Common use of Data protection Clause in Contracts

Data protection. 11.1 In executing the contractual activities the Parties shall treat all the personal data they receive for any reason in relation to the Trial in accordance with the objectives of the foregoing articles and in conformity with the provisions of Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 (General Regulations for the Protection of Personal Data, hereinafter "GDPR"), and with the related provisions of law and orders of national administrations, including any subsequent amendments (collectively the “Data Protection Laws”). 11.2 The terms used in this article, in this Agreement, in the informed consent documents and in any other documents used for the purposes of the Trial shall be construed and utilised in accordance with the meanings given in Annex B. 11.3 The Entity and the Sponsor (or the CRO if the CRO manages every aspect of the Trial in place of the Sponsor, assuming the ownership of the related treatments) are independent data controllers for the purposes of article 4 paragraph 7 of the GDPR. (Omit the following paragraph if the CRO is managing every aspect of the Trial instead of the Sponsor, assuming the ownership of the related treatments). The CRO ____ is the Data Processor for the purposes of Article 28 GDPR in reference to the ownership of the Sponsor and/or the Entity. 11.4 For the purposes of the Trial, personal data relating to the following categories of data subject will be processed: persons taking part in the trial; persons operating on the Parties’ behalf. Such data subjects will be appropriately informed of the processing of their data. For the purposes of the Trial, the following types of personal data will be processed: the data referred to in article 4 paragraph 1 of the GDPR; data classified as “sensitive” – and in particular, data relating to health, sexual preferences and genetic data – referred to in Article 9 GDPR. Such data shall be processed in accordance with the principles of legality, fairness, transparency, adequacy, relevance and necessity as contained in Article 5 paragraph 1 of the GDPR. 11.5 The Sponsor may transmit the data to affiliates of the Promoter's group and to third parties operating on its behalf, even abroad, in countries outside the European Union that do not offer the same level of privacy protection guaranteed in Europe. In this case, the Sponsor undertakes that this transfer takes place only to countries considered safe by the European Commission or, in any case, according to one of the methods allowed by the Applicable Privacy Law, such as the consent of the interested party, the adoption of Standard Clauses. approved by the European Commission and the selection of subjects adhering to international programs for the free circulation of data (eg EU-USA Privacy Shield).. 11.6 The Parties warrant that the persons authorised by them to process personal data for the purposes of the Trial will comply with the principles in place to safeguard data protection and the right to confidentiality and that any persons having access to the personal data will be obligated to process the data in accordance with the instructions given, in accordance with this article, by the data controller. 11.7 The Principal Investigator has been identified by the Entity as a person authorised for the data processing for the purposes of Article 29 GDPR and as a designated party for the purposes of Article 2 of the Code. 11.8 The Principal Investigator shall provide clear, complete information, also on behalf of the Sponsor, before the Trial starts (also before the preliminary phases or screening), to all patients, regarding the nature, purpose, results, consequences, risks and methods of the processing of personal data; in particular, all patients must be informed that the national and international authorities and the Ethics Committee may, in connection with the monitoring, checking and control of the Trial, have access to the related documentation and also to the original healthcare records of the patient, and that the data may also be accessed by the monitors and auditors in connection with their respective duties. 11.9 After the patient has been duly informed the Principal Investigator shall obtain the consent form for participation in the Trial and also the consent to the processing of personal data. The Entity is responsible for keeping the consent forms. The Entity is responsible for keeping the consent form, not only to the participation in the Trial but also to the treatment of data, signed by each patient and referred to in the previous art. 3.6 11.10 If either Party discovers a data protection breach, the other Party shall be informed within 24 hours from the breach having been verified, without affecting the Party’s independent assessment of the existence of the conditions and fulfilment of the obligations contained in Articles 33 and 34 GDPR.

