BioRep S.r.l., VAT No. 03891970968, with registered office at Via Olgettina 60, 20132 Milan, Italy, is constantly committed to protecting the online privacy of users of its websites http://www.nativaprenatale.it and https://www.biorep.it(hereinafter, unless otherwise specified, collectively referred to as the “Website”).

This document (the “Privacy Policy”) has been prepared to help you understand how your Personal Data, as defined below, will be processed when you use the Website. The Privacy Policy is intended to provide you with the information necessary to enable you to give explicit and informed consent to the processing activities carried out through the Website, where appropriate.

In general, any information or Personal Data that you provide to BioRep S.r.l. through the Website, or that is otherwise collected through the Website in connection with your use of the services offered by BioRep S.r.l. (the “Services”), as further described in Section 3 below, will be processed in accordance with the internationally recognized principles of lawfulness, fairness, transparency, purpose limitation, storage limitation, data minimization, accuracy, integrity and confidentiality.

INDEX

1. Data Controller and Data Protection Officer
2. Personal Data processed
   • Name, contact details and other Personal Data
   • Job applications
   • Special categories of Personal Data
   • Data voluntarily provided by the data subject
   • Browsing data
   • Cookies
3. Purposes of processing
4. Legal basis and mandatory or optional nature of processing
5. Recipients of Personal Data
6. Transfers of Personal Data
7. Retention of Personal Data
8. Data subject rights
9. Amendments

1. Data Controller and Data Protection Officer

BioRep S.r.l., as identified at the beginning of this Privacy Policy, is the Data Controller in relation to all Personal Data processed through the Website.

You may contact BioRep S.r.l.’s Data Protection Officer (“DPO”) at the following address: dpo@sapio.it.

2. Personal Data processed

When you browse the Website, BioRep S.r.l. may process your Personal Data which, depending also on how you choose to use the Services, may include an identifier such as your name, an identification number, an online identifier, or one or more factors specific to your physical, physiological, mental, economic, cultural or social identity, which make you identified or identifiable (hereinafter, “Personal Data”).

Your Personal Data may be collected either because you voluntarily provide it, for example when you request information from BioRep S.r.l. through the Contact section of the Website or when you create a personal account in order to receive the Services offered by BioRep S.r.l., or simply by analyzing your behavior on the Website.

The Personal Data processed through the Website includes the following:

a. Name, contact details and other Personal Data

In various sections of the Website, particularly when creating a personal account or requesting information through the “Contacts” section, you may be asked to enter information such as your name, telephone number, email address, city of residence, company you work for and other similar information.

Furthermore, when you communicate with BioRep S.r.l. using the contact details available on the Website, BioRep S.r.l. may collect any additional information that you choose to provide.

b. Job applications

When registering in the section of the Website dedicated to job applications with BioRep S.r.l. (“Work with us”), you will be asked to complete a form (the “Application”) through which you may provide BioRep S.r.l. with various types of Personal Data, including your contact details, professional and employment information, such as the university you attended, knowledge of foreign languages, professional qualifications and links to your professional social media profiles, and upload your CV through the relevant function.

Upon receiving an Application, BioRep S.r.l. may also review your publicly accessible professional profiles on social networks, such as LinkedIn, or other professional websites relating to you, even where such information has not been included in the Application, in order to obtain further information useful for assessing your suitability for the position for which you have applied.

c. Special categories of Personal Data

Certain sections of the Website, such as “Work with us” or “Contacts”, include free-text fields in which you may provide BioRep S.r.l. with information that may contain Personal Data.

Since these fields are free-text fields, you may use them, voluntarily or otherwise, to disclose certain special categories of Personal Data, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a person’s sex life or sexual orientation.

BioRep S.r.l. asks you not to submit such Personal Data unless strictly necessary. Such special categories of Personal Data may only be processed with your explicit consent, which may be expressed by selecting the relevant box in the Application form, and in accordance with the legislation applicable from time to time.

BioRep S.r.l. therefore emphasizes the importance of giving your explicit consent to the processing of special categories of Personal Data where you decide to share such information.

With regard to the Pharmacovigilance purpose described below, BioRep S.r.l. will process any Personal Data, including where applicable special categories of Personal Data, that you voluntarily submit to the dedicated address solely for the purpose described in Section 3 of this Privacy Policy.

d. Data voluntarily provided by the data subject

As mentioned above, in certain sections of the Website, such as “Work with us” or “Contacts”, you may enter text messages visible to BioRep S.r.l. that could contain Personal Data relating to other individuals.

In such cases, you act as an independent data controller and assume all obligations and responsibilities imposed by law.

Accordingly, you fully indemnify BioRep S.r.l. against any complaint, claim, request for compensation arising from data processing, or other demand that may be made against BioRep S.r.l. by third parties whose Personal Data has been processed through your use of Website functions in breach of applicable data protection laws.

