Introduction

This, set forth below, is the privacy policy of Jubilant Pharmova Limited, an integrated global pharmaceuticals company having three business segments Pharmaceuticals, Contract Research and Development Services and Proprietary Novel Drugs. (collectively ‘Jubilant’ "we" or "us"). This policy is applicable to all our subsidiaries/ entities and other affiliated/ promoter driven entities. A list of our subsidiaries/ entities and other affiliated/ promoter driven entities is available in the annexure at the end of this policy. Here we describe the practices we follow to respect the privacy of all visitors to websites we operate from which you are accessing this Policy ("our websites") and our social media pages that our websites link to.

We want you to be familiar with how we collect, use and disclose information. This Privacy Policy describes the privacy practices of Jubilant in connection with the information that we collect through www.jubilantpharmova.com operated by us, from which you are accessing this Privacy Policy. Uniform practices for collecting, using, disclosing, storing, retaining, disposing, accessing, transferring or otherwise processing such information assists Jubilant to process Personal Information appropriately, processing, disclosing it and/or transferring it only under appropriate circumstances.

In this policy, personal information means data which relates to an individual and which identifies that individual, either directly or indirectly, such as his/ her name or his/ her contact information. You have the right to access and update your personal information or to require their deletion. If you have any questions regarding the processing of your personal information, please contact us by dropping an e-mail at privacyofficer@jubl.com. Your requests will be dealt with in a prompt and proper manner. No charge will be levied for complying with a correction request, however, for all other requests Jubilant may charge a fee to cover its costs. Requests to update or delete personal data will be subject to any applicable legal and ethical reporting or document filing or substantiation or retention obligations imposed on Jubilant from time to time.

Purpose

The purpose of this policy is to highlight various leading practices and tools that support in compliance with data privacy regulations applicable to Jubilant in its role as both data controller as well as data processor, as applicable (if any).

Applicability

This privacy policy is applicable to everyone who accesses and uses www.jubl.com and the web pages contained within, including but not limited to external Legal entities in any form or manner, Jubilant customers, third party service providers, etc. who use or access this website, themselves or through authorised representatives.

Commitment to Privacy and Data Security

The term "personal data" as used in this Policy refers to information such as your name, birth date, e-mail address or mailing address that can be used to identify you. Jubilant does not process your personal data without your consent. In processing your personal data, we commit to fully comply with internationally recognized standards of privacy protection. In so doing, we stipulate compliance by our staff with strict standards of security and confidentiality.

We strive to keep your personal information secure and take reasonable effort that appropriate security and technical controls are implemented for the security of personal information. Only selected authorized employees, business partners, vendors and other third party providers may have access to this information.

Jubilant has instructed its third party service providers’ to employ industry standard security measures for appropriate security of information through legally binding terms and conditions. However, users of our websites are responsible for maintaining the integrity and security of any password, user ID, or other form of authentication involved in obtaining access to password protected or secure areas of our websites. Access to and use of password protected and/or secure areas of our websites is restricted to authorized users only. Unauthorized access to such areas is prohibited and may lead to criminal prosecution.

The next sections explain how and when we collect personal data from you.

Collection and Use of Information

Jubilant will collect relevant and necessary Personal Information, and will process such information only for the purpose it is collected. The purpose of collection will be specified not later than at the time of data collection, or on each occasion of change of purpose.

Most of our services/ information on the website do not require any form of registration, allowing you to visit our site without telling us who you are. If you are merely an anonymous visitor to our website, we do not collect any personal information about you, except to the limited extent through the use of cookies, which are described below. However, some services may require registration. When you register with us, you may need to complete certain fields (some are required and some are optional), as well as choose a user name and password. In these situations, if you choose to withhold any personal data requested by us, it may not be possible for you to gain access to certain parts of the website, obtain products or services and for us to respond to your query. Jubilant processes personal data for specific and limited purposes, which we inform you about when we ask you for information.

For example, we may collect and use personal data to provide you with products or services, to bill you for products and services you request, to market products and services which we think may be if interest to you, or to communicate with you for other purposes. Information you send to our customer service department is used only to help resolve your problem and is otherwise kept private. Jubilant keeps your data only for as long as is reasonably needed for such purposes and in accordance with any applicable legal or ethical reporting or documentation retention requirements.

