PRIVACY POLICY

1. Purpose

This privacy policy describes how MEDICOM Europe and Medicom SAS collect, use, protect and share users’ personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act. This policy comes into effect on 17 November 2025.

1.1 Contact details of the data controller

The website www.medicom-eu.com is published by MEDICOM SAS, a simplified joint-stock company with a share capital of €31,298,600, whose registered office is located at Boulevard de la Chanterie – 49124 Saint Barthélemy d’Anjou – France. Registered with the Angers Trade and Companies Register (RCS) under SIRET number 523 019 354 00035. Contact details are as follows: email (contact.rgpd.pro.eu@medicom.com) and telephone (02 41 96 34 34). The Website is hosted by ANDEGAVE – 78 Av. René Gasnier, 49100 Angers – SIRET: 49490168900039. The contact details are as follows: telephone 02 41 48 37 34.

1.2 Scope

This privacy policy applies to the processing of personal data carried out in connection with the use of the MEDICOM SAS website. It applies to all individuals who may interact with the website or the services it offers, in particular:

• Website visitors (browsing, contact forms, cookies, etc.).
• Users of any online services that may be made available (newsletter subscriptions, document downloads,
  submission of applications, etc.).
• People who contact us using the contact details provided on the website (email, telephone, forms).
• Where applicable, partners or service providers involved in the website’s activities.

This policy does not apply to data processing carried out outside the scope of the website (internal employee management, contractual relationships
with customers, etc.), which may be subject to separate policies or privacy notices.

2. Definitions

The terms used in this privacy policy, including ‘personal data’, ‘processing’, ‘controller’, ‘processor’ and ‘data subject’, have the meanings assigned to them by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).

3. Collection of Personal Data

MEDICOM SAS attaches great importance to the protection of the personal data of users of the Website.

3.1 Data sources

Third-party source: cookies

Our website uses cookies to enhance the user experience, analyse traffic and personalise content. Users can manage their preferences via the banner provided for this purpose during their first visit. Service provided by CookieYes:

• Specific consent for Google services (‘advertising’, ‘analytics’ and ‘personalised advertising’)
• Audience measurement (‘Clarity’)

Users of the Website can easily access information about cookies by clicking on the icon at the bottom of the page. By using our Website, users consent to our privacy policy. This consent does not apply to non-essential cookies, which require separate explicit consent, which is obtained via the banner provided for this purpose.

Third-party source: tools

Information may be provided to other parties for marketing, advertising or other purposes. The Website may use third-party tools, such as:

• Google Analytics (website analytics)
• Google Ads / Remarketing (targeted advertising)
• Social media icons (Facebook, LinkedIn, Instagram)

These tools collect certain technical data and may involve transfers outside the EU, subject to the explicit consent of the website user.

For data subjects: forms
If a user of the Website wishes to contact MEDICOM SAS, they must complete the contact form provided for this purpose on the Website. To this end, the user must provide all the information requested on the contact form. Otherwise, the contact form cannot be submitted to MEDICOM SAS.

Users of the Website undertake to provide MEDICOM SAS with accurate and truthful information about themselves. Users of the Website are solely responsible for any consequences arising from the information they provide to MEDICOM SAS via the contact form.

The information provided by the Website user to MEDICOM SAS via the contact form is subject to data processing. This data is processed for the purposes of customer relationship management (establishing contact), statistics, marketing (if the Website user has given their consent to MEDICOM SAS by ticking the box provided for this purpose on the contact form), etc. MEDICOM SAS is authorised to collect, process and use information concerning the Website user. This Data is retained by MEDICOM SAS for a period not exceeding that necessary for the purposes for which it is collected and processed.

3.2 Data Category

Cookies
Cookies collect the following information when the user browses the Website:

• IP address.
• Browser technical specifications.
• User consent options.
• List of authorised or refused services.
• Timestamp / date of consent selection to manage the validity period.
• Language or display settings.

Forms

We collect information when users of the Website contact us via various forms.
When users contact us or register on our Website, we may collect some or all of the following data:

• Contact details: surname, first name, email address.
• Professional information: role and company.
• The message.
• Sign up for the newsletter.

When you request a catalogue or sample, we may collect some or all of the following information:

• Contact details: surname, first name, email address.
• Professional information: role and company.
• The document type or reference number of the required sample.
• The message.
• Sign up for the newsletter.

As part of an application, we may collect all or some of the following data:

• Contact details: surname, first name, email address, telephone number, postal address and title.
• The professional information contained in the CV and cover letter: including, but not limited to, job title, experience, training, skills, academic background, etc.
• Job title.
• The message.

When you fill in a customer service form, we may collect some or all of the following information:

• Contact details: surname, first name, email address, postal address, telephone number.
• Professional information: role and company.
• The product reference number, the place of purchase, the quantity involved, the box and batch numbers, a photo of the batch, and a
  description of the problem.

The information collected on the Website may be mandatory or optional. Where certain data must be provided in order to access a service (for example, to process a contact request), the relevant fields are marked as such on the form.
If you refuse to provide mandatory data:

• We will not be able to process your request or provide the service in question (e.g. we will be unable to reply to a message, allow you to register on our website, or process an application).
• Some features of the website may not be available or may not work properly.

