Website Privacy Statement

1. Preamble

This privacy notice is addressed to all visitors and users of our websites and apps (“user” or “you”) of the Merck Group (“Merck”, “us”).

This privacy policy describes how Merck will use the personal data of the users within the scope of the operation of our websites and/or apps (“services”). "Personal Data" in this document means all information that relates to a natural person and with which this person can be directly or indirectly identified.

Should you have questions or queries regarding the processing of your personal data by Merck, please feel free to contact our Data Protection Officer Merck KGaA via privacy@merckgroup.com or the other contact details provided below.

Please click here for the specific HCP Privacy Notice.

3. The Processing Activities in Detail

This section explains the different data processing activities in which Merck processes your personal data for the operation of our services and the provision of information and functionalities.

In general, you are neither contractually nor statutorily obliged to provide your personal data for the below purposes, however your decision to not provide your data may lead to negative consequences, such as reduced features and functionalities and/or, in rare cases, the impossibility to use our information and services offered in this context.

3.1. Operation of our Services

We process your personal data for the purpose of the operation of our services. Whenever you access our services, you automatically transfer personal data to our servers for technical reasons.

This processing activity may include the following data categories:

• Your IP address;
• Identifier (manufacturer, version, type of web browser, operating system);
• Language settings of your web browser;
• The time of your visit and visited subpages of our website;
• Your referrer URL (i.e. the URL of the page from which you visit us);
• The data volume accrued during your visit to our website;
• Access status (file transferred, file not found, etc.); and
• Name of the provider of your internet access.

The data processing is based on our legitimate business interests. We process these data for the purpose of presenting our services and to ensure its technical stability and security (e.g. to prevent hacker attacks).

Data which is collected while browsing our website (e.g. IP Address) is regularly deleted after a period of fourteen days, beginning from your use of our service, unless a reasonably justified incident indicates a longer storage period (e.g. due to a hacking attack or for the provision of a service requested by you requiring your data).

Adverse Events of enforcement of rights:

If we become aware of potential cases of adverse reactions to one of our products, we are required by law to document and share the relevant information, including personal information with authorities worldwide and, where necessary for further assessment, to contact the reporting parties. In order to enforce our rights or to protect our rights or the rights of third parties with the holders of such rights, consultants and authorities.

No automated decision-making or profiling takes place.

3.2. Login and Registration

As the information we provide on this website is legally restricted to qualified healthcare personnel, we may require you to register and log-in to access our website (or to access restricted content sections). In order to register we collect your name, your email address and phone number, your profession, therapeutic area and address where you work.

We may also enable you to register via a service provider such as Doccheck Log-in and receive the information stated above from such service provider. Please check the data privacy notices of such providers as Merck is not responsible for their handling of your data.

Your personal data related to your registration we store as long as you have a website login account with us. Upon request to delete your account, we will act to delete your personal data provided in the registration form promptly (typically within 10 business days).

3.3. Contact Forms

We process your personal data to operate the contact form we provide in our service. This enables you to contact us, and e.g. ask for additional information or issue other service requests.

Your personal data will only be processed for the purpose of responding to your inquiry.

This processing activity may include the following data categories:

• The contact information you provided to us (such as your name and email address); and
• Other personal information that you include in your request.

The processing is based on our legitimate business interests. It serves our and your legitimate interest in answering your inquiry in a quick and competent manner.

Your personal data will be deleted after six months from the date of collection, unless necessary for the provision of a service requested by you requiring your data.

No automated decision-making or profiling takes place.

3.4. Newsletter

We process your personal data if you subscribed to our email newsletter. If you would like to receive our newsletter, you may enter your email address in our registration form and click the "Submit" button. You will then receive an email from us to your email address. You may complete the registration and thus verify your email address for sending newsletters by clicking on the confirmation link in this email.

This processing activity may include the following data categories: The information you provided to subscribe, such as your name, email address, work location and personal/professional interests.

The processing is based on your explicit consent you provided to us in the course of the subscription process.

Your personal data will be deleted when you withdraw your consent, e.g. by clicking on the unsubscribe button which is included in any of our newsletters.

No automated decision-making or profiling takes place.

3.5. Chatbots

You may where available use chatbots on our website to communicate your concerns to us. Chatbots are programs that, in a joint chat with you, classify your concerns with the help of artificial intelligence in order to forward them to our responsible employees and help you find your way around our website. The personal data provided during these chats will only be processed for the purpose of responding to your request.

