DATA PROTECTION

We use the personal data you enter exclusively for the purpose of providing the service you have requested. Your data will not be passed on to third parties unless there is a legal obligation to do so or you have given your prior consent. In particular, we will not sell, rent or otherwise transfer your personal data to third parties for marketing or advertising purposes. Users who do not wish to continue receiving our news service can unsubscribe using a simple unsubscribe mechanism included in all emails sent.

DATA PROTECTION OFFICER

The responsible person in the sense of the General Data Protection Regulation (GDPR) and at the same time service provider in the sense of the Telemedia Act (TMG) is Shop Apotheke Europe N.V.. You can find the contact details of the responsible person in the imprint. The contact details of the data protection officer are:

Dr. Sebastian Kraska IITR Datenschutz GmbH Marienplatz 2D-80331 München email@iitr.de

Please do not contact Dr. Kraska for requests for information, deletion or regarding the status of your orders. As an external data protection officer, Dr. Kraska is not involved in day-to-day operations. Always contact SHOP APOTHEKE EUROPE N.V. directly about this via kontakt@shop-apotheke.com. Please understand that Dr. Kraska cannot process or forward e-mails and telephone calls in this regard.

PROCESSING OF YOUR PERSONAL DATA FOR INFORMATIONAL USE

The subject of data protection law is personal data. Personal data is any information relating to an identified or identifiable natural person, e.g. name or address data. Telephone number, mobile number, fax number, bank details and insurance number are also assigned to personal data. Special categories of personal data represent a subgroup of personal data. From the legislature's point of view, this data is particularly worthy of protection. Special categories of personal data include, for example, information about health, sex life and sexual orientation. Information that cannot be associated with natural persons is not included.

When using our website for purely informational purposes, without logging in, registering or contacting us, the following data is collected, saved and processed in a log file when you access the website or call up a file: - IP address of the requesting computer - Date and time of access - name and URL of the accessed file - the browser used - number of bytes transferred - status of the page request - session ID - referrer

The collection and processing of the data is carried out for the purpose of enabling the use of our website (connection establishment) and ensuring system security and stability over the long term, as well as enabling the technical administration of the network infrastructure and its optimization of our website (legal basis Art. 6 para. 1 p. 1 lit. b and f GDPR).

In addition, this data is evaluated for internal statistical purposes and to improve the offer (legal basis Art. 6 Para. 1 S. 1 lit. f GDPR) and then deleted. This evaluation is carried out by an external service provider, so that the person responsible only has anonymized evaluation results that do not allow any conclusions to be drawn about your person. In addition, we use cookies and analysis services when you visit our website. You can find more detailed explanations in the lower section of this data protection declaration.

COOKIES

This website uses cookies. Cookies are small text files that are stored on your terminal device and saved by your browser on the hard disk. Cookies do not cause any damage to your computer and do not contain viruses. Cookies are used to enable functions and a user-oriented and smooth navigation, to make our offer more user-friendly, more effective and safer. We or our partners - in the case of third-party cookies - can read the cookies during your visit to our website. Information is stored in the cookie that is in each case related to the specific end device used. This does not mean, however, that we thereby gain direct knowledge of your identity.

Some of the cookies we use are deleted at the end of the browser session, even after you close your browser (so-called technology or session cookies). These cookies store a session ID that can be used to recognize your computer when you return to our website and enable certain functions of the website.

Other cookies remain on your terminal device and are only deleted after a specified time. They enable us or our partner companies to recognize your browser and any entries and settings you may have made on your next visit (persistent cookies). In addition, these cookies are partly used to statistically record the use of our website and to evaluate it for the purpose of optimizing our offer for you.

The data processed by cookies is necessary for the aforementioned purposes to protect our legitimate interests according to Art. 6 para. 1 p. 1 lit. f GDPR.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when you close the browser. If cookies are deactivated, the functionality of this website may be restricted. If it does not agree with the use of cookies, you can also find the option to object (opt-out) of the use of cookies on this website under the following link.

YOUR RIGHTS

You have the following rights vis-à-vis the aforementioned data controller:

- a right to free information about the personal data processed about you and to obtain a copy of this data, as well as information about, among other things, its origin and recipients, as well as the purpose of the data processing and the duration of storage (Art. 15 GDPR);

- if applicable, a claim to correction of incorrect or incomplete data (Art. 16 GDPR), deletion (Art. 17 GDPR) or restriction of processing (=blocking; Art. 18 GDPR) of this data;

- to object to the processing, insofar as it is based on a legitimate interest of the controller (Art. 6 (1) p. 1 lit. f GDPR) and you present grounds for objecting to the processing (Art. 21 GDPR).

- the right to request a transfer of the data you have provided to yourself or to another controller (Art. 20 GDPR).

