PRIVACY POLICY

The purpose of this privacy policy is to explain to you how Ferrer will process the personal data you provide us through this website, as well as any personal data we may collect from any interaction you have with us.

1. Who is the data controller?

The data controller of the personal data collected and processed through this website is Ferrer Internacional, S.A. (Ferrer) with NIF A08041162 and address at Avenida Diagonal, 549, 5ª Planta, 08029, Barcelona (Spain). You can contact Ferrer at the address dataprotectionSP@ferrer.com. In addition, if you have any other questions regarding the processing of your personal data, we invite you to contact the Data Protection Officer (DPO) at the address dpo@ferrer.com.

In certain cases, the data controller will not be Ferrer, but one of the companies that are part of the Ferrer group. For information about these companies and when they will be understood to be data controllers, you can consult section 8 of this policy entitled "In some countries, Ferrer has a direct presence, in which cases is the Ferrer group company a data controller?"

2. For what purposes do we process your personal data? In this section we will also inform you about its legal basis and the storage period

The purposes for which Ferrer will process the data collected through this website are:

2.1 Attend to and respond to queries, claims and/or suggestions that you submit to us through the form intended for this purpose, such as making a general query, you need assistance with the Inspirio pump or you want to file a quality complaint. To do this, we may contact you to give you a complete answer.

• Legal basis: We consider the existence of Ferrer's legitimate interest in correctly resolving and responding to the suggestions, queries or requests that you may make through the enabled channel, it being understood that, in no case, your rights and/or freedoms are affected or harmed by the fact that the request initiated by you is being answered.

In those cases where the consultation is to obtain information on orders and/or invoicing, the legal basis that will enable the processing of your data is legitimate interest in the event that you are the representative of the entity or company that has placed the order with us.

• Retention period: We will keep your information until we have resolved your query and, once resolved, we will directly delete the information that allows you to be identified. We will only keep the query or suggestion raised, but without any information that allows us to identify you.

2.2 To attend to and manage your communication about adverse reactions related to our products. We will only process the information necessary to follow up on the case, investigate the reported adverse reaction, and comply with our pharmacovigilance legal obligations. When the case is closed, we will delete the data that allows you to be identified, except for those that we must keep by legal obligation.

• Legal basis: compliance with the legal obligations attributable to Ferrer by current legislation on pharmacovigilance. In the event that we collect health information, considered a special category of data, the circumstance that enables its processing to be necessary for reasons of public interest in the field of public health to guarantee high levels of quality and safety of medicines or medical devices.
• Retention period: the data will be kept for a period of 10 years after the withdrawal of the medicine in the last country where it is marketed.
• Additional information on adverse reaction management: Ferrer Internacional adheres to the Code of Conduct regulating the processing of personal data in the field of clinical trials and other clinical research and pharmacovigilance promoted by Farmaindustria and approved by the Spanish Data Protection Agency.

If you wish to raise a complaint related to any of the processing of personal data included in the scope of the Code, you may contact the Governing Body of the Code of Conduct through the Secretariat of the Code: María de Molina, 54 – 7th floor, 28006 Madrid, Spain; telephone +34 91 515 93 50; email secretariacodigo@farmaindustria.es, without prejudice to your right to file a complaint with the Spanish Data Protection Agency.

2.3 In the event that you send us your curriculum vitae and/or job application, your data will be processed for the purpose of responding to said application and, where appropriate, allowing you to participate in a selection process for a job at Ferrer. You can find more details in the privacy policy that you will find attached to each application.

• Legal basis: the application of pre-contractual measures at the request of the user.
• Retention period: all CVs are destroyed once one year has elapsed since the end of the aforementioned selection process, so if you wish to continue being part of the Ferrer database, you must send your CV again once this period has elapsed.

2.4 Respond to the exercise of the rights recognised in the personal data protection regulations.

• Legal basis: compliance with a legal obligation regarding the management of the exercise of rights refers to the obligation provided for in the General Data Protection Regulation.
• Retention period: the data processed to manage your request will be processed while we are managing your request and, as soon as it has been resolved, the information will be blocked for 3 years, a period that has been determined in accordance with the limitation period of the obligations provided for in the personal data protection regulations.

2.5 To manage contact in relation to Ferrer's business development; to enter into strategic alliances or carry out business opportunities, including, but not limited to, Ferrer's in-licence or out-licence activities.

