Privacy Policy

Status: July 21, 2020

1. General information

The protection of your personal data is very important to us. We process your personal data exclusively on the basis of the statutory provisions (GDPR, DSG, TKG 2003).

In order to provide our website, to process the sale of our goods and to provide our services, we process information about you, so-called personal data – or “data” for short below. The term “processing” means any handling of the data, such as the collection, storage, use, or deletion of personal data.

We would be happy to inform you in the context of the data protection declaration about the processing of your personal data and the claims and rights to which you are entitled under data protection regulations.

The person responsible for processing your personal data is:

LENUS Pharma GesmbH

Seeböckgasse 59

1160 Vienna

Tel .: +43 (1) 405 14 19

Fax: +43 (1) 405 14 19-20

office@lenuspharma.com

www.lenuspharma.com

If you have any complaints, questions or suggestions about data protection, please do not hesitate to contact us at any time using the contact details given.

2. Data processing within the framework of our websites and our web shop

2.1. General information

As part of our websites and our web shop, we process data that you provide to us (e.g. when placing orders), logs (for security reasons, our servers log who makes inquiries) and cookies (these are small text files that are stored on your device stored and contain information to recognize you).

The web server for the operation of our website is technically operated by CureIT – Alexander Kacer as a processor.

To prevent third-party cookies from being set, you can block so-called third-party cookies in your browser. Here you will find instructions for the most common browsers:

Firefox: here

Chrome: here

Internet Explorer: here

Safari: Third-party cookies are blocked by default in Apple’s Safari.

2.2. Data processing for the operation and security of our websites and our web shop (server logs):

2.2.1.Server logs

Purpose of processing: When you visit our website, the web server collects usage data (so-called server logs). The collection of this data is necessary to technically enable the connection to our server and the use of the website. This data is also used to defend against and analyze attacks.

The following server logs are collected: The IP address of the requesting device, together with the date, time, the request, which file is requested (name and URL), what amount of data is transmitted to you, a message as to whether the request was successful, Identification data of the browser and operating system used, as well as the website from which the access was made (if access is via a link). In the case of mobile devices, the unique device number (IMEI) may be recorded.

Legal basis for processing: Your data is processed on the basis of our legitimate interest in ensuring the operation of the service and system security.

Recipient of the data: The web server for the operation of our website is technically operated by the IT service center of CureIT – Alexander Kacer as the processor. The data from the server logs are passed on to the law enforcement authorities should there be a hacker attack. Any further transfer to third parties will not take place.

Further information: The server logs are stored for a maximum of 6 months.

2.3. Data processing for marketing purposes:

2.3.1.Web analysis

Via the service providers listed below, we process data about your use of our websites and our web shop in order to be able to adapt them as best as possible to your interests.

• Google Analytics, a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Purpose of processing: Google Analytics stores cookies in order to recognize you and then to be able to create personalized user statistics about your website activities. In addition, we have activated the “anonymize IP” module from Google. For this purpose, the IP address assigned to you is anonymized by Google within the European Union.

Google Analytics stores the following cookies on your device:

Legal basis for processing: Your data is processed on the basis of your consent. You can prevent the use of cookies by setting your browser software accordingly. If the corresponding setting is not made, we will assume that you consent to the use of cookies.

Recipient of the data: The information generated by the cookie about your use of the website is usually transferred to a Google server in the USA and stored there. The appropriate level of protection for the transmission results from an adequacy decision of the European Commission according to Art 45 GDPR. Google is certified under the Privacy Shield Agreement and thus offers a guarantee that it will comply with European data protection law. Google works for us as a processor and may only use the transmitted data to process specific orders and is contractually obliged to comply with the statutory data protection regulations.

Further information: You can prevent the storage of cookies by setting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all functions of the website to their full extent. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your anonymized IP address) and from processing this data by Google by clicking on the following link (http: / /tools.google.com/dlpage/gaoptout?hl=de) download and install the available browser plug-in.

• Google Tag Manager

We use the Google Tag Manager tool from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) on our website. Google Tag Manager enables us to manage website tags via an interface. Google Tag Manager itself (which implements the tags) is a domain without cookies. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If a deactivation has been made at the domain or cookie level, it will remain in effect for all tracking tags that are implemented with Google Tag Manager. Your data will be processed on the basis of your consent. You can prevent the use of cookies by setting your browser software accordingly. If the corresponding setting is not made, we will assume that you consent to the use of cookies. Data will only be transmitted to Google once you have given your consent to the transmission.

The IP address transmitted by your browser as part of Google Tag Manager will not be merged with other Google data. We have also set up for this website in the Google Tag Manager that your data is anonymously transmitted to Google. This guarantees that your IP address is masked so that all data is collected anonymously. The full IP address will only be sent to a Google server in the USA and shortened there in exceptional cases. The appropriate level of protection for the transmission results from an adequacy decision of the European Commission according to Art 45 GDPR. Google is certified under the Privacy Shield Agreement and thus offers a guarantee that it will comply with European data protection law.

