Personal data refers to any information that directly or indirectly relates to your identity. As the legal basis regulating data protection and conditions for the processing of your data, we apply the Law on Personal Data Protection ("Official Gazette of RS", no. 87/2018).

Plus Pharmaceuticals DOO Kragujevac, located at Janka Veselinovića 2, 34000 Kragujevac, Serbia (hereinafter referred to as Plus Pharmaceuticals DOO), as the data controller, hereby informs you, in accordance with Article 23 of the Law on Personal Data Protection, about the conditions for collecting and processing personal data.

It is possible to visit and use our website without revealing your identity or any other data related to it. When visiting our website, due to the nature of the Internet, certain user data is collected, but these data alone are not sufficient to identify an individual and are considered statistical indicators used to improve the website’s quality. Such information may include the browser name, number of visits, average time spent on a page, type of computer and technical information about the user's connection to the website—such as operating system, internet service provider, IP (Internet Protocol) address assigned by providers, which varies for each user, and similar data.

What types of personal data do we collect?

1. PERSONAL DATA: Contact information such as name, surname, address, email address, and phone number
2. BUSINESS CONTACT DATA: Such as company address, business email
3. SENSITIVE PERSONAL DATA: Gender, personal ID number, date of birth
4. CONTRACT DATA: Such as the contents of a business cooperation agreement
5. PAYMENT INFORMATION: Such as bank account number, damage compensation requests, contract-related payments

Purpose of data processing / Legal basis:

1. To provide services: in order to deliver goods purchased through our www.plus-pharmaceuticals.com online store, we need your contact information to deliver products to the requested address.
2. Handling requests – complaint resolution, feedback: we aim to resolve such matters in accordance with the law. In order to process complaints appropriately and provide feedback, we need to collect certain data. Additionally, if a refund is requested, it will be necessary to complete the required form (so-called "NI" form), which includes your personal ID number, as required by regulations.
3. Contracting – before signing a contract, we may need to verify if the individual is authorized to enter into a contractual relationship. The same applies to executing certain contractual provisions. Identity verification may be necessary to ensure compliance with the contract and legal obligations.
4. Promotional notifications – if you have subscribed to receive notifications about sales or offers, the data you have shared for that purpose will be used to send such messages—as long as you wish to receive them.
5. Security measures – such as CCTV surveillance in our premises, which we use to ensure the protection of our employees, customers, visitors, and property.

Plus Pharmaceuticals DOO processes certain types of sensitive personal data when required to fulfill legal obligations, and only to the extent prescribed by law:

• Health-related data such as records of sick leave, medical reports, or documentation used to process damage claims resulting from incidents in our retail or business premises. We will not record data from your medical records unless strictly necessary. These may be shared with our insurance provider to handle your damage claim or, in the event of legal proceedings, submitted to the competent court.

We may share your personal data with the following parties:

• Third parties acting on our behalf (data processors). In such cases, these third parties may use your personal data only for the purposes outlined above and exclusively in accordance with our instructions;
• Employees in departments responsible for the services listed above may access your personal data, but only when strictly necessary for fulfilling their duties, and when obligated to maintain data confidentiality;
• Insurance companies providing services to Plus Pharmaceuticals DOO and its associates;
• External entities responsible for storing your personal data, independent from Plus Pharmaceuticals DOO (such as external consultants, auditors, attorneys, tax advisors, etc.);
• When required by law or by court order, such as law enforcement or other government authorities.

Your personal data is retained only as long as necessary to fulfill the processing purpose, after which it is deleted or made inaccessible – rendered anonymous.

The criteria for determining the retention period include:

• Duration of your contractual relationship with us;
• As long as we maintain any relationship with you;
• Legal requirements applicable to us regarding data retention.

When using certain features (applications, forms) on our website – such as contact forms, requests for product offers, or requests to receive news and promotions – Plus Pharmaceuticals DOO processes your personal data (identity and contact details) only if you have voluntarily provided it on our website to use our services and products. These personal data may include your name, surname, email, phone number, and/or other contact information, and will be used in accordance with our privacy policy and for the purposes you provided them.

