User Agreement

Data Processing Agreement
Effective Date: September 18, 2026

This Data Processing Agreement ("Agreement") establishes the terms and conditions under which Elixaris processes personal data in cases where such processing is carried out on behalf of and in accordance with the Documented Instructions of clinics, pharmacies, medical institutions, specialists, and other business clients who enter into an agreement with Elixaris for the supply of goods, the use of a business account, or the receipt of other relevant services ("Business Client").

This Agreement is an integral part of the respective agreement between Elixaris and the Business Client ("Main Agreement") and applies from the moment the Business Client enters into the Main Agreement or otherwise properly agrees to the application of this Agreement, solely with respect to those Personal Data processing operations in which the Business Client acts as the Controller and Elixaris acts as the Processor.

The purpose of this Agreement is to define the conditions under which Elixaris processes personal data on behalf of the Business Client, as well as the respective obligations of the parties regarding the protection of such data.

1. Definitions

The terms "personal data", "processing", "data subject", "controller", "processor", "sub-processor", and "personal data breach" shall have the meanings defined by the applicable data protection legislation. For the purposes of this Agreement, the term "Controller" also includes the "owner of personal data" within the meaning of the legislation of Ukraine, and the term "Processor" includes the "manager of personal data" within the meaning of the legislation of Ukraine.

"Business Client Personal Data" means personal data that the Business Client or a person acting on its behalf transfers, makes available, or otherwise instructs Elixaris to process, and which Elixaris processes on behalf of and according to the Documented Instructions of the Business Client within the scope of this Agreement.

"Documented Instructions" means the instructions of the Business Client regarding the processing of the Business Client Personal Data, which are contained in the Main Agreement, this Agreement, and its annexes, or are provided by the Business Client in writing through communication channels agreed upon by the parties and are accepted by Elixaris for execution.

"Health Data" means personal data related to the physical or mental health of an individual, which reveal information about their health status, including, in particular, information about symptoms, illnesses, diagnoses, treatment, medical findings, prescriptions, and the intake of medicinal products.

"Applicable Data Protection Legislation" means the legislation applicable to the respective processing, including, where applicable, Regulation (EU) 2016/679 ("GDPR"), national legislation of EU/EEA member states, legislation of Ukraine on personal data protection, and other mandatory rules of the respective jurisdiction.

2. Entry into Force and Term

This Agreement applies to the Business Client from the moment the Main Agreement enters into force or from the moment of any other proper agreement by the Business Client to the application of this Agreement, and remains in effect for the entire period during which Elixaris processes the Business Client Personal Data on behalf of the Business Client, including the period required for their return or deletion in accordance with Section 11 of this Agreement, unless otherwise

1. Status and Roles of the Parties

If Elixaris processes Business Client Personal Data solely on behalf of and according to the Documented Instructions of the Business Client, the Business Client acts as the Controller, and Elixaris acts as the Processor of such personal data.

This Agreement does not apply to processing carried out by Elixaris as an independent Controller for purposes determined by it independently, including for order acceptance and fulfillment, delivery, invoicing, accounting and tax reporting, fulfillment of statutory obligations, handling of claims, warranty issues, fraud prevention, and protection of Elixaris' rights.

In such cases, each party is independently responsible for the fulfillment of its obligations as a Controller regarding the respective processing, including proper notification of data subjects and determining the legal basis for processing, ensuring the realization of data subjects' rights, and fulfilling other requirements of Applicable Data Protection Legislation.

If, with respect to any individual Processing, Elixaris exceeds the scope of the Documented Instructions of the Business Client and independently determines the purposes and essential means of such Processing, Elixaris shall act as a Controller regarding such Processing to the extent provided by Applicable Data Protection Legislation.

If, with respect to any individual Processing, the Parties jointly determine its purposes and essential means, such Processing shall not be governed by this Agreement as relations between a Controller and a Processor and, if necessary, must be separately regulated by the Parties in accordance with Applicable Data Protection Legislation.

