This website is operated by Time Change GmbH on behalf of Merck KGaA. Further details can be found in the imprint.

With this data protection declaration we explain to you which personal data is processed for which purposes. Under certain sections we have added additional and more detailed explanations in fields under the headline "further information". This is following the recommendation of Data Protection Authorities (DPAs) to use "layered" privacy notices that allow users to gain a quick overview.
Technically, these can be implemented by using a dropdown text field. If that is not feasible you can consider adding the text in a checkbox like here. The information in the fields is not required – it is a best practice but if you want to leave it out the remaining information complies with GDPR information requirements.

1. Which data do we process and for which purpose?

a) What kind of data do we collect when you browse our website¹

Generally, we do not identify users who only browse our website. The browsing data we collect includes the name of your internet service provider, the website from which you access our website, the Merck website which you looked at, temporarily your full IP address and the date and duration of your visit.

b) Description of data processing

In the merely informative use of this website, ie if you do not register or otherwise provide us with information, our system automatically collects data and information that your browser transmits to our server (access data):

• your IP-address,
• the country from which you access this website
• the website from which you visit this website,
• the respective search term, if you come to this website via a search engine,
• the specific websites you visit with us,
• your internet service provider,
• your web browser as well as your operating system, with which you access this website,
• the files that you download from this website and
• the date, duration and time of your visit to this website.

c) Providing you with services you requested

For some services on this website, we ask for information from you like your name or an email address. We use your data to provide you access to services that you requested such as giving you access to our materials, answering questions about our products or sending you newsletters based on your selections.² In order to provide you with relevant information, we can individualize the content you requested based on the information we collected about you.¹

d) Legal obligations and legal enforcement

In some cases we are under a legal obligation to process personal data. A typical example is the processing within the scope of the so-called pharmacovigilance, i.e. the obligation to investigate and share data when potential side effects of drugs become known.³

Where required, we can also use your data to enforce our or third party rights (such as copyright infringements).¹

e) General statistics, website security

We use browsing data of our users for creating aggregated statistics (so that statistics do not show data about a single user but only about the collected data of a number of users), to learn what is of interest to users in order to improve our websites and offering. We also use the browsing data for maintaining or restoring the security of our offer or to detect and correct technical defects and errors.¹

We also collect data about the location of the devices accessing our website for statistical purposes (statistics from where visitors access our website, etc.); you can control the authorization for this using the browser settings.¹

2. Cookies und Tracking

a) Cookies

We use cookies in order to enable and facilitate the use of the website, for example to optimize the presentation or display of country-specific content (such as in your national language)).² You can disable or block cookies in your browser software; however, this may result in restrictions regarding the usability of this website.

Further information

• “Cookies" are small text files that enable our website(s) to store information on your computer and retrieve it later (e.g. when you visit our website again later). The use of cookies, for example, enables our websites to "remember" the language in which we are allowed to present our content to you.
• A distinction is made between required cookies, i.e. cookies that are necessary for technical reasons (e.g. in order to implement a login area) and analytical cookies, i.e. cookies that are used for the purpose of measuring the online audience.

3. Recipients of personal data; data transfer to third countries

a) Adverse events or enforcement of rights

Further information

• The following information will be transmitted and processed: Information about the terminal devices used (e.g. operating system, device type, browser, screen resolution), about the origin of our users (for instance, language as well as city and country the user of the website is from and the website via which the user reached us, IP address) and the use of our websites (e.g. our Merck website which have been opened and the content accessed as well as the date and duration of the visit).

If we become aware of potential cases of adverse reactions to one of our products, we are required by law to document and share the relevant information, including personal information with authorities worldwide and, where necessary for further assessment, to contact the reporting parties.

In order to enforce our rights or to protect our rights or the rights of third parties with the holders of such rights, consultants and authorities.

b) External service providers for data processing

We use service providers which support us to provide our services on this website. These service providers process data only in accordance with the instructions and under the control of Merck and exclusively for the purposes described in this privacy policy.

c) Data transfer to the Merck group companies

"We involve Merck KGaA from Germany, EMD Seronon in the USA/Canada and other Merck companies (global) in data transfer to perform internal administrative tasks within the Merck Group/to support them in fulfilling the purposes stated under 1.. These group companies process the data solely for the purposes set out in this Privacy Notice.“

4. Data Retention

We store data for as long as necessary for the provision of the service requested by you. For example, when you subscribe to a newsletter we will store the associated data at least until you unsubscribe.

Data which is collected while browsing our website and which can legally be considered personal data (such as the complete IP address) is stored for a period of time of, unless a reasonably justified incident indicates a longer storage period (e.g. due to a hacking attack).

Data without any personal identifiable information may be stored permanently.

5. Data protection rights and contact

a) General rights

You can request information about the data stored about you and have the right to receive the data provided by you in a common and machine-readable format. Furthermore, in justified cases, you may also request the deletion, correction or limitation of the processing of your data. If your personal data is transferred to a country outside the EU which does not provide appropriate protection, you can request a copy of the contract that implements the appropriate protection of personal data.

b) Right to object

Furthermore, in justified cases you can object to the processing of personal data concerning you where we process your personal data based on our legitimate interest (this is the case if the legal basis is Art. 6 f) GDPR as indicated in the footnotes). This applies in particular to the collection of your data for statistical measurement of the web audience by Matomo software, please see the following link: https://matomo.org/docs/privacy/.

c) Revocation of your consent

When you have given your consent to the processing of personal data concerning you on the website, you can revoke your consent at any time with effect for the future.

d) Contact person

To exercise these rights, please contact our data protection officer Group Data Privacy Officer, address: privacy@merckgroup.com. In addition and in case of concerns, you can also contact the competent data protection authority which is Authority in Wiesbaden:

DER HESSISCHE DATENSCHUTZBEAUFTRAGTE

Prof.Dr. Michael RONELLENFITSCH

POSTFACH 31 63

65 021 WIESBADEN

Data protection declaration as of: December 10th, 2018