All disclosures made by you will be considered to mean and imply your consent, for use and processing of all such personal data/ information, and such disclosure shall be at your risk.

You may choose to share your personal information for:

• Expressing an interest in working for Jubilant: Our website enables you to register your interest in working for us or applying for an advertised job vacancy. We may collect names, addresses, email addresses, contact numbers, educational background and resume details, etc. to evaluate your qualifications for the desired position and we may contact you for further information and communication related to your application for a job with us. We may share your information with third party agencies working at our instruction to provide recruitment and hiring services. For more details about the recruitment process and the information required, visit the Careers section of our websites;
• Posting queries, complaints, or requests: You may choose to share your personal information to connect with us and post your queries, requests, etc. by visiting the Contact Us section of our websites. We may use the information submitted by you in order to take where considered appropriate by us the necessary action(s), if applicable. Our websites additionally uses cookies to improve our websites’ performance and to enhance your browsing experience. Certain areas of our website also use cookies to understand more about you, so that we can over you a more personalized browsing experience.

What are Cookies?

Cookies are pieces of information stored directly on the computer or mobile device that you are using. Cookies allow us to collect information such as browser type, e-mail address when you are logged-in to your e-mail from the browser you are using, pages visited, including our websites, referring URL, language preferences, and other aggregated traffic data. You can configure your browser to refuse cookies, or to warn you before a cookie is placed. If you disable cookies, some parts of our websites may not function properly or at all.

Google Analytics

Google Analytics is a data processor under GDPR because Google Analytics collects and processes data on behalf of clients such as Cadista Pharmaceuticals, pursuant to our instructions. Cadista Pharmaceuticals retains full rights over the collection, access, retention, and deletion of collected data at any time. Google’s use of data is controlled by the terms of our contract with them and any settings enabled by Cadista Pharmaceuticals through the user interface of Google’s products.

Google Analytics collects first-party cookies, data related to the device/browser, IP address and on-site/app activities to measure and report statistics about user interactions on Cadista Pharmaceuticals website and/or apps that use Google Analytics. Cadista Pharmaceuticals may customize cookies and the data collected with features like cookie settings, User-ID, Data Import, and Measurement Protocol.

Google has earned ISO 27001 certification for the systems, applications, people, technology, processes, and data centers serving a number of Google products, including Google Analytics.

Information Security

In web-based computing, security of both data and applications is critical. Google dedicates significant resources towards securing applications and data handling to prevent unauthorized access to data.

Data is stored in an encoded format optimized for performance, rather than stored in a traditional file system or database manner. Data is dispersed across a number of physical and logical volumes for redundancy and expedient access, thereby obfuscating it from tampering.

Cadista Pharmaceuticals reserves the right to disclose all information collected to the extent required by law or to respond to a judicial order.

Special Categories of Personal Data

Jubilant does not intentionally collect any special categories of personal data (sensitive personal information) via our websites unless we are legally required to do so, for example, for recruitment purposes. Sensitive personal information includes: information revealing racial or ethnic origin; political opinions; religious or philosophical beliefs; trade-union membership; the processing of genetic or biometric data for the purpose of uniquely identifying a natural person; information concerning health; information concerning a natural person's sex life or sexual orientation; and in some cases, social security numbers or financial information.

Disclosure and Data Sharing

Jubilant will not sell, share, rent or otherwise distribute/ trade your sensitive personal information, collected through www.jubl.com or on any of the pages contained within or information provided by you when you avail any of the services provided by Jubilant, to third parties outside the Jubilant group. However, personal data may occasionally be transferred to third parties who act for or on behalf of Jubilant, or in connection with the business of Jubilant, for further processing in accordance with the purpose(s) for which the data were originally collected. Jubilant may share information with third party service providers contracted to provide services on our behalf for processing personal information, to conduct marketing campaigns and related services. Where disclosure of sensitive personal data to a third party is likely or necessary for whatever reason, Jubilant will, wherever possible, endeavour that the disclosure and intended use of the data are clearly indicated. Such third parties may operate different privacy policies. However, we endeavour that such third parties provide the same level of protection as Jubilant and, where appropriate, we will contractually require them to process data transferred only for the purposes expressly authorized by Jubilant. We will not share with third parties any data about you that is sensitive (e.g., medical information) in the absence of your prior and explicit consent. Your consent may always be revoked at a later date. If consent is revoked Jubilant may not be able to carry out certain requests made by you. Jubilant will, where practicable, inform third parties to whom your data have been transferred of your withdrawal of consent.