3.1. Obligations of the Business Client
The Business Client undertakes:

• To transfer to Elixaris only those Business Client Personal Data that are necessary for the agreed process, and to ensure that the composition and volume of such data are relevant, adequate, and non-excessive in relation to the specified purpose of the Processing;
• To ensure the availability of a proper legal basis for the Processing of the Business Client Personal Data in accordance with Applicable Data Protection Legislation, including their collection and transfer to Elixaris for Processing on behalf of the Business Client;
• To properly inform data subjects about the processing of their personal data and to obtain consent if consent is the necessary legal basis, as well as to ensure the fulfillment of other requirements regarding the transparency of Processing imposed on the Business Client as a Controller;
• To ensure the accuracy, reliability, and relevance of the Personal Data of the Business Client transferred to Elixaris;

• Not to transfer Health Data or other special categories of personal data unless this is directly provided for by a process separately agreed upon by the parties, reflected in Annex 1 to this Agreement, or in another written document of the Parties, and if the Business Client has not ensured a proper legal basis for such Processing and the fulfillment of special requirements of Applicable Data Protection Legislation regarding the respective category of data;

• To provide Elixaris only with lawful, clear, and Documented Instructions regarding processing that comply with Applicable Data Protection Legislation and do not require Elixaris to perform unlawful Processing;

• To ensure proper access management for its employees and other authorized persons to the respective systems and business accounts, including the timely provision, modification, and termination of the respective access rights.

3.2. Obligations of Elixaris
Within the scope of Processing Business Client Personal Data carried out by Elixaris on behalf of the Business Client, Elixaris:
• Processes Business Client Personal Data exclusively within the scope of the agreed purposes and volume and solely on the basis of the Documented Instructions of the Business Client, including regarding international transfers of personal data, except in cases where otherwise directly required by law. In such a case, Elixaris, unless prohibited by law, shall notify the Business Client of the respective legal requirement before starting such Processing;
• Does not use Business Client Personal Data for its own purposes and does not process them outside the scope of the Documented Instructions of the Business Client. The creation of technical or backup copies is allowed only in the volume necessary for the execution of Documented Instructions, ensuring system security and business continuity, backup copying, or fulfillment of statutory requirements;
• Ensures that persons who have access to Business Client Personal Data are bound by confidentiality obligations or a relevant statutory obligation of confidentiality and receive access only in the volume necessary for the performance of their functions;
• Implements appropriate technical and organizational security measures in accordance with Annex 2 and the requirements of Applicable Data Protection Legislation, taking into account the nature, scope, context, and purposes of the Processing, as well as the probability and severity of risks to the rights and freedoms of data subjects;
• Taking into account the nature of the Processing and to the extent possible through the application of appropriate technical and organizational measures, provides the Business Client with reasonable assistance in fulfilling its obligations to respond to data subjects' requests to exercise their rights in accordance with Applicable Data Protection Legislation;

• Provides reasonable assistance regarding data protection impact assessments, consultations with the supervisory authority, and the performance of other obligations related to Processing security, responding to personal data breaches, data protection impact assessments, and prior consultations with the competent supervisory authority, taking into account the nature of Processing and the information available to Elixaris, if such assistance concerns processing carried out by Elixaris on behalf of the Business Client;
• Engages Sub-processors exclusively in the order and under the conditions provided for by Section 9 of this Agreement;
• Provides the Business Client with information necessary to demonstrate compliance with the obligations of Elixaris as a Processor, and allows for and contributes to audits under the conditions provided for by Section 10 of this Agreement;
• Upon completion of the respective Processing, returns or deletes the Business Client Personal Data in accordance with Section 11 of this Agreement.

If Elixaris believes that a Documented Instruction of the Business Client infringes Applicable Data Protection Legislation, Elixaris shall immediately inform the Business Client thereof without unjustified delay and may suspend the execution of such instruction until it is clarified or brought into compliance with Applicable Data Protection Legislation.

4. Subject Matter, Nature, and Scope of Processing

Elixaris processes Business Client Personal Data on behalf of the Business Client only for the purposes and in the volume necessary for the execution of the Documented Instructions of the Business Client and the provision of the functionality for which, in accordance with the Main Agreement, Elixaris acts as the Processor of personal data.