Purpose of processing / legal basis: When visiting our website, your browser automatically and without your input transmits the following data to our web server:

• IP address of the device from which the request is sent and that has access to the internet,
• Date and time of access,
• Name and URL of the accessed file,
• The website/application from which access is made (referrer URL),
• The browser you are using, and, if applicable, the operating system and the name of your internet provider.

The server temporarily stores this data in what is known as a log file for the following purposes:

• Ensuring a smooth connection setup,
• Ensuring convenient use of our website/application,
• Evaluating system security and stability.

The legal basis for processing the IP address is Article 12(1)(6) of the Personal Data Protection Act (legitimate interest). Our legitimate interest arises from the above-mentioned purposes of data processing.

Recipients / categories of recipients: Generally, we do not share this data with third parties.

Retention period / criteria for determining the retention period: Data are temporarily stored only during your visit to the site and are automatically deleted afterward. Once you leave our website, geolocation data are erased.

Cookies: We use so-called cookies on our website in accordance with Article 12(1)(6) of the Personal Data Protection Act (legitimate interest). We consider our interest in optimizing our website to be justified within the meaning of this article. Cookies are small files stored on your device (laptop, tablet, smartphone, etc.) when you visit our website. They do not harm your device, contain no viruses, trojans, or other malicious software. Cookies store information related to the specific device you are using. However, this does not mean that we can identify you personally.

Cookies help make your visit to our website more pleasant. For example, we use so-called session cookies to recognize whether you have already visited certain parts of our website or are already logged into your user account. These are automatically deleted once you leave our website. We also use temporary cookies stored on your device for a specified period. When you revisit our website, it automatically recognizes that you have been there before and restores your previous settings.

We also use cookies to statistically track website usage to optimize the presentation of information tailored to your interests. These cookies allow us to recognize you automatically when you return to our website. They are automatically deleted after a specific period. Most browsers automatically accept cookies. However, you can configure your browser to not store cookies or to notify you before a new cookie is created. Completely disabling cookies may result in the inability to use all features of our website.

**Purpose of data processing / legal basis:** We also process your data through video surveillance installed in our stores and business premises for the purpose of protecting you and ourselves, based on a legally justified interest, particularly to protect property, employees, customers, and visitors from the following identified risks:

• Unauthorized access to premises and facilities;
• Removal, theft, or unauthorized use of protected items;
• Bringing weapons, explosives, radioactive or other hazardous items and substances into the premises;
• Break-ins, sabotage, violent attacks on property or theft of items;
• Unauthorized access to data and documentation;
• Protection of vehicles used for cash transport and other transport means.

The legal basis for data processing through video surveillance is Articles 29 and 30 of the Private Security Act.

**Recipients / categories of recipients:** Video recordings will not be publicly disclosed or shared with third parties unless required by law or authorized by competent authorities. Access to the video recordings is granted to our partner providing private security services, i.e. the company responsible for the physical and technical security of our premises. Additionally, for system maintenance purposes, a technician may have access to the footage solely to ensure the proper functioning of the surveillance system.

**Data retention period / criteria for determining the retention period:** Video footage is stored for 30 days. In certain situations (e.g., legal proceedings), copies of recordings may be retained longer. Once such proceedings are completed, recordings are deleted without delay.

**Purpose of data processing / legal basis:** Any personal data you provide via contact form, telephone, or email will be treated confidentially. We process your data solely for the purpose of responding to your inquiry. The legal basis for this processing is Article 12, Paragraph 1, Item 6 of the Law on Personal Data Protection (legitimate interest). Our—and simultaneously your—legitimate interest in such data processing stems from the need to respond to your questions, solve any issues, and ensure your satisfaction as our customer or website user.

If you participate in any of our surveys, your participation is voluntary. In anonymous surveys, we do not retain information that would identify participants. Only the date and time of your participation are saved. Any personal data you voluntarily submit in a survey will be stored and processed in accordance with the Law on Personal Data Protection. Please do not enter names or other data in free-text fields that could allow us to identify you or others. If you provide consent to participate in a survey, the legal basis for data processing is your consent in accordance with Article 12, Paragraph 1, Item 1 of the Law. You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal. Details on data processing related to surveys are specified in the privacy policy of each individual survey.

