CONTENTS

1. Data Protection
2. Responsibility for the processing of your personal data
3. Privacy policy for digital information request
   1. Scope and purpose of data processing
      1. Usage data in the information request portal
      2. Contact data
      3. Cookies
   2. Passing on personal data to (other) third parties
4. Duration of the retention of your data
5. Rights in relation to data processing
6. Contact data

A. Data Protection

Merz attaches great importance to the protection of personal data. In the following Privacy Policy, we inform you about who is responsible for processing your data. Any further information will be provided according to the specific capacity in which you contact us, that is to say, according to whether you contact us as a visitor to our website, a customer of our products, a health care practitioner, a prospective customer, or a competition participant. You will moreover be provided with general information on the processing of your data by Merz, in particular information on the transmission of your data, the duration for which your data are stored, and your rights in connection with the processing of your data.

Merz processes your data in accordance with the data protection provisions set forth in the German Federal Data Protection Act (Bundesdatenschutzgesetz–BDSG), specifically in the version applicable as of 25 May 2018, and in Regulation (EU) 2016/679 (General Data Protection Regulation–GDPR).

B. Responsibility for the processing of your personal data

The data controller that is responsible for the processing of your personal data within the meaning of Art. 4 (7) GDPR is Merz Aesthetics GmbH, Eckenheimer Landstraße 100, 60318 Frankfurt am Main (hereinafter ”Merz”).

C. Privacy policy for participants in the Interactive Live Webcast

Thank you for your interest in our Merz Aesthetics digital information request portal. The protection of your personal data is also important to us in the registration process for receiving the requested product or medical information. In the following paragraphs we specify the data processing which you may provide us with in connection with your participation.

a. Scope and purpose of data processing

The personal data processed by Merz includes all data required for the registration to receive the requested product or medical information and which is visible in the form. The legal basis for the processing of the data is Art. 6 (1) S. 1 lit. b and Art. 6 (1) S. 1 lit. f GDPR. We assume Merz’ legitimate interest in pursuing (potential) customers information requests in connection with our products (product information and medical information).

i. Usage data in the registration portal

When using the registration portal, various data about the accessing system is stored. This includes the type of browser used, the browser version, the operating system used, the website from which the Merz website is accessed, the sub-pages of the Merz website accessed, the date and time of access, the Internet protocol address (IP address), the Internet service provider and any data comparable to this data. Merz uses this data to make the website accessible, to detect and rectify any technical problems that may occur and to prevent and, if necessary, to prosecute any misuse of Merz's services. In addition, Merz uses this data in an anonymous form, i.e. without the possibility of identifying the user, for statistical purposes and to improve the websites. The legal basis for the processing of personal usage data is Art. 6 (1) S. 1 lit. f GDPR.

ii. Registration data

In order to receive the requested product or medical information, you will be asked to fill out a contact form and provide Merz with certain information (name data, contact/address data, specialty, product interests, other request-related information). The legal basis for processing the data described above is Art. 6 (1) S. 1 lit. b GDPR and Art. 6 (1) S. 1 lit. f GDPR.

iii. Cookies

Cookies are not used within the scope of using the Merz registration portal. Cookies are small text files that are stored on the user's data carrier and exchange certain settings and data with the Merz system via the browser. A cookie usually contains the name of the domain from which the cookie data was sent, information about the age of the cookie and an alphanumeric identifier.

b. Passing on personal data to (other) third parties

Merz relies on the support of specialized technical service providers for the technical processing of personal data. These service providers are carefully selected and are legally and contractually committed to ensuring a high level of data protection. The legal basis for our partnerships with these service providers is Art. 28 GDPR.
In connection with the provision of the registration portal, Filmhafen acts as service provider on behalf of Merz. The registration portal is hosted on servers of netcup GmbH. The legal basis for our partnerships with these service providers is Art. 28 GDPR.

D. Duration of the retention of your data

Unless otherwise stated in this Privacy Policy, personal data will be erased by Merz if it is no longer needed for the purposes for which it was processed and if the retention periods prescribed by law have expired. Contractually relevant data are usually erased ten years after the termination of the respective contract with Merz.

E. Rights in relation to data processing

If you would like detailed information on the personal data that has been stored by Merz about you, you can contact Merz. You may also request to receive information about any data that you have provided to Merz in accordance with applicable law in a structured, commonly used, and machine-readable format, or you may also request Merz to submit such information to a third party. If you discover that personal information that has been stored about you is incorrect or incomplete, you may request that such data be immediately corrected or completed at any time. If the requirements stipulated in Art. 17 and 18 GDPR are met, you may also request the erasure of your personal data or that processing of it be restricted. You also have the right to lodge a complaint with the relevant supervisory authority for data protection issues.

Insofar as the processing of your personal data is based on legitimate interests as per Art. 6 (1) S. 1 (f) GDPR, you are invariably entitled to object to such processing based on reasons arising from your particular situation. This entitlement also applies to any profiling that is conducted on the basis of the above provision. Merz will then no longer process the personal data unless Merz can prove compelling legitimate grounds for data processing that override your interests, rights and freedoms, or the data processing is for the purpose of establishing, exercising or defending legal claims. If personal data is processed for the purposes of direct advertising, you have the right to object at any time to the processing of your personal data for the purpose of such advertising. This also applies to any profiling insofar as it is associated with such direct advertising.

F. Contact data

If you have any questions about how Merz processes personal data or about exercising your rights against data processing, you can contact Merz at any time. Please send all inquiries to your known Merz representative or: datenschutz-aesthetics@merz.de. The data privacy officer at Merz can be contacted at: datenschutz-aesthetics@merz.de.