Detailed information regarding the subject matter, duration, nature, and purpose of the Processing, categories of data subjects, categories of personal data, recipients, and storage periods is set forth in Annex 1.

Elixaris has no right to change the Processing purposes determined by the Business Client or to independently determine new purposes for the Processing of Business Client Personal Data, except in cases where such Processing is directly required by applicable law.

The processing and transfer of Health Data do not belong to the standard scope of Processing under this Agreement and are allowed only within a process separately agreed upon by the Parties, reflected in Annex 1 or another written document of the Parties, after the determination of the Parties' roles, the purpose and scope of such Processing, the proper legal basis, and if GDPR applies—also the respective condition for the Processing of special categories of personal data pursuant to Article 9 of the GDPR, and the implementation of necessary technical and organizational protection measures.

The Business Client shall not transfer to Elixaris Personal Data of the Business Client that are not provided for by the agreed Processing process, in particular Health Data or other special categories of personal data, if their Processing has not been previously separately agreed upon by the Parties in accordance with this Agreement.

5. Data Subjects' Rights and Requests

The Business Client, as the Controller, is responsible for reviewing requests from data subjects regarding the exercise of their rights in accordance with Applicable Data Protection Legislation regarding Personal Data processed by Elixaris on its behalf.

If Elixaris receives such a request directly, Elixaris shall, without unjustified delay, forward it to the Business Client and, taking into account the nature of the Processing and to the extent possible through appropriate technical and organizational measures, provide the Business Client with the assistance necessary to fulfill its obligation to respond to the data subject's request.

Elixaris does not respond to such a request on the merits on behalf of the Business Client without its Documented Instruction, except in cases where providing a response is directly required from Elixaris by Applicable Data Protection Legislation.

The Business Client is obliged to timely provide Elixaris with the information and Documented Instructions necessary to execute the data subject's request within the timeframes established by Applicable Data Protection Legislation.

If the request concerns personal data and processing carried out by Elixaris as an independent Controller, Elixaris shall review it independently in accordance with Applicable Data Protection Legislation and its own Privacy Notice regarding personal data processing.

If a single request concerns simultaneously Processing carried out by Elixaris as a Processor and Processing carried out by Elixaris as an independent Controller, each Party shall be responsible for that part of the request that concerns Processing within its respective role.

6. Confidentiality

Elixaris preserves the confidentiality of the Business Client Personal Data processed on behalf of the Business Client and ensures that employees, contractors, and other persons authorized by Elixaris to Process such data, who have access to Personal Data of the Business Client, are bound by appropriate confidentiality obligations or relevant statutory confidentiality obligations and receive access to such data only in the volume necessary for the performance of their functions.

Elixaris does not disclose Personal Data of the Business Client to third parties, except as provided for by this Agreement, the Main Agreement, the Documented Instructions of the Business Client, or by statutory requirements.

Persons authorized by Elixaris to Process Business Client Personal Data carry out such Processing only in accordance with the Documented Instructions of the Business Client transmitted to them through Elixaris, and have no right to use such data for their own purposes, except in cases directly provided for by applicable law.

7. Security of Personal Data

Elixaris implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of the Processing, as well as the probability and severity of risks to the rights and freedoms of data subjects. The main measures are set forth in Annex 2.

Elixaris may modify and improve security measures provided that the overall level of security is not significantly reduced.

Depending on the nature and risks of a specific Processing, such measures include, where appropriate and applicable: pseudonymization and encryption of personal data; ensuring the ongoing confidentiality, integrity, availability, and resilience of Processing systems and services; the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; as well as a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.

In determining the appropriate level of security, Elixaris takes into account, in particular, the risks presented by processing, such as from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Business Client Personal Data transmitted or stored.

Elixaris regularly reviews the implemented technical and organizational measures and, if necessary, updates them taking into account changes in risks, technologies, the nature of Processing, and the infrastructure used.

8. Personal Data Breach

If Elixaris becomes aware of a Personal Data Breach affecting Business Client Personal Data, Elixaris shall notify the Business Client without unjustified delay after becoming aware of such Personal Data Breach.

