Privacy statement for contractors

PRIVACY STATEMENT FOR CONTRACTORS

SUPPLIERS, CLIENTS AND BUSINESS PARTNERS

This privacy statement provides information about what personal data Huvepharma EOOD collects and how it processes that data with respect to contractual relationships. This text aims to clarify how we use personal information from legal representatives, employees and/or points of contact for our clients, suppliers, and partners.

Information on the data controller

With respect to the applicable EU Data Protection law (Regulation (EU) 2016/679, or GDPR), the company responsible for processing your personal data as a data controller is: Huvepharma EOOD, having its seat and registered address at 3a, Nikolay Haytov St., 5th floor, 1113 Sofia, Bulgaria.

It has appointed a Data Protection Officer (DPO) whom you can reach at [email protected] if questions with data processing arise.

Leading principles in data processing

Huvepharma values privacy and considers data protection seriously. It abides by all applicable legal restrictions on data protection, it does not share personal data without permission, guarantees data and information is stored in a secure manner and provides for transparency, communication, and appropriate conditions for data subjects to be able to exercise their rights.

Huvepharma incorporates the main data protection principles of lawfulness, fairness, transparency, specific and explicit purposes, data minimization, data accuracy, retention control and minimization, security of data, and accountability in all its processing activities.

Categories of personal data

Categories of personal data processed throughout contractual relationships with you or the legal entity you are part of or represent include:

·       Identification data – your name and ID data (if and when needed)

·       Contact data – postal address, telephone number, email

·       Position within the company

·       Financial and tax data (including bank details) when the contractor is a natural person

Purposes of collecting your personal data and legal bases for its processing

Personal data is collected primarily directly from you and will be used for the purposes of administering contract/s with you including:

·       Identifying contract parties and points of contact

·       Concluding, executing and administering contracts

·       Paying amounts according to contract/s

·       Reporting and control over received or supplied services

·       Maintaining financial records and accountability

·       Meeting legal requirements applicable to Huvepharma EOOD activities or executing state and/or judicial authorities’ official requests, based on their responsibilities

·       Satisfying tax and customs regulations

·       Facilitating your business trips and/or participation of your representatives in symposiums, science conferences, seminars and congresses

·       Defending Huvepharma’s rights and legitimate interests

If we are willing to use your personal data for purposes other than the ones mentioned above, you will be notified in advance and provided with all additional information related to this new processing.

Huvepharma EOOD is processing your personal data for most of the purposes above based on the performance of a contract with you. For other activities, the most applicable legal basis is Huvepharma EOOD legitimate interests (in case they are not overridden by your rights and freedoms i.e., Art 6, par 1, p “f” of Regulation (EU) 2016/679) such as:

·       investigation into new sales areas/regions/sectors importing and selling products of Huvepharma group companies

·       Assessment of appropriate suppliers, clients, distributors and/or other partners, including inspection of contractors from risky countries and/or those under sanctions

·       Attracting more customers pursuing revenue growth

Personal data sharing

Your personal data may be shared with the following recipients:

·       Responsible state authorities with respect to their legal obligations (NRA, customs etc) as well as judicial authorities, based on their official request

·       Banks, for the purposes of processing payments, according to contracts

·       Huvepharma EOOD contractors or suppliers, when necessary for processing a contract or request (IT services and security, for example)

·       Huvepharma EOOD subsidiaries and representative offices worldwide, as part of the information exchange related to financial reports, other references etc

·       Other Huvepharma EOOD contractors – insurance companies, transport, logistics and/or courier services among others, when needed

Security measures

Huvepharma EOOD is applying all necessary physical, organizational and technical measures to protect your personal data from unauthorized access, usage, disclosure, or loss. Measures include minimizing the categories and volume of processed data with respect to specific purposes, ensuring restoration of data access and availability (in cases of technical or physical incidents), ongoing employees’ training and confidentiality engagement, additional data protection agreements with processors, and maintaining a certified integrated management system with respect to Quality and Information Security standards – ISO 9001:2015 and ISO 27001: 2022.

When required, transferring personal data to recipients in third countries (outside the European Economic Area or EEA) is always processed with respect to all requirements of Regulation (EU) 2016.679, and applying any of the following instruments – adequate level of data protection (for countries present in the list of the European Commission (EC) at the time of transfer, for providing adequate / same level of personal data protection), standard contractual clauses (SCC) or occasionally, using derogations for specific cases, i.e., when Huvepharma EOOD transfers personal data for the purposes of concluding 1) a contract with you (or upon steps on your part prior to entering into a contract with Huvepharma EOOD – Regulation (EU) 2016/679 – art. 49, para 1, p. “b”), or 2) a contract with another legal entity, intended for your benefit (Regulation (EU) 2016/679 – art. 49, para 1, p. “c”), or when any of the other conditions in the same art. 49 is present and all specific applicable requirements are met.

Data retention

Huvepharma EOOD retains documents containing your personal data for the purposes of administering contracts with you or the legal entity you represent for a period of 10 (ten) years after contract termination. For some contractual documents in the purchases’ folder, the retention period is longer with respect to the company’s legitimate interest in defending itself in cases of arising purchase-related claims, statistical as well as audit purposes.

All documents related to organizing business trips of Huvepharma EOOD contractors and partners, including invitation letters, are retained for 1 (one) year.

Your rights with respect to your personal data

As a data subject in the context of the European legislation for personal data protection, you have and exercise the following rights:

·       receive information about what personal data Huvepharma EOOD is processing about you

·       access your personal data as well as obtain a copy of it

·       request the correction and/or completion of any inaccurate/incomplete personal data

·       request erasure of your personal data (“right to be forgotten”) processed with no legal basis

·       restrict processing of your personal data in case of a legal dispute with Huvepharma EOOD or for the purposes of defending legal claims

·       object to data processing in cases your data is processed based on legitimate interest and direct marketing

·       request data portability when processing is based on consent or contractual obligation

·       not to be subject to a decision based solely on automated processing, including profiling which produces legal effects to your or significantly affects you

·       lodge a complaint with the Commission for Personal Data Protection of Bulgaria (CPDP) at the following address – 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg or a court of competent jurisdiction in cases you think your privacy rights are violated.

Following Bulgarian legislation on data protection, you can exercise your rights by submitting a request form to Huvepharma EOOD. You can also do it electronically with respect to the requirements of the Electronic Document and Electronic Trust Services Act by sending an email to [email protected]. You can do it personally or you can provide a power of attorney to someone else to do it for you. You can expect a response to your rights’ request within one (1) month following receipt thereof and, in any case, within two (2) additional months because of the complexity of the request or the total number of requests received.

Huvepharma EOOD collects personal data directly from you and it is necessary for concluding a contract with you or with the entity you represent. Without your personal data, Huvepharma EOOD will not be able to initiate/pursue this specific contractual relationship.

Huvepharma EOOD does not apply automated decision-making related to data processing as described in art. 22 of Regulation (EU) 2016/679.

This privacy statement may be updated without notice to meet changes in applicable legislation and the Huvepharma EOOD Privacy Policy, respectively. We will notify you accordingly if and when we make substantial changes and updates.

Huvepharma EOOD leadership