In accordance with applicable data protection legislation (“Personal Data Protection Legislation”; Law No. 2004-63 of July 27, 2004), OPALIA PHARMA SA provides certain information necessary to illustrate the processing of personal data via the recordati.com domain.

Data Controller

OPALIA PHARMA SA, a subsidiary of the Recordati group, with its registered office at Kalaat Al Andalous Industrial Zone, 2022 Ariana, Tunisia, registered in the National Register of Companies under number 0024497/T, is the data controller (hereinafter, the “Data Controller” or “Recordati”). Data Processed

The data processed includes:

Browsing Data: user’s browser language, name of the page visited, screen resolution of the device used, Matomo ID associating the request with the Analytics account, user location, browser characteristics, operating system and internet service provider used, source/media that redirected the user to the website;

Other data freely provided by users to access certain freely chosen services. Specific information and requests for consent, where applicable, are available in the relevant sections of the website.

Purposes and Legal Basis of Processing

Browsing data is used to enable navigation on the website and the use of its features, as well as to obtain anonymous statistical information on the use of the website, verify its proper functioning, and identify anomalies and/or abuse. The legal basis for processing is our legitimate interest in ensuring the proper functioning of the website and in continuously improving its quality and attractiveness to users, while respecting the lawfulness of processing pursuant to Articles 27 et seq. of Law No. 2004-63 of July 27, 2004. Based on our assessments, we believe that no interest, right, or fundamental freedom of users overrides this legitimate interest.

Data Recipients – Transfer of Data Abroad

As part of data processing for the purposes mentioned in the previous paragraph, data may be disclosed or made accessible to companies within the Recordati group in accordance with Articles 47 et seq. of Law No. 2004-63 of July 27, 2004.

Data Retention Period

Browsing data will be retained for two years from the date it is recorded. Data may be retained for longer periods, in accordance with the Data Controller’s instructions, and only upon request from public authorities.

Rights of Data Subjects

In accordance with the law, users always have the right to withdraw their consent at any time, where applicable, and to exercise the following rights at any time:

The “right of access,” i.e., the right to obtain confirmation as to whether or not personal data concerning them are being processed, and their communication in an intelligible form;

The “right of rectification,” i.e., the right to request the rectification or, if desired, the integration of personal data;

The “right to erasure,” i.e., the right to request the erasure or anonymization of personal data processed unlawfully, including data whose retention is unnecessary for the purposes for which it was collected or subsequently processed;

The “right to restriction of processing,” i.e., the right to request the erasure or anonymization of personal data processed unlawfully, including data whose retention is unnecessary for the purposes for which it was collected or subsequently processed. The right to obtain from the Data Controller the restriction of processing in certain cases provided for by privacy legislation;

The right to request from the Data Controller to indicate the recipients to whom it has notified any rectification, erasure, or restriction of processing (in accordance with Articles 32 to 49 of Law No. 2004-63 of July 27, 2004)

The “right to object,” i.e., the right to object, in whole or in part:

• to the processing of personal data carried out by the Data Controller for its own legitimate interest;

• to the processing of personal data carried out by the Data Controller for direct marketing or profiling purposes.