This processing activity may include the following data categories: The information you provided within the chat, such as your name, email address and personal/professional interests. Please do not enter any additional unnecessary personal data if it can be avoided.

The processing is based on our (and your) legitimate business interest in the prompt and competent response to your requests.

Your personal data will be deleted within 10 business days, counting from your transmission of your request.

No automated decision-making or profiling takes place.

3.6. Google Maps

We process your personal data to display maps, a service provided by Google LLC.

This processing activity may include the following data categories which will be transmitted to Google LLC in the United States of America:

• The technical data as described in Section 3.1;
• Your location;
• The content you access (e.g. places); and
• The frequency of these accesses.

The processing is based on our (and your) legitimate business interest to guide you to our premises and facilitate your route planning.

The use of the service is not possible without your data, and these are automatically provided when you open a sub-page on which Google Maps is integrated. We process no further personal data than those specified in Section 3.1. Information on data processing by Google can be found in Google's privacy policy under the following link: https://policies.google.com/privacy?hl=en.

We do not conduct automated decision-making or profiling in this context.

3.7. Social Bookmarks

We use social media plugins from various social networks (e.g., from YouTube, LinkedIn, Facebook, Twitter) on our services. Social bookmarks are internet bookmarks which enables the users of such services to collect links and news messages. With the help of these plugins you can share content or recommend products. We integrated such bookmarks as links only. That means that they just link you to corresponding services without automatically processing your personal data. If you decide to click on a social bookmark (meaning the embedded graphic), you will be directed to the page of the respective social media network. Please refer to the respective provider's privacy policy to learn how your personal data are handled when you decide to visit their services.

3.8. Cookies

Cookies improve the user experience on our services because they allow, e.g., the system to recognize returning visitors. The term "cookies" in this privacy notice refers to cookies and similar technologies. The term "computer" in this privacy notice refers to computers, smartphones and all other devices with internet access. Cookies are small, usually randomly coded text files that are sent to your computer and stored there. These cookies allow your browser to track certain information that may be retrieved and used by internet servers at a later stage. Merck uses cookies and similar technologies on its services for several reasons, for example:

• Websites load faster;
• Websites may be browsed faster;
• Your settings, such as language and time zone, may be saved;
• Security on websites is improved since your identity may be verified; and
• Your log-in to secured websites is facilitated.

We included the following three categories of cookies on our services:

3.8.1. Necessary Cookies

These cookies are necessary to safeguard the functionalities of our services and for the website to operate. Cookies are set, in particular, in response to your actions and depend on your specific service requests (e.g. setting your privacy preferences, filling out forms, or logging in). More specifically, we set the following cookies:

• FORMASSEMBLY: This cookie is used to support FormAssembly functionality, or the display of forms built using the FormAssembly platform.
• FASRV: Needed to enable forms from Form Assembly to work when embedded.
• OptanonConsent: This cookie is set by the cookie compliance solution from OneTrust. It stores information about the categories of cookies the site uses and whether visitors have given or withdrawn consent for the use of each category. This enables site owners to prevent cookies in each category from being set in the users browser, when consent is not given. The cookie has a normal lifespan of one year, so that returning visitors to the site will have their preferences remembered. It contains no information that can identify the site visitor.
• OptanonAlertBoxClosed: This cookie is set by websites using certain versions of the cookie law compliance solution from OneTrust. It is set after visitors have seen a cookie information notice and in some cases only when they actively close the notice down. It enables the website not to show the message more than once to a user. The cookie has a one year lifespan and contains no personal information.
• AWSELBCORS: This cookie is managed by AWS and is used for load balancing to ensure that visitor page requests are routed to the same server in any browsing session.
• AWSELB: This cookie name is associated with the Amazon Web Services Elastic Load Balancing functionality for routing client request on the server.
• SID: This is a very common cookie name but where it is found as a session cookie it is likely to be used as for session state management.
• bm_sv: This cookie is associated with Akamai and is used to differentiate between traffic from humans and bots.
• bm_mi: This cookie is associated with Akamai. It is used to analyse traffic to determine if it is automated traffic generated by bots or a human user.
• ak_bmsc: This cookie is associated with Akamai and is used to differentiate between traffic from humans and bots.
• cookietest: Common cookie name could have a number of different origins. Where this is first party and a session cookie, its most likely to do with checking to see if the browser is set to block or allow cookies.Common cookie name could have a number of different origins. Where this is first party and a session cookie, its most likely to do with checking to see if the browser is set to block or allow cookies.

