Vendors and Partners

Grifols is a global healthcare group founded in Barcelona in 1909 committed to improving the health and well-being of people around the world. Its three main business units - Biopharma, Diagnostic and Bio Supplies - develop, produce and market innovative solutions and services that are sold in more than 110 countries.

Grifols respects the privacy rights of all data subjects who entrust Grifols with their personal data and is committed to complying with the data protection regulations applicable in each country.

This privacy notice has been prepared in accordance with the European Union General Data Protection Regulation (the "GDPR") and applicable privacy and data protection laws; see Section 7 for specific provisions. It outlines Grifols' data collection practices and the choices that data subjects have about the way Grifols collects, uses and shares their personal data.

This privacy notice applies to the processing of personal data of (a) individuals that provide or could potentially provide services and/or products to Grifols, and (b) individuals (including but not limited to employees and legal representatives) belonging to vendors or partners that have or could potentially have a business relationship with Grifols. For the purpose of this privacy notice, "data subject" refers to both types of individuals.

1. Identification of the data controller(s)/owner(s) of the personal data

The data controller(s)/owner(s) is/are:

The Grifols' group company with which the data subjects (as defined above) have a contractual relationship,
The Grifols' group company operating and identified as such in the websites, landing pages, apps, and any other similar digital platforms through which the personal data of the data subjects are processed, or
The Grifols' group company contacting or to whom the data subjects contact (as identified in the methods used to establish said contact) for the remaining purposes set out in Section 3.

The identity and contact details of the Grifols' group companies are available here. The Grifols' group company/ies acting as controller/s will be referred to as "Grifols".

2. Identification of the data protection officer

The data protection officer acts as an interlocutor between Grifols and you in order to ensure Grifols' compliance with the data protection legislation and to guarantee your rights under such legislation. You may contact the data protection officer at dpo@grifols.com, unless the data controllers are Grifols Deutschland GmbH or Haema AG, in which case you may contact the data protection officer of each of these companies at dsb@grifols.com and dsb@haema.de, respectively.

3. Purposes, lawful basis for processing, categories and recipients of personal data

Purposes

- To contact data subjects by any means, including electronic ones, to evaluate potential business opportunities and collaborations, and to develop, control and manage current and future relationships. The reasons for contacting data subjects may include but are not limited to:

- Scheduling appointments (online or in-person),

- Sending surveys or similar, and

- Any other activities that may contribute to evaluating potential business opportunities.

- To assess your condition as business partner and, if applicable, to respond to any requests for information or suggestions.

- To develop and maintain the relationship with data subjects of the organizations with whom Grifols has a contractual relationship, including the management of training sessions.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics1.
Professional data².
Academic information³.

Recipients:

Grifols' group companies.
Providers of products and services.
Public or private organizations.

Lawful basis: Legitimate interest

- To carry out anticorruption compliance checks.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics1.
Professional data².
Academic information³.
Financial data⁴.

Recipients:

Grifols' group companies.
Providers of products and services.
Public or private organizations.

Lawful basis: Legitimate interest

- To carry out maintenance tasks in websites, landing pages and apps to offer a secure environment to its users.

Categories of personal data and recipients

Categories of personal data:

Browsing history data⁵.

Recipients:

Grifols' group companies.
Providers of products and services.

Lawful basis: Legitimate interest

- To manage corporate reorganization activities.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics1.
Professional data².
Academic information³.
Financial data⁴.
Browsing history data⁵.

Recipients:

Grifols' group companies.
Providers of products and services.
Potential investors or purchasers.

Lawful basis: Legitimate interest

- To send scientific, educational and commercial information about Grifols' group products, services and activities, by any means, including electronic ones. As set out in Section 6, data subjects may exercise their rights to object and withdraw their consent to have their data processed for direct marketing purposes.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics1.
Professional data².
Academic information³.
Interests and preferences.

Recipients:

Grifols' group companies
Providers of products and services.