Providing optional data does not affect access to services, but may improve the relevance or personalisation of communications. In addition, we automatically receive and record information from the Site user’s computer and browser, including the IP address, software and hardware, and the page requested by the Site user. Overall, we collect:

• Browsing data (IP address, browser, operating system, pages viewed, timestamp).
• Data provided via contact forms (name, email address, telephone number, message).
• Data relating to newsletter subscriptions (name, email address).

4. Purposes of the processing

MEDICOM SAS attaches great importance to the protection of the personal data of users of the Website.

Purpose	Relevant legal basis
Application	– To assess the application and determine whether a role can be offered. – To manage the recruitment process and provide updates at each stage. – To retain the profile in our talent pool for future opportunities (subject to the consent of the website user). – To comply with our legal and regulatory obligations, particularly in relation to audits, compliance or administrative checks.
Contact us or register on our website	– To improve customer service and support. – To contact users of the Website by email. – To run a competition, promotion or survey. – To manage customer enquiries and relationships. – To compile audience statistics and optimise the website. – To send communications (newsletters, offers) with prior consent. – To comply with legal obligations or respond to a dispute.
After-sales service form	– Address an issue arising from a purchase. – Provide a solution.
Request a catalogue or sample	– Respond to enquiries and handle contact and dispatch requests.
Cookies	– To personalise the user experience on the Website and meet individual needs. – To generate audience statistics for the Website and improve it. – – To suggest products based on items already selected during previous visits.

5. Shelf life

Data is retained only for as long as is necessary for the purposes for which it was collected or to comply with legal obligations.
It is then deleted or anonymised.

For information only:

• Data collected via the contact form, website registration form or application form is retained for a maximum of three years from the date of the last contact, unless the website user objects.
• Data collected via cookies is retained for a maximum period of 6 to 12 months, in accordance with the recommendations of the CNIL, and consent is sought again at least every 6 months.

6. Recipients and Data Transfers

6.1 External recipients

We do not share the data provided with any service providers or partners.

6.2 Internal recipients

We do not share the data provided with any service providers or partners.

7. Transfers outside the EU

No personal data is transferred outside the European Economic Area (EEA) without appropriate safeguards being put in place in accordance with the GDPR (such as the European Commission’s standard contractual clauses).
Data may be transferred outside the European Economic Area (EEA) only if:

• The country has been granted an adequacy decision by the European Commission.
• Standard Contractual Clauses (SCCs) have been signed.
• Binding Corporate Rules (BCR) are applied.
• The user’s explicit consent is obtained.

8. Rights of Data Subjects

8.1 List of rights

Users of the Website may at any time submit a request to MEDICOM SAS to find out what information MEDICOM SAS holds about them.
In accordance with the GDPR, users of the Website have the following rights in relation to their personal data:

• Right of access to data.
• Right to rectification in the event of an error.
• Right to erasure (‘right to be forgotten’).
• Right to restriction of processing.
• Right to object to processing.
• Right to data portability.
• The right to withdraw consent at any time (where applicable).
• Right to lodge a complaint with the CNIL

With regard to cookies, a pop-up message asks the user in advance whether they wish to accept cookies, which they may, of course, refuse. These cookies do not contain any confidential information about the user.
The user may give their consent to or object to the use of these cookies by adjusting their web browser settings in accordance with the browser’s user guide.

8.2 How to exercise

Users of the Website may at any time submit a request to MEDICOM SAS to find out what information MEDICOM SAS holds about them.
In accordance with the GDPR, users of the Website have the following rights in relation to their personal data:

• Form: https://medicom-eu.com/en/contact-us/
• Email: contact.rgpd.pro.eu@medicom.com
• Postal address: MEDICOM SAS – Data Protection Officer – Boulevard de la Chanterie –
  49124 Saint Barthélemy d’Anjou – France

MEDICOM SAS will respond to requests within one month (this period may be extended by two months, subject to notification, in the case of complex requests). The procedure is free of charge, except in cases of abusive requests.

8.3 Appeals in the event of a disagreement

Users of the Website have the right to lodge a complaint with: CNIL – Commission Nationale de l’Informatique et des Libertés – 3 Place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07 – France – Tel.: +33 (0)1 53 73 22 22 – www.cnil.fr

9. Data Security

We use state-of-the-art encryption to protect sensitive information transmitted online.
We also protect information offline. These measures are regularly reviewed to ensure that the level of protection is appropriate to the risks involved. In the context of recruitment, if the application results in a job offer, the data will be included in the personnel file and retained in accordance with our internal employee policy. If the application is unsuccessful, the data will be retained for a maximum of two years following the last contact, unless you object. Beyond this period, it will be deleted or anonymised. The processing of data is based on:

• The processing of pre-contractual measures taken at the request of the data subject (assessment of an application).
• Compliance with the legal obligations applicable to MEDICOM SAS.
• And, where applicable, explicit consent where the website user agrees to their data being retained for
  future opportunities.

When registering on our website, if at any time a user wishes to unsubscribe and no longer receive emails, detailed instructions on how to unsubscribe are included at the bottom of every email.

10. Contact details / Data Protection Officer

Please contact us if you have any questions:

• Form: https://medicom-eu.com/en/contact-us/
• Email: contact.rgpd.pro.eu@medicom.com
• Postal address: MEDICOM SAS – Data Protection Officer – Boulevard de la Chanterie –
  49124 Saint Barthélemy d’Anjou – France