Privacy Policy

Like many other companies, we may collect and use personal data. In this privacy notice, we explain:

• the purposes for which we collect and use your personal data;
• the categories of personal data we collect for these purposes, and how we collect them.

We also inform you of your rights regarding the personal data we collect and what you can do to exercise them.

If this notice does not answer all your questions, please feel free to contact us using the details provided.

1. INTRODUCTION

We are committed to protecting your privacy. When you use our websites, we collect certain information that can be used to identify you (“personal data”).

This notice explains how we use the personal data we collect when you use our website. It also informs you of your rights regarding your personal data.

2. CATEGORIES OF PERSONAL
DATA COLLECTED

We may collect the following types of personal data when you use our website:

• Contact details: information that enables us to contact you, such as your name, address, phone numbers, email addresses, and usernames.
• Identification data, civil status: information that helps us identify you more precisely, such as your gender, nationality, and date of birth.
• Personal data included in reports or notifications you send us: for example, if you provide us with information regarding our products and services via our website (such as by submitting a form to report suspected adverse drug reactions), we will collect all personal data contained therein.
• Employment information: if you apply for a position with us, we will collect information such as your professional background, references, and any other material you include in your application form or attached documents such as CVs.
• Records of our interactions with you: if you contact us through the website (by email, phone, or online form), we may keep a record of the information you provide.
• How you use our website: we collect information on the pages you visit and how you interact with them.
• Photos, videos, and testimonials: our website may contain visual and audio recordings relating to our employees or professionals in our sector. Publication of such data is based on the specific consent of the persons concerned. Any reuse of such data is prohibited and undertaken under your sole responsibility.

3. HOW DO WE COLLECT
YOUR PERSONAL DATA?

We collect personal data from a number of sources, including:

• Directly from you: e.g., when you create an account, purchase products or services, complete our forms, submit reports or requests, respond to surveys, or contact us by phone, email, or otherwise.
• Via our website: information about how you use our site.

In all cases, you will receive a specific information notice. Unless otherwise stated, the information we request is optional. Use of the website does not require you to actively provide your personal data. You can therefore browse freely without providing personal data. Non-provision of data has no effect, except in specific cases where you will be informed beforehand.

4. HOW AND WHY DO WE USE YOUR PERSONAL DATA?

We collect and use your personal data for the purposes described in the following table. For further details, please consult the relevant data processing notice.

• Consent: if you have consented to the collection and use of your personal data in specific cases. This may include, for example, obtaining your prior agreement to send you marketing communications.
• Contract: if we need to use your personal data to enter into a contract with you. For example, if we conclude a contract to provide you with our products or services.
• Legal obligation: if we must comply with a legal obligation. For example, when we are legally required to report an adverse event potentially involving our medicines.
• Legitimate interests: if we use your personal data for our legitimate interests (or those of third parties) without overriding your interests and fundamental rights. This includes carefully considered and specific objectives that enable us to improve our services for the benefit of our clients and end customers. Our legitimate interests also include evaluating the performance and safety of our products and meeting our industrial and regulatory obligations.
• Public interest: if your personal data is required for reasons of public interest, for example to protect you against serious health threats and to ensure high standards for our medicines and related care.

5. DATA SECURITY

We use appropriate security measures to prevent accidental loss, unauthorized use, access, modification, or disclosure of your personal data. Access is restricted to employees and service providers who need it for their role.

Procedures are in place to respond to suspected data breaches, and we will notify you and relevant authorities as legally required.

6. DATA RETENTION

We will retain your personal data only for as long as necessary to fulfill the purposes for which we collected it, including compliance with legal or reporting obligations.

To determine the appropriate retention period for personal data, we take into account the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, possible alternative means of achieving those purposes, and applicable legal requirements.

Details of the retention periods for our various processing activities can be found in the “retention period” column of the summary table of purposes presented in Section 4 of this notice.

In certain circumstances, we may anonymize your personal data so that it can no longer be associated with you. In such cases, we may use this information without limitation of time.

7. WHO HAS ACCESS TO YOUR PERSONAL DATA?

We may disclose your personal information:

• to our staff – our staff may access your personal data only where necessary for the performance of their professional duties.
• to group companies – for the purpose of providing you with services.
• to other service providers and consultants – such as companies that support our IT services, help us analyze collected data, process payments, send communications to our clients, provide legal or financial advice, and assist us in delivering our services.
• to government and regulatory authorities – where we are legally required to do so or in order to assist them in their investigations or actions. These parties use personal data for their own purposes and under their own data protection policies.