If it is established that the Personal Data Breach affects Business Client Personal Data, Elixaris, where practically possible, provides a preliminary notification within 24 hours from the moment of establishing such circumstance. If all necessary information is not yet available at the time of the initial notification, Elixaris provides it in phases without unjustified further delay as it becomes available.

The notification shall contain information as complete as available to Elixaris at the respective moment, including information on the nature of the breach, the categories and approximate number of data subjects concerned, the categories and approximate number of personal data records concerned, the likely consequences of the Personal Data Breach, measures taken or planned to address the Personal Data Breach and mitigate its possible negative consequences, and the contact person for further interaction.

Elixaris documents Personal Data Breaches affecting Business Client Personal Data, including known circumstances of such breach, its consequences, and remedial actions taken, in the volume necessary to comply with Applicable Data Protection Legislation.

Elixaris provides the Business Client with necessary information and assistance, taking into account the nature of Processing and available information, to help the Business Client fulfill its obligations regarding notification of the competent supervisory authority or data subjects, if the respective obligation is imposed on the Business Client as a controller.

Elixaris does not perform notification of the competent supervisory authority or data subjects on behalf of the Business Client without a corresponding Documented Instruction from the Business Client, except in cases where such an obligation is directly imposed on Elixaris by applicable law.

9. Sub-processors

The Business Client provides Elixaris with a general prior authorization to engage Sub-processors for carrying out individual Processing operations of Business Client Personal Data on behalf of the Business Client under the conditions of this section.

Before engaging a Sub-processor, Elixaris takes appropriate measures to verify that the respective Sub-processor provides sufficient guarantees to implement appropriate technical and organizational measures and will carry out Processing in accordance with the requirements of this Agreement and Applicable Data Protection Legislation.

The current list of Sub-processors is posted on the Website at [insert link] and contains at least the name of the Sub-processor, the nature or purpose of engagement, and the location of personal data Processing. Elixaris notifies the Business Client of the planned engagement of a new Sub-processor or replacement of an existing one no later than 30 calendar days before such engagement or replacement via electronic notification, notification in the business account, or another communication channel agreed upon by the Parties, which allows the Business Client to timely familiarize themselves with the change and exercise the right to object, unless another timeframe is dictated by urgent security or statutory requirements. In such an exceptional case, Elixaris notifies the Business Client of the respective change as far in advance as practically possible, or without unjustified delay after its implementation, if prior notification was impossible.

The Business Client may, within this timeframe, submit a written and reasoned objection related exclusively to risks to personal data protection or non-compliance of the respective Sub-processor with Applicable Data Protection Legislation. The Parties shall in good faith attempt to resolve the reason for the objection or agree on a reasonably available alternative. If an acceptable solution is not found, the Business Client may terminate the respective service or the Main Agreement only regarding those services for the provision of which the engagement of the respective Sub-processor is necessary, without penalty.

Elixaris ensures that each Sub-processor is engaged on the basis of a written contract or other legally binding document and is bound by data protection obligations that are no less protective than, and reflect, the same obligations regarding data protection imposed on Elixaris under this Agreement, in particular regarding confidentiality, security, responding to Personal Data Breaches, assisting in the realization of data subjects' rights, deletion or return of data, and international transfers of personal data.

Elixaris remains fully liable to the Business Client for the performance of the Sub-processor's obligations regarding personal data protection within the scope provided by Applicable Data Protection Legislation.

If the engagement of a Sub-processor involves an international transfer of Business Client Personal Data, Elixaris ensures compliance with the requirements of Section 12 of this Agreement prior to the commencement of such transfer.

10. Audit and Compliance Verification

Upon a reasoned request of the Business Client, Elixaris provides the Business Client with information sufficient to confirm compliance with this Agreement and the obligations of Elixaris as a Processor under Applicable Data Protection Legislation, including through a security questionnaire, available certificates, independent audit reports, or other relevant materials.

If such information is reasonably deemed insufficient, the Business Client may conduct an audit independently or with the engagement of an independent auditor authorized by the Business Client, no more than once every 12 months, except in cases of a Personal Data Breach or a reasonable suspicion of a material breach of this Agreement or Applicable Data Protection Legislation, and also if conducting an audit is required by a competent supervisory authority or applicable law.