Data protection. 11.1 In executing the contractual activities the Parties shall treat all the personal data they receive for any reason in relation to the Trial in accordance with the objectives of the foregoing articles and in conformity with the provisions of Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 (General Regulations for the Protection of Personal Data, hereinafter "GDPR"), and with the related provisions of law and orders of national administrations, including any subsequent amendments (collectively the “Data Protection Laws”). 11.2 The terms used in this article, in this Agreement, in the informed consent documents and in any other documents used for the purposes of the Trial shall be construed and utilised in accordance with the meanings given in Annex B. 11.3 The Entity and the Sponsor (or the CRO if the CRO manages every aspect of the Trial in place of the Sponsor, assuming the ownership of the related treatments) are independent data controllers for the purposes of article 4 paragraph 7 17 of the GDPR. (Omit the following paragraph if the CRO is managing every aspect of the Trial instead of the Sponsor, assuming the ownership of the related treatments). The CRO ____ is the Data Processor for the purposes of Article 28 GDPR in reference to the ownership of the Sponsor and/or the Entity. 11.4 For the purposes of the Trial, personal data relating to the following categories of data subject will be processed: persons taking part in the trial; persons operating on the Parties’ behalf. Such data subjects will be appropriately informed of the processing of their data. For the purposes of the Trial, the following types of personal data will be processed: the data referred to in article 4 paragraph 1 of the GDPR; data classified as “sensitive” – and in particular, data relating to health, sexual preferences and genetic data – referred to in Article 9 GDPR. Such data shall be processed in accordance with the principles of legality, fairness, transparency, adequacy, relevance and necessity as contained in Article 5 paragraph 1 of the GDPR. 11.5 The Sponsor may transmit the data to affiliates of the Promoter's group and to third parties operating on its behalf, even abroad, in countries outside the European Union that do not offer the same level of privacy protection guaranteed in Europe. In this case, the Sponsor undertakes that this transfer takes place only to countries considered safe by the European Commission or, in any case, according to one of the methods allowed by the Applicable Privacy Law, such as the consent of the interested party, the adoption of Standard Clauses. approved by the European Commission and the selection of subjects adhering to international programs for the free circulation of data (eg EU-USA Privacy Shield).. 11.6 The Parties warrant that the persons authorised by them to process personal data for the purposes of the Trial will comply with the principles in place to safeguard data protection and the right to confidentiality and that any persons having access to the personal data will be obligated to process the data in accordance with the instructions given, in accordance with this article, by the data controller. 11.7 The Principal Investigator has been identified by the Entity as a person authorised for the data processing for the purposes of Article 29 GDPR and as a designated party for the purposes of Article 2 of the Code. 11.8 The Principal Investigator shall provide clear, complete information, also on behalf of the Sponsor, before the Trial starts (also before the preliminary phases or screening), to all patients, regarding the nature, purpose, results, consequences, risks and methods of the processing of personal data; in particular, all patients must be informed that the national and international authorities and the Ethics Committee may, in connection with the monitoring, checking and control of the Trial, have access to the related documentation and also to the original healthcare records of the patient, and that the data may also be accessed by the monitors and auditors in connection with their respective duties. 11.9 After the patient has been duly informed the Principal Investigator shall obtain the consent form for participation in the Trial and also the consent to the processing of personal data. The Entity is responsible for keeping the consent forms. The Entity is responsible for keeping the consent form, not only to the participation in the Trial but also to the treatment of data, signed by each patient and referred to in the previous art. 3.6 11.10 If either Party discovers a data protection breach, the other Party shall be informed within 24 hours from the breach having been verified, without affecting the Party’s independent assessment of the existence of the conditions and fulfilment of the obligations contained in Articles 33 and 34 GDPR.

