Preamble

The present Personal Data Protection Policy (hereinafter the “Policy”) is adopted by the company under the trade name “HVD Life Sciences”, its group companies, particularly HVD Vertriebs-Gesellschaft m.b.H., and all related corporate bodies (including without limitation its branch offices) (hereinafter collectively “HVD” or “our Company” or “our” or “we”). Our Company is a marketing and distribution company which is mainly engaged in the resale of multi-vendor laboratory equipment and specializes in sourcing, supplying and supporting life science solutions. We also provide relevant technical services to our customers relating to the equipment, specializing in preventive maintenance and repair services.

Our Company uses its best efforts to provide high quality services to its customers globally and empower them to accomplish scientific advancements by providing high quality products and expert support, enabled by strong and lasting partnerships with carefully selected manufacturers of innovative and industry-leading tools and technologies. We greatly appreciate our customers and partners as well as their trust to our Company and we take all necessary steps so that all the information they provide to us in order to receive our services is securely maintained.

This Policy sets out the way in which we use and protect the personal information (hereinafter the “Personal Data”) we collect from you or for you through our website, through written or oral communication with you (including by entering into agreements with you). This Policy also describes the way in which our Company collects, transfers, processes, uses and discloses your Personal Data and determines its policies regarding the secure processing of Personal Data.

By providing your Personal Data to us (either directly or by allowing another person to do so on your behalf) or by using any of our products or services and/or by agreeing to this Policy, e.g. in the context of registering for any of our products or services, you understand and acknowledge that this Policy shall apply to the way that we collect and use your Personal Data and you consent to HVD collecting, transferring, processing, using and disclosing your Personal Data, as detailed in this Policy. In case that you do not agree with any part of this Policy, you must not provide in any way your Personal Data. In such case or in case you withdraw a consent that you have given under this Policy, this may affect our ability to provide services to you or negatively impact the services we may provide to you.

This Policy does not in any way govern your relations in your capacity as customer of our Company or user of our website www.hvdlifesciences.com (hereinafter the “Website”) with other companies that are not subject to the control or owned by us.

Please note that this Policy has been designed in accordance with the statutory provisions of the General Data Protection Regulation of the European Union (Regulation 2016/679) (hereinafter “GDPR”) which has entered in force on May 25, 2018.

Collection – Use – Purposes of Processing of your Personal Data

Α. We collect Personal Data at each point of contact or interaction with you as well as in the general course of our business operations, in particular, our Company may collect your Personal Data in the following cases:

(i) when using the services of our Website or by completing the relevant contact form or when attending an event or function or having chosen to receive advertising/informative/promotional programs from our Company (hereinafter the “Newsletters”);

(ii) when using our Company’s services (e.g. purchase of products, use of maintenance/repair or other relevant services);

(iii) by entering into and performing an agreement with our Company;

(iv) when contacting our Company through our Website or via other written or verbal communication channels;

(v) through third parties cooperating with our Company, where necessary in the context of our business operations and for the purpose of providing our services to our customers (e.g. public organizations, etc.).

Β. In the above-mentioned context, our Company may collect, store and use the following types of Personal Data:

General Contact Data

(i) information you may provide when contacting our Company (e.g. by completing the relevant contact form on our Website), attending an event or otherwise using our services;

(ii) any other information you may choose to disclose to us (either through our Website or otherwise) which is pertinent to the fulfillment of your personal requests within the scope of our business activities;

Contractual and Transaction Data

(i) any information you may disclose in the context of entering into or performing an agreement with our Company;

(ii) information received from third parties (e.g. public organizations) in the context of cooperation and the provision of services.

Specific Transaction Data

(i) Personal Details (e.g. Name, Surname, Contact Address, Contact Number, E-mail address);

(ii) Financial Data (e.g. Bank Account Number, Credit Card Information);

(iii) Employment Data (e.g. employment, position / title, employment location).

sensitive data

The term “sensitive data” refers to information related to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life, or sexual orientation, genetic information, criminal background, and any biometric data used for the unique identification.

We do not generally collect or process sensitive data. Exceptions apply only if:

(i) You have voluntarily and explicitly provided such data for a specific purpose, and you have given your explicit consent;

(ii) The processing is necessary to comply with legal or regulatory obligations; or

(iii) The processing of health- related data is required to provide or tailor our services to your needs in which case your explicit consent will be requested in advance.

In all such cases, processing will be carried out strictly in accordance with applicable data protection laws and subject to appropriate safeguards to ensure the protection of your fundamental rights and freedoms.

