COOKIE POLICY (for server-side setup)

With this policy we wish to create transparency and give you a clear overview of how and why we process your data through these technologies, what to be aware of, and how you can exercise your rights regarding such processing.

1. What are cookies?

Cookies are small text files, which the website place on your computer's hard drive, smartphone or other electronic device. In this policy, the term "cookies" also includes other kinds of automated data collection, e.g. flash-cookies, web storage, or cookies placed by the use of other kinds of software. The word "cookies" also refers to information about IP- and MAC-addresses and other information about your device.

Main categories of cookies

• Temporary cookies: cookies that are linked to your current visit to the website. These are deleted automatically when you close your web browser.
• Permanent cookies: cookies that will be stored on your equipment. These will be deleted after a certain period but will be renewed every time you visit the same website.

You can find detailed information about all cookies used below including information about purpose, provider, expiration date and more.

2. Processing data through the use of cookies

LEO Pharma’s use of cookies and similar technologies may include processing of your personal data, which can include information about your browser type, device, and website interactions. To the extent any such data can be linked to you, we will process such personal data in accordance with our Privacy Policy, which describes how we handle personal data, including information on your rights and how to exercise these. We recommend that you consult our Privacy Policy in order to learn more about our data processing in connection with the use of the Website.

The legal basis for the use of statistical and marketing cookies is your consent in accordance with Article 6.1.a of the GDPR, except for anonymous first-party statistical measurement for which the legal basis is Article 6.1.f of the GDPR (legitimate interests). For necessary cookies, the legal basis is Article 6.1.f of the GDPR (legitimate interests).

LEO Pharma operates a privacy-protective, server-side analytics setup where data flows through LEO Pharma-controlled servers first, not directly to third parties. This allows LEO Pharma to decide which identifiers are stored or changed, replace them with hashed or session-only versions, and remove them entirely if you haven't given consent. This means LEO Pharma, not the third parties, determines what identifiers exist and what information third parties ever receives.

We use a first-party cookie called "FPID" (First-Party Identifier) with a duration of 30 minutes. This cookie is set by our own domain and managed entirely by our server-side infrastructure. The third-party client creates and manages the FPID cookie server-side, ensuring LEO Pharma owns the identifier logic rather than the third party.

This first party analytics approach is permitted because:

- We use only first party cookies set by our own domain with a very short lifespan (30 minutes).
- The data collected is strictly anonymous - when you haven't consented, identifiers are session-only, generated from non-personal attributes, and change with every visit.
- The data is used solely for statistical purposes to improve website performance.
- LEO Pharma, not the third party, determines what identifiers exist and what information a third party ever receives.

When you have not given consent for statistical cookies, our server does not use the third-party client ID at all. Instead, it generates temporary identifiers based on technical non-personal inputs (such as page encoding, language, browser type, screen resolution, and IP address) combined with a short 5-digit date stamp. The server creates a SHA-256 hash from these inputs, which becomes the temporary client ID.

These identifiers are session-only, generated from non-personal attributes, and change with every visit. Non-consented visitors are never tracked across sessions, and all transformations happen entirely within LEO Pharma's infrastructure.

This consent-exempt analytics allows us to:

• Count the number of visits and sessions.
• Detect technical errors and performance issues.
• Understand which pages are most visited.
• Improve the overall user experience.

The system ensures that data leaving LEO Pharma's servers is either pseudonymised or anonymous, meeting both analytical needs and data protection principles.

3. Consent and cookies

Certain cookies are necessary for the Website to function properly (the “necessary cookies”). These types of technical cookies are therefore set automatically when you visit the Website, in order for us to deliver an operational Website to you.

We also use other categories of non-essential cookies – such as analytical or marketing cookies. These cookies are placed in order to optimize your experience on the Website and show material relevant to you and your identified preferences. See a detailed overview under Section 4 for the specific categories of cookies used on the Website. If cookies are used for purposes other than the purely necessary ones mentioned above, depending on the applicable law, users must consent to these cookies prior to them being placed on their device via the Website.

When you press [accept] to cookies and the associated data processing, you consent to the use of either all or your selected categories of cookies. In order for you to freely exercise an informed consent to the use of non-essential cookies through our Website, this Cookie Policy is designed to inform you of our use of cookies. Please note, that the Website may not function optimally if you choose to opt out of cookies.

Please also note that if you opt out of non-essential cookies, LEO Pharma will still collect anonymous, aggregated data for basic website functionality and error detection. However, we don't set analytics cookies or use the third party client ID, i.e. we will not store information or gain access to information stored in your devices. Temporary identifiers are created from technical details and a short timestamp, and they last only for the current session, so we cannot recognize you across visits. In this case only data that is anonymized i.e. transformed into information that cannot identify you is stored on our secure server and shared with the third party. This allows basic reporting like counting sessions and detecting errors while preventing tracking between visits. This data is not personally identifiable and is used exclusively for general analytics and service improvements.

4. How to avoid and delete cookies?

Have you given consent to the use of cookies, and if you do not want LEO Pharma to place or read non-essential cookies on your device anymore, you can at any time (i) withdraw or change your consent by clicking the cookie-icon at the bottom left of this Website, or (ii) by modifying your browser settings. How to modify your browser setting depends on what kind of browser you are using. Be aware that if you are using multiple browsers you will have to delete the cookies in all of them. As user, you also need to be aware that the website might not function optimally if you delete or block cookies.

5. Detailed cookie overview

• Necessary cookies: cookies that help make a website navigable by activating basic technical functions such as page navigation and access to secure website areas. Without these cookies, the Website would not be able to work properly. Therefore, these do not require your consent.
• Functional cookies: cookies that make it possible to store information that changes the way the Website appears or acts. For instance, your preferred language or region.
• Statistical cookies: cookies that help the Website owner understand how visitors interact with the Website by collecting and reporting information.
• Marketing cookies: cookies that are used to track visitors across different websites. The intention is to display ads that are relevant and interesting to the individual user and thus more valuable for publishers and third-party advertisers.

All cookies used on the Website are categorized into one of these four categories. For each category, except necessary cookies, you can choose if you want to give LEO Pharma consent to use cookies belonging to this category.

Below you can find a detailed list of all the cookies used in this website. You can see which category they belong to and you can find the expiration date. The list includes information such as each cookie’s name, provider, purpose, expiry date, and any relevant data processor details. Reviewing this list may help you make an informed decision about your cookie preferences.

6. Third-Party Services and Cookies

In addition to our server-side analytics approach, LEO Pharma websites may integrate third-party services to enhance user experience and functionality. These services may set their own cookies and tracking technologies when you interact with their content.

Important: These third-party services operate independently of our privacy-protective server-side analytics and may collect data directly from your browser according to their own privacy policies.

If you consent, the listed third parties may place cookies that track your interests and behaviour – for example which pages you visit and which products or services you view – across this and other websites, apps, social media and devices. These third parties act as joint or independent controllers for the personal data collected via these cookies and use it for their own purposes.

Specific Services Used on This Website when consent is given
Google Analytics (Google Ireland Limited)

• Purpose: Website analytics and performance measurement
• Privacy Policy: https://policies.google.com/privacy

Meta (Meta Platforms Ireland Limited)

• Purpose: Website analytics, marketing and performance measurement
• Privacy Policy: https://transparency.meta.com/

7. Contact and Further Information

If you have any questions regarding our use of cookies or the processing of your data, please refer to our Privacy Policy or contact us via the details provided on the Website. We may update this policy from time to time to reflect changes in our data practices or applicable regulations. Any updates will be posted on the Website with an updated revision date.