The audit is conducted upon a written notification at least 30 calendar days prior to the planned audit date, during business hours, without unreasonable disruption to the operational activity of Elixaris and with strict adherence to confidentiality. The requirement regarding the prior notice period does not apply if a different period is directly required by a competent supervisory authority, applicable law, or is objectively necessary in connection with a Personal Data Breach or another material risk to Business Client Personal Data. The auditor must not be a direct competitor of Elixaris and must be bound by appropriate confidentiality obligations.

The audit is limited to systems, processes, and documentation directly related to the Processing of Business Client Personal Data under this Agreement, and must not provide the Business Client or its auditor with access to data of other clients of Elixaris, confidential information not related to the subject matter of the audit, or information the disclosure of which could create a risk to the security of Elixaris systems. Elixaris has the right to implement reasonable measures to protect such information, provided that such measures do not prevent the Business Client from obtaining the information necessary to verify compliance with this Agreement and Applicable Data Protection Legislation.

Audit expenses shall be borne by the Business Client, except in cases where the audit confirmed a material breach of this Agreement or Applicable Data Protection Legislation by Elixaris; in such a case, reasonable audit expenses shall be reimbursed by Elixaris.

Elixaris maintains and, in cases and for periods provided by Applicable Data Protection Legislation, stores documentation regarding Business Client Personal Data Processing and implemented technical and organizational protection measures in the volume necessary to confirm compliance with this Agreement and the requirements of Applicable Data Protection Legislation.

Elixaris cooperates with the Business Client within the scope of the audit and provides reasonably necessary assistance to confirm compliance with the obligations of Elixaris as a Processor.

11. Storage, Return, and Deletion of Data

Upon termination of the Main Agreement or completion of the provision of services related to Processing, Elixaris, at the choice of the Business Client, returns to the Business Client the Business Client Personal Data and deletes existing copies stored by Elixaris, or deletes such data and all existing copies without their return, no later than within 30 calendar days, unless their further storage is required by law.

The Business Client notifies Elixaris of its choice regarding the return or deletion of Business Client Personal Data before the completion of the respective Processing or within 10 calendar days after receiving the respective notification from Elixaris. If the Business Client failed to communicate its choice within the specified timeframe, Elixaris has the right to delete the Business Client Personal Data in accordance with this section, unless their further storage is required by applicable law.

If applicable legislation requires further storage of individual Business Client Personal Data items, Elixaris stores such data only for the period provided by law and only for the purposes of fulfilling the respective statutory requirement, restricts their further Processing, and continues to apply the requirements of this Agreement regarding confidentiality and security to them. Elixaris notifies the Business Client of such a requirement, unless prohibited by applicable law.

Data in backups may be stored until the completion of the standard backup lifecycle and are not subject to immediate deletion from the backup copy, provided that their selective deletion is technically impossible or requires disproportionate measures, on the condition that they remain protected, isolated from ordinary use, not used for other purposes, and are deleted in accordance with the established cycle. If a backup copy containing such data is restored before the expiry of its storage period, Elixaris ensures the re-application of the respective deletion request to the restored data.

Elixaris ensures the deletion or, depending on the respective Documented Instruction, the return of Business Client Personal Data by all Sub-processors after the completion of their participation in processing, unless further storage is required by law.

Upon a reasoned request of the Business Client, Elixaris confirms the completion of the return and/or deletion of Business Client Personal Data in accordance with this section.

This section applies exclusively to Business Client Personal Data processed by Elixaris as a Processor, and does not extend to personal data lawfully processed by Elixaris as an independent Controller pursuant to Section 3 of this Agreement.

12. International Transfers

If Business Client Personal Data are transferred outside the country or territory for which Applicable Data Protection Legislation establishes special requirements for international data transfers, each Party within its respective role ensures compliance with the requirements applicable to such international transfer, and the application of a transfer mechanism provided by law, if such a mechanism is necessary.

Elixaris carries out an international transfer of Business Client Personal Data, including to a Sub-processor, only in accordance with the Documented Instructions of the Business Client, this Agreement, and Applicable Data Protection Legislation, except in cases where the respective transfer is directly required by applicable law.

