This EU Privacy Notice applies to any information about you collected, maintained, transmitted, stored, retained, or otherwise used (i.e. processed) by EVL through its Sites and Services (e.g. when you use our online feedback/queries portal in the "Contact Us" section of the website). It also applies to any personal information that you provide to us in email or telephone communications, including when you contact our customer call centers with questions or concerns regarding our products.

This EU Privacy Notice sets out the basis on which we gather, use, process and disclose any personal information that we collect from you. Where applicable, we will use your personal information only for the purposes and in the manner set forth below, which describes the steps we take to ensure our processing of your personal information is in compliance with the General Data Protection Regulation ((EU) 2016/679) (GDPR) and any implementing legislation (“EU Data Protection Legislation”).

We reserve the right to change this EU Privacy Notice from time to time at our sole discretion. If we make any changes, we will post those changes here and update the “Last Updated” date at the top of this EU Privacy Notice. Your continued use of the website or any of our services (including our call center services) after we make changes is deemed to be an acknowledgment of those changes, so please check this EU Privacy Notice periodically for updates.

In the EU, the concept of 'personal information' means any information relating to a living individual who can be identified directly from that data or indirectly in conjunction with other information. In addition to the types of personal information we collect as defined in Endo’s Privacy Notice, we also may hold some or all of the following types of personal information in relation to you:

• Information about your medical history
• Information in relation to questions or complaints you have submitted in relation to any of our products
• Records of your email communications with us and recordings of your telephone calls to us or our call center providers

We may hold, process, and disclose personal information provided by you for the following purposes:

We may, from time to time, (i) ask for your consent to use your personal information for a specific purpose, and/or (ii) process your personal information (including "sensitive personal information" as defined below) in order to protect your vital interests or the interests of another. Where processing is carried based on your consent, you will have the right to withdraw your consent to such processing at any time. The provision of your personal information is not a statutory or contractual requirement and you may refuse to disclose some. However, please note that if you do not provide us with your personal information, we will not be able to process your complaint.

Certain categories of your personal information are regarded as 'sensitive'. Sensitive personal information includes information relating to an individual's:

• Physical or mental health
• Religious, philosophical or political beliefs
• Trade union membership
• Ethnic or racial origin
• Biometric data used for the purpose of uniquely identifying a person
• Genetic data
• Sex life and/or sexual orientation

We only process such sensitive personal information where it is necessary for the establishment, exercise, or defense of legal claims, where it is necessary for reasons of public interest in the area of public health (such as ensuring high standards of quality and safety of medicinal products), or where we have obtained your explicit consent to process such data. As mentioned, where processing is based on your consent, you have the right to withdraw that consent at any time.

We may disclose your personal information to members of our corporate group including, without limitation, for the following reasons: in order to run global processes or global litigation, carry out group wide reporting, make decisions about the business and/or our products, or for processing customer complaints and issuing refunds where applicable.

We will inform you in advance if we intend to further process or disclose your personal information for a purpose other than the purposes set out in Endo’s Privacy Notice. We take all reasonable steps, as required by law, to ensure the safety, privacy and integrity of such data and information and, where appropriate, enter into contracts with such third parties to protect the privacy and integrity of such data and any information supplied.

The personal information that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (EEA), for the purposes described above. Those countries may not provide an adequate level of protection in relation to processing your personal information. Due to the global nature of our business, your personal information may be disclosed to members of our group located outside the EEA, including in particular in the USA. It may also be processed by personnel operating outside the EEA who work for us or for one of our suppliers who act on our behalf. We will ensure appropriate safeguards are in place to protect the privacy and integrity of such personal information (e.g., making use of standard contractual clauses as prescribed by Article 46 of the GDPR). You can obtain information concerning such safeguards by emailing us at privacy@endo.com, where applicable.

The security and confidentiality of your personal information is extremely important to us. As no data transmission over the Internet can be guaranteed as 100% secure, we cannot ensure or warrant the security of any information that you transmit to us and you transfer the personal information at your own risk. We endeavor to use and keep under review appropriate administrative, physical, technical and organizational measures (including staff training and awareness) in order to protect against unauthorized or unlawful processing of your personal information, including unauthorized destruction, alteration, disclosure, or access.

We will store your personal information for the purposes of providing access to our website and related services to you and for the exercise or defense of any legal claims. This information may be deleted upon request, subject to exceptions provided under law. Please see Section 12 (Your Individual Rights) for more information on how to make this type of request.

Our website may contain links to and from other websites. If you follow a link to any of those websites, please note that those websites may have their own privacy policies and we do not accept any responsibility or liability for those policies. Please check those policies before you submit any personal information to those websites.

You should keep us informed of any changes to your personal and sensitive personal information. You have a personal responsibility to ensure that any personal information you share with Endo is protected from unauthorized access or disclosure. If you become aware of a data breach or a potential data breach of your personal information, please report the matter immediately to privacy@endo.com.

The GDPR provides specific rights to individuals in the EU regarding your personal information. To the extent that we are a controller of your personal information, you may request access to, rectification, erasure, restriction of processing, objection to processing, or right to data portability. In each case, these rights are subject to restrictions under the law. The following is a summary of your rights:

• The right of access enables you to receive a copy of your personal information held by EVL
• The right to rectification enables you to ask us to correct or amend your personal information in certain circumstances
• The right to erasure enables you to ask us to delete your personal information in certain circumstances
• The right to restrict processing enables you to ask us to halt the processing of your personal information in certain circumstances
• The right to object enables you to object to EVL processing your personal information on the basis of our legitimate interests (or those of a third party)

The right to data portability enables you to request us to transmit personal information that you have provided to us, to a third party, or to give you a copy of it so that you can transmit it to a third party, where technically feasible. You can make such a request by sending an email to privacy@endo.com or by calling us at (800) 462-ENDO (3636). Please include your full name, mailing address, email address, phone number, date of birth (month, day), relationship to EVL (e.g., former employee, health care provider, patient in a clinical trial), and type of request (e.g., Request to Know/Access, Request to Delete). We will respond to your request within 30 days. That period may be extended by two further months, where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt of your request.

We may request additional information from you—such as employee ID number, as well information we may have on file about you, such as your date of hire—in order to verify your identity and confirm that the request is valid. The information we require may vary depending on your relationship to us. If we are unable to verify your identity using this process, we will provide you with an explanation and describe additional steps you may take to assist us in successfully verifying your request.

If you request deletion of your personal information, we will assess the request to confirm whether there are any reasons for which we are required to retain the information about you, including for specific business purposes, to fulfil a legal obligation, or other reasons permitted under the law. If we are not able to service your deletion request, we provide you with an explanation. We have the right to refuse your request where there is a basis to do so in law, or if your request is manifestly unfounded or excessive, or to the extent necessary for important objectives of public interest.

You have the right to lodge a complaint with the Office of the Irish Data Protection Commissioner if you are not satisfied with how your personal information is being handled.

If you require any further clarification regarding this EU Privacy Notice, please contact us via email at privacy@endo.com.