삼양바이오팜

GDPR privacy statement for healthcare professionals Effective date: December 16th , 2020

Scope of this privacy statement

This European General Data Protection Regulation (GDPR) privacy statement explains how Samyang, And all of its affiliated entities (hereinafter collectively referred to as "Samyang", "we", "us" or "our" '), Process your personal data and may include the personal data of other people when you provide them with personal data. It describes in detail how we collect your personal data, why we collect it and with whom we may share it. This privacy statement also indicates your rights in relation to your personal data. It applies to all your personal data, including personal data stored electronically or in paper format.

Personal data about you that we may collect

Samyang collects and processes your personal data that came directly from you, Personal data includes all information that identifies you or that can be used to identify you.

The types of personal data collected depend on the nature of your relationship with Samyang and applicable law. The personal data about you that we process includes data that we collect directly from you, either as part of your professional relationship with us or other possible interactions with our company.

We may also obtain personal data about you from publicly available sources and from third parties, which may fall under the following categories of personal data:

• First & Last name
• Email & Password used for Log-in
• Medical License Number
• Electronic Copy of Medical License
• Expertise or Major
• Age and date of birth
• Data collected by cookies
• Professional contact details (address, telephone number, email address)
• Personal contact details (address, telephone number, email address)

Use of your personal data

The processing of your personal data includes the recording, organization, structuring, storage, adaptation or alteration, recovery, consultation, use, disclosure by transmission, distribution, or available in any way, alignment or combination, restriction, deletion or destruction of your personal data.

We may process your personal data for the following purposes:

• Provide you with safety information about the product
• Respond to your requests for information, on products or services
• Compliance of our company and for the security of the installations and the network
• Authorize, grant, administer, control and terminate access to, or use of, Samyang's systems, facilities, records, property and infrastructure
• Internal investigations into any misconduct or possible non-compliance with our policies and procedures
• Audit of our programs and services for compliance
• Legal proceedings and government investigations (warrants, subpoenas and court decisions)
• Legal obligations to process personal data
• Communications relating to our studies
• Communications relating to market research and product development
• Communications relating to product information
• Administration of promotional programs (lottery, rewards and rebate programs)
• Determination of your eligibility for certain products, services or programs
• Study management, including monitoring of study activities
• Report conflicts of interest
• Manage business travel and professional expenses
• Determine training needs
• Plan and develop the organization (internal communications, budgets, administration and project management)
• Training, scientific or educational programs
• Communication with scientific specialists and leaders
• Sample requests
• Providing access to our resources
• Track your interactions (online and offline) with you
• Obtain details of your business practices, activities and interactions in order to understand your needs and preferences with respect to our products and services
• Financial reports (tracking and reporting of payments and other transfers of value made to you)

For any other purpose for which we need to notify you and obtain your consent, including for purposes required by local law, we will obtain your consent before processing your personal data for these purposes.

The legal basis for processing your personal data

The applicable legal basis for which we process your personal data for the aforementioned specific purposes includes the following:

• With your consent In some cases, we may ask for your consent to collect and process your personal data. If you choose to allow us to do so, you may withdraw your consent at a later date by contacting us as described in the "Contacting Us" section below. It should be noted that if you withdraw your consent, this will not affect the processing of your personal data which has already taken place. Where we process your personal data as part of this consent, we will provide you with more detailed information at the time of obtaining your consent.
• Compliance with Laws or Enforcement of an Applicable Contract In specific circumstances, we may need to process your personal data in order to comply with applicable laws / regulations or to fulfill our obligations under a contract to which you are subject. When we process your personal data to meet our legal obligations, you probably will not be able to object to this processing activity, but you will generally have the right to access, and review this information, unless that this does not hinder the performance of our obligations.
• Our Legitimate Interest We may process your personal data based on our legitimate interests in communicating or managing our interactions with you regarding our products and services, our scientific research, and educational opportunities. In addition to the other rights that you may have described below, you have the right to object to such processing of your personal data. You can notify us of your objection by contacting us as described in the “Contacting Us” section below.

To whom and when we will disclose or transmit your personal data

We will transmit or disclose your personal data to the following entities:

• Our worldwide subsidiaries, as mentioned below;
• Third parties with whom we have contracted to subcontract services in order to carry out activities or functions relating to the processing in relation to your personal data described above. If we do so, we will require those third parties acting on our behalf to protect the privacy and security of your personal data that we share with them. These third parties must agree, as part of a contract, not to use or disclose your personal data for purposes other than those necessary to provide us with the services in question, to perform the services on our behalf or to comply with legislation or applicable regulations.
• Government agencies, authorities and auditors. If we compensate you for the services you provide, we may disclose your personal data, including your financial relationship with us, as well as any money we have paid to you, to government authorities, agencies and auditors in relation to our regulatory activities, in response to authorized requests for information or in any other manner required by laws, regulations or industry codes.
• Potential or actual third-party buyers. If we decide to reorganize or divest our business through a sale, merger or acquisition, we may share your personal data with potential or actual buyers. We will require these buyers to process your personal data in accordance with this privacy statement.