The processing is based on our legitimate business interest to be able to provide our basic webservices in a secure and useful manner. Our website cannot function without these cookies and they can only be disabled by changing your browser preferences.

No automated decision-making or profiling takes place.

3.8.2. Functional Cookies

These type of cookies enable the provision of advanced functionalities and are used for personalization. The cookies are set in particular in response to your actions and depend on your specific service requests (e.g. setting the language).

• UULE: Placed by Google and Youtube and used to measure traffic on YouTube. A unique text word is saved to identify browser, timestamp for interactions and the browser/sourcepage that led the user to this website.
• s_ppv: This cookie is associated with Adobe Analytics site tracking and is used to measure a user's scroll activity to see how much of a page they view before moving to another page.
• s_cc: This cookie is associated with the Adobe Site Catalyst. It determines whether cookies are enabled in the web browser.
• TEST_AMCV_COOKIE_WRITE: Test cookie for the implementation of Adobe Marketing Cloud.
• s_ppv: This cookie is associated with Adobe Analytics site tracking and is used to measure a user's scroll activity to see how much of a page they view before moving to another page.
• s_vi_{hash}: Adobe Site Catalyst cookie, used to identify unique visitors, with an ID and timestamp.
• s_vi: Adobe Site Catalyst cookie, used to identify unique visitors, with an ID and timestamp
• s_tp: This cookie is associated with Adobe Analytics. The cookie is used for measuring a visitor’s scroll activity to see how much of a page they view before moving on to another page.
• s_sq: Adobe Site Catalyst cookie, stores information about the previous link clicked within the site
• _gid: This cookie name is associated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited._gid
• s_cc: This cookie is associated with the Adobe Site Catalyst. It determines whether cookies are enabled in the web browser.
• OTZ: “OTZ” is a cookie used by Google Analytics that provides an aggregate analysis of Website visitors.
• AID: This cookie from Google Analytics links your activities on other devices you have previously logged into using your Google account. Based on this, the ads you see on your devices are coordinated and conversion events are measured.
• _gat: This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
• _ga: This cookie name is associated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
• __unam: This cookie is usually associated with the ShareThis social sharing widget placed in a site to enable sharing of content across various social networks. It counts clicks and shares of a page.
• __stid: This cookie stores and tracks audience reach.

3.8.3. Targeting Cookies

These cookies allow us to provide more comfort for you. For example, previously searched products or services can be reloaded again after revisiting our website and you won’t need to enter all the details again. We can also detect if you need assistance with using our website and therefore offer you direct customer support.