• Legal basis: Ferrer's legitimate interest in accordance with Article 19 of the Organic Law on Data Protection and Guarantee of Digital Rights, as the processing is limited to the data necessary for their professional location and to maintain commercial relationships.
• Retention period: the information will be kept for as long as there is an interest in maintaining a commercial relationship with Ferrer.

2.6 To manage the User's interactions with Ferrer through the different social media profiles (Instagram, Facebook or X, among others). The data processed for this purpose will be those entered by users in their profile of the corresponding social network, therefore, regulated by the Privacy Policy of said social network, for which Ferrer is not responsible.

• Retention period: the data processed for this purpose will be kept for the duration of Ferrer's profile on the social network.
• Legal basis: Ferrer's legitimate interest in responding to the questions raised through the social network.

2.7 Ethical channel: Information on the processing of your data through this channel can be found in the Privacy Policy of the Ethics Channel.

2.8 Use of cookies and/or similar technologies: Information on the processing carried out through the cookies installed on this website and/or similar technologies can be found in the Cookies Policy.

2.9 Subject to your authorization, to send you, through electronic channels, information about Ferrer products related to your specialty or professional interests, or information about Ferrer's professional activities. These communications may also include more general information about Ferrer's activities and purpose.

• Legal basis: This processing is based on the express consent you have provided. You may withdraw your consent at any time by using the unsubscribe link included in each communication or by sending your request to dataprotectionSP@ferrer.com. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to its withdrawal.

• Retention period: We will retain your personal data for as long as you maintain your consent to receive these communications and do not request their deletion. Once you withdraw your consent or request the deletion of your data, we will stop using it for this purpose. However, we may retain, in a duly restricted manner, the data strictly necessary to demonstrate the consent you provided, its withdrawal, and our compliance with legal obligations for a period of three years.

3. What type of data are we going to collect through the form or navigation on this website?

Depending on your interaction with the website, we may process identification and contact data, professional data, information included in queries or complaints, data related to applications, browsing data and, in the event of notification of adverse reactions, strictly necessary health data.

4. Who will we share the personal data you provide with?

In general, your data will not be communicated to third parties, except in those cases where it is strictly necessary as a result of a legal or administrative requirement transferred by public bodies or authorities.

In the event that you have reported an adverse effect, Ferrer will communicate to the health authorities any information that is required to comply with pharmacovigilance obligations. Likewise, your identification data may be communicated to the insurance companies with which insurance has been contracted, in order to carry out the necessary steps to process the compensation files that may be appropriate.

During the course of our business, it may be necessary for us to share your information with one of the companies that are part of the Ferrer business group. The details of the companies that are part of this group are available in the Global Presence section of the website.

On the other hand, we inform you that your personal data may be accessed by third parties acting on behalf of Ferrer, provided that such access and data processing is essential for the provision of a service contracted by Ferrer. Under this scenario, these third parties will process the information exclusively for the purposes that Ferrer determines in each case and never for their own purposes.

5. Will your data be transferred internationally?

In the event that we must transfer your personal data to third parties located in other jurisdictions outside the European Economic Area, Ferrer will guarantee that the corresponding guarantees are applied in accordance with the provisions of the personal data protection regulations. Whenever the transfer takes place in a country for which there is no adequacy decision, the transfer will be articulated in accordance with the standard contractual clauses approved by the Commission. European. These are available here: Standard Contractual Clauses (SCC) - European Commission

You may request additional information regarding international transfers of personal data and obtain a copy of the safeguards in place by exercising your rights as provided in the section below.

6. What are your rights in relation to your personal data and how can you exercise them?

You can exercise the rights conferred on you by the regulations on the protection of personal data by directing your request to dataprotectionSP@ferrer.com or by writing to the contact address specified in section 8 of this policy in the event that the person responsible for the information is not Ferrer Internacional.

