PRIVACY NOTICE FOR USERS AND CLIENTS

Privacy — Notice to users and clients

Merqurio Editore Srl, with registered office in Naples, via Santa Brigida, 68, 80132, Tax Code and Companies Register Naples no. 05877761212 (hereinafter, "Merqurio"), as Data Controller (hereinafter, "Controller"), hereby informs you, pursuant to EU Regulation 679/2016 ("GDPR") and to the applicable national and EU data protection legislation pro tempore ("Privacy Regulations"), that your data will be processed according to the methods and for the purposes set out below.

2. Purposes and lawful basis of the processing

Your data are processed:

2.A) Even without your express consent, for the following Service Purposes

2.A.1) performance of the contract or fulfilment of pre-contractual obligations, in particular:

• delivery of Merqurio's services;
• management of pre-contractual and contractual relationships (including pharmacovigilance, medical information and customer satisfaction surveys on service quality);
• management of collections and payments;
• management and maintenance of websites owned by Merqurio.

2.A.2) compliance with obligations established by laws, fiscal obligations, regulations or EU legislation, or imposed by the Authorities.

2.B) Only with your separate and explicit consent, for the following Marketing Purposes

Sending by Merqurio of communications and advertising or direct-sale material from third parties, including by collecting consent on their behalf (companies of the Merqurio Group, third parties such as suppliers, partners and client companies), with commercial and/or promotional and/or advertising content and/or aimed at medical-scientific information and/or market research and/or opinion polls and/or statistical analyses for marketing purposes, by means of automated calling systems and/or e-mail and/or fax and/or sms and/or mms and/or other messaging services and/or newsletters and/or through traditional marketing channels such as phone and/or paper mail.

2.C) Only with your separate and explicit consent (Art. 7 GDPR), for the following Profiling Purposes

Analysis of the data subject's consumption, purchasing and professional habits and choices, carried out through segmentation operations and through the collection and analysis of subgroups of physicians based on their browsing habits, age and specialisation, solely with a view to best aligning the offer of content and initiatives to the user's preferences, and to avoid proposing topics not of interest, in order to send communications and advertising or direct-sale material relating to products/services/initiatives and/or market research and/or opinion polls and/or statistical analyses of third parties, by means of automated calling systems and/or e-mail and/or fax and/or sms and/or mms and/or other messaging services and/or newsletters and/or through traditional marketing channels such as phone and/or paper mail.

This is particularly relevant because Merqurio produces a large amount of content, addressed to users with different interests: the only logic and consequences of the "profiling" in question are that the Company carries out this profiling activity only for the purpose of creating "groups" of physician categories differentiated on the basis of their interests expressed on the Merqurio portal, their age and the type of specialisation, in order to align the delivery of content and initiatives to these categories, and avoid proposing topics not of interest to such groups (e.g. cardiologists are not sent the same articles of interest to oncologists). There are no other consequences for the user beyond what is described above as a result of profiling, and refusing to give consent will have no other consequence for the user than that of not receiving content tailored to their preferences.

2.D) Communication of data to third parties for marketing purposes

Communication of data to third parties (companies of the Merqurio Group, third parties such as suppliers, partners and client companies), so that they process them directly for their own marketing purposes (i.e. to send communications and advertising or direct-sale material with commercial, promotional, advertising and/or medical-scientific informational content; as well as to conduct market research, opinion polls and statistical analyses for marketing purposes). All of this by means of automated calling systems and/or e-mail and/or fax and/or sms and/or mms and/or other messaging services and/or newsletters, and/or through traditional marketing channels: phone and/or paper mail.

2.E) Communication of data to third parties for profiling purposes

Communication of data to third parties (companies of the Merqurio Group, third parties such as suppliers, partners and client companies) subject to the prior consent of physicians: Merqurio may communicate the relevant personal data to third parties (acting as data controllers), with the related category and membership of the "groups" mentioned above (2.C), so that such third parties may carry out their own profiling activities directly for their own profiling purposes (i.e. for their own analyses, sending newsletters and surveys, direct marketing communications, also through automated calling systems and/or e-mail and/or fax and/or sms and/or mms and/or other messaging services and/or newsletters and/or phone and/or paper mail).

2.F) Even without your express consent, for the following Purposes of maintaining the professional database

(lawful basis: legitimate interest, Art. 6(1)(f) GDPR): creation, verification, correction, updating and maintenance of the database of healthcare professionals owned by Merqurio, fed by the sources indicated in point 1, in order to hold accurate, complete and up-to-date professional information. This activity responds to Merqurio's legitimate interest in managing and offering its publishing and communication services addressed to the medical profession, as well as to the legitimate interest of those operating in the healthcare sector in being able to communicate to healthcare professionals medical-scientific, pharmacovigilance and medicinal product safety information, including Important Safety Notices (NII), Direct Healthcare Professional Communications (DHPC) and the communications commonly known as Dear Doctor Letters (DDL), with benefits in terms of the quality and relevance of the information received by the professionals themselves, the protection of public health and the accuracy of the data concerning them.

