PRIVACY POLICY

1. Controller responsible for data processing

Pharma Biologica - Biologische Arzneimittel GmbH
Represented by Managing Director Jens van Ophemert
Solinger Str. 22
40764 Langenfeld
Germany

Email: info@pharma-biologica.de
Telephone: +49 2175 - 9949989

2. Collection and processing of personal data

We collect, process and store your personal data only where necessary for the following purposes:

Processing orders and customer enquiries
Performing contracts and delivering products
Processing payments
Improving our services and website security

Processing is based on Article 6(1)(b) GDPR (performance of a contract) or on a legitimate interest under Article 6(1)(f) GDPR.

3. Disclosure of data to third parties

Your personal data is disclosed only to payment service providers and banks for processing payments; shipping companies for delivering ordered goods; IT service providers and hosting providers for maintaining and securing our website; and tax advisers and authorities where required by law.

Where external providers process data on our behalf, this takes place under a data processing agreement in accordance with Article 28 GDPR.

4. Use of an order management system

We use an order management system for order processing, operated by CG-Dienstleistungen, Adrian-Wilhelm-Weg 17, D-47877 Willich, Germany.

The legal basis is Article 6(1)(b) GDPR.

5. Retention period

We retain personal data only for as long as necessary to process contracts and comply with applicable statutory retention duties, including duties under tax and commercial law. Different periods may apply to invoices, accounting records and general business correspondence.

Once these periods expire, the data is deleted unless another legal basis permits or requires continued processing.

6. Your rights under the GDPR

You have the right to access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20).

Right to object (Article 21 GDPR): Where processing is based on our legitimate interests under Article 6(1)(f) GDPR, you may object in accordance with Article 21 GDPR. We will cease processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is needed for establishing, exercising or defending legal claims.

7. Right to lodge a complaint with a supervisory authority

If you believe that we are processing your personal data unlawfully, you may lodge a complaint with a competent data protection authority, including:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
Telephone: +49 211 38424-0
Email: poststelle@ldi.nrw.de

8. SSL/TLS encryption

Our website uses SSL/TLS encryption for security and to protect the transmission of confidential information. An encrypted connection is indicated by “https://” in your browser address bar and the browser’s connection security information. Encryption protects data in transit against interception by third parties.

9. Social media

We maintain public profiles on social networks such as Facebook, Instagram, YouTube and LinkedIn. When you visit these profiles or interact with our content, for example through likes, comments or messages, the platform operators process personal data. We have limited control over this processing.

Joint responsibility: For relevant processing operations, we share responsibility with the respective platform operators under Article 26 GDPR. The platforms are primarily responsible for processing data within their services.

Our purposes include communicating with users, answering enquiries, presenting and improving our offering, and analysing reach and use through aggregated Insights. The legal bases are Article 6(1)(f) GDPR (legitimate interests in public communication) and Article 6(1)(b) GDPR where an enquiry concerns a contract.

If you contact us through a social network, we process your information according to the principles described in this privacy policy, as we would for contact through our website.

Platform operators may transfer data to third countries, including the United States, relying on applicable safeguards such as the EU–US Data Privacy Framework or standard contractual clauses. Further information is available in the providers’ privacy policies:

10. Cookies and tracking technologies

Our website uses cookies and similar technologies, such as web beacons, pixels and scripts, to provide functions, analyse use and protect your privacy. Information such as your IP address, browser information and device information may be processed.

We distinguish between essential cookies for secure and functional operation, including navigation, security, multilingual display and contact forms; preference cookies for settings such as language or region; statistics cookies for analysing website use; marketing cookies for tracking use across websites and personalised content or advertising; and unclassified cookies which we review regularly.

Non-essential cookies and comparable technologies are used only with your consent under Article 6(1)(a) GDPR. Processing necessary for secure and functional operation is based on our legitimate interests under Article 6(1)(f) GDPR.

We use Real Cookie Banner to manage technologies and consent. Information about its operation is available from devowl.io (German). The legal bases for related processing are Article 6(1)(c) GDPR (legal obligations) and Article 6(1)(f) GDPR (legitimate interests in documenting consent).

The following services may process personal data, such as IP addresses and device information, or transfer data to third countries:

WPML: Multilingual website system which stores preferred language settings and routes to appropriate language versions (essential).
Wordfence Security: Security plugin which processes IP addresses for threat analysis (essential).
WPForms: Processing contact enquiries submitted through forms (functional).
WP Mail SMTP: Sending emails through external servers (functional).
Google Tag Manager: Tag management by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It does not itself set cookies, but can load other services which use cookies or similar technologies. Such services are enabled only with consent under Article 6(1)(a) GDPR. Data may be transferred to Google LLC in the United States under applicable safeguards, including the EU–US Data Privacy Framework and EU standard contractual clauses. See Google’s privacy policy and Tag Manager’s use policy.
Google Analytics 4: Website analytics by Google Ireland Limited at the address above. We use GA4 to analyse website use and create activity reports. IP addresses and device and browser information may be processed. The service is used only with consent under Article 6(1)(a) GDPR. Data may be transferred to Google LLC in the United States under the safeguards above. See Google’s privacy policy and Analytics terms.
Google Translate: Translation of website content by Google; may transfer data to third countries (functional, only with consent).
Google Fonts, hosted locally: Our fonts are stored on our own server. Loading them does not establish a connection to Google’s servers or send personal data to Google.

You can change or withdraw consent at any time through the cookie banner or the “Privacy settings” control at the bottom of the screen. Withdrawal takes effect for the future and does not affect the lawfulness of previous processing.

If you are under 16, you may consent to optional services only with permission from your parent or guardian.

11. Contact form

When you contact us through a form, we store your submitted information, including contact details, to process your enquiry and any follow-up questions. The legal basis is Article 6(1)(b) GDPR (steps before entering a contract).

12. Job applications

If you apply for a job with us, we process your personal data solely for the recruitment process. The legal bases are Section 26(1) of the German Federal Data Protection Act (BDSG) and Article 6(1)(b) GDPR. If no employment follows, your data is deleted within six months unless you consent to longer retention or statutory duties require it.

English translation prepared in October 2026 from the German policy dated 4 August 2025.