Privacy & cookies policy

At Arcadia your privacy matters to us and we want you to be confident that your data is safe and secure with us. We invite you to carefully read this Privacy Policy, which sets out in which context we are processing your data and explains your rights and our obligations when doing so. Should you have any further question in relation to the processing of your data, you can contact us via email to our Data Protection Officer at info@arcadiapharma.co.uk

What information do we have about you?

We collect various types of data about you, including:

• Your general and identification information (e.g. name, first name, last name, email and/or postal address, fixed and/or mobile phone number, organisation bank details);

• Your function (e.g. title, position, name of company and/or trading name)

You can visit our website without providing any information. We may collect your identifiable information (such as name, address, telephone number, e-mail address or other identifying information) only when you choose to submit it to us, for example if you are required to register to use any part of our website.

How will we use the information?

We always process your data for a specific purpose and only process the data which is relevant to achieve that purpose. In particular, we process your data for the following purposes:

• Process your order;

• Manage your account;

• Provide you with appropriate, adequate and updated information about our products and services;

• Improve the quality of our interactions and services by adapting our offering to your specific needs;

• Answer your requests and provide you with efficient support;

• Track our activities (e.g. measuring interactions or sales, number of appointments/calls);

• Manage our IT resources, including infrastructure management and business continuity;

• Preserve the company’s economic interests and ensure compliance and reporting (such as complying with our policies and local legal requirements, tax and deductions, managing alleged cases of misconduct or fraud; conducting audits and defending litigation);

• Manage mergers and acquisitions involving our company;

• Archiving and record keeping;

• Billing and invoicing;

• Any other purposes imposed by law and authorities.

With your consent we will:

• Send you surveys (e.g. to help us improve your future interactions with us) Who has access to your data and to whom are they transferred?

We will not sell, share, or otherwise transfer your data to third parties other than those indicated in this Privacy Policy.

In the course of our activities and for the same purposes as those listed in this Privacy Policy, your data can be accessed by, or transferred to the following categories of recipients, on a need to know basis to achieve such purposes:

• Our personnel (including management, staff personnel and departments);

• Our suppliers and services providers that provide services and products to us;

• Our IT systems providers, cloud service providers, database providers and consultants;

• Our business partners who offer products or services jointly with us or with our subsidiaries or affiliates;

• Any third party to whom we assign or novate any of our rights or obligations; and Version 1 | September 2020 Page 12 of 13 Privacy & Cookies Policy

• Our advisors and external lawyers in the context of the sale or transfer of any part of our business or its assets.

The above third parties are contractually obliged to protect the confidentiality and security of your data, in compliance with applicable law.

Your data can also be accessed by or transferred to any national and/or international regulatory, enforcement, public body or court, where we are required to do so by applicable law or regulation or at their request.

How do we protect your data?

We have implemented appropriate technical and organisational measures to provide a level of security and confidentiality to your data. These measures take into account:

• The state of the art of the technology;

• The costs of its implementation;

• The nature of the data; and

• The risk of the processing.

• The purpose thereof is to protect it against accidental or unlawful destruction or alteration, accidental loss, unauthorised disclosure or access and against other unlawful forms of processing.

Moreover, when handling your data, we:

• Only collect and process data which is adequate, relevant and not excessive, as required to meet the above purposes; and

• Ensure that your data remains up to date and accurate.

For the latter, we may request you to confirm the data we hold about you. You are also invited to spontaneously inform us whenever there is a change in your circumstances so we can ensure your data is kept up-to-date.

Where do we store your data?

Your data is stored at out office, Unit 3 Bell Court, Fforestfach, Swansea, SA5 4HP. Some data is held in a hard copy at our secure premises, on our Customer Account Management system, our cloud service provider, our accounting system and with our contracted IT service provider.

Your data will always be kept safe and secure whilst with us and our providers.

How long do we store your data?

We will only retain your data for as long as necessary to fulfil the purpose for which it was collected or to comply with legal or regulatory requirements.

Our Website uses cookies. They are used to make our service more user-friendly, effective and secure. Cookies are small text files that are deposited on the computer and stored by the browser. Most of the cookies we use are session cookies, which are automatically deleted at the end of your visit. Cookies do not damage your computer and do not contain viruses.

You can block or remove cookies at any time within the relevant browser settings.

What are your rights and how can you exercise them?

You may exercise the following rights under the conditions and within the limits set forth in the law:

• The right to access your data as processed by us and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating;

• The right to request the erasure of your data or the restriction thereof to specific categories of processing;

• The right to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal;

• The right to object, in whole or in part, to the processing of your data; If you have a question or want to exercise the above rights, you may send an email to info@arcadiapharma.co.uk or a letter to Data Privacy, Arcadia Pharmaceuticals, Unit 3 Bell Court, Fforestfach, Swansea, SA5 4HP.

If you are not satisfied with how we process your data, please address your request to our Data Protection Officer at info@arcadiapharma.co.uk, who will investigate your concern. In any case, you also have the right to file a complaint with the competent data protection authorities, in addition to your rights above.

How will you be informed of the changes to our Privacy Policy?

Any future changes or additions to the processing of your data as described in this Privacy Policy will be notified to you in advance through an individual notice through our usual communication channels (e.g. by email or via our internet websites).