PRIVACY POLICY

1. Who We Are

CDI Laboratories Inc. (“we” “us” or “our”) is committed to protecting and respecting your privacy. This Notice (together with our website Terms and Conditions and any other documents referred to on it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be used by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

For the purpose of all relevant legislation (the “Data Protection Laws”), including but not limited to the EU & UK General Data Protection Regulation, the Controller and entity responsible for the compliant processing of the personal data you provide is CDI Laboratories Inc., 12 W Mendez Vigo Avenue, Mayaguez, Puerto Rico USA 00680.

2. Personal Data Processing

We collect and process personal data about you when providing our core services. Please see below for the further details on the personal data we collect and the lawful bases we rely on to process this information:

Purpose	Personal Data	Lawful Basis	Source
To subscribe to any of our services, post material or respond to a request further service on our website.	Name, Address, Contact Details	Legitimate interests to provide updates to customers	From you
To answer your inquiry or request, or to notify you of any changes to our service.	Name, Address, Contact Details	Legitimate interests to act and respond to Inquiries or, where applicable, in the course of performance of a contract we have with you	From you
To record and respond to when a problem is reported with our website.	Name, Email Address	Legitimate business interests in ensuring that we provide you with a functioning website	From you
To undertake surveys that we use for research purposes.	Name, Address, Contact Details, Survey Responses	Legitimate interest of ensuring we can improve the services we provide to you	From you
To carry out transactions through our website and the fulfilment of the related orders.	Name, Address, Contact Details, Financial Details	Legitimate interest of providing our customer service to you	From you
Track visits to our websites and the resources accessed to understand the products or services of interest.	IP Address	Consent	From you or via Cookies
Assess suitability for job roles based on the information provided in response to the Careers page or the Product Co-Development and Licensing section on our website.	Name, Email, Address, Contact Details, CV	Legitimate business interests to consider you as a candidate for employment with us	From you
Marketing and publicity or to provide you with information about goods and services which may be of interest to you.	Name, Address, Contact Details	Consent i.e. via subscribing to marketing messages; If you wish to withdraw your consent to marketing, you can email us at [email protected]	From you

3. Disclosure of Your Information

We may disclose your personal data to any member of our group, which means our subsidiaries, our ultimate holding company, and its subsidiaries. We may also disclose your personal data to our employees and third parties such as our officers, agents, suppliers, or subcontractors as far as it is reasonably necessary for the purposes as set out in this Privacy Notice, for example:

• if we engage with a supplier to support in us providing our services to you, we may share your personal data where relevant to the services being provided;
• if we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;
• if CDI Laboratories Inc. is (or substantially all of its assets are) acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets;
• if we are under a duty to disclose or share your personal data to comply with any legal obligation, or to enforce or apply our website terms and conditions of supply and other agreements; or
• to protect the rights, property, or safety of CDI Laboratories Inc., our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction which is part of our proper business function.

Where we use a third party to process personal data on our behalf, we ensure that these third parties sufficiently comply with relevant Data Protection Laws, including in relation to international data transfers and where relevant enter into a written contract to ensure they fulfil these obligations.

4. How Long We Hold You Information For

We will only hold your information for as long as is necessary for the purpose we have collected it for, plus a period to allow us to deal with any follow up issues that may arise.

Typically, where we provide services to you, or you purchase goods from us, we will hold your information for the duration of our engagement or until the goods are received by you, and for a period of 6 years after the date that those goods or services are no longer offered by us to enable us to deal with any payment or follow up issues that may arise.

5. Where We Store Your Personal Data

Your personal data may be transmitted through, stored, or processed in countries, states, or provinces other than where you are based, in which case the information is bound by the laws of those jurisdictions and may be disclosed in accordance with those laws. We will take measures to protect your personal data with appropriate contract clauses or other applicable safeguards.

6. Automated Decision Making and Profiling

Automated decisions are where a computer decides about you without a person being involved. Profiling is the automated analysis of a person's personality, behaviour, or interest to make predictions of decisions about them.

CDI Laboratories Inc. do not undertake any automated decision making or profiling activity.