Lawful basis: Legitimate interest: when a contractual relationship exists.

Consent: when a contractual relationship does not exist.

- To use the data subjects' personal data (including their image, voice and any other identifying features) in the terms regulated in the authorization document for the recording and use of images or other identifying features or in any other communication of similar characteristics, as well as for evidencing the consent of the data subjects.

- To manage and control the registration, participation and attendance of data subjects to symposiums, conferences, webinars, training sessions, scientific awards or similar events, in person or online, organized by Grifols or third parties.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics¹.
Professional data².

Recipients:

Grifols' group companies.
Providers of products and services.

Lawful basis: Consent

- To comply with certain regulatory obligations resulting from interactions with data subjects.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics¹.
Professional data².
Academic information³.
Financial data⁴.

Recipients:

Grifols' group companies.
Providers of products and services.
Public or private organizations.

Lawful basis: Legal obligation

- To execute and maintain the existing contractual relationship between Grifols and the data subjects, including the communication of the personal data and the use of the image, voice or other identifying features of the data subjects necessary to accomplish the contractual purposes.

Categories of personal data and recipients

Categories of personal data:

Identification data and personal characteristics¹.
Professional data².
Academic information³.
Financial data⁴.

Recipients:

Grifols' group companies.
Providers of products and services.
Financial entities.
Public or private organizations.

Lawful basis: Execution of a contract

^1. For example, name, last name, sex, nationality, image, voice, ID/passport or social security affiliation number, username.
^2. For example, professional contact details, job position, place of work, member of professional associations.
^3. For example, training, degree, curriculum vitae.
^4. For example, financial interests and bank details.
^5. For example, IP address, device ID, visited sections, country from which the connection is made.

^1. For example, name, last name, sex, nationality, image, voice, ID/passport or social security affiliation number, username.
^2. For example, professional contact details, job position, place of work, member of professional associations.
^3. For example, training, degree, curriculum vitae.
^4. For example, financial interests and bank details.
^5. For example, IP address, device ID, visited sections, country from which the connection is made.
Purposes	Categories of personal data and recipients	Lawful basis
- To contact data subjects by any means, including electronic ones, to evaluate potential business opportunities and collaborations, and to develop, control and manage current and future relationships. The reasons for contacting data subjects may include but are not limited to: - Scheduling appointments (online or in-person), - Sending surveys or similar, and - Any other activities that may contribute to evaluating potential business opportunities. - To assess your condition as business partner and, if applicable, to respond to any requests for information or suggestions. - To develop and maintain the relationship with data subjects of the organizations with whom Grifols has a contractual relationship, including the management of training sessions.	Categories of personal data: Identification data and personal characteristics1. Professional data². Academic information³. Recipients: Grifols' group companies. Providers of products and services. Public or private organizations.	Legitimate interest
- To carry out anticorruption compliance checks.	Categories of personal data: Identification data and personal characteristics1. Professional data². Academic information³. Financial data⁴. Recipients: Grifols' group companies. Providers of products and services. Public or private organizations.	Legitimate interest
- To carry out maintenance tasks in websites, landing pages and apps to offer a secure environment to its users.	Categories of personal data: Browsing history data⁵. Recipients: Grifols' group companies. Providers of products and services.	Legitimate interest
- To manage corporate reorganization activities.	Categories of personal data: Identification data and personal characteristics1. Professional data². Academic information³. Financial data⁴. Browsing history data⁵. Recipients: Grifols' group companies. Providers of products and services. Potential investors or purchasers.	Legitimate interest
- To send scientific, educational and commercial information about Grifols' group products, services and activities, by any means, including electronic ones. As set out in Section 6, data subjects may exercise their rights to object and withdraw their consent to have their data processed for direct marketing purposes.	Categories of personal data: Identification data and personal characteristics1. Professional data². Academic information³. Interests and preferences. Recipients: Grifols' group companies Providers of products and services.	Legitimate interest: when a contractual relationship exists. Consent: when a contractual relationship does not exist.
- To use the data subjects' personal data (including their image, voice and any other identifying features) in the terms regulated in the authorization document for the recording and use of images or other identifying features or in any other communication of similar characteristics, as well as for evidencing the consent of the data subjects. - To manage and control the registration, participation and attendance of data subjects to symposiums, conferences, webinars, training sessions, scientific awards or similar events, in person or online, organized by Grifols or third parties.	Categories of personal data: Identification data and personal characteristics¹. Professional data². Recipients: Grifols' group companies. Providers of products and services.	Consent
- To comply with certain regulatory obligations resulting from interactions with data subjects.	Categories of personal data: Identification data and personal characteristics¹. Professional data². Academic information³. Financial data⁴. Recipients: Grifols' group companies. Providers of products and services. Public or private organizations.	Legal obligation
- To execute and maintain the existing contractual relationship between Grifols and the data subjects, including the communication of the personal data and the use of the image, voice or other identifying features of the data subjects necessary to accomplish the contractual purposes.	Categories of personal data: Identification data and personal characteristics¹. Professional data². Academic information³. Financial data⁴. Recipients: Grifols' group companies. Providers of products and services. Financial entities. Public or private organizations.	Execution of a contract