In any event, if you provide or otherwise process Personal Data relating to third parties when using the Website, you hereby warrant, assuming full responsibility in this regard, that such processing is based on the consent of the relevant third-party data subject or on another appropriate legal basis authorizing the processing of the information concerned.

e. Browsing data

The IT systems and software procedures used to operate the Website acquire, as part of their normal operation, certain Personal Data whose transmission is implicit in the use of Internet communication protocols.

This information is not collected in order to be associated with identified data subjects but, by its very nature, could, through processing and association with data held by third parties, allow users to be identified.

This category of data includes IP addresses or domain names of computers used by users who connect to the Website, URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response provided by the server, such as successful completion or error, and other parameters relating to the user’s operating system and IT environment.

This data is used solely to obtain anonymous statistical information concerning use of the Website, to check that it is functioning correctly, and to identify anomalies and/or misuse, and is deleted immediately after processing.

The data may also be used to establish liability in the event of potential computer crimes affecting the Website or third parties. Except in such circumstances, data relating to web contacts is currently retained for no longer than seven days.

f. Cookies

Definitions, characteristics and applicable legislation

Cookies are small text files that websites visited by users send to and store on their computers or mobile devices, and which are then sent back to the same websites during subsequent visits.

Cookies enable a website to remember users’ actions and preferences, such as login information, selected language, font size and other display settings, so that these do not have to be entered again when users return to the website or browse from one page to another.

Cookies are therefore used for IT authentication, session monitoring and the storage of information concerning the activities of users accessing a website. They may also contain a unique identification code that makes it possible to track users’ browsing activities within the website for statistical or advertising purposes.

While browsing a website, users may also receive cookies on their computers or devices from websites or web servers other than the one they are visiting, known as “third-party” cookies.

Certain operations could not be performed without the use of cookies and, in some cases, cookies are therefore technically necessary for the operation of the website itself.

There are various types of cookies depending on their characteristics and functions, and they may remain on the user’s computer for different periods of time. These include session cookies, which are automatically deleted when the browser is closed, and persistent cookies, which remain on the user’s device until a predetermined expiry date.

Under applicable legislation, users’ express consent is not always required for the use of cookies.

In particular, “technical cookies” generally do not require consent. These are cookies used solely for the purpose of transmitting communications over an electronic communications network, or to the extent strictly necessary to provide a service explicitly requested by the user.

In other words, these cookies are essential for the operation of the website or necessary to perform activities requested by the user.

By contrast, “profiling cookies”, which are intended to create profiles relating to users and are used to send advertising messages in line with preferences expressed by users while browsing the Internet, generally require users’ prior consent, subject to applicable legislation.

Types of cookies used by the Website and selection/deselection options

The Website uses the following cookies, which may be deselected, except for third-party cookies, for which you must refer directly to the relevant selection and deselection procedures provided through the applicable links:

Technical browsing or session cookies, which are strictly necessary for the operation of the Website or to allow you to access the requested content and Services.

Analytics cookies, which make it possible to understand how the Website is used. These cookies do not collect information concerning your identity or other Personal Data. Information is processed in aggregated and anonymous form.

BioRep S.r.l. also uses third-party cookies, namely cookies from websites or web servers other than those operated by BioRep S.r.l.

The third parties listed below, together with links to their respective privacy policies, act as Data Processors on behalf of BioRep S.r.l., meaning that they process Personal Data on behalf of BioRep S.r.l.

With regard to third parties that send cookies through the Website, their respective privacy policies are available at the following links:

Google Analytics (anonymized):

https://www.google.com/policies/privacy/partners/

https://tools.google.com/dlpage/gaoptout

Cookies used on the Website

The cookies sent by BioRep S.r.l. through the Website include:

Cookie settings

You may block or delete, in whole or in part, technical and functionality cookies using the relevant functions of your browser.

Please note, however, that if you do not authorize technical cookies, you may be unable to use the Website, view its content or access the related Services.

Disabling functionality cookies may result in certain Services or functions of the Website becoming unavailable or not operating correctly, and you may need to modify or manually enter certain information or preferences each time you visit the Website.

Your choices regarding Website cookies will themselves be recorded in a specific cookie.

However, this cookie may in certain circumstances fail to function correctly. In such cases, we recommend deleting unwanted cookies and also preventing their use through your browser settings.

Your cookie preferences will need to be reset if you use different devices or browsers to access the Website.

How to view and modify cookies through your browser

You may authorize, block or delete, in whole or in part, cookies through the specific functions provided by your browser.

For further information on how to configure cookie preferences through your browser, please refer to the relevant instructions for:

• Internet Explorer
• Firefox
• Chrome
• Safari

You may also manage your choices concerning third-party cookies using online platforms such as AdChoices.