• Facebook Pixel

We use Facebook Pixel, an analysis tool from Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbor, Dublin 2 Ireland on our website. With the help of the Facebook pixel, the behavior of the users can be evaluated, which reached our website from a Facebook advertisement. This can be used to improve and measure the success of our Facebook ads. In addition, our website uses Facebook pixels to reach people with advertisements who have already interacted with our website in the past. Your data will be processed on the basis of your consent. You can prevent the use of cookies by setting your browser software accordingly. If the corresponding setting is not made, we will assume that you consent to the use of cookies.

Facebook Pixel stores the following cookies on your device:

By using the Facebook pixel, the visit to our website is communicated to Facebook so that visitors to Facebook can see suitable ads. If you have a Facebook account and are logged in, your visit to this website will be assigned to your Facebook user account. Your data will be processed on the basis of your consent. You can prevent the use of cookies by setting your browser software accordingly. If the corresponding setting is not made, we will assume that you consent to the use of cookies. The data will only be transmitted to Facebook if you have consented to the transmission.

Facebook Ireland and the site operator are jointly responsible for the processing of your data, which is used to create page insights in connection with a visit or other interaction with a page or the content connected to it, within the meaning of Article 26 GDPR. The following applies:

– Facebook Ireland and the site operator have reached an agreement that specifies which of them fulfills which obligations under the GDPR. The agreement is available at https://www.facebook.com/legal/terms/page_controller_addendum.

– Facebook Ireland and the site operator have agreed that Facebook Ireland is responsible for providing the information about processing for site insights and enabling you to exercise your rights under the GDPR. Facebook and the site operator have agreed that the Irish Data Protection Commission is the lead supervisory authority overseeing the processing for site insights. You can find more information about your rights and how to exercise them at https://www.facebook.com/policy.php.

Further information on Facebook pixels and the exact scope and purpose of data processing can be found in Facebook’s data protection declaration at https://www.facebook.com/policies/cookies.

You can change your settings for advertisements in Facebook at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen, for this you have to be logged in.

• Amazon Pay

We use Amazon Pay, an online payment service from Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg (“Amazon Payments”). With Amazon Pay, we offer the customers of our web shop another payment method. With the help of Amazon Pay, payments can be processed in our webshop without customers having to create a customer account or enter their account details. Amazon customers can use the information that they have already saved in their Amazon account. This simplifies the ordering and payment process significantly. Amazon Pay processes your payments to us on our behalf.

Amazon Pay stores the following cookies on your device:

Legal basis for processing: Your data is processed on the basis of your consent. You can prevent the use of cookies by setting your browser software accordingly. If the corresponding setting is not made, we will assume that you consent to the use of cookies.

Recipient of the data: The information generated by the cookie about your use of the web shop is transmitted to Amazon Pay and used there for payment processing.

Further information on Amazon Pay and the exact scope and purpose of the data processing can be found in the Amazon Pay privacy policy at https://pay.amazon.de/help/201212490?ld=NSGoogle.

• Paypal

We use PayPal in our webshop, an online payment service provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal L-2449, Luxembourg (“PayPal”). With PayPal, we offer the customers of our web shop another payment method. With the help of PayPal, payments can be processed in our webshop without customers having to create a customer account or enter their account details. PayPal customers can use the information that they have already saved in their PayPal account. This simplifies the ordering and payment process significantly. PayPal processes your payments to us on our behalf.

PayPal stores the following cookies on your device:

Legal basis for processing: Your data is processed on the basis of your consent. You can prevent the use of cookies by setting your browser software accordingly. If the corresponding setting is not made, we will assume that you consent to the use of cookies.

Recipient of the data: The information generated by the cookie about your use of the web shop is transmitted to PayPal and used there for payment processing.

You can find more information about PayPal and the exact scope and purpose of data processing in PayPal’s data protection declaration at https://www.paypal.com/at/webapps/mpp/ua/privacy-full.

2.4. Data processing as part of our social media activities:

We use so-called “social media plugins”. These enable us to display interaction elements or content (e.g. text contributions, graphics, images and videos) from social media services. Via these plugins, data, including personal data, can be transmitted to the social media service providers and, if necessary, used by them.

Your data will be processed on the basis of your consent. You can prevent the use of cookies by setting your browser software accordingly. If the corresponding setting is not made, we will assume that you consent to the use of cookies.

We are currently using social media plugins for the following services:

YouTube: We use plugins from the YouTube service on our website. The plugins can display interaction elements or content (e.g. videos, graphics or text contributions). Via these plugins, data can be sent to YouTube and possibly used by YouTube. A transmission of data to YouTube does not take place until you have consented to its use.

YouTube stores the following cookies on your device:

Further information about YouTube and the exact scope and purpose of data processing can be found in Google’s data protection declaration at https://policies.google.com/privacy. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland is responsible for data processing.