Use and Purposes of Processing of Your Personal Data

We use your Personal Data only for specific, explicit and legitimate purposes and in accordance with the applicable data protection data, more specifically. We may use and process your Personal Data to provide and personalize the services you request and expect from us, to offer you high quality products and the expected expert level of services, conduct direct marketing etc. as set forth below in more details. We collect your consent prior to processing your Personal Data where required by applicable law. We may use and process your Personal Data for the following purposes:

(i) in order to provide you the services requested and fulfill your requests regarding the services provided by our Company;

(ii) where permitted by law and in line with your communication preferences, to provide you with Newsletters, promotions, specific offers, and other marketing messages via e-mails or other channels to inform you about the services provided and new offers/categories of products/services;

(iii) where permitted, to create individual or group profiles based on your habits and preferences in order to provide personalized offers and services;

(iv) to answer questions and requests you may address to us;

(v) for internal purposes of our Company and in order to secure the quality of services provided;

(vi) for our Company’s proper execution/performance of a concluded agreement;

(vii) for other purposes as provided or required by law (e.g. our Company’s compliance with its legal obligations or for the protection of its or your vital interests or in cases where the processing is necessary to defend our legal rights or establish, exercise, defend and execute our legal claims).

Protection of Personal Data of Data Subjects

Our Company applies appropriate legal and takes organizational and technical measures to ensure the protection of your Personal Data in compliance with applicable privacy and data protection laws. These measures are designed to safeguard Personal Data against accidental and unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.

Our security measures include, among others:

(i) access restrictions to Personal Data on a strictly need-to-know basis;

(ii) secure storage systems and encryption technologies where appropriate;

(iii) procedures for regular testing, assessment, and evaluation of the effectiveness of technical and organizational measures;

(iv) staff awareness and confidentiality obligations for employees handling Personal Data.

We require our affiliates, partners, and service providers with whom we share Personal Data to implement adequate safeguards and enter into data processing agreements, thereby ensuring that they process such data only under our instructions and in compliance with the same standards of confidentiality and security.

Our Company also takes reasonable steps to ensure that your Personal Data is accurate, kept up to date where necessary, and retained securely only for as long as required for the purposes described in this Policy or as required by law.

‍

Retaining Personal Data

Our Company retains your Personal Data only for the period necessary to fulfill the purposes outlined in this Policy, unless a longer retention period is required or permitted by applicable law.

We will delete or anonymized your Personal Data once we no longer need it for the provision of our services and/or for our business purposes and/or for the performance of a contract we have entered into and/or for legal purposes, or as otherwise required by the applicable legislation for the protection of your Personal Data from time to time.

We will destroy your Personal Data as set above as early as practicable and in a secure manner that prevent recovery or reconstruction. If printed on paper, Personal Data will be securely shredded or incinerated. If stored electronically, data will be destroyed using appropriated technical methods to ensure that it cannot be restored or reconstructed at a later time.

Common Use – Disclosure of Personal Data to Third Parties

In order to provide you with our products and the best level of services at the expected level of quality, our Company may share your Personal Data with carefully selected affiliates, transport and courier companies, and other business partners where necessary for the fulfilment of contractual obligations.

Except as expressly provided in this Policy, our Company will not sell, rent, or otherwise disclose your Personal Data to third parties.

Disclosure of Personal Data to third parties takes place only under the following conditions:

(i) With your explicit consent: you have provided explicit written consent and (i) the third party has provided sufficient guarantees in respect of the technical and organizational measures governing the processing to be carried out and (ii) the third party has entered into a written contract with us which imposes on the third party obligations identical to those imposed on our Company under the provisions of Personal Data protection laws;

(ii) Legal obligations: it is required in order for our Company to comply with the respective legislation and only towards any competent tax authority, public prosecutor, police, criminal investigation and judicial authorities in response to their requests;

(ii) Legal proceedings: in connection with actual or potential legal proceedings, where disclosure is necessary to establish, exercice, or defend legal claims.

(iii) Justified interests: it is required for the purposes of establishing, exercising or defending the legal rights and legal interests of our Company – including information to regulatory, prosecution οr other authorities for the purposes of fraud prevention and anti-counterfeiting, unauthorized use and illegal activities.

Our Company will not transfer Personal Data to countries outside the European Union without your prior written consent except if pursuant to intragroup transfer agreements or the standard contractual clauses approved by the European Commission.

Your Rights

You have the following rights, as specified in the GDPR and the applicable national data protection laws, as well as binding directives and codes of practice issued from time to time by the respective supervisory authorities:

(a) The right to be informed and the right of access

You have the right to be informed about the processing of your Personal Data by our Company, including details about the purposes of processing, categories of data processed, recipients, storage periods, and your rights. You also have the right to access your Personal Data and to obtain a copy of your Personal Data undergoing processing.

