PRIVACY STATEMENT

Subject to applicable laws, by using and/or interacting with the Aspen websites and/or providing your personal data to Aspen, you are consenting to the collection, holding, use and disclosure of that data as set out in this Privacy Statement.

This statement covers Aspen and its subsidiaries, adapted where appropriate in-country on the subsidiary websites.

Aspen acknowledges and respects the privacy of individuals and is committed to the protection of their personal data. This statement sets out the way in which Aspen will use, manage and protect your personal data. To the extent that you are using and or interacting with the Aspen websites to -

• apply for employment with Aspen in any country within the European Union, or
• apply for employment with Aspen from within the European Union

then the provisions of the Aspen HR EU Candidate Privacy Notice shall govern the processing by Aspen of your personal data. In either case, where there is a conflict between the provisions of this Privacy Statement and the Aspen HR EU Candidate Privacy Notice, the latter shall take precedence.

What Data Does Aspen Collect and Hold?
Subject to applicable laws, Aspen may collect and hold personal data related to you which is necessary for the purpose of conducting Aspen’s business, including (without limitation) (i) to deliver products, services or information, (ii) to assist you with matters relating to Aspen’s products and services, (iii) to improve and better understand your preferences in respect of Aspen’s products and services (iv) to fulfil Aspen’s regulatory obligations and (v) to process your application for employment with Aspen. Examples of data Aspen collects and holds include, without limitation, to the extent permitted by applicable laws, your name, your professional qualifications, address, telephone number, facsimile number and email address. This data is usually collected directly from you but occasionally, where it is unreasonable or impractical to do so, it may be provided by third party service providers or publicly available sources. You may choose

Aspen Pharmacare Holdings Limited (Rev 27/09/2018) Page 2

not to provide any personal data to Aspen, however, Aspen may not be able to provide products or services to you. Aspen will not collect, hold, use or disclose sensitive data (such as information about racial or ethnic origins, political or religious beliefs, gender, date of birth or health information) except with your consent or where required or permitted by law. Aspen may collect, hold, use or disclose sensitive data such as your or your child's health data where you have provided it to Aspen in the context of communicating feedback on, or to report an issue or adverse event related to, one of Aspen’s products.

How Does Aspen Use and Disclose Data?

Aspen may use the personal data that you submit to Aspen in connection with the above-stated purposes and Aspen may use the data to respond to your requests; improve Aspen’s level of service and the content of the Aspen websites; provide you with tips, helpful information, product news and updates; notify you of new Aspen products and services (where you have agreed to this); seek your views on Aspen products and services; consider your application for employment; and for Aspen’s own administrative and quality assurance purposes. Aspen may also allow that data to be given to third parties (such as service providers as further specified below). You can opt out of receiving marketing materials by writing to Aspen at the below address or following any instructions to unsubscribe to one of Aspen’s marketing emails. Aspen may disclose personal data (other than sensitive data) to its suppliers, contractors, agents or partners:

• to meet the purpose for which it was submitted; or
• for the purpose of processing and delivering your request (e.g. providing products or services); or
• if Aspen is required or authorised by law to disclose the data.

Aspen may also disclose your personal data to distributors of Aspen’s products and services, as well as service providers and subcontractors retained to perform functions on Aspen’s behalf or to provide services to Aspen, such as warehousing and delivery; marketing and advertising; website hosting and management; information technology; legal; accounting; audit and other professional service providers. All service providers and subcontractors that act on Aspen’s behalf are contractually obligated that they do not collect, use or disclose the personal data for any purpose other than to perform such functions on Aspen’s behalf or to provide services to Aspen or as otherwise required by law. Aspen may also disclose this data to its affiliated companies under the principles set out above.

Aspen Pharmacare Holdings Limited (Rev 27/09/2018) Page 3

Aspen is subject to mandatory reporting requirements and may disclose sensitive data to regulatory authorities, overseas affiliates of Aspen and/or third parties managing or requiring oversight of such reporting on Aspen's behalf and as required by law. You should note that your data may be processed in countries with lower data protection standards than your country of residence. Subject to applicable laws, by using and/or interacting with the Aspen websites, you consent to any transfer, processing or storing of data outside your country of residence. Aspen will ensure that if data is transferred outside your country of residence, it will still be treated in accordance with this statement.