International transfer of your personal data

We may transmit your personal data to third parties with whom we have contracted to subcontract services in order to carry out activities or functions relating to the processing in relation to your personal data described above. Our third parties have a contractual obligation to comply with applicable laws or regulations, including the obligation to have a valid mechanism for the cross-border transfer of personal data within the EU in place to receive the personal data from the EU.

For more information on our cross-border transfers of your personal data, please contact us using the contact details provided in the "Contacting Us" section below.

How we protect your personal data

We use industry standard administrative, technical and physical safeguards to protect your personal data against loss, theft, misuse, unauthorized access, modification, disclosure and destruction. We restrict access to your personal data strictly to employees and third parties acting on our behalf who have a legitimate need for it. We will transfer your personal data to third parties acting on our behalf only when we have received written assurances that your personal data will be protected in a manner consistent with this privacy statement and our privacy policies and procedures.

The retention period of your personal data

If you do not have any login record for a year, Samyang will delete or archive your personal information. Your scanned copy of the medical license will be deleted immediately upon deletion of your account. However, unless directed, your personal data will be kept for the duration of your relationship with us. We will store and retain the personal data we collect about you in accordance with our company's records retention policy. Once this period has elapsed, they will be archived or deleted. You can find a detailed timeline of our retention practices at https://www.samyangbiopharm.com/eng . Please note that some information may be retained for longer if we are required to do so or if local law requires it.

Data retention

We retain your personal information for as long as necessary to provide the Service and fulfill the transactions you have requested, or for other essential purposes such as complying with our legal obligations, maintaining business and financial records, resolving disputes, maintaining security, detecting and preventing fraud and abuse, and enforcing our agreements.

Your rights

You have the right to view and obtain a copy of your personal data, including an electronic copy, as well as to ask us to correct any inaccurate or incomplete personal data that we hold about you. You can also request that we delete your personal data when it is no longer necessary for the purposes for which you have provided it to us, restrict the processing of your personal data to certain limited purposes when it is not possible to delete or object to our processing of your personal data. In certain circumstances, you may be able to ask us to send a copy of your personal data to a third party of your choice.

To exercise these rights, please contact us as described in the “Contacting Us” section below. You also have the right to lodge a complaint with the supervisory authority (see details in the “Remedies” section below) when you believe that your rights have been infringed.

Revision of this privacy statement

We may make changes to this privacy statement from time to time to reflect changes in our legal obligations or the ways in which we process your personal data. We will notify you of any concrete changes to this privacy statement, which will become effective as soon as it is communicated.

Contact us with questions or concerns

• To ask questions ;
• report a concern or file a complaint;
• no longer participate in a program or service;
• exercise any of the aforementioned rights, including those relating to access, correction, portability, objection, restriction and deletion.

Samyang EU Data Protection Officer (DPO)

Address

Samyang Corp. 295 Pangyo-ro, Bundang-gu, Seongnam-si Gyeonggi-do 13488, Korea

Email address

croquis@samyang.com

Phone

+82 2 2157 9822

Samyang EU Onsite Representative

Samyang Hungary. Gödöllő, Bláthy Ottó utca, 2100, Hungary

Email address

sunwoo.kim@samyang.com

GDPR website privacy statement Effective date:
December 16th, 2020

Scope of this Privacy Statement

This Privacy Statement applies to websites, mobile applications and digital services that relate to or publish this Privacy Statement. The purpose of this Privacy Statement is to inform you about Personal Data that Samyang plc, including our affiliated entities (hereinafter collectively referred to as "Samyang", "we", “Our” or “our”), may collect about you, how we collect your Personal Data, the purposes for which we use it, the people to whom we may disclose it and the rights you can exercise in order to limit our use of your Personal Data. In this Privacy Statement, websites, applications and digital services that may relate to or publish this Privacy Statement will be collectively referred to as “websites”

Personal Data about you that we may collect

On our websites associated with this Privacy Statement, we will collect and process Personal Data that does not identify you personally by name (such as your IP address) or that does not include your contact details, but which could be used to identify a specific computer or device that has accessed our website and which, in conjunction with certain other information, could be used to identify you. We receive this Personal Data as part of your interactions on our websites.

