on behalf of Centrient. All systems and databases involved, will only collect, receive, use and share data in accordance with and as permitted by applicable laws, our Global Privacy Policy and this Privacy Statement. For any further information about the suppliers, We only store your personal data as long as necessary for conducting our business, unless we are under a legal obligation to retain the data for a longer period. For any further information about the retention periods, please contact us by sending an email to info@centrient.com.

THE TYPES OF PERSONAL DATA WE COLLECT

We collect and share several types of personal data (directly from you or from public or third party information sources), dependent on the nature of your position and role within Centrient and the requirements of applicable laws. Sensitive data (e.g., data which reveal race, ethnic origin, religious or philosophical beliefs, health, sexual orientation, political opinions or trade union membership) will only be processed if the specific legal requirements to do so are met.

We collect the types of personal data mentioned in this chart, if and as far as those personal data are necessary to achieve the purpose of collection:

contact information (e.g. name, home and business addresses, telephone numbers and e-mail addresses)

personal information related to your job (e.g. job position)

registration of attendance and access to the Centrient sites.

We collect personal data when you provide it to us through registration, completion of forms or e-mails, as part of an order for products or services, inquiries or requests or other situations in which you have chosen to provide the data to us.

THE PURPOSES OF THE COLLECTION AND USE

If we intend to process personal data for any other purpose which is not related to one of the purposes mentioned in this chart, we will always inform you about that, e.g. by modifying this privacy statement or by sending a personal message.

The purposes of the processing of your personal data are:

• Customer relationship management
• Vendor relationship management
• Marketing
• Realization of any agreement, between you and Centrient
• Fulfilling a request from you for information or advice
• Meeting statutory or other legal requirements
• Providing an optimal service and sending you information about our company and our (new) products or services, which could suit your interest.

THE LEGAL GROUND FOR THE PROCESSING OF PERSONAL DATA

We may process your personal data on or more of the following legal grounds:

• Necessary for the performance of contract with you or your company (e.g. contact, bank account number);
• Necessary to comply with our legal obligations (e.g. tax information);
• Necessary in order to protect your vital interest or of another person (e.g. registration of attendance and access to the Centrient sites); or
• Necessary for the purposes of the legitimate interests of Centrient or third parties, such as our interest to do business in an efficient way.
• Only if you are genuinely in the position to freely give your consent, in some cases, we may process your personal data after your consent. You may withdraw your consent at any time (for any further processing).

THE PARTIES WHO HAVE ACCESS TO YOUR PERSONAL DATA

Your personal data shall only be accessible to and be shared with persons and parties who need to have access to the specific personal data. In practice, the following persons and parties may have access to your personal data:

• Employees of Centrient who need the personal data to perform their work (e.g. Sales and Marketing, Procurement, Communications and Quality/Regulatory staff members);
• Our suppliers, as far as necessary to perform their services for Centrient (e.g. companies engaged with the security of our sites); and
• Third Parties to comply with our legal obligations.

Access to third parties (such as suppliers) to your personal data is only granted if (i) the third party complies with all applicable personal data protection laws, (ii) a non-disclosure obligation is in place and (iii) the third party processes the personal data in accordance with this Privacy Statement. If the personal data is processed by a data processor, a Data Processing Agreement will be in place. If the data is transferred outside the European Union, for example, because a data center or our supplier is located there, such transfer shall always we subject to the conditions set out by the applicable personal data protection laws. If we are obliged to transfer your personal data to comply with a legal obligation, we will always aim to protect your right to privacy as much as possible.

THE PERIOD WE KEEP HOLD OF YOUR PERSONAL DATA

We only store your personal data as long as necessary for conducting our business, unless we are under a legal obligation to retain the data for a longer period. For any further information about the retention periods, please contact us by sending an email to info@centrient.com.

THE PROTECTION OF YOUR PERSONAL DATA

We will take all reasonable, appropriate security measures to Centrient and our relationships and employees to protect your personal data against unauthorized access or alteration, disclosure or destruction. We will comply with the applicable security standards.

If, despite the security measures, there is a security incident that probably affects your privacy, we will inform you as soon as possible about the incident. We inform you about the measures we have taken to limit the impact and prevent repetition in the future.

YOUR RIGHTS REGARDING THE PROCESSING OF YOUR PERSONAL DATA (AND HOW TO EXERCISE THEM)

• You have the following rights regarding the processing of your personal data by Centrient:
• The right to object to the use of your personal data, e.g. if you believe that the use of your personal data is not necessary for the performance of our activities or comply with a legal obligation.
• The right to access your personal data. This means that you can request which personal data of you is registered and the purposes for which such personal data is used.
• The right to correct your personal data (if we process incorrect personal data about you), then you can have personal data corrected.
• You can also ask us to limit the processing of your personal data also for a certain term limit, we need to assess your requests or objections.
• The right to have your personal data deleted from our systems.
• The right to have your personal data transferred to a Third Party.

You may exercise these rights by sending a letter (by mail or by email), with your name, address, telephone number and a copy of a valid ID to Centrient at privacy@centrient.com. Please make any social security number on the ID unreadable, before sending it to Centrient. Please clearly mention which right you invoke and the reasons for it. You will get an answer within one month.

We will meet any of your requests unless we have a compelling, legitimate interest not to. Such interest may (amongst others) be if the request is done unreasonably often, if it costs unreasonably heavy technical efforts to comply or has unreasonably heavy technical consequences for our systems, or the privacy of others are at risk.

Please note that after deletion of the data, for technical reasons, not all copies of the data can be removed (immediately) from our systems and back-up systems.

You may also file a complaint about the use of your Personal data with the Supervisory Authority (e.g. for the Netherlands: https://autoriteitpersoonsgegevens.nl/nl/zelf-doen/privacyrechten/klacht-over-gebruik-persoonsgegevens?qa=klacht)

(UNSOLICITED) MESSAGES SENT BY CENTRIENT

Centrient may use your contact information to send (unsolicited) messages related to our products. If the message has a commercial purpose, we may only send such messages (without prior consent) to our existing customers. If you are not a customer, Centrient will only send such messages after you have given your prior consent.

You will be given the opportunity to unsubscribe to this type of communication at any time and in each message.

COOKIES

We shall only store so called “cookies” on your computer when you have provided us with your consent by clicking on the appropriate button(s) during your visit of our website. Cookies are small text files that the website stores locally on your computer. Cookies allow us to recognize your computer the next time you visit us. By doing so, Centrient is able to improve user-friendliness of the website and to adjust the website to your needs. Most Internet browsers are set to accept these cookies automatically.

The type of personal information we collect as a result of a cookie is specific to your computer and may include the Internet Protocol (IP) address, the date and time you access our website and what parts of the website are visited. We collect the foregoing personal information to monitor the usage and usefulness of our website, for statistical purposes and to send you information about our company and our (new) products and services, which suit your interest.

You may set your browser to notify you when you receive a cookie or to refuse receiving it. You can also withdraw your consent at all times by re-entering our website and select the right options. By changing settings, you can also determine that your browser will not accept cookies from this website. Be aware that in such events you may no longer be able to use all the possibilities and features of our website.