Data privacy

This Policy may be modified by the Servier Group, to take into account any changes from applicable laws and regulations, as well as in our activities. The changes will appear on this page, that we invite you to consult regularly.

Who is the data controller?

The Servier Group is made up of several entities. The Servier entity acting as data controller may differ depending on the purpose pursued.

The Servier entity acting as data controller is indicated in the table below. It is also indicated in the information that may have been given to you via another channel.

Why do we collect your personal data and on which basis? Which data are we talking about?

This Policy describes activities for which we need to use your personal data, according to the appropriate legal basis.

We only use data that is strictly necessary for the purposes we are pursuing.

Data controller entity	Purpose pursued	Personal data collected	Legal basis of processing
Les Laboratoires Servier (LLS) 50 rue Carnot – 92284 Suresnes Cedex France	Management of requests for medical information	Identification data that we need to answer to you: first name, last name, email address, phone number, postal address, country, name of the concerned productData that you spontaneously communicate to us	Legal obligation
Les Laboratoires Servier (LLS) 50 rue Carnot – 92284 Suresnes Cedex France	Management of quality defect reports	Identification data that we need to answer to you: first name, last name, email address, phone number, postal address, country, name of the concerned product, batch number, dosage, box sizeData that you spontaneously communicate to us	Legal obligation
Biofarma 50 rue Carnot – 92284 Suresnes Cedex France	Management of reports of suspected counterfeiting	Identification data that we need to answer to you: first name, last name, email address, phone number, postal address, country, name of the concerned product, batch number, place of purchase of the product, purchase date Data that you spontaneously communicate to us	Legitimate interests of the data controller entity to efficiently protect our products/services
Servier Monde 50 rue Carnot – 92284 Suresnes Cedex France	Management of  digital health project’s submissions	Identification data that we need to answer to you: first name, last name, organization, email address, country, town, project area Data that you spontaneously communicate to us	Legitimate interests of the data controller entity to study your application and answer to it
Servier Monde   50 rue Carnot – 92284 Suresnes Cedex France	Management of requests relating to another subject	Identification data that we need to answer to you: first name, last name, email address, telephone number, postal address, country, subject Data that you spontaneously communicate to us	Legitimate interests of the data controller entity to provide you with adequate assistance
Servier Monde   50 rue Carnot – 92284 Suresnes Cedex France	Newsletter subscription	Email address	Consent
Servier Monde   50 rue Carnot – 92284 Suresnes Cedex France	Account creation to access the press area	First nameLast nameProfessional email addressMediaCountry	Legitimate interests of the data controller entity to check the legitimacy of your request and respond to it if necessary
Les Laboratoires Servier (LLS) 50 rue Carnot – 92284 Suresnes Cedex France	Report of side effects	Identification data that we need to answer to you: first name, last name, email address, phone number, postal address, country, name of the concerned product	Legal obligation
Les Laboratoires Servier (LLS) 50 rue Carnot – 92284 Suresnes Cedex France	Record of switchboard’s calls	Identification dataAll personal data provided at the time of the call	Legitimate interests of the data controller entity to improve service quality and for training purposes

How long do we keep your personal data?

The Servier Group entity acting as data controller will only keep your personal data for as long as necessary to achieve the purposes pursued in this Policy. More specifically:

Purpose pursued	Data retention period
Management of requests for medical information	We keep your personal data for 10 years starting from the day we received your request.
Management of quality defect reports	We keep your personal data for 10 years starting from the day we received your request.
Management of reports of suspected counterfeiting	We keep your personal data for 5 years starting from the day we received your request then, if necessary, during the period of the litigation.
Management of digital health project’s submissions	We keep your personal data for 13 months starting from the day we received your request.
Management of requests relating to another subject	For all non-specific requests for information (i.e. not linked to a regulatory obligation) for which the law does not impose a specific period, we keep your personal data for 13 months starting from the day we received your request.
Newsletter subscription	We keep your personal data until you unsubscribe or for a period of 3 years starting from the date of your last contact, whichever occurs first.
Account creation to access the press area	We keep your personal data until you request for deletion of the account or for a period of 2 years starting from the last connection to the account.
Report of side effects	We keep your personal data for 30 years after the relevant marketing authorisation has ceased to exist; the data is then deleted or archived in an anonymised form, unless otherwise envisaged by mandatory local regulations.
Record of switchboard’s calls	We keep your personal data for a maximum period of 6 months from the recording.

How do we secure your personal data?

We put in place adequate technical and organisational measures to ensure security, integrity and confidentiality of your personal data.

These measures are designed with the aim of protecting personal data against unauthorised access, loss, destruction or alteration. In implementing these measures, we take into account the technologies available, the costs of implementation, as well as the nature, context and purposes of the processing of personal data and the risks to the rights and freedoms of the persons concerned.

Do we share your personal data?

Your personal data processed by the entities of the Servier Group will only be accessible by a limited list of employees of the Servier entities concerned, on a need-to-know basis or when required by law.

Your personal data may also be transmitted to partners with whom the entities of the Servier Group collaborate in order to provide the expected services.

Finally, the entities of the Servier Group may communicate upon request your personal data to the competent authorities, such as public health authorities.

Do we transfer your personal data internationally?

The Servier Group is made up of entities located throughout the world. It also works with partners and subcontractors located in many countries throughout the world.

Your personal data may therefore be transferred for the purposes described above to recipients located in a country that does not offer an adequate level of protection. In such a case, the Servier Group will take all necessary measures and guarantees to ensure the security of such transfers (such as the conclusion of European Commission Standard Contractual Clauses).

What are your rights?

According to the legal basis for the concerned purpose and when the applicable law provides it, you have the following rights:

• Request access to your personal data
• Update, correct or delete your personal data
• Request that some of the personal data you gave us be provided to you, or to another data controller, in a commonly used and machine-readable format (right to portability of your personal data)
• Define post-mortem directives
• Restrict or object to the processing of your personal data
• Withdraw your consent

You can exercise these rights with the Data Protection Officer (“DPO”):

• By email to the following email address: dataprivacy@servier.com
• By regular mail to the following address:

Servier Monde

Data Protection Officer

50, rue Carnot
92284 Suresnes Cedex

FRANCE

You also have the right to lodge a complaint with the French Data Protection Authority (“Commission Nationale de l’Informatique et des Libertés”, “CNIL”), in particular on its website www.cnil.fr.

Your data may be used for the following purposes: