Cookies and Privacy Policy

1. Which data do we process and for which purpose?

• What kind of data do we collect when you browse our website:1 Generally, we do not identify users who only browse our website. The browsing data we collect includes the name of your internet service provider, the website from which you access our website, the Merck website which you looked at, temporarily your full IP address and the date and duration of your visit.
• Providing you with services you requested: For the services on this website, we ask for information from you like your name and email address. We use your data to provide you access to services that you requested, namely use of the myMS companion questionnaire.2 After completing the questionnaire on this website, you can send the form by email to your healthcare team (‘send to my MS team’) or download the report to your local device. When you choose ‘send to my MS Team’, your default email client will open an email populated with sample text. Any data you include in this will be stored and shared as per your email client’s policies for the safeguarding transmission of data. Your MS Team will then use the data you share to prepare for your appointment and will in turn store and delete it within the timeframe outlined by their individual data privacy policies.
• Legal obligations and legal enforcement: In some cases we are under a legal obligation to process personal data. A typical example is the processing within the scope of the so-called pharmacovigilance, i.e. the obligation to investigate and share data when potential side effects of drugs become known.4 Where required, we can also use your data to enforce our or third party rights (such as copyrightinfringements).5
• General statistics, website security: We use browsing data of our users for creating aggregated statistics (so that statistics do not show data about a single user but only about the collected data of a number of users), to learn what is of interest to users in order to improve our websites and offering. We also use the browsing data for maintaining or restoring the security of our offer or to detect and correct technical defects and errors.6 We also collect data about the location of the devices accessing our website for statistical purposes (statistics from where visitors access our website, etc.); you can control the authorization for this using the browser settings.7

2. Cookies and Tracking

• Cookies: We use cookies in order to enable and facilitate the use of the website, for example to optimize the presentation or display of country-specific content (such as in your national language).8 You can disable or block cookies in your browser software; however, this may result in restrictions regarding the usability of this website. In addition to cookies, we also use other web technologies such as pixel tags, web beacons or clear GIFs (hereinafter also referred to as "cookies") for these purposes.

Further Information:

• "Cookies" are small text files that enable our website(s) to store information on your computer and retrieve it later (e.g. when you visit our website again later). The use of cookies, for example, enables our websites to "remember" the language in which we are allowed to present our content to you.
• A distinction is made between required cookies, i.e. cookies that are necessary for technical reasons (e.g. in order to implement a login area) and analytical cookies, i.e. cookies that are used for the purpose of measuring the online audience (see GOOGLE ANALYTICS).
• Google Analytics: This website uses Google Analytics, a web analysis service provided by Google Inc. ("Google") to store "analytical cookies" on your device.9 This means that information about users and the use of our website is transmitted to Google and processed on our behalf for the purpose of compiling reports on website activity, measuring website visits and visitors and providing similar services for us. Thisincludes the transmission of your IP address, but it will not be merged with other Google data. In addition, it is shortened (usually within the European Union) and saved by Google only in an abridged form. For storage in the United States, Google's self-certification according to the Privacy Shield provides an appropriate level of data protection. You can object to the processing of your data for these purposes by installing a browser plugin and you can activate it by following this link: Google Analytics

The following information will be transmitted and processed: Information about the terminal devices used (e.g. operating system, device type, browser, screen resolution), about the origin of our users (for instance, language as well as city and country the user of the website is from and the website via which the user reached us, IP address) and the use of our websites (e.g. our Merck website which have been opened and the content accessed as well as the date and duration of the visit).

3. Recipients of personal data; data transfer to third countries

• Adverse events or enforcement of rights: If we become aware of potential cases of adverse reactions to one of our products, we are required by law to document and share the relevant information, including personal information with authorities worldwide and, where necessary for further assessment, to contact the reporting parties. In order to enforce our rights or to protect our rights or the rights of third parties with the holders of such rights, consultants and authorities.
• External service providers for data processing: We use service providers which support us to provide our services on this website. These service providers process data only in accordance with the instructions and under the control of Merck and exclusively for the purposes described in this privacy policy.

4. Data Retention

We store data for as long as necessary for the provision of the service requested by you. For example, when you subscribe to a newsletter we will store the associated data at least until you unsubscribe. Data which is collected while browsing our website and which can legally be considered personal data (such as the complete IP address) is stored for a period of time of 7–14 days, unless a reasonably justified incident indicates a longer storage period (e.g. due to a hacking attack). Data without any personal identifiable information may be stored permanently.

5. Data protection rights and contact

• General rights: You can request information about the data stored about you and have the right to receive the data provided by you in a common and machine-readable format. Furthermore, in justified cases, you may also request the deletion, correction or limitation of the processing of your data. If your personal data is transferred to a country outside the EU which does not provide appropriate protection, you can request a copy of the contract that implements the appropriate protection of personal data.
• Right to object: Furthermore, in justified cases you can object to the processing of personal data concerning you where we process your personal data based on our legitimate interest (this is the case if the legal basis is Art. 6 f) GDPR as indicated in the footnotes). This applies in particular to the collection of your data for statistical measurement of the web audience by Google Analytics or Adobe Analytics.
• Revocation of your consent: When you have given your consent to the processing of personal data concerning you on the website, you can revoke your consent at any time with effect for the future.
• Contact person: To exercise these rights, please contact our data protection officer Norbert Moeren,
  Corporate Privacy Officer, Merck KGaA, Phone: +49 6151 72 – 5167. Fax: +49 6151 72 – 915167.
  E-mail: privacy@merckgroup.com.