**Recipients / categories of recipients:** As a rule, we do not transfer your data to third parties. Exceptionally, our partners (data processors) may process your data on our behalf. All partners are carefully selected and contractually obligated to maintain confidentiality, in accordance with Article 45 of the Law on Personal Data Protection.

Additionally, in some cases, we may need to forward your inquiry to other contractual partners (e.g., suppliers for product-related questions) so they can respond. In such cases, the inquiry will be anonymized beforehand so that the recipient cannot identify you. If it becomes necessary to forward personal data, we will inform you and seek your consent beforehand.

The results of our surveys are primarily used internally. We do not share this data with third parties unless you have given us explicit permission to do so.

**Retention period / criteria for determining retention:** All personal data you provide through questions (suggestions, praise, or complaints) submitted via our website or email will be deleted or anonymized no later than 90 days after we provide a final response. Experience has shown that follow-up questions rarely occur beyond this period.

Purpose of data processing / legal basis: With your consent, we track your user behavior on our website and in our newsletters. User behavior tracking includes the sections you visit and which links you click. This allows us to create personalized user profiles with your personal data and/or your email address in order to tailor our newsletters, on-site ads, and printed materials to your individual interests and thereby improve our offer.

The legal basis for this data processing is Article 12, Paragraph 1, Item 6 of the Law on Personal Data Protection (legitimate interest), or Article 12, Paragraph 1, Item 1 (consent). The processing of customer data for our marketing purposes or for the marketing purposes of third parties is considered a legitimate interest.

Right to object: You can object at any time and free of charge to the processing of your data for the aforementioned purposes through any communication channel. Once you object, we will no longer process your data. The objection does not affect the lawfulness of data processing conducted based on consent prior to the objection. To object, simply send us an email or a letter by post to our contact address.

Recipients / categories of recipients: As a general rule, we do not share this data with third parties.

Retention period / criteria for determining the retention period: If you withdraw your consent for personalized marketing or object to specific promotional activities, we will delete your data from the corresponding mailing lists. If you object, your contact address will be blocked for further processing for marketing purposes. Please note that due to technical reasons related to the preparation of promotional materials, it is possible that you may still receive promotional content even after submitting your objection. We thank you for your understanding.

Purpose of data processing / legal basis: You have the option to subscribe to our newsletter via our website. If you have agreed to receive our newsletter, we will use your email address and possibly your name to send you information about products, promotions, contests, news, and store offers. We store and process this data for the purpose of sending newsletters.

The newsletter content includes promotions (offers, discounts, contests, etc.) and products listed on www.plus-pharmaceuticals.com.

With your consent, we record your user behavior on our website www.plus-pharmaceuticals.com and in our newsletter. The evaluation includes which sections you visited and which links you clicked. This allows us to create personalized user profiles with your personal data and/or email address to tailor our marketing messages (especially newsletters, banners, and printed materials) to your personal interests and improve our offering.

The legal basis for processing data for newsletter purposes is your consent in accordance with Article 12, Paragraph 1, Item 1 of the Law on Personal Data Protection.

To ensure that there was no mistake when entering your email address, we use the so-called double opt-in process. After entering your email address in the registration field, we will send you a confirmation link. Your email address will only be added to our mailing list once you click that confirmation link.

You may withdraw your consent to receive the newsletter or to create a personalized user profile at any time. Withdrawal of consent does not affect the lawfulness of data processing carried out prior to the withdrawal. You can do this by unsubscribing via the link provided at the end of each newsletter. Upon withdrawal, we will delete your data.

Recipients / categories of recipients: If we engage external partners to send newsletters, they are contractually obligated to maintain the confidentiality of personal data in accordance with Article 45 of the Law on Personal Data Protection. Further disclosure to third parties is excluded.

Retention period / criteria for determining retention period: If you withdraw your consent to receive the newsletter, we will remove your data from the corresponding mailing list.

The following notes regarding data processing apply if you have contacted us, are negotiating a contract with us, or already have a contract with us, and if your personal data is being processed in that context. Which data is processed in an individual case depends primarily on the agreed services. Therefore, not all sections of this paragraph may apply to you.

How do we collect your data and what categories of data do we process?

We generally collect data directly from you.