Personal Data about you that we process through our websites associated with this Privacy Statement may fall into the following categories of Personal Data:

• Demographic data
• Cookie data
• Online identifiers
• Third party cookies

When we collect Personal Data about you that can directly identify you, the following privacy statements will be provided to you with additional information about what data we may collect, how we will collect it, the purposes for which we will do so, the people to whom we may disclose it and the rights you may exercise in order to limit our use of this data. Please click on the following privacy statements that apply to your interactions with us:
<Insert hyperlink to the GDPR Healthcare Professionals Privacy Statement>

Use of your personal data

The processing of your Personal Data includes the recording, organization, structuring, storage, adaptation or alteration, recovery, consultation, use, disclosure by

transmission, dissemination, or making available in any way, alignment or combination, restriction, deletion or destruction of your Personal Data.

We may process your Personal Data for the following purposes:

• Compliance of our company and security of installations and network
• Legal obligations to process personal data
• Authorize, grant, administer, control and terminate access to, or use of, Samyang's systems, facilities, records, property and infrastructure.
• Statistical analyzes, including analyzes carried out by our suppliers
• Track your interactions with us
• Website administration
• Audit of our programs and services for compliance purposes
• Marketing activities, including tracking third-party cookies and creating an interest-based profile relating to your interactions with us or others

For any other purpose for which we must notify you and obtain your consent, including for purposes required by local law, we will obtain your consent before processing your Personal Data for these purposes.

The legal basis for processing your Personal Data

The applicable legal basis for which we process your Personal Data for the aforementioned specific purposes includes the following:

• With your consent: In some cases, we may ask for your consent to collect and process your Personal Data. If you choose to allow us to do so, you may withdraw your consent at a later date by contacting us as described in the "Contacting Us" section below. Please note that if you withdraw your consent, this will in no way affect the processing of your Personal Data which has already taken place. When we process your Personal Data as part of this consent, we will provide you with more detailed information when we obtain your consent.
• Compliance with Laws or Enforcement of an Applicable Contract: In specific circumstances, we may need to process your Personal Data in order to comply with applicable laws / regulations or to fulfill our obligations under of a contract to which you are subject. When we Process your Personal Data to meet our legal obligations, you probably will not be able to object to this processing activity, but you will generally have the right to access, and review, such information, unless you do so. does not hinder the performance of our obligations.
• Our legitimate interest: We may process your Personal Data based on our legitimate interests in communicating or managing our interactions with you regarding our products and services, our scientific research, and educational opportunities. In addition to any other rights you may have described below, you have the right to object to such processing of your Personal Data. You can notify us of your objection by contacting us as described in the “Contacting Us” section below.

Cookies and similar technologies to collect Personal Data

Cookies

This website may use a technology called a "cookie". A cookie is a small data file that a website can place on a computer's hard drive, in which your Internet browser files are stored. Thanks to cookies, you do not need to re-enter certain information in certain registration areas, because cookies help a site remember information that a visitor has already entered. They also help provide you with content-specific information and track how different parts of the website are used. Cookies may be placed on your computer by us or by third parties with whom we have signed a contract, such as for web analysis and advertising network services. With most Internet browsers or other software, you can change your browser settings to delete cookies from your computer's hard drive, block all cookies, or receive a warning before a cookie is saved. Check your browser instructions to learn more about these functions. Refusing cookies could limit the functionality of the site and prevent you from taking full advantage of the many functions of the site. Check your browser instructions to learn more about these functions. Refusing cookies could limit the functionality of the site and prevent you from taking full advantage of the many functions of the site. Check your browser instructions to learn more about these functions. Refusing cookies could limit the functionality of the site and prevent you from taking full advantage of the many functions of the site.

Don't follow me

There are a number of ways you can opt out of tracking your online activity. One of these is to set up a preference in your browser that alerts websites you visit that you don't want them to collect certain information about you. This is called a "Do not follow me" signal. Please note that our websites and web resources do not currently respond to these signals from web browsers. he There is as yet no universally accepted standard for how a company should proceed when it detects a “Do Not Track” signal.

Google analytics

You can use Google Analytics to improve our website and to help us understand which parts of the site are being used. Google Analytics uses technical tools, such as first-party cookies and JavaScript code, to collect information about visitors. The Google Analytics service tracks visitors to the site with JavaScript enabled. Google Analytics anonymously tracks how visitors interact with a website, including where they are from and what they are doing on a site. Google Analytics collects the information described above from users.

This information is then used to administer and update the website. We will also assess whether site visitors match anticipated demographic statistics and determine how key audiences navigate the content.

• A. Opt-out clause: Google analytics offers an opt-out clause for people who visit the website and who do not want their data to be collected. You can get more information about this option here: http://tools.google.com/dlpage/gaoptout.
• B. Use of Google data: Google and its wholly owned subsidiaries may retain and use, subject to the terms of its privacy policy
  (available at http://www.google.com/privacy.html or any other URL Google may provide from time to time), information collected during your use of Google Analytics Information Disclosures and Sharing.

Personal data of children

This site is not designed for individuals under the age of 16. We do not intentionally collect Personal Data from anyone under the age of 16.

