Privacy Policy under the New Federal Law Pursuant to Art. 6 and Art. 19 (LPD)

DIPHARMA SA (P. IVA CHE-207.217.085), in the person of its Legal Representative pro tempore, with registered office in Piazza Col. C. Bernasconi 5 – 6830 Chiasso (Ticino), as Data Controller, hereby informs you that, in compliance with the new Federal Data Protection Law (LPD) which regulates and governs the protection of personal data and their free circulation your personal data will be processed in accordance with the aforementioned Federal Law, based on the principles of correctness, lawfulness, proportionality of interests and transparency, as well as the protection of your privacy and rights, for the purposes, in the manner and under the terms set out below.

-1- Purpose, methods, and legal bases of data processing

This privacy policy applies exclusively to the online activities of this website and is valid for visitors/users of the site. It does not apply to information collected through channels other than this website https://leafletsapropterin.ch/. The purpose of this privacy statement is to provide maximum transparency regarding the information the site collects and how it uses it.

Your personal data will be processed exclusively for purposes that are strictly connected, instrumental and necessary to the fulfilment of the obligations inherent to the relationship with our Company; in particular:

The processing of personal data is carried out by means of the operations of collection, registration, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation, and destruction. The processing of personal data will be carried out by the data controller, the person(s) in charge and the authorised persons (appointees) with the observance of all precautionary measures to ensure their security and confidentiality. The data will not be subject to profiling.

The data will be stored at the data controller and at the data processors designated by the data controller. In any event, your personal data will be stored and processed within the borders of the Helvetica Confederation and will only be transferred outside these borders with your express consent.

In the event that you provide comments and/or personal data for the purpose of requesting information and/or specific services requested by you (e.g. requesting commercial information, subscribing to our portal, subscribing to our newsletter), such data shall be deemed to have been voluntarily provided by you at the time of the request for the provision of the service. By entering a comment or other information, the user expressly accepts this privacy policy. The data received will be used exclusively for the provision of the service requested and only for the time necessary for the provision of the service.

The information that users of the site decide to make public through the services and tools made available to them, is provided by the user knowingly and voluntarily, exempting this site from any liability for any violation of the law. It is up to the user to verify that he/she has the permissions to enter personal data of third parties or content protected by national and international regulations.

The data collected by the site during its operation are used exclusively for the above-mentioned purposes and stored for the time strictly necessary to carry out the specified activities. In any case, the data collected by the site will never be provided to third parties, for any reason whatsoever, unless it is a legitimate request by a judicial authority and only in the cases provided for by law.

-2- Nature of data collection and consequences of failure to provide data.

Like all websites, this site makes use of log files in which information collected automatically during user visits is stored. The information collected may be as follows

• internet protocol (IP) address
• browser type and parameters of the device used to connect to the site;
• name of the internet service provider (ISP);
• date and time of visit;
• the visitor’s web page of origin (referral) and exit;
• possibly the number of
• Your email address should you decide to subscribe to our newsletter, for which your explicit consent will still be

The aforementioned information is processed automatically and collected in an exclusively aggregate form for the purpose of verifying the proper functioning of the site, for security reasons and for the legitimate interests of the owner as provided for by current legislation. For security purposes (anti-spam filters, firewalls, virus detection), the automatically recorded data may possibly also include personal data such as the IP address, which could be used, in accordance with the laws in force on the subject, in order to block attempts to damage the site itself or to cause damage to other users, or in any case harmful or criminal activities.This data is never used for user identification or profiling, but only for the purpose of protecting the site and its users and the legitimate interests of the Data Controller in the processing of data. By using or consulting this site, visitors and users explicitly approve this privacy policy and consent to the processing of their personal data in the manner and for the purposes described below, including the possible disclosure to third parties if necessary for the provision of a service. The provision of data and therefore consent to the collection and processing of data is optional, however, denying consent may make it impossible to provide certain services and the site navigation experience may be compromised.

Consent to the use of your data for marketing and/or advertising purposes (sending of e-mails and/or communications with newsletter advertising offers) is optional and requires on your part, in addition to the provision of your personal data, also an explicit request through the opt-in function on this website.