PLEASE NOTE: disabling technical and/or functionality cookies may make the Website inaccessible or may cause certain Services or functions to be unavailable or not operate correctly. You may also need to modify or manually enter certain information or preferences each time you visit the Website.

3. Purposes of processing

BioRep S.r.l. will use your Personal Data collected through the Website for the following purposes:

• to provide the Services, including enabling you to register on the Website in order to access restricted documents and assisting you if you lose or forget your Website login details or password; sending you the BioRep S.r.l. newsletter that you have specifically requested as a Service and which contains informational rather than commercial content; responding to requests for information submitted through the Contacts section; and providing any other Service you request (“Provision of Services”);
• to properly perform activities connected with and instrumental to the Pharmacovigilance purposes that BioRep S.r.l. is legally required to carry out, including, by way of example: (i) identifying previously unknown adverse reactions; (ii) improving and expanding information concerning suspected adverse reactions already known; (iii) assessing the causal relationship between administration of a medicinal product and the adverse reaction observed; and (iv) notifying the competent authority of such information in order to ensure that medicinal products used have a favorable benefit/risk ratio for the population (“Pharmacovigilance”);
• to review Applications submitted by candidates and contact individuals who have submitted Applications through the Website (“Recruitment”);
• to send you marketing communications, promotions and advertising, market research and surveys by email, SMS, postal mail, telephone, banners, instant messaging, through an operator and through BioRep S.r.l.’s official social media pages (“Marketing”);
• to create a profile of you by collecting and analyzing information about your general activities on the Website. This profile will be used to provide you with information about other products and/or services that BioRep S.r.l. believes may be of interest to you and to display advertising that may be relevant to your preferences. All algorithms involved in this automated or semi-automated process are regularly tested to ensure that you are not offered products that are not of interest to you (“Profiling”);
• to comply with legal obligations requiring BioRep S.r.l. to collect and/or further process certain types of Personal Data (“Compliance”);
• to prevent or identify any misuse of the Website or fraudulent activity, thereby enabling BioRep S.r.l. to protect its rights in legal proceedings (“Misuse/Fraud”).

4. Legal basis and mandatory or optional nature of processing

The legal bases relied upon by BioRep S.r.l. to process your Personal Data for the purposes described in Section 3 above are as follows.

Provision of Services

Processing for this purpose is necessary in order to provide you with the Services and therefore for the performance of a contract with you.

You are not required to provide BioRep S.r.l. with your Personal Data for this purpose, but if you do not do so, BioRep S.r.l. will not be able to provide you with the relevant Services.

The same applies to the newsletter Service, which is provided following your specific request through submission of an email address and which you may cancel at any time by following the instructions provided in Section 8 of this Privacy Policy.

Pharmacovigilance

Processing for this purpose is necessary in order to perform the activities required by pharmacovigilance legislation with which BioRep S.r.l. must comply.

Provision of the relevant data is voluntary, but failure to provide it could impair the proper functioning of the pharmacovigilance system.

Where reports are submitted, data collected for this purpose will be processed exclusively for the purposes described above.

Recruitment

Processing for this purpose enables BioRep S.r.l. to consider your Application and is therefore necessary in order to initiate the recruitment process and potentially offer you a position.

You are not required to provide BioRep S.r.l. with your Personal Data for this purpose, but if you do not do so, your Application cannot be considered.

If you wish to provide special categories of Personal Data, such as information relating to health or religion, BioRep S.r.l. will require your specific consent, which you may provide at the end of the Application.

Marketing

Processing for this purpose is based on your consent.

You are not required to provide BioRep S.r.l. with consent for this purpose and you are free to withdraw it at any time without any adverse consequences, other than the fact that you will no longer receive marketing communications from BioRep S.r.l.

You may withdraw consent previously provided by following the instructions in Section 8 of this Privacy Policy.

Profiling

Processing for this purpose is based on your consent.

You are not required to provide BioRep S.r.l. with consent for this purpose and you are free to withdraw it at any time without any adverse consequences.

You may withdraw consent previously provided by following the instructions in Section 8 of this Privacy Policy.

Compliance

Processing for this purpose is necessary for BioRep S.r.l. to comply with applicable legal obligations.

When you provide Personal Data to BioRep S.r.l., such Personal Data must be processed in accordance with applicable law, which may require its retention and disclosure to authorities for accounting, tax or other legal obligations.

Misuse/Fraud

Information collected for this purpose will be used exclusively to prevent and/or identify fraudulent activity or misuse of the Website and thereby enable BioRep S.r.l. to protect its rights in legal proceedings.