How we protect your Personal Data

We employ industry standard administrative, technical and physical safeguards to protect your Personal Data against loss, theft, misuse, unauthorized access, modification, disclosure and destruction. We restrict access to your Personal Data strictly to employees and third parties acting on our behalf who have a legitimate need for it. We will transfer your Personal Data to third parties acting on our behalf only when we have received written assurances that your Personal Data will be protected in a manner consistent with this Privacy Statement and our privacy policies and procedures.

To whom and when we will disclose or transmit your Personal Data

We will transmit or disclose your Personal Data to the following entities:

• Our global subsidiaries, as mentioned below;
• Third parties with whom we have contracted to subcontract services in order to carry out activities or functions relating to the processing of your Personal Data described above. If we do so, we will require these third parties acting on our behalf to protect the privacy and security of your Personal Data that we share with them. Unless otherwise specified in this Privacy Statement, these third parties must agree, by contract, not to use or disclose your Personal Data for any purpose other than those necessary to provide us with the services in question, to perform the services on our behalf or comply with applicable laws or regulations.
• Government agencies, authorities and auditors. We may disclose your Personal Data to government agencies, authorities and auditors in response to authorized requests for information or in any other manner required by laws, regulations or industry codes.
• Potential or actual third-party buyers. If we decide to reorganize or divest our business through a sale, merger or acquisition, we may share your Personal Data with potential or actual buyers. We will require these buyers to process your Personal Data in accordance with this Privacy Statement.

International transfer of your Personal Data

We may transmit your Personal Data to third parties with whom we have contracted to subcontract services in order to carry out activities or functions relating to the processing of your Personal Data described above. Our third parties have a contractual obligation to comply with applicable laws or regulations, including the obligation to have a valid mechanism for the cross-border transfer of Personal Data within the EU in place to receive Personal Data from it.

For more information on our cross-border transfers of your Personal Data, please contact us using the contact details provided in the “Contacting Us” section below.

The retention period of your personal data

If you do not have any login record for a year, Samyang will delete or archive your personal information. Your scanned copy of the medical license will be deleted immediately upon deletion of your account. However, unless directed, your personal data will be kept for the duration of your relationship with us. We will store and retain the personal data we collect about you in accordance with our company's records retention policy. Once this period has elapsed, they will be archived or deleted. You can find a detailed timeline of our retention practices at https://www.samyangbiopharm.com/eng . Please note that some information may be retained for longer if we are required to do so or if local law requires it.

Data retention

We retain your personal information for as long as necessary to provide the Service and fulfill the transactions you have requested, or for other essential purposes such as complying with our legal obligations, maintaining business and financial records, resolving disputes, maintaining security, detecting and preventing fraud and abuse, and enforcing our agreements.

Links to third-party websites

For practical reasons, this website may contain links to other websites owned or managed by third parties, which may provide you with useful information. The policies and procedures described herein do not apply to those sites. We are not responsible for the collection or use of Personal Data by or on any third party site. We therefore decline

any liability for any use by third parties of Personal Data obtained through your use of the third party website. We suggest that you contact these sites directly for any information on their privacy, security, data collection and distribution policies.

Your rights

You have the right to view and obtain a copy of your Personal Data, including an electronic copy, as well as to ask us to correct any inaccurate or incomplete personal data that we hold about you. You can also request that we delete your Personal Data when it is no longer necessary for the purposes for which you have provided it to us, restrict the processing of your Personal Data to certain limited purposes when it is not possible to delete or object to our processing of your Personal Data. In certain circumstances, you may be able to ask us to send a copy of your Personal Data to a third party of your choice.

To exercise these rights, please contact us as described in the “Contacting Us” section below. You also have the right to lodge a complaint with the supervisory authority (see details in the “Remedies” section below) when you believe that your rights have been infringed.

Revision of this Privacy Statement

We may make changes to this Privacy Statement from time to time to reflect changes in our legal obligations or the ways in which we process your Personal Data. We will notify you of any concrete changes to this Privacy Statement which will become effective as soon as we are notified.

Contact us with questions or concerns

Please contact Samyang's EU Data Protection Officer (DPO) at the following contact details to:

• To ask questions ;
• report a concern or file a complaint;
• no longer participate in a program or service;
• exercise any of the aforementioned rights, including those relating to access, correction, portability, objection, restriction and deletion.

Samyang EU Data Protection Officer (DPO)

Address

Samyang Corp. 295 Pangyo-ro, Bundang-gu, Seongnam-si Gyeonggi-do 13488, Korea

Email address

croquis@samyang.com

Phone

+82 2 2157 9822

Samyang EU Onsite Representative

Samyang Hungary. Gödöllő, Bláthy Ottó utca, 2100, Hungary

Email address

sunwoo.kim@samyang.com