PRIVACY NOTICE OF DRUGSTOC EHUB LIMITED

INTRODUCTION

1.1 Drugstoc Ehub Limited is a tech-based pharmaceutical distribution Company incorporated under the Laws of the Federal Republic of Nigeria.

1.2 References in this notice to "we", "us" or "Drugstoc" are references to Drugstoc Ehub Limited.

1.3 Reference in this Notice to "personal data" means any information that identifies, or could reasonably be used to identify, a living individual, either on its own or together with other information.

WHAT INFORMATION WE COLLECT ABOUT YOU

The personal data that we collect and process may include:

• Basic information such as name, date of birth, employer, title, relationship affiliations with a person or organization.
• Contact information such as physical address, email address, fax, and phone number(s).
• Background information provided by you or collected by us as part of our recruitment or contract employee onboarding processes.
• Confidential information provided to us by or on behalf of our clients or generated by us in the course of providing our products/services.
• Details relating to your visits to our offices or work sites.
• Any other information relating to you which you may provide to us.

HOW WE PROTECT YOUR PERSONAL INFORMATION

3.1 We are committed to protecting your personal information and implementing appropriate technical and organizational security measures to protect it against any unauthorized or unlawful processing and against any accidental loss, destruction, or damage.

3.2 Our IT security practices are contained in our Information Security Policy.

HOW WE USE YOUR PERSONAL DATA

Whether we obtain your personal data directly from you or from a third party, we will only use your personal data in connection with our professional activities, legitimate interests (including the fulfillment of our contractual or legal/regulatory obligations). These "Authorized Uses" include:

• Providing our professional services to our clients.
• Managing our business relationship with our service providers and/or vendors.
• Acting in compliance with our legal obligations or pursuant to a valid court order.
• In furtherance of or to protect the vital interest of the data subject.
• Processing your requests/information further to your consent during your visit to our offices and online platforms.
• Legitimate interests pursued by the Company or by a third party to whom the data is disclosed.

HOW YOUR PERSONAL DATA IS OBTAINED

We often obtain and process your personal data:

• In the course of our recruitment or employee onboarding processes.
• Further to an employment, service, or any other contractual obligation we have with you.
• When you email us, contact us via our website, or subscribe to our services.
• When you physically visit any of our premises.
• When you attend any of our event(s).
• When you volunteer your personal data to us for any specific reason(s).

SHARING YOUR PERSONAL DATA

Your personal data may be shared with our related entities and affiliates. Our related entities and affiliates ensure a corresponding level of data protection. Where we share your personal data with third parties, we will do this in accordance with the Nigerian Data Protection Act, 2023 (NDPA) and NDPR observing appropriate safeguards.

MARKETING

We would like to send you information about our products, services and special offers which may be of interest to you. Where we have your consent or it is in our legitimate interests to do so, we may do this by post, email, telephone, text message (SMS) or call. We will only ask whether you would like us to send you marketing messages when you tick the relevant boxes. If you have previously agreed to being contacted in this way, you can unsubscribe at any time by contacting us at [email protected] or by using the unsubscribe link in the emails.

RETAINING YOUR PERSONAL DATA

We will delete your personal data as you say so, or when it is no longer reasonably required for the Authorized Uses (subject to our retention policy) or when you withdraw your consent (whichever is applicable), provided that we are not legally required or otherwise authorized to continue to hold such data. The withdrawal of consent shall not affect the lawfulness of data processing that occurred before the withdrawal of the consent. We may retain your personal data for an additional period to the extent that deletion would require us to overwrite our automated disaster recovery backup systems or to the extent we deem it necessary to assert or defend legal claims or in pursuance of any regulatory, accounting or reporting requirement.

