Privacy & Data Subject Requests

TBTB Global – DSAR Notice | Effective 11 February 2026 | v1.1

Effective Date: 11 February 2026 | Version 1.1 | Public Document

This notice explains how TBTB Global handles personal data in two contexts: (1) our website and corporate communications, and (2) client programs where TBTB acts primarily as a data processor on behalf of a client (the data controller).

1. Applicable Legal Frameworks

TBTB Global complies with applicable data protection and privacy laws in the jurisdictions where it operates, including but not limited to:

• European Union: General Data Protection Regulation (GDPR)
• Brazil: Lei Geral de Proteção de Dados (LGPD)
• Colombia: Ley 1581 de 2012 and Decreto 1377 de 2013
• Panama: Ley 81 de 2019 (Protección de Datos Personales)
• Mexico: Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)
• Argentina: Ley 25.326 de Protección de Datos Personales
• United States: Applicable state privacy laws (e.g., CCPA/CPRA as relevant)

Where conflicts exist between jurisdictions, we apply the higher standard of protection. Additional jurisdiction-specific disclosures may apply and are available upon request.

2. Roles and Scope

• Website context (Controller): When you contact us, request information, or interact with our recruiting or support channels, the relevant TBTB entity acts as the controller for that website-related data.
• Client program context (Processor): In most life sciences / pharma programs (e.g., diagnostics coordination, monitoring operations, vendor governance), TBTB processes personal data under the client's written instructions. The client is the controller and determines purposes and means.
• This notice applies across the TBTB Global group entities that operate the website and provide services, and to personal data processed through those activities.

3. What Data We Process

3.1 Website and Communications (Controller)

• Contact and business information you provide (name, email, phone, company, job title).
• Message content and attachments you send to us.
• Basic technical logs necessary to operate and secure the site (e.g., server logs, IP address, timestamps).
• We do not collect analytics on this website and we do not use tracking pixels for advertising.

3.2 Client Programs (Processor)

• Program identifiers and operational data needed to deliver services (e.g., case identifiers, sample identifiers, shipment status, site/vendor contacts).
• Where applicable, sensitive data such as health/diagnostic-related data, processed strictly under client instructions and contractual safeguards.

4. Purposes and Lawful Bases

4.1 Website and Communications (Controller)

• Respond to inquiries and provide requested information.
• Provide IT/app support and service communications.
• Manage business relationships and contracting conversations.
• Protect the website and systems (security, abuse prevention).
• Comply with legal obligations (records, dispute handling).

Where applicable, we rely on legitimate interests, contract necessity, consent (for specific optional communications), and legal obligations depending on the context and jurisdiction.

4.2 Client Programs (Processor)

For client programs, the controller determines the lawful basis and provides required notices to data subjects. TBTB processes data solely to deliver contracted services under controller instructions.

5. Sharing of Data

• Within TBTB Global group entities on a need-to-know basis to deliver services.
• With vetted service providers (subprocessors) that support hosting, communications, IT support, and security, under contractual confidentiality and data protection terms.
• With authorities when required by law.

We do not sell personal data.

6. International Transfers

Because TBTB operates internationally, personal data may be accessed or processed across borders. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses, contractual protections, and vendor terms) and limit transfers to what is necessary for service delivery and support.

7. Retention

• Website inquiries: retained as long as needed to respond and manage the relationship, then deleted or anonymized unless legal obligations require longer retention.
• Client program data: retained per the controller's instructions and applicable contractual and legal requirements.

8. Data Processing Agreements (DPA)

TBTB maintains a standard Data Processing Agreement (DPA) that covers the obligations of both parties regarding the processing of personal data under applicable law. A DPA is available upon request for clients, partners, and other stakeholders who require contractual data protection commitments.

To request a copy of our standard DPA, please contact: contactenos@tbtbglobal.com

9. Your Rights / Data Subject Requests (DSAR)

Depending on your jurisdiction you may have the right to access, correct, delete, object, restrict processing, or request portability of your personal data.

9.1 Routing Rule (Important)

• If your request relates to a client program (where TBTB is a processor): please contact the program controller (the client). If you do not know who the controller is, email us and we will route your request.
• If your request relates to our website, recruiting, vendor onboarding, or direct communications with TBTB: contact us using the channel below.

9.2 How We Handle Requests

• We may request information to verify identity before processing a request.
• We respond within legally required timelines based on jurisdiction and context.
• Where TBTB is a processor, we assist the controller per contract and applicable law.

10. SMS and Messaging Communications

TBTB Global may send SMS/text messages to patients and caregivers who are enrolled in our patient support programs and who have provided written consent through the program enrollment form (Informed Consent / TCLE).

• Purpose: Messages are sent solely for care coordination purposes, including appointment scheduling, exam reminders, and program support. Messages are never sent for marketing or promotional purposes.
• Phone number sharing: Mobile phone numbers collected through program enrollment will not be shared, sold, rented, or transferred to third parties for marketing purposes under any circumstances.
• Message frequency: Message frequency varies based on your care program activity. You may receive up to 4 messages per month.
• Costs: Message and Data Rates May Apply depending on your mobile carrier plan.
• Opt-out: You may opt out of SMS communications at any time by replying STOP to any message you receive. You will receive a single confirmation message and no further messages will be sent.
• Help: Reply HELP to any message for assistance, or contact us at contactenos@tbtbglobal.com.
• Eligibility: SMS communications are available to patients enrolled in TBTB Global programs in the United States.

Full SMS Terms & Conditions: tbtbpharma.com/sms-terms

11. Contact

12. Updates to This Notice

We may update this notice to reflect operational, regulatory, or technological changes. The effective date above indicates the latest version.

Informational notice only. This document is not legal advice and should be reviewed by local counsel for jurisdiction-specific requirements.