-3- Timing and terms

The Data Controller, the data processors and the persons authorised to process data (appointees) will process personal data for the time necessary to fulfil the purposes set out above and, in any case, for no longer than 10 years from the termination of the relationship where this is provided for or made necessary by the regulations in force. With regard to the provision of data by you for receiving commercial information, newsletters and periodical information, the data will be processed until you request to unsubscribe.

-4- Communication and dissemination of data

Your personal data, for the purposes of the execution of the contract or the services requested by you and for the purposes indicated above, may be communicated

• to all natural and legal persons (by way of example but not limited to legal, administrative and tax consultancy firms, auditing firms, couriers and forwarding agents, data processing center’s, IT consultants, suppliers, etc.) in cases where communication is necessary for the purposes illustrated above;
• to banking institutions for the management of collections and payments;
• to factoring or debt collection companies;
• to our specially appointed collaborators and employees within the scope of their
• to SMTP providers for sending the Newsletters

-5- Rights of the data subject

By calling +41 91 60 11 700 or writing to privacyDSA@dipharma.ch you may exercise your rights at any time in relation to the data controller (Data Controller) in accordance with the Federal Data Protection Law (LPD), which we reproduce here for your convenience.

You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, even if it has not yet been recorded, as well as its communication in intelligible form. The data subject has the right to be informed:

• the origin of the personal data (with particular regard to the case where the data are not collected from the data subject and, in the case of transfer of data to a third country, the existence of appropriate safeguards, the purposes and methods of processing
• of the logic applied in the event of processing carried out with the aid of electronic instruments
• of the identification details of the data controller, data processors and the designated representative
• of the entities or categories of entity to whom or which the personal data may be communicated or who or which may get to know said data in their capacity as designated representative(s) in the State’s territory, data processor(s) or authorised entity(ies)
• the categories of personal data being processed;
• the retention period of the data or the criteria used to determine this period;
• the existence of automated decision-making processes, with particular regard to profiling, and the logic applied to them;
• the right to obtain a copy of the personal data undergoing processing;

The data subject also has the right to obtain:

• the origin of the personal data (with regard to the case where the data are not collected from the data subject and, in the case of transfer of data to a third country, the existence of appropriate safeguards, the purposes and methods of processing
• of the logic applied in the event of processing carried out with the aid of electronic instruments
• of the identification details of the data controller, data processors and the designated representative
• of the entities or categories of entity to whom or which the personal data may be communicated or who or which may get to know said data in their capacity as designated representative(s) in the State’s territory, data processor(s) or authorised entity(ies)
• the categories of personal data being processed;
• the retention period of the data or the criteria used to determine this period;
• the existence of automated decision-making processes, about profiling, and the logic applied to them;
• the right to obtain a copy of the personal data undergoing processing;

The data subject also has the right to obtain:

• updating, rectification or, where interested therein, integration of the data;
• the cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed
• certification to the effect that the operations as per letters a) and b) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected
• the portability of the data to other parties, for which an explicit request must be made to the following addresses +41 91 60 11 700, privacyDSA@dipharma.ch
• the deletion of the data in our archives (so-called right to be forgotten), by notification to +41 91 60 11 700, privacyDSA@dipharma.ch
• to restrict the processing of data in accordance with the Federal Data Protection Law (LPD)

The data subject has the right to object, in whole or in part, to the processing of data:

• for legitimate reasons relating to his or her situation, even if the processing is relevant to the purpose of collection
• the processing of personal data concerning him/her for the purposes of sending advertising material or direct sales or for carrying out market research or commercial communication;
• the processing of data including profiling based on such

Where the processing of data is based on the data subject’s consent, the data subject shall have the right to withdraw such consent at any time by making an explicit request to the following addresses +41 91 60 11 700, privacyDSA@dipharma.ch.

Moreover, the data subject has the right to lodge a complaint with the Supervisory Authority.

The aforementioned rights may be exercised by making a request to the Data Controller or the Data Processor by telephone, by e-mail to the above-mentioned addresses or by registered letter with acknowledgement of receipt.

Consent of the Data Subject

In requesting the express manifestation of your consent to the processing of your data (which, however, we will consider as given orally in the event of failure to return this undersigned letter) we will consider you, as of now, informed of the processing carried out by us, pursuant to and for the purposes of the Federal Data Protection Law (LPD)