2.5. Other third party providers

We also use the following third-party providers to improve our website:

• •Google Maps: With the integration of Google Maps, we can show you the Google map service directly on our website and thus enable you to use the map function. By integrating Google Maps, data can be sent to Google and, if necessary, used by Google. When you visit our website, data is not automatically transmitted to Google.

Your data will be processed on the basis of your consent. You can prevent the use of cookies by setting your browser software accordingly. If the corresponding setting is not made, we will assume that you consent to the use of cookies. Data will only be transmitted to Google if you have consented to its use.

The appropriate level of protection for the transmission results from an adequacy decision of the European Commission according to Art 45 GDPR. Google is certified under the Privacy Shield Agreement and thus offers a guarantee that it will comply with European data protection law.

Further information on Google Maps and the exact scope and purpose of data processing by Google can be found in Google Inc.’s data protection declaration at https://policies.google.com/privacy. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland is responsible for the data processing at the transmission recipient.

• •Issuu: With the integration of Issuu, we can show you the publication service of Issuu Inc directly on our website and thus enable you to display online magazines and articles. Readers should be reached online in an appealing design. By integrating Issuu, data can be sent to Issuu and used by Issuu if necessary.

Your data will be processed on the basis of your consent. You can prevent the use of cookies by setting your browser software accordingly. If the corresponding setting is not made, we will assume that you consent to the use of cookies. Data will only be transmitted to Issuu if you have consented to the transmission of the data.

Issuu stores the following cookies on your device:

You can find more information on this at https://issuu.com/legal/privacy.

Further information on Issuu and the exact scope and purpose of data processing can be found in Issuu’s data protection declaration at https://issuu.com/legal/privacy. Issuu Inc 131 Lytton Ave, Palo Alto, CA 94301, United States is responsible for data processing.

3. Data processing in the context of business operations:

3.1. Data processing in the context of making contact:

Purpose of processing: If you contact us (e.g. by e-mail or telephone), we will process the data you provided when contacting us, only insofar as this is necessary to process the request or to process it.

Legal basis for processing: Your data is processed to carry out pre-contractual measures or to fulfill a contractual relationship or is based on our legitimate interest, namely for the organization of the response to inquiries.

Recipient of the data: This data is only transmitted under the condition that the transmission is necessary for answering the query.

Further information: We process your data for as long as this is necessary to process the request and in the event of a follow-up request for a further seven years after the last contact with you.

3.2. Data processing in the context of the customer account:

Purpose of processing: When you register on our website, we process the data disclosed during your registration for the establishment of the business relationship within the framework of the contractual relationship and for the processing of the services we offer.

Legal basis for processing: Your data is processed to carry out pre-contractual measures or to fulfill a contractual relationship.

Recipient of the data: The data will not be transmitted to third parties or only under the condition that you have given your separate consent to the transmission.

Further information: You can delete your user account at any time. After deleting your user account, we will delete your data.

3.3. General data processing in the context of a customer order:

Purpose of processing: When you place an order with us, we process your data to process the order, to answer questions that you send to us in connection with your order, and for the formal handling of the business cases to be dealt with by us Framework of the business relationship.

Legal basis for processing: Your data is processed to fulfill a contractual relationship or is based on a legal basis in the context of a business relationship (or to process this).

Recipient of the data: If your data, which is relevant in each individual case, is required to fulfill the contractual relationship or on the basis of a legal basis, this will be done to the following recipient categories:

• Bank Institutes
• Legal Representatives
• Chartered Accountants, Auditors and Tax Advisors
• Courts
• Competent Administrative Authorities
• Collection Agencies
• Outside Financiers
• Contractual Partners and Business Partners
• Insurance Agencies
• Statistik Austria
• Carriers
• Suppliers
• Data Center as a Processor

Further information: We only process your data for as long as is necessary for the fulfillment of the contractual relationship or due to the legal obligations (e.g. according to tax and company law retention obligations). We generally keep data for seven years.

4. Your rights

4.1. Right to information about the stored data in accordance with Art 15 GDPR

You have the right to request information as to whether we are processing your personal data. If this is the case, you have a right to information about this personal data as well as other information related to the processing.

4.2. Right to correct inaccurate data in accordance with Art 16 GDPR

In the event that personal data that we process about you is not (no longer) correct or incomplete, you can request a correction and, if necessary, completion of this data.

4.3. Right to erasure of data in accordance with Art 17 GDPR

If the legal requirements are met, you can request the deletion of your personal data.

4.4. Right to restriction of data in accordance with Art 18 GDPR

If the legal requirements are met, you can request that the processing of the data relating to you be restricted.

4.5. Right to data portability in accordance with Art 20 GDPR

If the legal requirements are met, you can request the transfer of your data in a structured, common and machine-readable format.

4.6. Right to object to unreasonable data processing in accordance with Art 21 GDPR

For reasons that arise from your particular situation, you can at any time object to the processing of the data relating to you that we have based on the performance of a task that is in the public interest or that we have based on a legitimate interest in accordance with Article 6 (1) (f) GDPR process, lodge an objection.