PRIVACY POLICY

— 01 — DATA CONTROLLER —

Data Controller

The data controller is DRUGSTORE 94 SRLS, an Italian company. Registered office: Via Como 2, 21050 Clivio (VA), Italia. VAT number / Fiscal code: 04158740128. Email: contact@drugstore94.com. Phone (Italy): +39 335 711 9600 — Phone (Tunisia): +216 28 071 937.

— 02 — SCOPE —

A B2B Website

DRUGSTORE94 is a business-to-business (B2B) website addressed to professional buyers, retailers, distributors and other businesses. The general pages of this website are public. However, the wholesale catalogue, prices and ordering are not public: they are available only inside the private client area, which is accessible after creating an account and being verified as a professional buyer. This website is not directed to consumers and we do not knowingly collect data from private consumers for retail purposes. All data described in this policy is provided by professionals in the context of a potential or existing business relationship.

— 03 — DATA WE COLLECT —

Data We Collect

Depending on how you interact with us, we may process: • Company data provided at registration: company name, country, city, address, phone number, website and activity sector. • Account data: your full name, email address and password (stored only in hashed form). • Order data: quotations, orders, sample requests, cart contents, invoices and related correspondence. • Communication data: messages sent through the contact form or by email. • Technical data: IP address, browser type, session identifiers and access logs, collected for security purposes. • Verification data: one-time passwords (OTP) generated to secure access to your account.

— 04 — PURPOSES & LEGAL BASES —

Purposes & Legal Bases

We process your data only where a legal basis under the GDPR applies: • Performance of a contract: managing your wholesale account, quotations, samples and orders, and communicating with you about them. • Legal obligations: invoicing, accounting and tax obligations under Italian and EU law. • Legitimate interests: ensuring the security of the platform, preventing fraud and abuse, and defending legal claims. • Consent: answering contact requests and, where applicable, sending you information you have asked for. Consent can be withdrawn at any time. We do not sell or rent personal data, and we do not use it for consumer-style behavioural advertising or profiling.

— 05 — ACCOUNT SECURITY —

Account Security

Access to the wholesale area is protected by individual accounts with hashed passwords and, where enabled, one-time password (OTP) verification. Wholesale catalogues and prices are confidential and accessible only to verified partners. We apply technical and organisational measures appropriate to the risk, including transport encryption (HTTPS/TLS), rate limiting and restricted access to personal data within our team.

— 06 — WHO WE SHARE DATA WITH —

Who We Share Data With

Your data may be shared, only to the extent necessary, with: • Our production platform and partner workshops in Tunisia, for the execution of orders. • Logistics providers and carriers, for the delivery of samples and orders. • Banks and payment providers, for the processing of payments. • Hosting, email and IT service providers that support the operation of this website. • Professional advisors (accountants, lawyers) and public authorities, where required by law. These recipients act as processors or independent controllers as the case may be, and are bound by confidentiality and data protection obligations.

— 07 — INTERNATIONAL TRANSFERS —

International Transfers

As part of our production model, data related to orders and deliveries may be transferred to our Tunisian platform and partner workshops outside the European Economic Area. Such transfers are carried out only for the performance of your orders and are safeguarded by appropriate measures, including the terms agreed with our partners and the data minimisation applied to each transfer.

— 08 — DATA RETENTION —

Data Retention

We keep personal data only as long as necessary for the purposes described above: • Account and order data: for the duration of the business relationship and, thereafter, as required by legal retention obligations (in particular, accounting documents are kept for 10 years under Italian law). • Communication data: for the time needed to handle your request and, where relevant, for the defence of legal claims. • Technical and security data: for a limited period consistent with the security purpose. After these periods, data is deleted or anonymised.

— 09 — YOUR RIGHTS —

Your Rights

Under the GDPR you have the right to: • Access your personal data and obtain a copy. • Rectify inaccurate or incomplete data. • Erase your data in the cases provided by law. • Restrict or object to processing. • Data portability, where applicable. • Withdraw consent at any time, without affecting prior processing. To exercise your rights, write to contact@drugstore94.com. You also have the right to lodge a complaint with the Italian supervisory authority (Garante per la Protezione dei Dati Personali).

— 10 — COOKIES —

Cookies

This website uses only technical cookies and similar storage technologies that are strictly necessary for its operation: session authentication, protection against cross-site request forgery (CSRF), interface preferences and security. We do not use profiling, advertising or third-party analytics tracking cookies.

— 11 — UPDATES —

Updates to This Policy

This privacy policy may be updated from time to time to reflect legal, technical or organisational changes. The date of the latest revision is indicated below. Significant changes will be communicated to registered partners. Wholesale Terms & Conditions are available on the Conditions page.

Last revision: September 2026