PRIVACY NOTICE We appreciate your visit to our website, which is operated by Swixx Biopharma AG with its seat at Neuhofstrasse 5A, CH- 6340 Baar, Switzerland, Company Registration Number 17030383314 . This Privacy Notice aims to provide you with general information about personal data that we may collect about you, how we may use it and how our company protects information when you visit and use this website or interact with us in some other manner. In this policy, “processes” means how we collect, store, share and otherwise use that information for lawful purposes. "We", “us” and "our" means the above company, Swixx Biopharma AG, and it covers all the instances where we might process personal information. We are committed to protecting and respecting your privacy. Our privacy policy is regularly updated to reflect the recent regulatory developments as well as data protection best practices; any such updates will be published on our website. We encourage you to check this policy occasionally to ensure you are up-to-date with our privacy stance as a company. However, we will also certainly notify you, if we are required to do so. Notwithstanding any change to this policy, we will continue to process your personal data in accordance with your rights and our obligations in law. Please note that we do not collect any personal data through our website except if you should choose to subscribe to our News Announcement mailing list. In the course of our company operations, we may come into contact and process data about individuals (personal data). The rest of this document outlines how we deal with this data and strive to protect your privacy and interests as best as we can. Who we are? Swixx Biopharma AG is a company registered in accordance with Swiss laws. For the purposes of both Swiss and the EU privacy laws our company is the controller of your personal data that you share with us when you visit our website, in relation to a contract concluded with us or as a consequence of any other interaction with our company unless stipulated otherwise. We process your personal data only on lawful basis mandated by data protection laws. Why do we process your personal data? The purpose of processing your personal data is given by reasons of our interaction. We process your personal data in particular if you are (i) our business partner or an employee working for us or our business partner and you are interested to receive information related to our services; (ii) a healthcare professional who is looking for professional or educational information, provides us with services, or wishes to inform about experience with the use of the product we distribute; (iii) a candidate interested in a job with our Company; (iv) visitor of the events we organize or sponsor or (v) visitor of our website. Information on processing of personal data of our employees and health care professionals who cooperate with us is contained in specific documents available to employees and co-operating health-care professionals. What personal data do we collect and how do we process them? Please note that we may process your personal data in accordance with the provisions of the European General Data Protection Regulation (“GDPR”) and the Swiss Federal Act on Data Protection (“FADP”) particularly under the following circumstances: Processing personal data received from affiliates We provide certain services to our affiliates including financial, HR, legal or IT services. In these cases we act as processor of personal data related to these services. There are some other instances where we may process personal data for the purposes of management of Swixx Biopharma group, i.e. tasks related to management of group`s financial, HR and corporate matters, assembling of consolidated financial statements and other similar tasks; in such case we act as personal data controller and the personal data are processed on the basis of our legitimate interest in accordance with Article 6 (1) (f) of the GDPR and / or to fulfil the respective legal obligations in accordance with Article 6 (1) (c) of the GDPR. Who do we share your personal information with? If relevant and necessary, we may share your data with some of our partners resp. their affiliates in the EU who provide us with different services being our (i) agents, contractors and suppliers, inclusive of companies that provide us with technology services i.e. data analysis, hosting and technical support as well as those companies who are engaged to market and distribute our products; companies we work with on our recruitment process; or (ii) our professional advisors, auditors, investors. When we share your information with other organizations or data processors, we require use of your data only for the purpose we have them for and they have to follow our instructions whilst complying with appropriate security measures. We may also provide the pharmacovigilance data to the authorization holders or their representatives of US- companies in the EU (list of such external recipients can be found at: https://www.swixxbiopharma.com/partners.htm ) or our affiliated companies in or outside the European Economic Area (i.e. in Albania, Serbia, Montenegro, Macedonia, Kosovo and Bosnia and Herzegovina) as required by respective pharmacovigilance procedures or based on patient’s consent as described above. We may also share your data with law enforcement agencies, regulators, courts, public authorities or emergency services if and when we are required to do so on lawful basis. We may also provide your data as necessary for carrying out the group’s business to our affiliates shown at the contact page of our website at: https://www.swixxbiopharma.com/contact.htm . Such affiliates are controllers of such data. As some of these affiliates are located outside of the European Economic Area in countries for which no Adequacy Decision was published by the European Commission and the Swiss Federal Data Protection and Information Commissioner (i.e. in Albania, Serbia, Montenegro, Macedonia, Kosovo and Bosnia and Herzegovina) we ensure that there are appropriate safeguards to protect your personal data in the form of Standard Contractual Clauses (Controller to Controller) entered into between these companies and Swixx Biopharma AG. Our data may partially be stored in Serbia where AMICUS SRB d.o.o. with its seat at Milorada Jovanovića 9, Postal Code 11000, Belgrade – Cukarica, with registration number 21029033, activity code 4646 and TIN 108585471 (our affiliate in Serbia), provides us with the services of data storage and back-up. It stores our data (which may include your personal