We do not disclose any personal information except in the cases mentioned above, or where we are legally required to do so, or where disclosure is necessary to assist with investigations and crime prevention. We may provide statistical information and analyses to other third parties, but we ensure that such information is aggregated and that no individual can be identified before it is shared.

8. DO WE TRANSFER YOUR DATA
OUTSIDE EUROPE?

We may transfer your personal data to third parties and other companies within our group located outside France. In order to process your personal data for the purposes set out in this notice, we may transfer your personal data to third parties or group companies established outside the EU and the EEA (“Europe”).

To ensure the security of your personal data, we only transfer your information to countries outside Europe in accordance with the General Data Protection Regulation (“GDPR”). This requires the application of one of the following conditions:

• The European Commission has decided that the country provides an adequate level of protection for your personal data (in accordance with Article 45 of the GDPR). For example, your data may be transferred to Switzerland. Switzerland is considered to provide an adequate level of protection for personal data by decision of the European Commission dated 26/07/2000.
• The transfer is subject to legally binding and enforceable safeguards by the recipient to protect personal data (in accordance with Article 46 of the GDPR).
• The transfer is subject to binding corporate rules (in accordance with Article 47 of the GDPR).
• The transfer is based on a GDPR derogation for transfers of personal data outside the EU (in accordance with Article 49).

Where applicable, you will be provided with a specific information notice.

9. YOUR RIGHTS

Under certain conditions, you have the right to:

• request access to your personal data.
• request the rectification of personal data we hold about you. This allows you to have incomplete or inaccurate personal data corrected.
• request the deletion of your personal data. You may ask us to delete personal data where further processing is no longer justified. You also have the right to request deletion of your personal data where you have exercised your right to object to processing (see below).
• object to the processing of your personal data, even when based on our legitimate interest (or that of a third party), where something in your particular situation gives you reason to do so. You may also object to receiving direct marketing. If your objection does not relate to marketing, we may refuse your request on the grounds that:
  • there are compelling legitimate grounds for processing the data, or the data is necessary for the establishment, exercise, or defense of legal claims;
  • you previously gave consent, in which case you must withdraw that consent rather than object;
  • you are bound by a contract with us;
  • we are under a legal obligation to process your data.
• request the restriction of processing of your personal data. This allows you to ask us to suspend the processing of your personal data in certain circumstances, for example, while verifying its accuracy.
• request that we transfer the personal data you have provided to us to you or to another party. This right to data portability applies only where you have consented to the use of your personal data, or where processing is based on a contract with you.
• request not to be subject to automated decision-making. We only use automated decision-making and profiling in very limited circumstances for our online activities.
• define instructions regarding the handling of your personal data after your death.

We will always strive to help you exercise your rights. However, we may refuse a request on legal grounds.

We will review your request promptly and respond within one month of receipt. We may extend this period by two months if necessary to respond appropriately (for example, if the request is complex). The reasons for any extension will be communicated to you.

If we decide not to act on your request, we will inform you of the reasons.

If you disagree with a decision regarding your rights as a data subject, or if you believe we are violating data protection provisions in Europe, you have the right to lodge a complaint with the data protection authority.

10. DIRECT MARKETING

We may provide you with information about our products and services by mail, by telephone, or by electronic means, based on your consent and according to the preferences you indicate when we collect your personal data. You may withdraw your consent at any time by using the options provided in our communications or by contacting us using the details set out at the end of this notice.

11. COOKIES

What is a cookie?

A cookie is a small text file that requests permission to be placed on your computer’s hard drive by the websites you visit. They are widely used to make websites function more efficiently. Some of these cookies are necessary for the website to operate. Others are used to identify you and, depending on your browsing behavior, help our teams improve the website.

Are cookies placed when you browse the website?

Marie Antoinette Agency has chosen to use the Google Analytics solution. These analytical, statistical, or audience measurement cookies allow us to understand how the website is used, evaluate its performance, and improve its operation for our visitors. For example, they make it possible to compile statistics and traffic volumes and analyze the use of the various elements of the site (sections and content visited, user paths), in order to enhance the site’s relevance and usability.

The cookies used are as follows:

Please note that if you use an ad blocker in your browser, data collection is disabled by default.

12. CONTACT

If you have any questions about how we process your personal data, or if you wish to exercise one of your rights, you may contact us or our Data Protection Officer at the following address: hello@marie-antoinette.fr

13. UPDATES TO THIS NOTICE

We may update this notice from time to time to reflect changes in the way we process personal data (for example, if we implement new systems or procedures that involve new uses of personal data) or to clarify the information contained in this notice. Any updates will be made in accordance with applicable data protection laws.

We encourage you to review this notice periodically. Where required by law, we will inform you directly of any changes to this notice or to the way we use your personal data.

Last updated: September 2025