3.1. Additional information about the lawful basis to process personal data

The table above shows the applicable lawful basis to process the personal data by purpose. In this section, you can find additional details of the lawfulness of the processing:

Consent (article 6.1 (a) of the GDPR): Data subjects may provide their consent through the data collection forms, by clicking acceptance buttons or ticking boxes, replying to e-mails or making any other affirmative clear action. Data subjects may withdraw their consent at any time, as set out in Section 6.
Legitimate interest of Grifols and/or third parties (article 6.1(f) of GDPR): Grifols pursues the following legitimate interests which override the fundamental rights and freedoms of the data subjects, given that the processing is within the data subjects' reasonable expectations based on their relationship with Grifols:
- Prevention of fraud.
- Direct marketing,
- Daily management of a multinational group of companies and internal administration, which means sharing information with the companies of the Grifols group, and
- Creation of a secure information system infrastructure for preventing unlawful or malicious activities that may compromise the personal data.

In any event, data subjects may request further information on the legitimate interest or exercise their right to object to the processing of their personal data based on legitimate interest by addressing their request to privacy@grifols.com.

Legal obligation (article 6.1(c) of GDPR): Grifols needs to process the requested personal data to comply with legal obligations. Failure to provide the personal data requested could result in the impossibility for Grifols to comply with such legal obligations.
Execution of a contract (article 6.1(b) of GDPR): Failure to provide the personal data requested by Grifols could result in the impossibility of executing or maintaining such contract.

3.2. Recipients of personal data

The table above shows categories of recipients with whom Grifols may share personal data, by purpose. This section includes additional information regarding these recipients when applicable:

Grifols' group companies: The list is available here.
Providers of products and services: for example, travel agencies, IT service providers, credit risk service providers, insurance providers, courier agencies, marketing agencies, event organizers, providers operating in the anticorruption sector, lawyers, auditors, photographers, cameramen and media agencies/owners.
Public or private organizations: for example, health authorities, pharmaceutical industry associations or governmental organizations.
Potential investors or purchasers
Financial entities

Grifols will endeavour that the personal data is only transferred to countries that offer an adequate level of data protection. If the personal data is processed in countries that do not offer said level of protection, Grifols and/or the providers (as the case may be) will adopt, if necessary, the appropriate safeguards to carry out such international data transfers in accordance with the applicable data protection legislation. Information on the appropriate safeguards for international data transfers can be obtained from Grifols at privacy@grifols.com.

Grifols does not share personal data with any other third party unless it is authorised by the data subject or required by the applicable law.

4. Retention period

Grifols will retain the personal data for the time strictly necessary for the fulfilment of the purposes for which it has been collected or, if applicable, until the end of the statutes of limitation of any liabilities that may arise, and during the term required to comply with any applicable legal obligation.