It remains understood that: (i) the sending of marketing communications, profiling activities and the communication of data to third parties for their marketing or profiling purposes take place exclusively subject to your separate consent, as set out in points 2.B, 2.C, 2.D and 2.E; (ii) contact by automated means (e-mail, sms, messaging, automated calls) takes place only in the cases and with the safeguards set out in Art. 130 of Legislative Decree 196/2003.

2.G) Even without your express consent, for the following Purposes of communicating professional data to healthcare sector entities

(lawful basis: legitimate interest, Art. 6(1)(f) GDPR): communication of professional data only, as referred to in point 2.F (identifying data, profession, specialisation, professional register enrolment, workplace and facility, professional contact details) to third parties operating in the healthcare sector (in particular pharmaceutical companies and their licensees, research organisations, healthcare service providers), which will process them as autonomous Data Controllers, exclusively for purposes connected with their activity in the healthcare sector, such as:

• medical-scientific information, including through networks of medical representatives;
• information and communications relating to the safety, quality and correct use of medicinal products and to pharmacovigilance, including Important Safety Notices (NII), Direct Healthcare Professional Communications (DHPC) and the communications commonly known as Dear Doctor Letters (DDL), agreed upon or circulated in accordance with the instructions of the competent regulatory authorities;
• transparency obligations laid down by law or by sector codes;
• invitations to scientific and training events through non-automated channels;
• verification and updating of their own records.

Expressly excluded from such communication is any use by third parties for: (i) sending communications by automated means (e-mail, sms, mms, messaging, automated calls), which presupposes the data subject's consent given to the individual third party pursuant to Art. 130 of Legislative Decree 196/2003; (ii) profiling activities, which presuppose the consent referred to in points 2.C and 2.E. Any consents you have given to Merqurio on behalf of specific third parties (points 2.B, 2.D, 2.E) remain referred exclusively to the third parties named therein and do not extend to other recipients.

The recipient third parties are contractually bound to process the data within the limits set out above, to provide their own privacy notice pursuant to Art. 14 GDPR and to act upon the rectifications and objections that Merqurio communicates to them. Merqurio has also carried out a balancing test for this purpose, available on request according to the methods set out in point 9. You may object at any time to such communication, including before it takes place, pursuant to Art. 21 GDPR, according to the methods set out in points 8 and 9; the objection is communicated to the third parties that have already received the data.

Finally, sending by Merqurio of communications and informational and/or advertising or direct-sale material of Merqurio, with commercial and/or promotional and/or advertising content and/or aimed at medical-scientific information, to the e-mail address you provided upon registration, relating to Merqurio services, products and content similar to those you have already used or consulted and/or related or complementary to the use of the site's services. Every e-mail sent for such purposes will allow you, by clicking the dedicated unsubscribe link, to refuse further communications: Merqurio's interest is the general interest of an undertaking in promoting its own services and is considered legitimate by law under the national data protection legislation (purposes set out in the rules on so-called soft-spam pursuant to Art. 130, para. 4 of Legislative Decree 196/2003 — Italian Privacy Code).

4. Data retention

The Controller processes data for Service purposes for the time necessary to respond to your request and fulfil the purposes set out above, and in any case for no longer than 1 year from collection for contact data and no longer than 6 months from collection for browsing data. Furthermore, the Controller carries out processing operations for no longer than 4 years from data collection for Marketing and Soft-spam Purposes; and for no longer than 12 months from collection for Profiling purposes.

For Service purposes that derive from legal obligations, the duration of processing is the one set by applicable legal terms (i.e. for the entire duration of the obligation itself and subsequently in accordance with applicable statutes of limitation).

Data processed for the purposes referred to in point 2.F are retained for as long as the data subject is professionally active as a healthcare professional, with periodic verification and updating against the sources referred to in point 1, and in any case for no longer than 10 years from the end of professional activity, without prejudice to any further terms deriving from legal obligations.

The user may opt out, in whole or in part, at any time and independently, using the links placed in the footer of all pages of www.dottnet.it and in the footer of all e-mail communications received, or, if preferred, according to the methods set out in paragraph 9 of this document.

6. Communication of data

Your data may be communicated, even without your consent, for the purposes set out above to supervisory bodies, law enforcement or the judiciary which will process them, on their express request, as autonomous Data Controllers for institutional purposes and/or pursuant to the law in the course of investigations and controls.