However, we may also collect data from other companies, public authorities, or third parties (e.g. credit bureaus, tax authorities). Additionally, personal data may be collected through our internal systems for reporting possible violations of law or internal guidelines.

The following personal data may be processed: personal data (e.g., name, address, other contact details, date and place of birth, nationality), identification and authentication data (e.g., company registration excerpt, ID card data, signature sample), data related to our business relationship (e.g., payment data, order data), creditworthiness data, company structure and ownership information, photographs and video recordings (e.g., during delivery), as well as similar data types.

Purpose and legal basis of data processing:

Processing for the purpose of fulfilling contractual obligations (Article 12, Paragraph 1, Item 2 of the Law):

Data is processed for the purpose of preparing, establishing, and executing the contractual relationship.

Processing for compliance with legal obligations (Article 12, Paragraph 1, Item 3 of the Law):

The purpose of processing arises, depending on the case, from legal requirements. For example, data may be processed to fulfill retention obligations, identification requirements (e.g., anti-money laundering laws), tax inspections and reporting, or responding to inquiries from public authorities.

Processing for the purpose of legitimate interests (Article 12, Paragraph 1, Item 6 of the Law):

There may be a need to process personal data beyond what is required for contract performance. Our legitimate interests for such processing include selecting suitable business partners, fulfilling legal claims, avoiding liability, controlling access, investigating violations, preventing crimes, and processing damages resulting from the contractual relationship.

If a contract is concluded, we may collect creditworthiness data from credit bureaus to verify your credit capacity. The data may include name, date of birth, addresses, and payment history. You may obtain information about your stored data directly from the credit bureau.

Who has access to your data?

Within our company, only departments that need your data to fulfill contractual, legal, or legitimate obligations will have access. We may also engage external service providers who may receive access to your personal data. Data protection compliance is ensured via contracts.

How long do we store your data?

We store your personal data for as long as is necessary to fulfill the purposes mentioned above. We observe legally mandated retention periods, such as the 5-year retention period required by the Accounting Law.

Are you required to provide us with your data?

In the context of our business relationship, you are required to provide personal data that is necessary to start, conduct, and complete the business relationship, or data we are legally obligated or entitled to collect. Without this data, we generally cannot enter into a business relationship with you.

What rights do you have as a data subject?

You have the right to request information about the personal data we process. You also have the right to request rectification, deletion, data portability, and restriction of processing. If processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of the processing done before withdrawal. You also have the right to file a complaint with the supervisory authority (Commissioner for Information of Public Importance and Personal Data Protection).

Data Controller:

The controller responsible for processing your data is Plus Pharmaceuticals DOO Kragujevac, Janka Veselinovića 2, 34000 Kragujevac, Serbia, Registration No: 21011177, VAT: 108498015, Phone: +381 60 417 04 14, Email: marketing@plus-pharmaceuticals.com. You can also contact our Data Protection Officer at the same address.

DATA PROCESSING ON SOCIAL MEDIA

In some cases, the platform operator is also responsible for processing your personal data. Additionally, in certain situations, we share responsibility as co-controllers in accordance with Article 43 of the Law on Personal Data Protection. Plus Pharmaceuticals DOO manages the following social media pages:

• Facebook: https://www.facebook.com/profile.php?id=100066521076710
• Instagram: https://www.instagram.com/pluspharmaceuticals/

1. Responsibility of the Platform Operator

We have only limited influence on how social media platforms (such as user administration and information sharing) process your data. Wherever possible, we configure the platform to comply with data protection laws. However, in many areas, we cannot influence the data processing performed by the platform operator nor do we know exactly what data they collect.

The platform operator manages the entire IT infrastructure, applies its own privacy policies, and maintains a direct relationship with you (as a registered user). The platform operator is solely responsible for managing your user profile data, to which we do not have access.

You can find more information about how platform operators process your data and how to object to such processing in their respective privacy policies:

• Facebook: https://www.facebook.com/privacy/explanation
• Instagram: https://help.instagram.com/519522125107875

2. Our Responsibility a) Purpose / legal basis for data processing:

We process your data on our social media pages for the purpose of informing consumers about products, offers, services, promotions, sweepstakes, company news, and more. We also use the pages to interact with visitors and respond to their questions, compliments, or complaints.

