This Privacy Statement applies to:

1. personal data voluntarily provided to us regarding medical information, complaints about products, or drug safety, and

2. when you contact us by phone, email, fax, post, or web form to seek medical information, file complaints, or report adverse reactions related to our products.

Personal data refers to data that identifies you as an individual or that is related to a directly or indirectly identifiable person.

When you contact us by phone or web form, we may request personal data from you during the interaction.

Please do not provide us with information about another identifiable person (such as your patient or a family member). For example, if you are reporting an adverse reaction for your patient or family member, do not provide us with the name or address of the patient or family member.

For what purpose and on what legal basis we process personal data
We use personal data to:

Comply with our legal and regulatory obligations regarding the reporting of adverse reactions, complaints about products, and the safety of our products for patients. As part of this, we may contact you if we need more information about the adverse reaction or complaint you have reported.

Respond to your inquiries and provide customer service, including tracking and responding to concerns, and for quality assurance purposes; such use is in line with our legitimate interest in providing or facilitating accurate and timely information about our products, or with your consent.

Further carry out our activities in accordance with our legal obligations, for statistical purposes, or to comply with our legitimate interests in enforcing our business. Carrying out our activities includes:

• Determining if you are eligible for access to certain products, services, and data that may only be provided to licensed healthcare providers.

• Analyzing or predicting healthcare provider preferences to identify added trends to develop, improve, or customize our products, services, and business operations.

• Protecting our rights, privacy, safety, or property of you or others.

Automated decision-making
Costero B.V. does not carry out automated processing; namely decisions made by computer programs or systems without human intervention (for example, an employee of Costero B.V.). Therefore, there are no decisions made regarding matters that may have (significant) consequences for individuals.

How we disclose personal data
We provide personal data to our external service providers to provide services such as information technology and related infrastructure facilities, customer service, email delivery, auditing, and other services.

We may also disclose your personal data if we deem it necessary or appropriate to comply with applicable laws and our regulatory monitoring and reporting obligations (which may include laws outside the country where you are located), to comply with requests from public and government agencies (which may include agencies outside the country where you are located), to cooperate with law enforcement, or for other legal reasons.

Furthermore, we may use, disclose, or transfer personal data to a third party in the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other circumstance involving all or part of our business, assets, or stock (including bankruptcy or similar developments) or to protect our rights, privacy, safety, or property of you or others.

How long we retain personal data
Costero B.V. does not retain your personal data for longer than is strictly necessary to achieve the purposes for which your data is collected.

Sharing of personal data with third parties
Costero B.V. does not sell your data to third parties and only provides it if necessary to comply with a legal obligation. We enter into a data processing agreement with companies processing your data on our behalf to ensure the same level of security and confidentiality of your data.

Cookies, or similar techniques, that we use
Costero B.V. does not use cookies or similar techniques.

How we secure personal data
Costero B.V. takes the protection of your data seriously and implements appropriate measures to prevent misuse, loss, unauthorized access, unwanted disclosure, and unauthorized alteration. If you believe your data is not properly secured or if there are indications of misuse, please contact us at info@costero.eu.

Accessing, modifying, or deleting data
You have the right to access, correct, or delete your personal data. Additionally, you have the right to revoke your consent for data processing or object to the processing of your personal data by Costero B.V. and you have the right to data portability. This means that you can request us to send the personal data we have about you in a computer file to you or another organization mentioned by you. You can send a request for access, correction, deletion, data transfer of your personal data, or a request to revoke your consent or object to the processing of your personal data to info@costero.eu. To ensure that the request for access has been made by you, we ask you to send a copy of your ID with the request. In this copy, please black out your photo, MRZ (machine-readable zone, the strip with numbers at the bottom of the passport), passport number, and Citizen Service Number (BSN) for privacy protection. We will respond to your request as soon as possible, but within four weeks.

Costero B.V. also wants to inform you that you have the possibility to file a complaint with the national supervisory authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). This can be done via the following link: https://autoriteitpersoonsgegevens.nl/nl/contact-met-de-autoriteit-persoonsgegevens/tip-ons.

Updates
From time to time, we update this Privacy Statement.
All changes will be effective when we publish the revised Privacy Statement.

Costero B.V.
February 2024