5. Sources of personal data

If data subjects do not directly provide Grifols with their personal data, Grifols may obtain the personal data from event organizers databases and public sources, such as websites and publications from the healthcare sector, professional social networks or social listening tools (that is, tools aimed at identifying and evaluating the market's perception about a specific brand, product, company, topic or problem).

If data subjects provide personal data of third persons for the purpose of executing and maintaining a contractual relationship, the data subjects will inform said third persons about the processing of their personal data beforehand, by providing a copy of this privacy notice.

6. Data protection rights

The following data protection rights are applicable under the GDPR. Grifols undertakes to respect other data protection rights that may be applicable in accordance with the data protection legislation of each country.

Rights

Access

Content: You may request confirmation as to whether or not your personal data is being processed and, if so, you can obtain access to your personal data included in Grifols' files.

Rectification

Content: You may request the rectification of your personal data if inaccurate.

Erasure

Content: You may request the erasure of your personal data.

Objection

Content: You may request that your personal data is not processed under specific circumstances.

Portability

Content: You may request receiving, in an electronic file, the personal data that you provided Grifols with, as well as the right to transmit it to other parties.

Restriction of processing

Content

You may request a restriction on how your personal data is processed when:

· the accuracy of the personal data is being verified after you have contested its accuracy.

· processing of your personal data is unlawful and you object to its erasure.

· Grifols does no longer need the personal data for the purposes of processing it, but you need it in order to prepare, exercise or defend a legal claim.

· you have objected to the processing of the personal data for the performance of a task carried out in the public interest or necessary for the purposes of a legitimate interest, while verifying if Grifols' legitimate grounds override yours.

Withdrawal of consent

Content: You may withdraw your consent without affecting the lawfulness of the processing based on consent before its withdrawal.

Rights	Content
Access	You may request confirmation as to whether or not your personal data is being processed and, if so, you can obtain access to your personal data included in Grifols' files.
Rectification	You may request the rectification of your personal data if inaccurate.
Erasure	You may request the erasure of your personal data.
Objection	You may request that your personal data is not processed under specific circumstances.
Portability	You may request receiving, in an electronic file, the personal data that you provided Grifols with, as well as the right to transmit it to other parties.
Restriction of processing	You may request a restriction on how your personal data is processed when: · the accuracy of the personal data is being verified after you have contested its accuracy. · processing of your personal data is unlawful and you object to its erasure. · Grifols does no longer need the personal data for the purposes of processing it, but you need it in order to prepare, exercise or defend a legal claim. · you have objected to the processing of the personal data for the performance of a task carried out in the public interest or necessary for the purposes of a legitimate interest, while verifying if Grifols' legitimate grounds override yours.
Withdrawal of consent	You may withdraw your consent without affecting the lawfulness of the processing based on consent before its withdrawal.

You may exercise, when appropriate, your data protection rights by, for example, sending a written communication to Grifols at privacy@grifols.com with the subject line "Partners". To that end, Grifols may request as many information and documents as appropriate to identify you.

In addition, you may lodge a complaint with a data protection authority, including the one at your residence, place of work or place of the alleged infringement.

7. Specific Provisions

France

When Grifols France S.A.R.L. is the data controller, the data subjects have the right to provide guidance on the management of their data after their death.

Portugal

When Grifols Portugal – Produtos Farmacêuticos e Hospitalares, Lda. is the data controller, the data subjects have the right to provide guidance on the management of their data after their death. When guidance on the management of their data has not been provided by the deceased data subject, the exercise of the data protection rights defined in Section 6 may be carried out by their heirs. The data subjects may also determine the impossibility of exercising these rights after their death.

When there is a legal obligation of secrecy, the rights of the data subjects cannot be exercised.

Thailand

When Grifols (Thailand) Ltd. is the data controller, see full privacy notice here.

United Kingdom

All references throughout the document to the GDPR also refer to, as applicable, the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland.

Date of creation: June 2022