If GDPR applies to the transfer and personal data are transferred to a third country or an international organization, such transfer is carried out in accordance with Chapter V of the GDPR. If the European Commission has adopted a valid adequacy decision regarding the respective country, territory, sector, or international organization, the transfer may be carried out on the basis of such a decision. In the absence of such a decision, the Parties ensure the application of appropriate safeguards provided for by the GDPR, in particular, where applicable, the Standard Contractual Clauses adopted by the European Commission regarding international transfers of personal data (Standard Contractual Clauses — SCCs) in the appropriate module.

If SCCs or another mechanism requiring it apply to the respective transfer, the Parties conduct the necessary assessment of the transfer circumstances and, if necessary, implement additional technical, organizational, and/or contractual measures to ensure an appropriate level of protection of Business Client Personal Data.

If the legislation of Ukraine applies to the international transfer, such transfer is carried out in accordance with the requirements of Article 29 of the Law of Ukraine "On Personal Data Protection", in particular on the condition of ensuring an appropriate level of personal data protection by the respective state or in the presence of another basis provided by law or appropriate safeguards for such transfer.

The engagement of a Sub-processor involving an international transfer of Business Client Personal Data is carried out simultaneously with compliance with the requirements of Sections 9 and 12 of this Agreement.

13. Requests from Government Authorities

If Elixaris receives a legally binding request, demand, decision, or other mandatory order from a state, judicial, or another competent authority regarding Business Client Personal Data, Elixaris, unless prohibited by applicable law, notifies the Business Client of such request without unjustified delay prior to the disclosure of the respective data or, if prior notification is impossible, notifies the Business Client of such request as far in advance as permitted, providing information about the requesting authority, its legal basis, nature, and volume of the requested data.

Elixaris verifies the competence of the respective authority, the legal basis, the mandatory nature, and the scope of the request, and provides only those Business Client Personal Data and only in the volume and scope that are legally mandatory.

If Elixaris has reasonable grounds to believe that the respective request is unlawful, excessive, or exceeds the powers of the authority, Elixaris, to the extent permitted by applicable law and deemed reasonably possible, uses available means to challenge such request or limit its scope to the execution of the legally mandatory disclosure.

If Elixaris is prohibited from notifying the Business Client of the respective request, Elixaris, to the extent permitted by law, exerts reasonable efforts to obtain a waiver of such prohibition and notifies the Business Client without unjustified delay after the termination of the respective prohibition.

Elixaris documents received requests from competent authorities and disclosures made in response in the volume provided by Applicable Data Protection Legislation and, if permitted by law, provides the respective information to the Business Client upon its reasoned request.

If GDPR applies to the Processing and the request comes from a judicial, administrative, or another authority of a third country, any transfer or disclosure of Business Client Personal Data is carried out with a view to the requirements of Chapter V of the GDPR, including Article 48 of the GDPR, if it applies.

14. Duration, Priority, and Other Provisions

This Agreement is effective for the duration of the period during which Elixaris processes Business Client Personal Data, and after the termination of the Main Agreement—in the part of provisions which by their nature continue to operate, including provisions regarding confidentiality, security, return and deletion of Business Client Personal Data, liability for Personal Data Protection breaches, and other provisions the execution of which is necessary after the termination of the Main Agreement.

In case of inconsistency between this Agreement and the Main Agreement regarding Personal Data Processing, the provisions of this Agreement shall prevail within the scope of such inconsistency.

If Standard Contractual Clauses (SCCs) apply to the respective international transfer, in case of inconsistency between the SCCs and this Agreement or the Main Agreement, the provisions of the SCCs shall prevail within the scope of such inconsistency.

If Applicable Data Protection Legislation in the respective jurisdiction requires the inclusion of additional mandatory provisions, the Parties agree to execute the necessary amendment or local addendum to this Agreement if such provisions cannot be properly executed on the basis of this Agreement without introducing respective modifications.

Elixaris may periodically update this Agreement in connection with changes in Applicable Data Protection Legislation, Processing methods, services used, or technical infrastructure, provided that such changes do not reduce the level of Business Client Personal Data protection and do not contradict Applicable Data Protection Legislation. The current version of the Agreement is published on the Website with the effective date indicated.