data) on a dedicated server located in Serbia. As there is no Adequacy Decision published by the European Commission and the Swiss Federal Data Protection and Information Commissioner with respect to Serbia, we ensure that there are appropriate safeguards to protect your personal data in the form of Standard Contractual Clauses (Controller to Processor) entered into between our company and Amicus SRB. You may find the wording of the abovementioned Standard Contractual Clauses at the website of European Commission h t t p s : / / e c . e u r o p a . e u / i n f o / l a w / l a w - t o p i c / d a t a - p r o t e c t i o n / i n t e r n a t i o n a l - d i m e n s i o n - d a t a - p r o t e c t i o n / s t a n d a r d - c o n t r a c t u a l - clauses-scc or you may contact us at the addresses or phone number below to obtain a copy of the signed Standard Contractual Clauses. How we protect your personal information We are keen to maintain the highest standards of data privacy and security to protect your personal details and other information about you because we want you to feel completely confident about your interaction with us. We regularly review our processes and procedures and take reasonable steps, consistent with generally accepted industry standards, including technical, administrative and physical safeguards to protect your data from unauthorized access and use, misuse, disclosure, alteration, accidental loss and/or destruction. Please always follow commonly accepted security recommendations (use of secure protocols, etc.), when transmitting personal data via Internet. Know your rights In relation to the personal data provided to us, you have the following rights: 1 . Right   of   access : You have the right to obtain from us confirmation as to whether or not your personal data are being processed, and, where that is the case, to access such personal data and the related information, in particular concerning the purpose of personal data processing, its duration, categories of personal data processed, the period of storage of the personal date and recipients to whom the personal data are disclosed. If personal data is disclosed abroad, we also inform you of the name of the state and, as the case may be, the adequate safeguards. Such right to access may nevertheless be restricted based on the rights and freedoms of others. 2 . Right to rectification : Upon your request we shall correct inaccurate or amend incomplete personal data related to you. 3 . Right   to   erasure (Right to be forgotten): Under the conditions set out in GDPR and in FADP, we shall, upon your request erase the personal data for example in cases when such data are no longer necessary in relation to the purposes for which they were collected, they were processed based on your consent which was withdrawn, you objected to their further processing or they were processed unlawfully. 4 . Right   to   restrictions   of   processing : Under the conditions set out in GDPR and in FADP (for example when the accuracy of personal data is contested by you or the personal data were unlawfully processed), we shall, upon your request, restrict processing of your personal data; in such case we shall process such personal data only for limited reasons set out in GDPR and in FADP or other applicable laws. 5 . Right   to   data   portability : Under the conditions set out in GDPR and in FADP and to the extent of our technical capabilities, you shall have right to receive the personal data you provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from us. Furthermore, in exercising your right to data portability, you shall have the right to have the personal data transmitted directly from us as controller to another controller, where technically feasible. 6 . Right   to   object : In certain cases (in particular with respect to personal data processed on the basis of our legitimate interest) you may object to the processing of your personal data. In such case we may be required to cease from further processing of such personal data. 7 . Right   to   withdraw   consent : In case that your personal data are processed based on your consent, you shall have the right to withdraw such consent at any time in the same form and manner as the consent was originally given, or contact our company using the contact details below for such purpose; lawfulness of personal data processing carried out prior to such withdrawal shall remain unaffected. Please note that even after you have chosen to withdraw your consent we may continue to process your personal data to the extent required or permitted by law. 8 . Right   to   contact   the   Supervisory   Authority : You shall have the right to lodge a complaint in relation to our processing of your personal data with the competent supervisory authority, in Switzerland with the Swiss Federal Data Protection and Information Commissioner, with its registered office at Feldeggweg 1 CH - 3003 Berne, Switzerland, E-mail: info@edoeb.admin.ch, website: https://www.edoeb.admin.ch/edoeb/en/home.html . Contact details of supervisory authorities of EU Member States can be found at https://edpb.europa.eu/about-edpb/board/members_en How long do we keep your personal data? The period for which we keep your personal data depends on the purpose for which your information was collected and is used . We never keep your data which are no longer required for the purpose for which they were collected. Data related to performance of a contract we keep for the duration of such contract and after its termination as long as it is required by applicable laws (for example in relation to accounting or taxes) or as long as our legitimate interest (e.g. resolution of potential legal claims lasts. Data related to job seekers we keep only until we close the respective position unless you are hired for employment and thus the personal data are made part of your personal file. Data processed on the basis of your consent we keep as long as required for the purpose for which they were collected in any case until revocation of your consent at the latest. Data processed in order to comply with legal requirements (such as pharmacovigilance data) are processed as long as required by applicable laws. Any more questions? We hope this Privacy Notice has been helpful in setting out the way we handle your personal data and your rights to control it. If you have any more questions on how the Company will handle your personal data or want to exercise any of the rights related to processing of your personal data outlined above, please contact us directly at data@swixxbiopharma.com or telephone us on +41 (41) 5523-440.