Additionally, if Jubilant goes through a business restructuring, reorganisation or transition, such as a merger, acquisition by another company, or sale of all or a portion of its assets, your personal information collected through our websites may be among the assets transferred. A prominent notice will appear on our websites for 30 days after any such change in ownership or control of your personal information. It will be your responsibility to check such postings or notices on our websites, and no individual notices nor intimations will be issued by us.

Jubilant may disclose your Personal Information and Sensitive Personal Information as we believe to be necessary or appropriate: under applicable law, including laws outside your country of residence; to comply with legal process; to respond to requests from public and government authorities, including public and government authorities outside your country of residence, for national security and/or law enforcement purposes; to enforce our terms and conditions; and to allow us to pursue available legal remedies or limit the damages that we may sustain. Additionally, in the event of a reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings), we may transfer the Personal Information and Sensitive Personal Information we have collected to the relevant third party. We may share your Personal Information and Sensitive Personal Information with governmental agencies or other companies assisting us in fraud prevention or investigation. We may do so when: permitted or required by law; or, trying to protect against or prevent actual or potential fraud or unauthorized transactions; or, investigating fraud which has already taken place. The information is not provided to these companies for marketing purposes.

Consent and Control

Consent

Consent is often referred to as an individual’s choice to “opt-in” or “opt-out” of Jubilant’s use of your personal information and Sensitive Personal Information and is usually obtained by a “check box” or signature confirming the individual understands and agrees to the processing of their personal information. At times, express written consent from the individual may be required based on the information processing activity.

Jubilant receives consent from individuals prior to:

• collecting, using, or processing their personal information, including sensitive personal information, in certain ways or sharing the individual’s personal information with any third party. Sensitive personal data is data revealing an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation;
• transferring the individual’s personal information outside of the individual’s country of residence
• using or placing web cookies on an individual’s computer or other electronic devices

Control of your Information

Jubilant also provides individuals with the right to control their personal information, which includes the right to access, modify, erase, restrict, transmit, or object to certain uses of their information.

You may request to review, correct, update, suppress or object to the use or processing of your personal information that collected through our websites or information provided by you when you avail any of the services provided by Jubilant. You may review, update, correct or delete your personal information collected through the website or service by e-mailing us at privacyofficer@jubl.com. We may need to verify your identity, before processing your request.

If you have privacy concerns regarding access to or the correction of your personal information, please contact us at privacy contact information mentioned within Section 16 “Privacy Contact Information” of this policy.

In your request, please make clear what personal information you would like to have changed, whether you would like to have your personal information that you have provided to us suppressed from our database or otherwise let us know what limitations you would like to put on our use of your personal information that you have provided to us.

While the majority of questions and issues related to access or requests can be handled quickly, complex requests may take more research and time. In such cases, issues will be addressed, or you will be contacted regarding the nature of the problem and appropriate next steps, within 30 days.

Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion. There may also be residual information that will remain within our databases and other records, which will not be removed. In addition, there may be certain information to which we are unable to enable you to review, for legal, security, or other reasons.

Jubilant reserves the right to decline access to your personal information under certain circumstances. If your personal information is not disclosed to you, you will be provided with the reasons for this non-disclosure.

Retention and Disposal

Your personal data will be retained in a form which enables Jubilant to identify the individual for no longer than it is necessary for the purposes for which the data was collected and used. Your personal data may be retained in certain files for a period of time as required by applicable law and following Jubilant’s data retention policies in order to comply with such financial or legal requirements, to properly resolve disputes or to troubleshoot problems. If you wish to cancel your account or request that we no longer use your information to provide you services, contact us via the information above. We will respond to your request to access or delete your information within 30 days.