• visitor_id: This is a cookie pattern (visitor_id) that appends a unique identifier for a website visitor, used for tracking purposes. The cookies in this domain have lifespans of 10 years.This is a cookie pattern that appends a unique identifier for a website visitor, used for tracking purposes. The cookies in this domain have a lifespan of 10 years.
• AMCVS_: This is a pattern type cookie name associated with Adobe Marketing Cloud. It stores a unique visitor identifier, and uses an organisation identifier.
• AMCV_: This is a pattern type cookie name associated with Adobe Marketing Cloud. It stores a unique visitor identifier, and uses an organisation identifier to allow a company to track users across their domains and services.
• CONSENT: This cookie carries out information about how the end user uses the website and any advertising that the end user may have seen before visiting the said website.
• SSID: This cookie carries out information about how the end user uses the website and any advertising that the end user may have seen before visiting the said website.
• SIDCC: This cookie carries out information about how the end user uses the website and any advertising that the end user may have seen before visiting the said website.
• SEARCH_SAMESITE: These cookies are used by Google to display personalized advertisements on Google sites, based on recent searches and previous interactions.
• SAPISID: This DoubleClick cookie is generally set through the site by advertising partners, and used by them to build a profile of the website visitor's interests and show relevant ads on other sites. This cookie works by uniquely identifying your browser and device.
• 1P_JAR: This cookie carries out information about how the end user uses the website and any advertising that the end user may have seen before visiting the said website.
• _gcl_au: Used by Google AdSense for experimenting with advertisement efficiency across websites using their services
• APISID: This DoubleClick cookie is generally set through the site by advertising partners, and used by them to build a profile of the website visitor's interests and show relevant ads on other sites. This cookie works by uniquely identifying your browser and device.
• everest_g_v2: This cookie carries out information about how the end user uses the website and any advertising that the end user may have seen before visiting the said website.
• DV: These cookies are used by Google to display personalized advertisements on Google sites, based on recent searches and previous interactions.
• demdex: This cookie helps Adobe Audience Manger perform basic functions such as visitor identification, ID synchronization, segmentation, modeling, reporting, etc.
• demdex: This cookie helps Adobe Audience Manger perform basic functions such as visitor identification, ID synchronization, segmentation, modeling, reporting, etc.
• __sharethis_cookie_test__: Tracks which pages are being shared and by whom
• __Secure-xxxxxxx: These cookies are used by Google for advertising purposes. They track your browsing activity across websites and build a profile of your interests to show you relevant and personalized ads.
• NID: This domain is owned by Google Inc. Although Google is primarily known as a search engine, the company provides a diverse range of products and services. Its main source of revenue however is advertising. Google tracks users extensively both through its own products and sites, and the numerous technologies embedded into many millions of websites around the world. It uses the data gathered from most of these services to profile the interests of web users and sell advertising space to organisations based on such interest profiles as well as aligning adverts to the content on the pages where its customer's adverts appear.
• HSID: This cookie is set by DoubleClick (which is owned by Google) to build a profile of the website visitor's interests and show relevant ads on other sites.

The processing is based on your explicit consent you provided to us in the course of the subscription process. You either grant your consent by accepting all cookies in our cookie banner or by activating the cookie type you have selected. Your consent is voluntary, and you may revoke it at any time with effect for the future. You can revoke your consent by reopening our Cookie Center and deactivating the cookie type. If you do not grant your consent or revoke it, this will not result in any disadvantages for you. However, without your consent, the functions explained above will not be available to you.

3.8.4. Management and Deletion of Cookies

Some computer browsers automatically accept all cookies. In this case, you may not see the Cookie Center which allows you to manage your cookies individually. However, you can change your browser settings to block all cookies. You may also be able to configure your browser settings so that only certain types of cookies are blocked or so that you are notified as soon as a new cookie is to be stored on your computer. In this case, you can accept or reject cookies individually. If this function is available to you, you will find more detailed explanations in the help function of your browser. There you will also find information on how to delete all or certain cookies for which you have given us your consent. For more information on managing and deleting cookies for popular browsers, please see the following links: Google Chrome, Mozilla Firefox, Microsoft Internet Explorer, Microsoft Edge, Apple Safari.

5. Your Data Protection Rights

Regarding the data processing in the European Union, you have the following data protection rights:

• Right of access: You have the right to obtain information on the processing of your personal data and to receive a copy these data.
• Right to rectification: You have the right to ask us to correct or complete your personal data to the extent they prove to be wrong and/or incomplete.
• Right to erasure: Under certain circumstances, you have the right to ask us to delete your personal data.
• Right to restriction of processing: You may also have the right to ask us to limit the processing of your personal data.
• Right to data portability: You have the right to receive your personal data in a structured, common and machine-readable format and request that these data are transferred to another data controller.
• Right to object: You have the right to object to the processing of your personal data by us, in particular if the processing of your personal data is based on (i) the necessity of the performance of a task in the public interest, or (ii) legitimate interests. We will then stop the processing of your personal data unless we remain legally authorized to do so.
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority against the processing of your personal data if you believe that the processing of your personal data violates data protection regulations.

In case you granted us your consent to process your personal data, you may withdraw this consent with effect for the future. We will then stop the processing of your personal data, unless we have a legal permission to do so. Please note that your withdrawal has effect for future processing operations only and does not make data processing operations, which we executed before such withdrawal, unlawful.

To withdraw your consent, you may e.g. send an email to privacy@merckgroup.com. If you withdraw your consent, you may no longer be able to use the services affected by the withdrawal. Apart from that, you will not suffer any further disadvantages.

If you do not specify your withdrawal to a specific processing operation, we will assume that you withdraw your consent regarding all processing of your personal data that is based on your consent.