Welcome to the Henry Schein Corporate Brands website. The protection of your personal data is
particularly important to us. Below we would like to inform you in detail about how we deal with them.

1. Responsible for the Data Processing and Contact for Data Protection Questions

Controller for this website is:
Henry Schein Services GmbH
Monzastr. 2a
63225 Langen
Germany
(hereafter: “Henry Schein”).

If you have any questions or concerns regarding the protection of your data at Henry Schein you may contact the Data Protection Officer via the following contact details:

E-Mail: Datenschutzbeauftragter@henryschein.de

Via Letter: To the Data Protection Officer, c/o Henry Schein Services GmbH, Monzastr. 2a, 63225 Langen, Germany

2. Data Henry Schein Collects and Processes
a) Information we collect about you when you visit our website
To visit and use our website, it is generally not necessary to provide personal data. Only access data without direct personal reference, such as the name of your Internet service provider, the page from which you are visiting us, the names of the requested files and their access date are being processed. This data is only evaluated to improve our website and does not allow any direct conclusions to be drawn about you personally.

In accordance with our values we treat all personal data that we receive in accordance with the data protection principles from Art. 5 GDPR, i.e.
1) lawful, transparent processing in good faith,
2) purpose limitation,
3) data minimization,
4) accuracy and data quality,
5) memory limitation,
6) integrity and confidentiality and
7) accountability.

3. Use of Personal Data and Legal Basis
We only use your personal data to the extent permitted by law. This mostly happens in the following situations:

a) For the necessary pursuit of our legitimate interests or those of a third party and insofar as your interests and rights do not take precedence. E.g. if responding to your inquiries, notifying you of changes to our terms and conditions or this privacy information, or when we demonstrate our products or services to you.

As part of legal requirements we are subject to, we have or will conclude written agreements with third-party recipients that are in accordance with this data protection declaration. We require all third-party recipients to respect the security of your personal data and to treat them in accordance with the law, in particular the applicable data protection regulations. Your data will only be passed on to third parties outside the Henry Schein Group to the extent necessary and to the extent permitted by law.

For some processings we engage third party data processors (e.g. IT service providers). With these the required data processor agreements are concluded.

b) Our services are not directed to children. If a parent or guardian becomes aware that his or her child has provided us with personal information without their consent, please contact us. If we become aware that a child has registered for a service and has provided us with personal information, we will delete such information from our files.

4. International Data Transfers
Your personal data may be transferred to a destination outside the EU in countries where the protection of personal data is not as strong as in the EU, e.g. in the USA or UK. Where such transfers take place, we undertake all necessary precautions required by the GDPR.

For example, your personal data is recorded in a database of our sister company, Henry Schein UK Holdings Ltd., United Kingdom. This is done in order to operate our website and so that you can use all of our products and services to their full extent and is necessary for improving and conducting our business. In particular we e.g. measure the needs of our customers and improve our products and services for you in order to optimize our offers. In addition, other affiliates of the Henry Schein Group can access your data within the scope of the legal provisions.

Your data may be processed by Henry Schein employees who work outside the EU and work for us or one of our business partners, suppliers, subcontractors or data processors. These employees may be involved in the performance of services to you.

5. Your responsibility and obligations
Where necessary, you must ensure that you have collected or have given all the necessary consents, information and notices that are required in accordance with the applicable data protection regulations in order to allow the lawful processing of personal data (including special categories, for example Health data of your patients) to us and to third parties, so that we and the third parties working on our behalf (data processors) can legally use, process, store and transfer the personal data.

6. Storage Period
We will keep your data only as long as necessary for the fulfilment of the respective purpose for which they were collected. This also includes the fulfilment of legal, in particular commercial, corporate, tax and regulatory requirements. In order to determine the appropriate retention period for personal data we take into account, among other things, the quantity, type and sensitivity of the personal data; the possible risk of damage (e.g. through unauthorized use or disclosure), the purposes for which we process your personal data and whether we can achieve these purposes with other, milder means within the applicable legal requirements.

We will take all reasonable steps to destroy or delete any data that is no longer needed from our system.

7. Security of your Data
We protect your data against accidental or intentional manipulation, destruction or loss as well as against unauthorized access by third parties through the use of suitable technical and organizational security measures. These are continuously checked and improved in line with technological developments.

8. Your rights
According to the regulations of the GDPR you have the following rights:

• a) the right to access and correction your personal data: you can e.g. Request a copy of your personal data that we hold about you and check that we process it legally and ask us or - via customer log-in - independently correct incomplete or inaccurate data.
• b) the right to have your personal data deleted: Please delete your data if we no longer have a legitimate reason to continue processing it or you have effectively exercised your right to object. Please note that we cannot always comply with your request for deletion for certain legal reasons.
• c) the right to object to the processing of your personal data with future effect: e.g. at any time if we process your personal data for direct marketing purposes or if we rely on a legitimate interest or that of a third party, but you have a situation that outweighs your rights and freedoms. In some cases, however, we may be able to demonstrate that we have an overriding legitimate interest or other authorization to process your personal data further.
• d) the right to restrict or suspend the processing of your personal data: e.g. to determine the correctness of your data or if you have a right to erasure but do not want to exercise it or if you ask us to only keep your data so that you can justify, exercise or defend claims.
• e) the right to transfer your personal data to you or third parties in a commonly used, machine-readable format: Please note that this right only applies to automated data that you have approved for use or that we have used to fulfill a contract with you.
• f) the right to withdraw your given consent at any time with future effect, in cases where we rely on your consent to process your personal data: Please note that this does not affect the lawfulness of processing before revocation. If you withdraw your consent, we may not be able to provide certain products or services to you.
• g) the right to lodge a complaint: In justified cases, you can lodge a complaint with the responsible data protection authority. However, we would like you to contact us with your concerns in such a case so that we can try to resolve your concerns by mutual agreement. We are happy to be your first point of contact.

With regard to your request, we may need to request specific information from you to help us confirm your identity and ensure your rights. This serves your and our security so that your personal data is not passed on to unauthorized third parties. To speed up our response, we can also contact you to provide us with more information related to your request.

We try to respond to all legitimate requests within a reasonable time, if possible within a month. Occasionally, it may take longer, e.g. if we have any questions, your request is complex or you have made several requests. In this case we will notify you and keep you up to date.

In principle, you can exercise all the rights mentioned free of charge. In individual cases, we are entitled by the GDPR to charge a reasonable processing fee if your application is obviously unfounded, repeated or excessive. Alternatively, we can also refuse your request under these circumstances.

We reserve the right to modify this Privacy Information and related business practices at any time. We will duly inform you of any changes by posting here.

Last Updated: 2022-07-20