Access, Correction and Security

Aspen is committed to using commercially reasonable means to ensure that your personally identifiable data is protected appropriately and according to the nature and sensitivity of the data. Aspen uses a variety of security technologies and procedures to help protect your personally identifiable data from unauthorized access, interference, misuse, loss, modification, or disclosure. Unfortunately, the security of data transmitted via the internet cannot be fully guaranteed. Whilst every effort is made to protect your personally identifiable data, Aspen cannot guarantee the security of the personally identifiable data you transmit to the Aspen websites via the internet and any transmission is at your own risk. While Aspen cannot guarantee that loss, misuse or alteration to data will not occur during internet transmission, once Aspen has received your data, Aspen makes commercially reasonable efforts to prevent such unfortunate occurrences.

You can access and request correction of any personal data concerning you at any time. You may also request that Aspen deletes your personal data at any time. Any such requests should be made directly by contacting Aspen (see below for details). Please note that there are some exceptions to your right to gain access to your data, including (but not limited to) where:

• providing access would have an unreasonable impact upon the privacy of other individuals; or
• the request for access is frivolous or vexatious; or
• the data relates to existing or anticipated legal proceedings between you and Aspen, and the data would not be accessible by the process of discovery in those proceedings; or
• providing access would be unlawful.

Subject to applicable laws, Aspen may charge a fee for reasonable costs incurred in providing such access, and will advise of the amount of the fee before access is provided.

Aspen Pharmacare Holdings Limited (Rev 27/09/2018) Page 4

Retention Period

We keep your personal data for as long as it is necessary to do so to fulfil the purposes
for which it was collected. The criteria we use to determine data retention periods for personal data includes the following: (i) Retention in case of queries. We will retain it for a reasonable period after the relationship between us has ceased (up to 6 months) in case of queries from you; (ii) Retention in case of claims. We will retain it for the period in which you might legally bring claims against us; (iii) Retention in accordance with legal and regulatory requirements. We will consider whether we need to retain it after the period described in (ii) because of a legal or regulatory requirement. Clickstream Data Each time you visit the Aspen websites the Aspen server may, subject to applicable laws, collect specific, anonymous data, known as click-stream data. Data collected may include the type of browser and system you are using, the address of the site you have come from and move to after your visit, the date and time of your visit, and your server's IP address. Aspen may collect this data for statistical purposes to find out how the Aspen websites are used and navigated. Aspen may use this data to evaluate and improve the Aspen websites’ performance or to identify individuals who may threaten the security or integrity of the Aspen websites. Cookies Subject to applicable laws, cookies may be used by Aspen websites. A cookie is a piece of data that Aspen’s web server may send to your machine when you visit the Aspen websites. The cookie is stored on your machine, but does not identify you or give Aspen any data about your computer.

A cookie helps Aspen to recognise you when you re-visit the Aspen websites and to co-ordinate your access to different pages on the Aspen websites. Aspen uses cookies to learn more about the way you interact with the content and help Aspen improve your experience of using the Aspen websites. With most internet browsers, you can erase cookies from your computer hard drive, block all cookies, or receive a warning before a cookie is stored. If you want to do this, refer to your browser instructions or help screen to learn more. If you reject the use of cookies, you will still be able to access the Aspen websites but please note that your use of the websites may not be optimized as much as if cookies were enabled.

Aspen Pharmacare Holdings Limited (Rev 27/09/2018) Page 5

Links to Other Sites

Aspen may provide links to other sites on its websites. If you use these links, you will leave the Aspen website. Aspen is not responsible or accountable for any of these sites, their content or their usage of your personal data. It is advisable that you check the privacy policies on those sites. Contact Us Please contact us if you have a complaint regarding Aspen's compliance with this statement or any applicable data protection laws. Aspen will consider and respond to a complaint within a reasonable time frame. In addition, please contact us if you:

• wish to discuss any privacy issues;
• have any concerns regarding your personal data;
• do not wish to receive any future communications from Aspen.

Aspen Pharmacare Holdings Limited
c/o The Information Officer
E-mail address: This email address is being protected from spambots. You need JavaScript enabled to view it.