- If you have given us consent to process your personal data, you may revoke this consent at any time with effect for the future. The lawfulness of the data processing carried out before the revocation remains unaffected.

Corresponding requests are to be sent to the address of the pharmacy given below.

SHOP APOTHEKE EUROPE N.V. Dirk Hartogweg 14 NL-5928 LV Venlo E-Mail: datenschutz@shop-apotheke.com

In addition, you have the right to complain about alleged violations of data protection law to a supervisory authority, for example in the state of the country of the registered office of the controller, your place of residence, workplace or the breach (Art. 77 DSGVO).

Competent data protection supervisory authority for the controller:

Autoriteit Persoonsgegevens Postbus 93374 NL 2509 AJ DEN HAAG Tel. 0031-70-88885-00 cbpweb.nl

You are welcome to contact us first before reporting to the supervisory authority.

RECRUITEE

The applicant platform is implemented by the service provider Recruitee. In the following, you will be informed about the data processing conducted by Recruitee.

Nature and purpose of processing

Subscriber agrees to use the Services only for recruitment and/or talent acquisition purposes. Recruitee processes Personal Data on behalf of Subscriber as part of the Services and pursuant to the Agreement.

Data Subjects

The aforementioned processing of personal data relates to the following data subjects:

- Subscriber's applicants, potential applicants, candidates and potential candidates (hereinafter collectively: "Candidates");

- Visitors to the Subscriber's career website provided as part of the Services (hereinafter: "Visitors");

- all persons visiting the Subscriber's referral website, if the referral website is provided as part of the Services, or referring a Candidate through the Services (hereinafter: "Referrers").

Categories of personal data

Recruitee processes the following categories of Candidate Personal Data on behalf of the Subscriber: - Contact details, including names - resumes - Email correspondence - address details - employment history - Letters of motivation and other application materials - Information on candidates collected via integrations between services and via third party services on behalf of the subscriber or end users - comments on candidates - candidate evaluations; and - Other personal data processed in the context of the Services in relation to Candidates. For clarity, Personal Data that relates to Candidates and simultaneously to other Data Subjects is considered to be processed on behalf of the Subscriber (e.g., email address from a User to a Candidate).

Recruitee processes the following categories of Candidate Personal Data on behalf of the Subscriber: - Traffic source - HTTP requests and responses - cookies - date and time of use - other personal data relating to Visitors that is processed as part of the Services.

Recruitee may process the above personal data only to the extent that it falls within the Services, except where personal data has been anonymized and is used to improve the Services. The Subscriber or End User may provide Recruitee with additional instructions for the processing of Personal Data through its use and within the scope of the Services. For example, an End User may delete Personal Data related to a Candidate in the SaaS. Subscriber shall ensure that any instructions given by Subscriber, including but not limited to those given on Subscriber's behalf, are in compliance with applicable laws and regulations, including but not limited to the GDPR.



DATA SECURITY

Shop Apotheke Europe N.V. uses technical and organizational security measures in order to protect the data we have under our control against accidental or intentional manipulation, loss, destruction or against access by unauthorized persons.

ENCRYPTION

All your transmitted data is protected by SSL encryption. Secure Socket Layer (SSL) is a protocol developed to enable secure data transmission over the Internet. SSL uses the public-private key method. With this, data encoded with a publicly available key can only be decoded again with a very specific private key.

LAW ENFORCEMENT

By order of the competent authorities, we may in individual cases provide information about the personal data collected, insofar as this is necessary for the purposes of law enforcement, to avert danger, to fulfill the statutory tasks of the constitutional protection authorities or the Military Counter-Intelligence Service, or to enforce intellectual property rights. (Art. 6 para. 1 p. 1 lit. c, e, f, Art. 9 para. 2 lit. g, f GDPR).

In particular, we are entitled, even without a corresponding order, to store content and to pass it on to third parties, insofar as this is required by law (Art. 6 para. 1 p. 1 lit. c, Art. 9 para. 2 lit. g GDPR) or is necessary and legally permissible at our discretion in order to

- comply with legal provisions or judicial or official orders (Art. 6 para. 1 p. 1 lit. c, Art. 9 para. 2 lit. f, g GDPR)

- to respond to the assertion of an infringement of rights by third parties (Art. 6 para. 1 p. 1 lit. f, Art. 9 para. 2 lit. f GDPR)

- to protect the rights, property or personal safety of the pharmacy, users of the website or the public (Art. 6 para. 1 p. 1 lit. f, Art. 9 para. 2 lit. f GDPR).

If you have any questions, suggestions or comments on the subject of data protection, please do not hesitate to contact us at the following e-mail address: datenschutz@shop-apotheke.com

#Version of the data protection declaration: December 2021