In addition, some types of information may be stored for an infinite duration due to legal requirements or technical constraints, and will, if practical, be blocked from further processing for purposes which are not mandatory by law or when a consent is withdrawn. The information that you provide may be stored or transferred in our systems or on the systems provided by our third parties.

Disclaimer: In no event will Jubilant be liable to you or to any other party for any indirect, special, consequential or punitive damages for or arising from any use of, or access to, the personal information and Sensitive Personal Information submitted on our websites or any other or hyper linked website, including, without limitation, any loss of information or data, even if we may have been expressly advised of the possibility of such damages.

Changes to this Privacy Policy

Jubilant may change this privacy policy as needed at its sole discretion. If changes to the policy are made, please note that it may take up to 30 business days before new privacy practices are implemented. Check this page on our websites periodically if you would like to monitor changes.

Withdrawing Consent and Restriction of Processing

Subject to the conditions mentioned above, you may withdraw consent to personal data processing or you may review, update, correct or delete your personal information collected through our websites by e-mailing us at privacyofficer@jubl.com.

Privacy Contact Information

You may at any time, contact our Data Protection Officer directly with all questions and suggestions concerning data protection by e-mailing at privacyofficer@jubl.com.

Annexure

List of entities/ subsidiaries:

NOTE: This list is not exhaustive and is subject to change without prior notice.

Jubilant Clinsys Limited;
2. Jubilant Biosys Limited;
3. Jubilant Chemsys Limited;
4. Jubilant First Trust Healthcare Limited;
5. Jubilant Infrastructure Limited;
6. Jubilant DraxImage Limited;
7. Jubilant Innovation (India) Limited;
8. Vanthys Pharmaceutical Development Private Limited;
9. Jubilant Generics Limited;
10. Cadista Holdings Inc.;
11. Jubilant Cadista Pharmaceuticals Inc.;
12. TrialStat Solutions Inc.;
13. Jubilant Pharma Holdings Inc.;
14. Jubilant Clinsys Inc.;
15. HSL Holdings Inc.;
16. Jubilant HollisterStier LLC;
17. Jubilant Life Sciences (USA) Inc.;
18. Jubilant DraxImage (USA) Inc.;
19. Draxis Pharma LLC;
20. Jubilant HollisterStier Inc.;
21. Jubilant Discovery Services LLC;
22. Draximage (UK) Limited;
23. Jubilant Pharma Limited;
24. Jubilant Life Sciences International Pte. Limited;
25. Jubilant Biosys (Singapore) Pte. Limited;
26. Jubilant Drug Development Pte. Limited;
27. Jubilant Innovation Pte. Limited;
28. Drug Discovery and Development Solutions Limited;
29. Jubilant Life Sciences (Shanghai) Limited;
30. Draximage Limited, Cyprus;
31. Draximage Limited, Ireland;
32. Jubilant Pharma NV;
33. Jubilant Pharmaceuticals NV;
34. PSI Supply NV;
35. Jubilant Life Sciences NV;
36. Jubilant Life Sciences (BVI) Limited;
37. Jubilant Biosys (BVI) Limited;
38. Jubilant DraxImage Inc.;
39. 6981364 Canada Inc.;
40. Jubilant Innovation (USA) Inc.;
41. Jubilant Pharma Australia Pty Limited;
42. Jubilant Draximage Radiopharmaceuticals Inc.;

Other affiliated/ promoter driven entities:

1. SSB Consultants and Management Services Private Limited;
2. HSB Corporate Consultants Private Limited;
3. Jubilant Enpro Private Limited;
4. Jubilant Energy Private Limited;
5. Jubilant Industries Limited;
6. Jubilant Industries Inc.

Grievance Redressal

In reference to Rule no. 5 (9) of Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 of Information Technology Act 2000, Any grievance or complaint, in relation to processing of personal information, should be sent to Jubilant Pharmova in writing to following contact email ID. Grievance shall be redressed as expeditiously as possible.

Ajay Khanna, Grievance Officer
E-mail: Grievance@jubl.com