1. Preamble

This privacy notice is addressed to all visitors and users of our websites and apps (“user” or “you”) of the Merck Group (“Merck”, “us”).

This privacy policy describes how Merck will use the personal data of the users within the scope of the operation of our websites and/or apps (“services”). "Personal Data" in this document means all information that relates to a natural person and with which this person can be directly or indirectly identified.

Should you have questions or queries regarding the processing of your personal data by Merck, please feel free to contact our Data Protection Officer via emails provided below.

• China: [China Data Privacy] via [chinaprivacy@merckgroup.com]
• Hong Kong: [China Data Privacy] via [chinaprivacy@merckgroup.com]
• India: [Vikas R Gupta] via [vikas.r.gupta@merckgroup.com]
• Indonesia: [Miranda Andamsari] via [Miranda.andamsari@merckgroup.com]
• South Korea: [Korea Data Privacy] via [koreaprivacy@merckgroup.com]

2. General Information

This section informs you who is the controller of the processing of your personal data, how you may contact the controller and which rights you have as a data subject in this context.

2.1. Controller

The data controller means the person who determines the purposes and means of the processing of your personal data. For the processing activities described of in this privacy notice, the controller is

China
[Merck Chemicals (Shanghai) Co., Ltd.]
[No. 227 Dong Yu Road, New Bund World Trade Center Phase II]
[Tel: (+86) 21 2033 8288]

[Sigma-Aldrich (Shanghai) Trading Co., Ltd.]
[509 Renqing Road, Bldg. 10, Zhangjiang High Tech East Park, Pudong]

Hong Kong
[Merck Chemicals (Shanghai) Co., Ltd.]
[No. 227 Dong Yu Road, New Bund World Trade Center Phase II]
[Tel: (+86) 21 2033 8288]

[Sigma-Aldrich (Shanghai) Trading Co., Ltd.]
[509 Renqing Road, Bldg. 10, Zhangjiang High Tech East Park, Pudong]

[Merck Limited]
[11/F, Elite Centre, 22 Hung To Road, Kwun Tong, Kowloon]
[Tel: (+852) 3196 0000]
[Fax: (+852) 2506 2529]

India
[Merck Life Science Private Limited]
[8th Floor, Godrej One, Pirojshanagar, Eastern Express Highway, Vikhroli (E), Mumbai – 400079, INDIA]

[Sigma-Aldrich Chemicals Private Limited]
[Plot # 12, Bommasandra Jigani Link Road, Bangalore 560 100, India]

Indonesia
[PT. Merck Chemicals and Life Sciences]
[Jl.TB Simatupang No. 8, Jakarta Timur 13760]
[+62 2128565600]
[+62 2128565600]

Korea
[Merck Ltd.]
[4F Haesung-2-Bldg, 508 Teheran-ro, Gangnam-gu, Seoul 06178, Korea]
[+82-2-2185-1700]

2.2. Data Protection Officer

Merck has appointed a Data Protection Officer. You may reach him/her as follows:

China
[chinaprivacy@merckgroup.com]
[Tel: (+86) 21 2033 8288]
[No. 227 Dong Yu Road, New Bund World Trade Center Phase II]

Hong Kong
[chinaprivacy@merckgroup.com]
[Tel: (+86) 21 2033 8288]
[No. 227 Dong Yu Road, New Bund World Trade Center Phase II]

India
[vikas.r.gupta@merckgroup.com]
[Godrej One, 8th floor, Pirojsha Nagar, Eastern Express Highway,Vikroli East, Mumbai, Maharashtra 400079]

Indonesia
[Miranda.andamsari@merckgroup.com]
[+62 2128565600]
[Jl.TB Simatupang No. 8, Jakarta Timur 13760]

Korea
[koreaprivacy@merckgroup.com]
[+82-2-2185-1700]
[Merck Ltd. Korea, 4F Haesung-2-Bldg, 508 Teheran-ro, Gangnam-gu, Seoul 06178, Korea]

3. The Processing Activities in Detail

This section explains the different data processing activities in which Merck processes your personal data for the operation of our services and the provision of information and functionalities.

