Last updated: September 2026

Data protection and data security are important to Lupin Europe GmbH (hereinafter “Lupin”, “we” or "us”). This privacy notice (or "Notice") communicates how Lupin will make use of information of health care professionals (“HCPs”) and patients that visit the website at https://lupineurope.eu (the "Site"), including in connection with the provision of educational material relating to our products, and describes your data protection rights, including the right to object to some of the processing which Lupin carries out. More information about your rights, and how to exercise them, is set out in the “Your choices and rights” section.

In addition, this Notice explains how your information is collected by cookies and other tracking technologies (together "cookies") when you are using the Site. For more information, see the section on “Cookies” below.

1.  Data Controller and Scope

Under the EU and UK General Data Protection Regulation (each the “GDPR” as applicable), the body that determines how and why your personal data is processed is defined as the “controller”. The controller of your personal data is:

Lupin Europe GmbH

Hanauer Landstraße 139-143

60314 Frankfurt am Main

Phone: +49 (0)69 478730

E-Mail: [email protected]

Website: https://lupineurope.eu

You can contact us at the details above if you have questions about this Notice or wish to contact us for any reason in relation to our personal data processing or use of cookies.

2. Compliance with Applicable Laws

When using your personal data, Lupin as Controller will always comply with the relevant data privacy and data protection laws, which includes regulatory and national law requirements that may apply to such use and processing and, where applicable, giving you the specific rights that apply in the country where you reside (altogether “applicable law”).

3. Data Protection Requirements

Lupin will comply with data protection law. This means that the personal data we hold about you must be:

• used lawfully, fairly and in a transparent way;

• collected only for valid purposes that we have explained to you clearly and not used in any way that is incompatible with these purposes;

• relevant to the purposes we have told you about and limited to those purposes only;

• accurate and kept up to date;

• kept only for such time as is necessary for the purposes we have told you about; and

• kept securely.

4. Data Processing

We collect the following personal data when you use our Site.

Device Information

When you access and use the Site, we collect the personal data that your browser automatically transmits to our server.

This may include the following information: ("Device Information"):

IP address;

Date and time of request;

requested URL/file;

browser/user agent

b) Personal data we collect from you

We collect your personal data, including Device Information, from you and process it for the following purposes and based on the following legal bases under the GDPR (where applicable). Provision of this personal data is optional but failure to do so may result in certain features or functions of our Site not being available to you.

5. Retention

a) Scope and purpose of processing

We retain your personal data for no longer than is necessary for the purposes for which it is processed. More particularly:

server log files (including IP addresses) are stored by our hosting provider for security and technical purposes for up to approximately 8 weeks;

backup data may be retained for a limited period; and

further storage may take place in individual cases if this is required by applicable law.

After these periods, we will delete your personal data.

6. Data Sharing

We share your personal data with the following categories of recipient:

our hosting provider – the Site is hosted by IONOS. IONOS receives IP address and server log data for the purposes of website hosting, security, and maintenance; and

other service providers – for example, technical support providers to ensure the Site functions correctly, and the website developer.

In some scenarios, we may be required to share your personal data with law enforcement agencies or regulators in accordance with applicable law.

In the event that our business is sold or integrated with another business, your details will be passed to the new owners of the business in order to continue to operate the Site.

7. International Transfers

The Site is hosted on secure servers with our service provider IONOS.

For transfers between the UK, EEA and Switzerland and New Zealand, we rely on appropriate adequacy decisions by the European Commission or the UK/Swiss Governments.

8. Your Choices and Rights as a Data Subject

If you are based in Switzerland, the UK or the EU, you have at least the following rights:

These rights may be limited if, for example, fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law to retain or have compelling legitimate interests to keep.

If you wish to exercise any of these rights, please email us at [email protected] so we can assist you. Please note that, in some cases, we may request additional information from you to verify your identity before we can respond to your request.

Wherever we rely on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. We may, however, have other legal grounds for processing your data for other purposes, such as those set out in the “Data Processing” section above.

9. Cookies

a) What are cookies and other tracking technologies?

A cookie is a very small text document, which often includes an anonymous unique identifier. Cookies are created when your browser loads a particular website. The website sends information to the browser, which then creates a text file. Every time the user goes back to the same website, the browser retrieves and sends this file to the website's server. Find out more about the use of cookies on www.allaboutcookies.org.

When we talk about cookies in this Notice, this term also includes other similar technologies (such as device fingerprinting and local processing).

b) The types of cookies we use

We use the following types of cookies on the Site:

c) Session and persistent cookies

Cookies can be persistent or session cookies depending on the time that they remain on your device. A persistent cookie is stored on your device after your web browser is closed or once your session ends. It can be used to recognise your device when you open your browser and use the Site again. A session cookie exists temporarily on your device while your browser is open. It is deleted automatically once you leave the Site or close your browser.

10. Data Security and Security Measures

We are committed to protecting your privacy and treating your personal information confidentially. In order to avoid any manipulation, loss or misuse of your data stored by us, we take extensive technical and organisational security measures that are regularly reviewed and adapted to technological progress. Our security measures are continuously revised in line with technological developments. Our employees are obliged to maintain confidentiality. This includes, among other things, the use of recognised encryption methods (SSL or TLS).

However, we would like to point out that due to the structure of the internet, it is possible that the rules of data protection and the above-mentioned security measures may not be observed by other persons or institutions for which we are not responsible. In particular, unencrypted data - e.g. if this is done by e-mail - can be read by third parties. We have no technical influence on this. It is the responsibility of the user to protect the data provided by him against misuse by encryption or in any other way.

11. Minors

The Site, and the information provided on the Site, are not designed or intended for use by children of 16 years and younger. Where required, Lupin also do not knowingly collect, process or store any personal data from any users under the age of 16 without the verifiable consent of a parent or guardian prior to collecting, processing or storing information collected either directly or indirectly through the use of the Site. Parents or guardians of minors may have the right to request to view or delete personal data provided by the child either directly or indirectly through the use of the Site.

12. Contact Information

You can get in touch with us with any questions about this Notice, our data processing, or our use of cookies in connection with the Site using the contact details here.

If you have questions or concerns about this Notice or the processing of your personal data,

you may also contact our external Data Protection Officer at:

Bird & Bird DPO Services SRL
Avenue Louise 235 b 1
1050 Brussels, Belgium
Email: [email protected]

If you have any concerns, you have the right to complain to us and:

For EU Personal Data: Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

For UK Personal Data: Information Commissioner's Office (ICO)

For Swiss Personal Data: the Swiss Federal Data Protection and Information Commissioner.

13. Updates to this Privacy Notice

Changes to the law or changes to our corporate processes may require an adaptation of this Notice and we refer you to this page to review and read this Notice regularly. The most current version of this Notice can be accessed on the Site any time under “Privacy Notice”, saved and printed out. This Notice was last updated as of the “Last Updated” date shown above.