YOUR RIGHTS AS A DATA SUBJECT

At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:

• Right of access — You can request a copy of the information we hold about you.
• Right of rectification — You can correct inaccurate or incomplete data.
• Right to be forgotten — You can ask for your data to be erased.
• Right of portability — You can transfer your data to another organization.
• Right to object — You have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing, including profiling— You also have the right to be subject to the legal effects of automated processing or profiling.
• Right to judicial review — In the event that Drugstoc refused your request under rights of access, we will provide you with a reason for the refusal. You also have a right to make a complaint to the Nigeria Data Protection Commission ("NDPC").

WHAT CONSTITUTES CONSENT OF A DATA SUBJECT?

Consent of a data subject to this Privacy Notice is construed accordingly:

• Visitors: When you visit our website or online platforms and volunteer your personal information; when you physically visit any of our premises or when you voluntarily attend any of our recorded webinars or events.
• Client: When you engage our services and/or sign a service level agreement with us in that regard, subsequent to the disclosure of personal information.
• Vendor/Supplier: When you approach/engage us for the supply or provision of goods/services.
• Job Applicant: When you send your application/CV in the response to our advertised job offers or a cold email.

CAN I FIND OUT THE PERSONAL DATA THAT DRUGSTOC HOLDS ABOUT ME?

Drugstoc at your request can confirm what information we hold about you and how it is processed. If Drugstoc does hold personal data about you, you can request the following information:

• Contact details of the Data Protection Officer, where applicable;
• The purpose of the processing as well as the legal basis for processing;
• If the processing is based on the legitimate interest of Drugstoc or a third party, information about those interests;
• The categories of personal data collected, stored, and processed;
• Recipient(s) or categories of recipients that the data is/will be disclosed to;
• If we intend to transfer the personal data to a third party or international organisation, information about how we ensure this is done securely. We will ensure the recipient is in a country on NDPC's Adequacy list. Where the recipient is in a country outside NDPC's adequacy list, we shall ensure the execution of the requisite Data Transfer Agreement (DTA) imposing obligations no less than the NDPA/NDPR on the recipient of the personal data.
• How long the data will be stored;
• Details of your rights to correct, erase, restrict or object to such processing;
• Information about your right to withdraw consent at any time;
• How to lodge a complaint with the supervisory authority (NDPC);
• Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and the possible consequences of failing to provide such data;
• The source of personal data if it was not collected directly from you;
• Any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

WHAT FORMS OF ID WILL I NEED TO PROVIDE FOR A DSAR?

Drugstoc accepts the following forms of ID (but not limited to) when information on your personal data is requested:

• Passport
• Driver's license
• National Identity Card
• Permanent Voters Card

DISPUTE RESOLUTION

If you have any complaints regarding our compliance with this Privacy Notice, please contact our Data Protection Officer. We will investigate and attempt to resolve complaints and disputes regarding the use and disclosure of personal information within thirty (30) business days in accordance with this Privacy Notice and in accordance with applicable law and regulation in Nigeria.

COMPLIANCE WITH THE REGULATORS

This Privacy Notice is in line with the provisions of Nigeria Data Protection Regulation, Act, 2023 (“NDPA). Nigeria Data Protection Regulation, 2019 (Regulation). This Regulation describes how data controllers including Drugstoc collects, handles and stores personal information and it applies regardless of whether data is stored electronically, on paper or on other materials.

CONTACT US

If you have any questions or suggestions regarding our Privacy Notice, please contact our Data Protection Officer.

Data Protection Officer: Cynthiamary Unaka

Email: [email protected]

Telephone: 08036879999

CAVEAT ON WEBSITE LINKS

Our website may contain links to other websites. Save and except as otherwise expressly stated by us, any link to another website is not covered by our privacy notice. We strongly advise that you should satisfy yourself with the details of any privacy notice provided on other websites or links.

REVISION TO THIS PRIVACY NOTICE

Drugstoc reserves the right and prerogative to change or modify this Privacy Notice at any time, with or without advance notice in order to reflect changes in the law and/or our privacy practices. Such changes will be effective immediately after posting, whether dated or not. We encourage you to check this notice whenever you visit our website — www.drugstoc.com, applications, premises. to ensure that you are happy and comfortable with any changes.