Data protection. 11.1 11.1. In executing the contractual activities the Parties shall treat all the personal data they receive which, for any reason in relation reason, they have come to know during the clinical Trial in accordance with the objectives of the foregoing articles and in conformity with the provisions of Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 (General Regulations for the Protection of Personal Data, hereinafter "GDPR"), and with the related provisions of law and orders of national administrations, including any subsequent amendments (collectively the “Data Protection Laws”)) as well as any regulations of the Entities. 11.2 11.2. The terms used in this article, in this Agreement, in the informed consent documents and in any other documents used for the purposes of the Trial shall be construed and utilised utilized in accordance with the meanings given in Annex B. 11.3 11.3. The Entity and the Sponsor (or the CRO if the CRO manages every aspect of the Trial in place of the Sponsor, assuming the ownership of the related treatments) are independent data controllers for the purposes of article 4 paragraph 7 of the GDPR. (Omit the following paragraph if the CRO is managing every aspect Each of the Trial instead Parties will arrange at its own expense, as part of the Sponsorits organizational structure, assuming the ownership of the related treatments). The CRO ____ is the Data Processor for the purposes appointment of Article 28 Data Processors and assignment of functions and tasks to designated subjects, who operate under their authority, in accordance with the GDPR in reference to the ownership of the Sponsor and/or the Entityand current legislation. 11.4 11.4. For the purposes of the Trial, personal data relating to the following categories of data subject subjects will be processed: persons taking part in the trial; persons operating on the Parties’ behalf. Such data subjects will be appropriately informed of the processing of their data. For the purposes of the Trial, the following types of personal data will be processed: the data referred to in article 4 paragraph 1 of the GDPR; data classified as “sensitive” – and in particular, data relating to health, sexual preferences life and genetic data – referred to in Article 9 GDPR. Such data shall be processed in accordance with the principles of legality, fairness, transparency, adequacy, relevance and necessity as contained in Article 5 paragraph 1 of the GDPR. 11.5 11.5. The Sponsor may transmit send the data to other affiliates of the Promoter's Sponsor’s group and to third parties operating on its behalf, even including those abroad, in countries outside of the European Union that do not offer EU, only in compliance with the same level conditions set out in Articles 44 and ss. of privacy protection guaranteed the GDPR. For the purpose of this Agreement, "Affiliate" or "Affiliates" shall mean any person or entity controlled by, controlling, or under common control with either Sponsor or Entity. For this purpose, "control" means direct or indirect beneficial ownership of at least fifty percent (50%) interest in Europethe voting stock (or the equivalent) of such person or entity or having the right to direct, appoint or remove a Segoe UI majority or more of the members of its board of directors (or their equivalent), or having the power to control the general management of such person or entity, by contract, law or otherwise. In this case, the Sponsor undertakes that this transfer takes place only to countries considered safe by will guarantee an adequate level of protection of personal data also through the European Commission or, in any case, according to one use of the methods allowed by the Applicable Privacy Law, such as the consent of the interested party, the adoption of Standard Clauses. Contractual Clauses approved by the European Commission. Where the Sponsor is established in a State that does not fall within the scope of European Union law and that: - has not been the subject of an adequacy decision of the European Commission pursuant to Articles 44 and 45 of the EU GDPR 2016/679, and/or - does not ensure an adequate level of protection under the GDPR, the Sponsor and the selection of subjects adhering Entity must complete and sign the Standard Contractual Clauses document (this last document is attached to international programs for the free circulation of data (eg EU-USA Privacy Shieldthis Agreement)... 11.6 11.6. The Parties warrant that the persons authorised authorized by them to process personal data for the purposes of the Trial will comply with the principles in place force to safeguard data protection and the right to confidentiality and that any persons having access to the personal data will be obligated to process the data in accordance with the instructions given, in accordance with this article, by the data controller. 11.7 11.7. The Principal Investigator has been identified by the Entity as a person authorised authorized for the data processing for the purposes of Article 29 GDPR and as a designated party for the purposes of Article 2 quaterdecies of the Code. 11.8 The Principal Investigator shall provide clear, complete information, also on behalf of the Sponsor, before the Italian Law Decree 196/2003. AIFA National template 10-11-2022 Clinical Trial starts Agreement (also before the preliminary phases or screening), to all patients, regarding the nature, purpose, results, consequences, risks and methods of the processing of personal data; in particular, all patients must be informed that the national and international authorities and the Ethics Committee may, in connection with the monitoring, checking and control of the Trial, have access to the related documentation and also to the original healthcare records of the patient, and that the data may also be accessed by the monitors and auditors in connection with their respective duties. 11.9 After the patient has been duly informed the Principal Investigator shall obtain the consent form for participation in the Trial and also the consent to the processing of personal data. The Entity is responsible for keeping the consent forms. The Entity is responsible for keeping the consent form, not only to the participation in the Trial but also to the treatment of data, signed by each patient and referred to in the previous art. 3.6 11.10 If either Party discovers a data protection breach, the other Party shall be informed within 24 hours from the breach having been verified, without affecting the Party’s independent assessment of the existence of the conditions and fulfilment of the obligations contained in Articles 33 and 34 GDPR.CTA) PI Baldi V. 0.5 20 Sep 2023