5. Recipients of Personal Data

Your Personal Data may be shared with the following parties (the “Recipients”):

• parties typically acting as Data Processors, including individuals, companies or professional firms providing BioRep S.r.l. with assistance and consultancy relating to accounting, administrative, legal, tax, financial and debt collection matters connected with the provision of the Services;
• parties with whom it is necessary to interact in order to provide the Services, such as hosting providers or providers of email distribution platforms;
• parties appointed to carry out technical maintenance activities, including maintenance of network equipment and electronic communications networks;
• individuals authorized by BioRep S.r.l. to process Personal Data where necessary to carry out activities strictly related to the provision of the Services and who are bound by confidentiality obligations or subject to appropriate statutory confidentiality obligations, such as BioRep S.r.l. employees;
• companies belonging to the SAPIO S.r.l. Group for internal administrative purposes;
• parties, entities or authorities to whom BioRep S.r.l. is required to disclose your Personal Data for Compliance, Misuse/Fraud purposes or pursuant to orders issued by competent authorities;
• for Pharmacovigilance purposes, parties accessing the Italian National Pharmacovigilance Network, parties required to carry out pharmacovigilance activities, including AIFA, Marketing Authorization Holders for medicinal products, Italian Regions, Local Health Authorities, pharmacovigilance offices of hospitals or Scientific Institutes for Research, Hospitalization and Healthcare, other companies of the SAPIO S.r.l. Group, pharmacovigilance consultancy companies, and parties entitled to access Personal Data pursuant to laws, secondary legislation or orders issued by public authorities.

6. Transfers of Personal Data

BioRep S.r.l. may transfer your Personal Data outside the European Economic Area.

7. Retention of Personal Data

Personal Data processed for the purpose of Provision of Services will be retained by BioRep S.r.l. for the period strictly necessary for that purpose, for example in order to respond to requests for information submitted through the Contacts section.

In any event, since such Personal Data is processed in order to provide you with the Services, BioRep S.r.l. may retain it for a longer period, particularly where necessary to protect BioRep S.r.l.’s interests against potential claims relating to the Services.

Personal Data processed for Pharmacovigilance purposes will be retained for the period necessary for that purpose in accordance with applicable legislation.

Specifically, Personal Data will be anonymized within three months of closure of the relevant case and, in any event, no later than two years after the end of the financial year in which the first report was received.

Personal Data processed for Recruitment purposes will be retained by BioRep S.r.l. for the entire period during which the position for which the Application was submitted remains open or, if shorter, for two (2) years.

BioRep S.r.l. reserves the right to contact candidates before the expiry of this period to ask them to extend the retention period for their Personal Data or to provide an updated Application.

If no response is received, BioRep S.r.l. will delete the Personal Data collected.

Personal Data processed for Marketing and Profiling purposes will be retained by BioRep S.r.l. until you withdraw your consent. In any event, you will be asked periodically to renew your consent.

Once consent has been withdrawn, BioRep S.r.l. will no longer use your Personal Data for these purposes but may nevertheless retain it, particularly where necessary to protect BioRep S.r.l.’s interests against potential claims relating to such processing.

Personal Data processed for Compliance purposes will be retained by BioRep S.r.l. for the period required under specific legal obligations or applicable legislation.

Personal Data processed for the purpose of preventing Misuse/Fraud will be retained by BioRep S.r.l. for the period strictly necessary for that purpose and therefore for as long as BioRep S.r.l. is required to retain it in order to protect its rights in legal proceedings or disclose such data to the competent authorities.

8. Data subject rights

You have the right to ask BioRep S.r.l., at any time, to:

• access your Personal Data, or obtain a copy of such Personal Data, as well as further information concerning the processing being carried out;
• rectify or update your Personal Data processed by BioRep S.r.l. where it is incomplete or out of date;
• erase your Personal Data from BioRep S.r.l.’s databases;
• restrict BioRep S.r.l.’s processing of your Personal Data;
• obtain the Personal Data concerning you in a structured, commonly used and machine-readable format.

You may also:

• object to the processing of your Personal Data by BioRep S.r.l.;
• withdraw your consent for Marketing purposes.

You may withdraw your consent to Marketing communications sent by email using the dedicated link included at the bottom of each email you receive.

The same method may be used to stop receiving the BioRep S.r.l. newsletter if you previously requested it as a Service.

In addition to the above, you may exercise your rights by writing to BioRep S.r.l. at the following address: info@biorep.it.

In any event, you always have the right to lodge a complaint with the competent Supervisory Authority, the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), if you believe that the processing of your Personal Data is contrary to applicable legislation.

9. Amendments

This Privacy Policy has been in force since May 3, 2018.

BioRep S.r.l. reserves the right to amend or simply update its content, in whole or in part, including as a result of changes to applicable legislation.

BioRep S.r.l. will inform you of such changes as soon as they are introduced and they will become binding as soon as they are published on the Website.

BioRep S.r.l. therefore invites you to visit this section regularly in order to review the latest and most up-to-date version of the Privacy Policy and remain informed about the Personal Data collected and how BioRep S.r.l. uses it.