We reserve the right to remove content where necessary. Additionally, we may share your content (e.g., comments, images) on our page when the platform supports such functionality. We also process your data in order to communicate with you.

The legal basis for this data processing is our legitimate interest under Article 12, Paragraph 1, Item 6 of the Law. This processing serves our public relations and communication interests.

The platform operator does not influence our data processing related to consumer communication on social media.

b) Recipients / categories of recipients:

Public content you share on our social media pages (e.g., comments, videos, images, likes, public messages) is visible to all users. We do not process such data beyond the purpose for which it was originally posted. However, we reserve the right to remove any content that violates laws or our guidelines (e.g., hate speech, explicit content, intellectual property violations).

Private messages sent to us via social media are treated confidentially. If necessary, we may redirect you to more secure communication channels. Confidential messages are not forwarded to third parties unless required for service delivery or if you have given explicit consent. Our carefully selected external partners are contractually bound to maintain confidentiality in accordance with Article 45 of the Law.

If required, anonymized requests may be forwarded to suppliers or partners for resolution. If forwarding of personal data is necessary, we will notify you and request your consent in advance.

c) Retention period / criteria:

All personal data you submit via inquiries (e.g., questions, suggestions, praise, complaints) is deleted or anonymized within 90 days of our final response. Publicly posted content may remain indefinitely unless removed during content updates or due to legal violations or violations of our policies.

We have no control over data deletion performed by the platform operator. For such matters, their privacy policies apply.

d) Sweepstakes and Promotions Purpose / legal basis for data processing:

You may participate in our sweepstakes through our website, newsletter, or social media channels (such as www.plus-pharmaceuticals.com). Unless otherwise stated for a specific contest or unless you have given separate explicit consent, any personal data you submit as part of your participation will be used solely for the execution of the sweepstakes (e.g., selecting/determining winners, notifying winners, delivering prizes, and—if necessary—anonymously publishing winners' names).

If you use your full name or recognizable photos on your social media profile, we cannot rule out the possibility that other users may identify you as a winner.

The legal basis for processing your data in sweepstakes is generally Article 12, Paragraph 1, Item 2 of the Law (performance of a contract). If you provide consent within the context of a sweepstake, the legal basis for data processing is Article 12, Paragraph 1, Item 1 of the Law (consent). In that case, you have the right to revoke your consent at any time. The revocation does not affect the lawfulness of the data processing carried out before the revocation.

Recipients / categories of recipients:

Your personal data will only be shared with third parties when necessary to carry out the sweepstakes (e.g., to send the prize via a logistics provider or sponsor), or if you have given explicit consent. Please note that in some cases, participation in a sweepstake may take place on public forums (e.g., comment sections), making it possible for others to see your participation.

If your full name or profile picture is publicly visible on the social media platform, we cannot exclude the possibility that other users may identify you as a winner.

Retention period / criteria:

After a sweepstake ends and winners are announced, participants' data is deleted unless retention is required by law (e.g., for tax or warranty obligations). If a prize includes a warranty, winner data is retained for the duration of the warranty period in case repair or replacement is needed.

When participating in a sweepstake via social media (e.g., through posts or comments), we have no control over the deletion of your data by the platform operator. In such cases, the platform operator’s privacy policy applies.

e) Sending Newsletters via Social Media Purpose / legal basis for data processing:

You can also subscribe to our newsletter via social media platforms. If you have given your consent to receive our newsletter, we will process only your email address—and possibly your name—to send you personalized information about products, promotions, sweepstakes, news, and surveys about customer satisfaction. We store and process this data solely for the purpose of sending newsletters. The content of the newsletters includes product offers, discounts, sweepstakes, and other promotional content.

With your consent, we also analyze your user behavior based on data collected from our website www.plus-pharmaceuticals.com and our newsletter. This includes data such as which categories you navigate and which links you click. Based on this, personalized user profiles may be created and linked to your identity and/or email address. These profiles help tailor marketing content—such as newsletters, banners, and printed materials—to your personal interests and improve our offerings.

The legal basis for the processing of your data in this context is your consent, in accordance with Article 12, Paragraph 1, Item 1 of the Law on Personal Data Protection.