(b) The right to rectification

You have the right to obtain without due delay the rectification or completion of your Personal Data, if your Personal Data are inaccurate or incomplete.

You have the right to request the erasure of your Personal Data. We shall satisfy your request where one of the following grounds applies:

(i) the Personal Data are no longer necessary in relation to the purposes for which they were collected;

(ii) you withdraw your consent and there is no other legal ground for the processing;

(iii) you exercise the right to object to the processing (see below (f)) and there are no overriding legitimate grounds for the processing;

(iv) your Personal Data have been unlawfully processed; and

(v) your Personal Data have to be erased in compliance with a legal obligation.

(d) The right to restrict processing

You have the right to request the restriction of processing of your Personal Data and we will satisfy your request where one of the following applies:

(i) you contest the accuracy of your Personal Data, for a period enabling us to verify the accuracy of your Personal Data;

(ii) the processing is unlawful and you oppose to the erasure of your Personal Data and request the restriction of their use instead;

(iii) you exercise the right to object to the processing (see below (f)) pending the verification from our Company whether the legitimate grounds for the processing override your interests, rights and freedoms.

(e) The right to data portability

You have the right to receive your Personal Data in a structured, commonly used and machine-readable format, as well as the right to request to have those data transmitted to you or another controller that proceed to their processing.

(f) The right to object

You have the right to object at any time to:

(i) the processing of your Personal Data by our Company for our legal interests or legal interests of third parties;

(ii) the processing of your Personal Data for direct marketing purposes;

(iii) the processing of your Personal Data for statistical purposes;

(iv) the processing of your Personal Data for automated decision making and profiling when such procedures produce legal effects or significantly affects you.

For any question you may have or in order to exercise all the above-mentioned rights you can contact our Company either (a) through the respective contact form in our Website or by sending e-mail to the following e-mail address dataprotection@hvdgmbh.com or (b) by sending a letter to the address set out in the end of this Policy.

You are also entitled to withdraw at any time the consent you have provided regarding the processing of your Personal Data (without retroactive effect) following one of the aforementioned ways.

Ιn case that you consider that any of your rights or any of our Company’s legal obligations with respect to the processing of your Personal Data is violated, you may lodge a complaint before the competent supervisory authority.

For our office in Austria:

Österreichische Datenschutzbehörde

Address: Wickenburggasse 8, 1080 Vienna

Contact Number: (0043) 1 521520

E-mail: dsb@dsb.gv.at

For our branch office in Greece:

Hellenic Data Protection Authority

Address: 1-3, Kifisias Avenue, 115 23 Athens

Contact Number: (0030) 210 6475600

Fax: (0030) 210 6475628

E-mail: contact@dpa.gr

For our branch office in Poland:

The Bureau of the Inspector General for the Protection of Personal Data (GIODO)

Address: ul. Stawki 2, 00193 Warsaw

Contact Number: (0048) 2253 10440

Fax: (0048) 2253 10441

E-mail: kancelaria@giodo.gov.pl

Links to other sites

Our Website may contain links to third party websites or include third party websites. Please note that this Policy does not apply to these websites and our Company is neither in any way responsible for the availability or the content of these sites nor controls, signs or bears responsibility for the collection, use, maintenance, common use or disclosure of your Personal Data from third parties.

We encourage you to procure in advance and always review the disclaimers and privacy policies published in each website or mobile application before disclosing any of your Personal Data.

Applicable Law

The processing and protection of Personal Data of the Data Subjects is governed by the terms of this clause, the provisions of GDPR and the applicable legislation which implements or supplements GDPR or otherwise is related to the processing of individuals’ Personal Data together with the binding directives and Codes of Practice issued from time to time from the respective supervisory authorities (see European Commission).

Amendments

We reserve the right to update this Policy from time to time and post the most up-to-date version on the Website at any time without announcement. If substantial changes have been made, our Company may post a relevant announcement relating to the amendments on the Website or inform you by sending a notification via e-mail. We encourage you to check the Website at regular intervals in order to verify whether there have been any amendments, as well as to review from time to time this Policy in order to keep informed about the way in which we process your Personal Data.

If you proceed with the use of our Website, you agree with this Policy and any updates. If you do not agree with the terms for the protection of Personal Data provided in this Policy you must not use our services.

Communication

If you have any questions about this Policy or the way we process your Personal Data, or if you wish to either provide a compliment or submit a complaint, you may address and contact us by sending a letter to our registered office address (Wurzbachgasse 18, P.O. Box 54, A-1152 Vienna, Austria) or via e-mail using the following e-mail address: dataprotection@hvdgmbh.com.

‍

This Policy was updated in December 2025.