In general, you are neither contractually nor statutorily obliged to provide your personal data for the below purposes, however your decision to not provide your data may lead to negative consequences, such as reduced features and functionalities and/or, in rare cases, the impossibility to use our information and services offered in this context.

3.1. Operation of our Services

We process your personal data for the purpose of the operation of our services. Whenever you access our services, you automatically transfer personal data to our servers for technical reasons.

This processing activity may include the following data categories:

• Identifier (manufacturer, version, type of web browser, operating system);
• Language settings of your web browser;
• The time of your visit and visited subpages of our website;
• Access status (file transferred, file not found, etc.);

The data processing is based on our legitimate business interests. We process these data for the purpose of presenting our services and to ensure its technical stability and security (e.g. to prevent hacker attacks).

We will store information for a necessary period as required by law, or for a necessary period at your request for providing the services, or for a period as per your consent.

4. Data Transfers

We transfer your personal data as follows.

4.1. Merck Group

To our worldwide affiliates, to the extent that this is permissible within the framework of the purposes and legal bases stated under 3. In these cases, our group companies will use the personal data for the same purposes and under the same conditions as described in this privacy notice (e.g., answering your inquiry about a product that falls within the area of expertise of a foreign Merck affiliate). A list of our affiliated group companies and their contact details can be found here. If and to the extent we transfer your personal data in this context to a country outside the EU or the EEA and to which no adequacy decision of the European Commission exists, we safeguard an adequate level of data protection by entering into the EU standard contractual clauses with such affiliate. You may obtain these EU standard contractual clauses here.

4.2. Service Provider

We may also engage service providers (data processors) within (e.g. shared service centers) or outside the Merck Group (e.g. hosting providers, support service providers) to process personal data in accordance with our instructions. In these cases, we retain control over and remain fully responsible for your personal data. We will take all reasonable safeguards required by applicable law to ensure the integrity and security of your personal data when engaging such service providers and will, should these service providers process your personal data in a country outside the EU or the EEA, safeguard an adequate level of data protection by entering into the EU standard contractual clauses with such service provider. You may obtain these EU standard contractual clauses here.

4.3. Public Authorities

In certain cases, we are required by law to transfer data to a requesting public authority.

Upon submission of a court order, we may be obliged by national Copyright Acts to provide owners of copyright and ancillary copyrights with information about customers who are alleged to have infringed copyright laws. In these cases, we may be obliged to transfer your personal data, in particular your user ID of an IP address allocated at the time requested and, if known, your name and address.

In other respects, personal data will only be transferred to state institutions and public authorities within the framework of mandatory national legal provisions or if disclosure is necessary in the event of attacks on the network infrastructure for legal or criminal prosecution.

5. Your Data Protection Rights

Regarding the data processing in the European Union, you have the following data protection rights:

• Right of access: You have the right to obtain information on the processing of your personal data and to receive a copy these data.
• Right to rectification: You have the right to ask us to correct or complete your personal data to the extent they prove to be wrong and/or incomplete.
• Right to erasure: Under certain circumstances, you have the right to ask us to delete your personal data.
• Right to restriction of processing: You may also have the right to ask us to limit the processing of your personal data.
• Right to data portability: You have the right to receive your personal data in a structured, common and machine-readable format and request that these data are transferred to another data controller.
• Right to object: You have the right to object to the processing of your personal data by us, in particular if the processing of your personal data is based on (i) the necessity of the performance of a task in the public interest, or (ii) legitimate interests. We will then stop the processing of your personal data unless we remain legally authorized to do so.
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority against the processing of your personal data if you believe that the processing of your personal data violates data protection regulations.

This Privacy Notice is up-to-date and dates from April 2022. We reserve the right to amend the Privacy Notice at any time with effect for the future, in particular to adapt it to a further development of the website or the implementation of new technologies.