To ensure that your email address was not entered incorrectly, we use a so-called "Double Opt-In" procedure: after you enter your email address in the registration field, we will send you a confirmation link. Only after you click this link will your email be added to our mailing list.

You may revoke your consent to receive the newsletter, participate in customer satisfaction surveys, and create personalized user profiles at any time. The link for unsubscribing is provided in each newsletter. By unsubscribing, you withdraw your consent for both the newsletter and personalized profiling, and your user data will be deleted. The revocation does not affect the lawfulness of processing based on consent before its withdrawal.

Recipients / categories of recipients:

If we engage external service providers to send newsletters, they are contractually obligated to maintain data confidentiality in accordance with Article 45 of the Law.

Retention period / criteria for determining the retention period:

If you revoke your consent to receive our newsletter, your email address will be blocked from further use in newsletter delivery. Your data will be deleted from the mailing list within six months of unsubscribing. If you signed up via a social media platform, we have no control over the deletion of your data by the platform provider. In such cases, the privacy policies of the respective platform apply.

3. Joint Responsibility, Article 43 of the Law on Personal Data Protection

A shared responsibility relationship exists in part with the operator of the social media platform, in accordance with Article 43 of the Law.

For web tracking methods made available by the social media platform operator, both the operator and we are jointly responsible. Web tracking may occur regardless of whether you are logged into or registered on the social media platform. As previously mentioned, unfortunately, we have very limited influence over the tracking methods used by the operator—for example, we cannot disable them.

The legal basis for these web tracking methods is Article 12, Paragraph 1, Item 6 of the Law (legitimate interest). The justified and legitimate interest lies in optimizing the social media platform and the specific fan page.

Further information on recipients and/or categories of recipients, as well as on the data retention period and/or criteria for determining the retention period, can be found in the data protection policies of the respective platform operators. We have no control over these policies.

You can exercise your rights concerning the prevention of these web tracking methods by referring to the data protection policies of the platform operators mentioned in section 2. You can contact the platform operators using the contact information provided in their privacy policies.

As for the statistics made available to us by the platform operator, we can only influence them to a limited extent and cannot disable them entirely. However, we ensure that no additional optional statistics are requested from the platform.

Therefore, we kindly ask you to be aware that the platform operator may potentially use your profile data and behavioral information to analyze your preferences, relationships, tendencies, etc. Plus Pharmaceuticals DOO has no influence over the processing or forwarding of your data by the social media platform operator.

4. Your Rights

In accordance with Article 26 of the Law, you have the right to request, free of charge, information or details about the processing of your personal data.

Additionally, if the legal conditions are met, you have the right to correction (Article 29), deletion (Article 30), and restriction of processing (Article 31).

If the processing of your data is based on Article 12, Paragraph 1, Item 5 or 6 of the Law, you have the right to object to such processing in accordance with Article 37 of the Law. If you object, we are obliged to stop processing your data unless we present compelling legal grounds that override your interests, rights, or freedoms.

If you have provided us with your data, in accordance with Article 36 of the Law, you have the right to transfer this data to another controller. As a rule, on social networks, this right can be exercised only directly with the platform operator, as only the operator has access to your profile data.

If the processing of your data is based on your consent under Article 12, Paragraph 1, Item 1 of the Law, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise the above rights, or if you have additional questions or complaints, please contact our Data Protection Officer using the contact details provided in the next section of this text.

Additionally, under Article 82 of the Law, you have the right to file a complaint with the national data protection authority (Commissioner for Information of Public Importance and Personal Data Protection).

If you wish to exercise your rights regarding the specific processing of your data, please contact us. We will examine your request (e.g., request for information or objection) or, if necessary, forward it to the relevant social media platform operator if your request concerns data processing by the operator.

5. Contact Information for the Data Protection Officer at Plus Pharmaceuticals DOO

If you have any additional questions or concerns regarding the processing of your personal data, feel free to contact us and we will do our best to assist you.

For this purpose, you can contact the Data Protection Officer at Plus Pharmaceuticals DOO either in writing or via email at the following address:

**Plus Pharmaceuticals DOO Kragujevac**,
Janka Veselinovića 2,
34000 Kragujevac, Serbia
**Email:** marketing@plus-pharmaceuticals.com