Privacy notice

DRAFT — 7 September 2026. Before publication, verify the public email address, any appointed data protection officer, hosting and Google contract/transfer arrangements, actual log and backup retention, and the legal basis and consent controls for reCAPTCHA. This draft does not certify those arrangements. PRIVACY NOTICE 1. Who is responsible? LAGOM PHARMATECH GmbH, Brunnwartsweg 6, 82031 Grünwald, Germany, represented by managing director Petr Svoboda, is responsible for processing personal data on this website and in the associated customer portal. For privacy questions and requests, contact info@lagom-pharmatech.de or write to the address above. 2. Website access and essential functions When you access the website, our hosting systems process connection data such as your IP address, request time, requested page, response status and browser information to deliver the website, investigate faults and prevent attacks. The legal basis is our legitimate interest in a secure, functioning website (Article 6(1)(f) GDPR). Odoo uses cookies and similar storage for functions such as sessions, authentication and privacy preferences. Storage strictly necessary for a service you request is covered by section 25(2) TDDDG. Other device storage/access requires consent under section 25(1) TDDDG unless a statutory exception applies. Disabling necessary cookies can prevent login or other requested functions from working. Google Analytics and Plausible analytics are not currently enabled. 3. Inquiries and contact The inquiry form processes your name, email address, selected inquiry type and message, plus the company/pharmacy and pharmacy number if supplied. We store these details in our Odoo CRM and use them to assign, process and answer your inquiry. Required fields are needed to submit the form; other details are optional. Do not include patient information, diagnoses or prescriptions. For inquiries submitted with the form checkbox, we rely on your consent (Article 6(1)(a) GDPR). We record the checkbox wording, version, language and acceptance time as evidence. You can withdraw consent at any time by emailing the address above, with effect for the future. Earlier processing remains lawful. You can also contact us directly by email or post without using the form. Where communication concerns a contract with you or steps you request before a contract, Article 6(1)(b) GDPR applies. For communication with representatives of business customers, our legitimate interest in handling business inquiries and relationships is the basis under Article 6(1)(f) GDPR. Submitting an inquiry does not subscribe you to advertising or a newsletter. 4. Professional access and orders For customer accounts, professional eligibility checks and orders, we process contact and company details, access credentials, eligibility information, billing/delivery details and transaction records as required for the service. The bases are Article 6(1)(b) GDPR for contracts with you, Article 6(1)(f) for business contact administration and security, and Article 6(1)(c) for applicable commercial, tax and pharmaceutical obligations. Required information is needed to verify access or fulfil an order. Access checks do not constitute medical advice. 5. Abuse prevention and Google reCAPTCHA The inquiry form uses technical checks and request limits. It temporarily stores keyed fingerprints of network address and email, together with form and timing information, to prevent spam and duplicate submissions. These fingerprints are pseudonymous, not anonymous. This serves our legitimate interest in security (Article 6(1)(f) GDPR). Google reCAPTCHA is also enabled in the site's Odoo configuration for protected interactions, including login where invoked. It can transmit IP address, browser/device and interaction information to Google and use cookies to assess automated activity. Its security purpose must be assessed under Article 6(1)(f) GDPR; any device access that is not strictly necessary requires prior consent under section 25(1) TDDDG and the corresponding processing basis under Article 6(1)(a) GDPR. The inquiry checkbox does not give consent to reCAPTCHA. Google information: https://policies.google.com/privacy and https://cloud.google.com/recaptcha/docs/faq 6. Recipients and international processing Authorised staff handle inquiries and orders. Service providers support hosting, system maintenance and email delivery. This Odoo instance is managed through Cloudpepper BV, Belgium, with the selected server region Frankfurt, Germany. Outgoing email uses Google Gmail. Email content and recipient details are therefore processed by Google. Business transactions may also require disclosure to delivery providers, banks, advisers or authorities, limited to their respective tasks. Provider access or processing outside the EEA, including in the USA, may occur. The applicable Google contracting entity, subprocessors and transfer safeguards must be confirmed for the services actually contracted before this notice is released. Cloudpepper describes its processor and transfer terms at https://cloudpepper.io/gdpr-data-processing-agreement/; Google publishes its Cloud Data Processing Addendum at https://cloud.google.com/terms/data-processing-addendum/. These provider terms must be matched to the account and contract in use; their publication alone is not a verification of this site's arrangements. 7. Retention Inquiry and account data are retained for the time needed to handle the inquiry or business relationship. Once that purpose ends, deletion is subject to applicable recordkeeping duties and the need to establish, exercise or defend legal claims. Consent evidence is kept only as needed to demonstrate the relevant processing. Technical inquiry guard records are scheduled for daily cleanup once their expiry is more than two days old; this does not delete CRM inquiries. Server logs, mailbox copies and any backups have separate retention settings, which must be verified before publication. A withdrawal does not remove records that must be retained on another lawful basis. 8. Your rights Subject to the statutory conditions, you may request access, correction, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your situation. You may withdraw consent at any time. Contact us using the details in section 1. You may complain to a supervisory authority, including at your habitual residence or place of work. Our local authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany: https://www.lda.bayern.de/de/beschwerde.html 9. Updates We update this notice when the website, services or processing practices change. Notice version: 2026-09-07-v1. Inquiry consent version: contact-2026-09-07-v1.