7. Your Rights

In most cases, Data Protection Laws enable you to exercise legal rights against entities that process their personal data. The following rights are afforded based on the location in which you are based:

• Right to be Informed: We will inform you before collecting your data if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You also have the right to request this information from us at any time.
• Right to Rectification or Correction: We are obliged to ensure that the information we hold about you is accurate and up to date. You have a right to ensure that any inaccuracies in your personal data are corrected or removed by us. We will promptly correct any information found to be incorrect.
• Right of Access and Portability: You can ask us to confirm if we are using any of your personal data, to give you a description of the data we are processing and/or to send you a copy of it. Where applicable, you also have the right to require us to provide your personal data to you or another service provider in a portable format.
• Right to Erasure: We are obliged to consider any request you have to erase the personal data we hold about you and respond to confirm if completed or provide reasons for retaining your personal data.
• Right to Object or Withdraw Consent: Where we have stated that we may use your personal data based on ‘our legitimate interests,’ you have a right to object to us processing your information on this basis. For certain purposes such as Marketing and Publicity stated above, we may request your consent to process the personal data. You have the right to withdraw your consent for these purposes or sharing the data with third parties at any time by using the contact details provided.
• Right to Restriction of Processing: You have the right to request for us to restrict processing of your personal data in circumstances dictated by relevant Data Protection Laws.

To exercise any of the above rights, please see the contact details listed below. You can also request the right to access information at any time by writing to: CDI Laboratories Inc., Request for information, P.O. Box 569, Mayaguez, PR 00681-0569.

We will try our best to deal with any complaints or requests directly, but where you are unsatisfied with the response you have the right to raise any concerns about the way in which we handle your personal data with the Federal Trade Commission (FTC) or relevant data protection Supervisory Authority in the jurisdiction in which you are located.

• US - Federal Trade Commission
• Canada - Office of the Privacy Commission of Canada
• UK - Information Commissioner’s Office

8. Cookies and Links to Other Websites

We may obtain information about your general internet usage by using a cookie file which is stored on the hard drive of your computer. Cookies contain information that is transferred to your computer’s hard drive. You cand find further information in our cookie policy.

Our website may, from time to time, contain links to and from the website of advertisers, affiliates and relevant third parties. If you follow a link to any of these websites, please note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites, and such sites are not governed by this Privacy Notice. Please exercise caution and check the privacy policies applicable to the websites in question before you submit any personal data.

9. Additional Information for US Residents

If you reside in the US, this section supplements the information contained in the Privacy Policy. US residents have specific rights regarding their personal information which are set out in Applicable Data Privacy Legislation including but not limited to:

The California Consumer Privacy Act (“CCPA”) became effective on January 1, 2020, and is supplemented by the California Privacy Rights Act (“CPRA”) which became effective on January 1, 2023 (applicable to personal data collected from January 1, 2022) and created a variety of privacy rights for California consumers. Additionally, Virginia (effective January 1, 2023), Colorado (effective July 1, 2023), Connecticut (July 1, 2023), and Utah (December 31, 2023) have passed laws extending similar privacy rights to their consumers.

Please note that in the preceding twelve (12) months, we have not sold your personal information.

We may disclose certain personal information, such as your first and last name, email address, job title/position, and other similar contact data, financial information, and employment details with our subsidiaries and affiliates and other third parties, including service providers who provide Services on behalf of CDI Laboratories Inc. When personal information is disclosed to a subsidiary, affiliate or other third party the recipient entity will be obligated to provide the same level of privacy protection required under Applicable Data Privacy Legislation.

You have the following Rights in relation to the processing of your personal data.

• Notice of and Access to personal information - A right to notice of and access to certain information about our collection and use of your information.
• Correction of personal information - A right to ask for inaccurate personal information be to be corrected.
• Deletion of personal information - A right to ask that we delete your personal information relating to you, subject to certain exceptions.
• Objection to the sale of or sharing of personal information - A right to ask for your personal information to not be sold or shared with a third party, subject to certain exceptions.
• To transmit personal information to another entity - A right to ask for your personal information to be transferred, in a readily useable format, to another entity.

None of these rights are absolute and there may be circumstances in which we are required or permitted under applicable law not to address your request.

Only you or an authorized agent (that you authorize to act on your behalf), may make a verifiable request related to your personal information.

Any verifiable request (including those to delete data) must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative (such as by requiring you to provide a signed written authorization that the agent is authorized to make a request on your behalf).
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

You may exercise your rights under Applicable Data Privacy Legislation by contacting us by the means described in the ‘Contacting Us’ section of this policy.

10. Changes to Our Privacy Policy

This privacy notice was last updated in August 2024. Any changes we may make to our Privacy Notice in the future will be posted on this page. You should check this page occasionally to ensure that you are happy with any changes.

11. Contact Us

Questions, complaints, comments and requests regarding this Privacy Notice or our treatment of your personal data are welcomed and should be sent to [email protected] or alternatively you can contact us by telephone at +1 939-280-5293.