Notice of Personal Data Processing

1. WHAT IS THIS ABOUT?

In Novo Nordisk we aim to be transparent about our use of your personal data and how we protect it. This notice explains which types of personal information we collect, why we collect it, and what we do with it.

2. WHO IS RESPONSIBLE FOR YOUR DATA?

The Novo Nordisk entity you entered a contract with is responsible for the collection and use of your personal data relating to this contract. If you have any questions or concerns with how we process your personal data, please reach out to your Novo Nordisk contact person, or to the Novo Nordisk Data Privacy Officer at privacy@novonordisk.com

3. HOW DO WE COLLECT YOUR PERSONAL DATA?

Directly from you or your employer
From Novo Nordisk entities
From publicly available publications, websites, or social media
From third parties such as medical communication or logistic agencies

4. PURPOSE – WHY DO WE COLLECT AND USE YOUR DATA?

To respond to your questions and requests for information
To document and coordinate your involvement in an event or for scientific research
To pay you
To meet transparency obligations
To investigate compliance

5. WHAT TYPES OF DATA DO WE COLLECT AND USE?

Type(s) of data	What we may collect and use:
Personal identification information	First name, last name, title, date of birth, unique identifier, photo or video, professional qualifications
Contact information	Address, phone number, email address
Financial information	Bank account number
Information to meet your needs	Such as allergies or food aversions

6. WHAT IS OUR LEGAL BASIS TO COLLECT AND USE YOUR DATA?

We enter a contract with you – it is necessary for us to fulfil obligations in the contract
Compliance with applicable laws – it is necessary to fulfil our legal obligations
Legitimate interests – We have a legitimate interest such as a business opportunity

7. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

In line with the purpose as stated above, we may share your data with:

Third party	Such as
Suppliers or vendors assisting Novo Nordisk	Consultants, IT service providers, financial institutions, law firms
Other Novo Nordisk entities	Novo Nordisk affiliates
Public authorities	Tax authorities

8. HOW YOU CAN CONTROL THE USE OF YOUR PERSONAL DATA?

Your rights	How you exercise your rights
Overview of your data	Ask for a copy of your personal data, which we provide in a structured format, readable to a machine
Restrict use	Request that we stop or limit the use of your personal data
Deletion	Request that your personal data is deleted or destroyed
Correct your data	Ask us to correct information about you
Complain about our use of the data	Submit a complaint to your local Data Protection Authority

9. HOW LONG WILL WE KEEP YOUR DATA?

Unless we’re required by law to keep your data for a longer period, we will keep it for up to 10 years.