Elixaris notifies the Business Client of material changes to this Agreement prior to their entry into force via email, business account, or another agreed communication channel of the Parties. If the respective change materially alters the scope of Processing, the roles of the Parties, or rights and obligations of the Parties regarding personal data protection and is not directly necessary for the execution of a mandatory requirement of legislation, such a change applies after its proper approval by the Parties in accordance with the Main Agreement.

If any individual provision is not directly provided for by this Agreement, the respective local addendum, or applicable SCCs, the provisions of the Main Agreement regarding applicable law and dispute resolution shall apply to this Agreement. If applicable SCCs establish separate requirements regarding applicable law or a competent court, the respective provisions of the SCCs shall apply to relations governed by them.

15. Contacts

For matters related to this Agreement and personal data protection, the Business Client may contact Elixaris using the following contact details:

Elixaris:
Email:
Address:

Annex 1. Description of Approved Processing Operations wherein Elixaris Acts as a Processor

This Annex applies solely to those Processing operations in which Elixaris actually acts on behalf of and under the Documented Instructions of the Business Client. Personal data processing required by Elixaris for its own purposes, including order fulfillment, delivery, accounting and tax record-keeping, warranty service, and complaint handling, is not covered by this Annex and is carried out by Elixaris as an independent Controller in accordance with Section 3 of the Agreement.

Processing Operation №1. Processing of personal data on behalf of the Business Client within the scope of the process separately agreed upon by the Parties:

1. Processing operations - Collection, recording, organization, storage, access, transfer, use for the execution of the agreed process, restriction, and erasure.
2. Purpose of processing - Execution of the respective process separately agreed upon by the Parties, within the scope of which Elixaris processes personal data on behalf of and under the documented instructions of the Business Client.
3. Legal basis - Determined by the Business Client acting as a controller in accordance with applicable legislation.
4. Categories of data subjects - Determined depending on the respective process of Processing agreed upon by the Parties and restricted to the data necessary for its execution.
5. Categories of personal data - First name and last name; phone number; email address, if required for communication; delivery address or delivery point; information about the ordered product and its quantity; information about the Business Client who created the order.
6. Special categories of data - Are not a standard part of the process. Health data, diagnoses, medical conclusions, doctor's recommendations, and prescriptions must not be transferred to Elixaris unless the respective processing is provided for by a separately implemented process with a determined legal basis and additional security measures.
7. Recipients - Elixaris and its authorized personnel; respective subprocessors solely to the extent necessary for the execution of the agreed process.
8. Storage period - For the duration of the period required for the respective processing, and after its completion — in accordance with Section 11 of this Agreement.

As of the effective date of the Agreement, standard Processing operations for Health Data or other special categories of personal data by Elixaris on behalf of the Business Client are not provided for. Any such Processing may be carried out only after a separate written agreement is reached by the Parties and after its inclusion in this Annex, indicating the purpose, categories of data, categories of data subjects, duration, recipients, legal basis, and additional security measures.

Annex 2. Technical and Organizational Measures

• Personal user accounts for employees and other authorized users;
• Separation of access rights in accordance with functions and the "need-to-know" principle;
• Use of strong passwords and two-factor authentication where technically available and appropriate;
• Access control to CRM, order management systems, and other systems in which personal data are processed;
• Restriction and control of access for contractors and service providers;
• Procedures for prompt termination or modification of access following a change in role or termination of cooperation;
• Secure corporate email and appropriate means of account protection;
• Backup copying and measures for restoring data availability in the event of a technical incident;
• Data protection during transfer (in transit) using appropriate secure protocols;
• Registration and investigation of security incidents and the procedure for responding to personal data breaches;
• Regular review of access rights, security settings, and risks as Elixaris systems evolve.

Specific technical solutions may change taking into account the chosen infrastructure, providers, and risk level, provided that an appropriate level of protection is maintained.

Annex 3. Information on Subprocessors

The current list of Subprocessors is published at [URL]. For each Subprocessor, at least the following details shall be specified: name, service/function, categories of personal data, location of Processing, and, if applicable, the international transfer mechanism.