The rights you can exercise are those detailed below:

• Right of access: You have the right to obtain confirmation as to whether or not we are processing personal data concerning you, as well as to request a copy of it.
• Right of rectification: You have the right to ask us to rectify your personal data where it is inaccurate or incomplete.
• Right to erasure: You can ask us to have personal data deleted when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
• Right to object: You can object to personal data being processed based on the legitimate interest pursued by Ferrer, including profiling. In this case, Ferrer will stop processing the data, unless there are compelling legitimate reasons or they are necessary for the exercise or defence of possible claims.
• Right to restriction of processing: You have the right to request the limitation of the processing of the data, in which case we will only keep them for the exercise or defence of claims.
• Right of portability: You have the right to receive your personal data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller when the processing of your data is legitimised by consent or derives from the performance of a contract, provided that it is carried out by automated means.

Similarly, in the case of processing whose legitimacy is the consent given by the data subject, the data subject has the right to withdraw said consent at any time, without this affecting the lawfulness of the processing based on consent prior to its withdrawal.

We will consider all requests and provide our response within the time period set by applicable law. You should be aware, however, that certain information may be exempt from such requests in some circumstances by including personal data that we need to continue to process for our legitimate interests or to comply with a legal obligation.

Likewise, inform you that you have the right to file a complaint with the corresponding Supervisory Authority, being in Spain the Spanish Data Protection Agency (www.aepd.es). In the event that the data controller is not Ferrer Internacional, you can consult the details of the supervisory authority in section 8.

If you have any questions regarding the processing of Ferrer's personal data, you can contact our data protection officer at the following e-mail: dpo@ferrer.com

7. In some countries, Ferrer as a business group has a direct presence. In which cases is the local company of the Ferrer group responsible for the processing?

There are certain cases in which the data controller will not be Ferrer Internacional, S.A., but one of the companies in the group with which Ferrer operates directly.

In the event that you can select a country in which Ferrer has a direct presence in the form (see the detail, Global Presence), it will be understood that this company is the data controller. Specifically, the purposes for which it is understood that the subsidiary will be responsible are:

• To manage and respond to requests, queries or communications made through the form "I need to make a general enquiry", the form "I want to request medical information about a product" or the form "I need information about orders and billing".
• Identify, evaluate and prevent the risks arising from the use of our medicines and, where appropriate, follow up on the case received through the form "I want to report an adverse reaction".
• To respond to queries, requests and possible quality complaints that you make through the "I want to make a quality complaint" form.
• Management of job applications received if you provide us with your CV.

The identification details of these companies are as follows:

In addition, without prejudice to any other administrative or judicial remedy, data subjects may lodge a complaint with the competent data protection authority, in particular with the authority of the country of their habitual residence, place of work or place of the alleged infringement. The contact details of certain supervisory authorities that may apply are provided below, for information purposes:

• Mexico:

• Chile:

Council for Transparency — CPLT and, as of December 1, 2026, the Personal Data Protection Agency

 https://www.consejotransparencia.cl

 Morandé 360, 7th floor, Santiago. Tel.: +56 9 3928 9757. Contact: contacto@consejotransparencia.cl. The CPLT has complaint and citizen service forms.

• Peru: 

National Authority for the Protection of Personal Data — ANPD, Ministry of Justice and Human Rights

 https://www.gob.pe/anpd

Online complaint for misuse of personal data through the official procedure "Report the misuse of personal data". Follow-up: protegetusdatos@minjus.gob.pe.

• Costa Rica:

 Inhabitants' Data Protection Agency — PRODHAB

https://www.prodhab.go.cr

 San Pedro de Montes de Oca, Mall San Pedro, Ofimall Centro Ejecutivo, 6th floor. Tel.: +506 2234 0189. The site includes a specific "Complaints" section.

• United Kingdom:

Information Commissioner's Office — ICO

https://ico.org.uk

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Tel.: 0303 123 1113. Online claims using the ICO form.

Information on the European Supervisory Authorities can be found on the official website of the European Data Protection Board: Our Members | European Data Protection Board

8. Information for healthcare professionals

If you are a healthcare professional, you can consult the information regarding the processing of your personal data in the Privacy Policy of Healthcare Professional.

You can also access the privacy policies of the different companies of the Ferrer Group below:

• Italy
• France
• Poland
• Mexico
• Czech Republic
• Austria
• El Salvador
• Peru
• Panama
• Nicaragua
• Honduras
• Guatemala
• Dominican Republic
• Costa Rica
• Chile
• Portugal

9. Changes or modifications to our privacy policy

We may revise this Privacy Policy from time to time and post the most current version on our website. We will inform you if your rights are significantly affected as a result of a review.

Last Revised: May 2026