Data Privacy

Biocorp pays particular attention to the protection of personal data. This General Policy on Personal Data Protection describes how your personal data is processed by Biocorp, as well as the scope of your rights.

This Policy does not describe the cookies used on our websites, nor the data collected during your visit to the website. For more information, please see our Website Data Policy and/or our Cookie Policy available at https://biocorpsys.com/en/data-privacy/. This General Policy is only applicable if you are not already within the scope of another specific privacy policy (patients, candidates, employees).

1. REGULATORY FRAMEWORK

Biocorp complies with the rules in force on data protection, in particular Law No. 78-17 of 6 January 1978 relating to information technology, files and freedoms, as amended (known as the “Data Protection Act”) and the General Data Protection Regulation No. 2016/679 of 27 April 2016 (known as the “GDPR”), for all processing of personal data implemented in the context of the services or products provided.

Understanding the following terms is essential to understand the concepts of personal data protection:

• “Personal data” means any information relating to an identified or identifiable natural person, directly or indirectly;

• “Processing” means any operation or set of operations which is performed on personal data or sets of personal data, including automated means;

• A “controller” is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing; and

• A “processor” is the natural or legal person who processes personal data on behalf of the controller.

2. LAWFUL BASES

Biocorp implements various processing of personal data based on the following lawful bases:

• Consent represents the data subject’s consent to the collection and use of their data (e.g. for the calculation of CO₂ emissions from visitors’ travel, or to carry out studies on Biocorp’s products);

• The performance of a contractual obligation between the data controller and the data subject (e.g. for operations relating to the management of suppliers, partners, customers, or distributors);

• Compliance with a legal obligation imposed on the data controller (e.g. for the management of requests to exercise GDPR rights, the payment of invoices and tax returns, the processing of alerts and reports, or health vigilance); and

• Legitimate interests pursued by Biocorp that do not create an imbalance to the detriment of the rights and interests of the persons concerned (e.g. for the management of vulnerabilities and security incidents, the security of assets via video surveillance, the management of disputes, or the evaluation of the beneficiaries of donations, patronages or sponsorships).

3. PROCESSED DATA

As part of its activities, Biocorp may collect the following personal data from you, whether from collection forms or exchanges with you, regardless of the medium of these exchanges, in particular:

• Identification data necessary for your identification (e.g. your surname, first name);

• Contact data (e.g. your email address, telephone number);

• Personal data (e.g. your job title, the identity of your employer);

• Economic and financial information (e.g. your bank details, billing address):

• Health data (e.g. your processing, in connection with a health vigilance case); and

• Connection data (e.g. your log data).

Where Biocorp processes special categories of data (or sensitive data) within the meaning of Article 9 of the GDPR, such processing is based on the express consent of the data subject or on one of the other exceptions provided for by the applicable regulations.

4. COMPLIANCE APPROACH

Biocorp implements various means and mechanisms aimed at the practical implementation of this Policy. A non-exhaustive list of these means and mechanisms is presented below.

• Register of processing: Biocorp keeps an up-to-date register of its processing activities as a data controller and, where applicable, a register of its activities as a personal data processor;

• Data protection in new projects: in the context of new projects involving the processing of personal data, the legal department identifies whether a Data Protection Impact Assessment (“DPIA”) is required; and

• Awareness, training and monitoring: Biocorp encourages a culture of data protection amongst all its employees. Various means of information, awareness and training are made available to employees in order to understand the implications of the regulations and to know the rules and procedures to be followed (legal/compliance newsletter, e-learning modules, face-to-face training etc.). Each new employee, when hired, receives documentation informing them of the rules to be followed and their rights in terms of personal data.

5. DATA SECURITY

Biocorp is committed to ensuring the security and confidentiality of the data collected by implementing appropriate technical, physical and organisational measures to protect it against unauthorised access, use and disclosure. These measures take into account the nature, scope, context and purposes of the data processing, as well as the risk and danger to the rights and freedoms of the data subjects.

An IT charter specifies the general rules of use and security that employees and more broadly, users of Biocorp’s IT resources, are required to respect.

In the event of a breach of your personal data, Biocorp has a procedure and obligation to notify the relevant supervisory authority and to inform you, as soon as possible, of any personal data breach that may result in a high risk to your rights and freedoms.

6. DATA RECIPIENTS

The recipients of personal data are duly authorised to the extent necessary for the pursuit of the purposes specified above, and necessary for their activity:

• Biocorp employees, within the limits of their rights and attributions;

• Biocorp’s Data Protection Officer;

• Third parties involved such as lawyers, court officers, chartered accountants, audit firms, auditors;

• Biocorp’s service providers and subcontractors, in compliance with contractual obligations; and

• The administrative and judicial authorities, or social bodies, competent and authorised to receive such data.

When Biocorp acts as a data controller and uses subcontractors, Biocorp ensures that the latter provide sufficient guarantees as to the implementation of appropriate technical and organisational measures to ensure that the processing meets the requirements of the applicable regulations on the protection of personal data and guarantees the protection of the rights of the data subject. In addition, each contract involving the processing of personal data includes a clause setting out the obligations of the processor regarding the processing carried out on behalf of Biocorp. This clause includes the public policy obligations provided for in Article 28 of the GDPR as well as the commitment to comply with the applicable regulations.

7. DATA RETENTION PERIOD

Your data is kept for a limited period of time. This period is determined in an internal data retention policy according to the purpose of the processing and rules resulting from CNIL recommendations or according to regulatory obligations.

8. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION

In the event of a transfer of personal data outside the European Union (EU), guarantees would be taken to provide a legal framework for this transfer and to put in place technical and contractual measures, as defined by the regulations, to ensure compliance with the principles of the GDPR and the security of the data concerned.

In this case, the data subjects are informed about the country in which the recipient of the data transferred is located, the nature of the data transferred, the purpose of the transfer and the categories of recipients of the data transferred and the guarantees ensuring an adequate level of data protection.

9. RIGHTS OF DATA SUBJECTS

In accordance with the regulations in force on the protection of personal data, you have the right to access and rectify data concerning you. You also have the right to limit processing and to erasure (or the right to be forgotten) under the conditions set out in Articles 17 and 18 of the GDPR.

If the legal basis for the processing is the legitimate interest of Biocorp, or, where applicable, the public interest mission, you also have the right to object in accordance with the legal provisions.

Finally, you also have the right to the portability of your data as well as the right to withdraw your consent at any time, for processing based on this legal basis. The withdrawal of your consent will have no impact on the lawfulness of the processing carried out before its withdrawal.

All your rights can be exercised at any time:

• By sending an email to privacy@biocorp.fr; or

• By writing to Biocorp Production, DPO – Legal Department, ZI de Lavaur, La Béchade 63500 ISSOIRE, France.

You also have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL) or a data protection authority of an EU Member State.

10. MODIFICATION OF THIS POLICY

Biocorp reserves the right to modify or, in general, to update, at any time and without notice, this General Personal Data Protection Policy, in particular in order to take into account any changes in Biocorp’s organization and/or governance, regulations, as well as the decisions and standards of the CNIL.

Any substantial changes will be indicated on the website. We invite you to consult this page regularly to keep yourself informed of any changes that may be made.