Subject to your consent, where required, your data may be communicated to the following categories of entities operating in Italy and the European Union, who will process them for the purposes set out in this notice and using all the methods set out in this notice, in particular:

• Merqurio Group companies, in their capacity as Data Controllers: in particular, Merqurio Pharma srl, with registered office in Naples, via Santa Brigida, 68, 23, Tax Code and Companies Register Naples no. 05460871212; Merqurio Servizi srl, with registered office in Naples, via Santa Brigida, 68, Tax Code and Companies Register Naples no. 05905471214; Merqurio Holding srl, with registered office in Naples, Via Michelangelo Schipa, 61, Tax Code and Companies Register Naples no. 05415651214;
• third-party companies or other entities (e.g. suppliers, partners and client companies operating in the pharmaceutical sector, in the sector of Pharmaceutical Companies, communication agencies, medical professional websites) to which Merqurio and/or Merqurio Group companies — under contractual agreements (e.g. assignment and/or rental and/or lease and/or licence to use the data, or other) — communicate your data, in their capacity as Data Controllers.

8. Data subject rights

We inform you that, as a data subject, you have the right to:

• obtain confirmation as to whether or not your Personal Data exist, even if not yet registered, and that such Data are made available to you in intelligible form;
• obtain indication and, where applicable, a copy: a) of the origin and category of the Personal Data; b) of the logic applied in case of processing carried out with the aid of electronic instruments; c) of the purposes and methods of processing; d) of the identifying details of the Controller and processors; e) of the entities or categories of entities to which the Personal Data may be communicated or who may become aware of them, in particular if recipients in third countries or international organisations; f) where possible, of the data retention period or the criteria used to determine such period; g) of the existence of an automated decision-making process and, in such case, of the logic used, the importance and expected consequences for the data subject; h) of the existence of adequate safeguards in case of transfer of data to a non-EU country or to an international organisation;
• obtain, without undue delay, the update and rectification of inaccurate Data or, where there is an interest, the integration of incomplete Data;
• obtain erasure, transformation into anonymous form or blocking of Data: a) processed unlawfully; b) no longer necessary in relation to the purposes for which they were collected or subsequently processed; c) in case of withdrawal of the consent on which the processing is based and where there is no other lawful basis; d) where you have objected to processing and there is no overriding legitimate ground to continue processing; e) in case of fulfilment of a legal obligation; f) in the case of Data relating to minors. The Controller may refuse erasure only in case of: a) exercise of the right to freedom of expression and information; b) fulfilment of a legal obligation, performance of a task carried out in the public interest or in the exercise of official authority; c) reasons of public health interest; d) archiving in the public interest, scientific or historical research or for statistical purposes; e) exercise of a right in judicial proceedings;
• obtain restriction of processing in case of: a) contesting the accuracy of the personal Data; b) unlawful processing by the Controller, to prevent erasure; c) exercise of a right in judicial proceedings; d) verification of any prevalence of the legitimate grounds of the Controller over those of the data subject;
• receive, where processing is carried out by automated means, the Personal Data concerning you in a structured, commonly used and machine-readable format, in order to transmit them to another Controller or — if technically feasible — to obtain the direct transmission by the Controller to another Controller, without hindrance;
• object, in whole or in part: a) for legitimate reasons, to the processing of Personal Data concerning you, even if relevant to the collection purpose; b) to the processing referred to in points 2.B and 2.C of par. 2, also partially in relation to the individual communication channels;
• exercise opt-out, in whole or in part, at any time and independently, using the links placed in the footer of all pages of www.dottnet.it, and in the footer of all e-mail communications received, or, if preferred, according to the methods set out in paragraph 9 of this document;
• object at any time, pursuant to Art. 21 GDPR, to the processing based on the legitimate interest referred to in points 2.F and 2.G, including before the communication to third parties referred to in point 2.G takes place; in such case Merqurio will refrain from the processing — and will inform the third parties that have already received the data — unless it demonstrates the existence of compelling legitimate grounds which override those of the data subject, or the need to establish, exercise or defend a right in judicial proceedings;
• lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

In the cases set out above, where necessary, the Controller will notify the third parties to whom your Personal Data have been communicated of any exercise of rights on your part, except in specific cases (e.g. where such notification proves impossible or would entail a disproportionate effort compared with the right protected).

10. Controller, processor, officers and Data Protection Officer

The Data Controller is:

• Merqurio Editore S.r.l., with registered office in Naples, via Santa Brigida, 68, 80132.

The appointed Data Protection Officer is:

• Silvio Tortora Maione
• dpo@merqurio.it

The up-to-date list of processors and processing officers is kept at the Controller's premises and can be requested according to the methods described in paragraph 9 of this document.