Privacy Notice to workers.

Chattem, Inc., as your employer, is responsible for the processing of the above Personal Data under the following justifications (legal basis) and for the following purposes.

Performance of employment contract.

We generally process your Personal Data on the basis of the relevant applicable contractual relationship. This means that the processing of Personal Data - for the purposes described below - is necessary to the execution of employment contract and is therefore mandatory. Please keep in mind that, should you refuse that Opella processes such Data, we may be unable to properly carry on this contractual relationship. In particular, we process your Data to:

• to manage onboarding, for example to facilitate the negotiation, drafting, and finalization of employment contracts. This involves confirming the candidate's employment terms, benefits, start dates, and any other pertinent details necessary to formalize the employment relationship;

• to handle financial and contractual matters, for example to fulfill the employment contract and ensure compliance with local and international tax regulations. This involves data analysis, financial modeling, and regular communications with internal teams, external advisors, and tax authorities to ascertain the organization's tax obligations and optimize tax strategies;

• to manage planning and administration of payroll, expenses, compensations and benefits, for example to administer and oversee all aspects of employee benefits and wellbeing programs within the organization. This encompasses both contractual benefits, such as health insurance, retirement contributions, as well as discretionary benefits and wellbeing initiatives aimed at promoting overall staff satisfaction and wellness. Activities include managing benefit enrollment, tracking eligibility criteria, coordinating with insurance providers, facilitating access to wellness programs and recreational activities, providing mental health support, and administering additional perks and benefits to enhance the employee experience;

• to manage travels and expenses, for example to issue, oversee, and administer corporate credit cards designated for various business-related expenses, or to review, authorize, and coordinate business travel requests, managing bookings and reservations, as well as to handle travel-related expense claims; 
• to enhance the skills, knowledge, and capabilities of the workforce, for example to organize and administer discretionary training programs within the organization. This encompasses identifying skill gaps or development opportunities, selecting appropriate training initiatives, scheduling sessions, and tracking participation and performance outcomes. Additionally, this activity includes evaluating the effectiveness of training efforts and adjusting programs as needed to support employee development and organizational goals; 
• to manage careers, development, performance evaluation and appraisal, and mobility, for example to develop and execute competency management, career plans, and talent development strategies within the organization. This includes identifying, nurturing, and retaining talent through activities such as skill development, training, talent acquisition, performance evaluations, succession planning, talent pool development, and engagement and retention strategies; 
• to manage workforce and organization, for example to organize and oversee the structure of the organization and its people. This encompasses activities such as defining job roles, charting organizational hierarchies, coordinating team alignments, evaluating performance, planning career paths, and ensuring that the workforce is aligned with the Company's strategic goals; 

• to manage offboarding, for example to ensure a smooth and compliant transition out of the organization. This encompasses activities such as finalizing payroll, ensuring the return of company property, revoking access to company systems and premises, conducting exit interviews, and documenting reasons for termination or resignation. Additionally, this data aids in understanding turnover rates, capturing feedback for organizational improvement, and maintaining records for any future rehiring or reference checks. The process ensures that both the organization's and the individual's interests are protected during the separation phase.

   

Compliance with legal obligations.

Certain processing activities are required to comply with our legal, regulatory, ethical and compliance obligations, for example with regards to tax reporting, social security contributions, pharmacovigilance, transparency, regulatory fining and submissions to Health Authorities, managing conflicts of interest and alerts reporting, ensuring the health and safety of our staff (“duty of care”), fighting against fraud, conducting internal investigations, audits, managing conflict of interest reporting. This also includes ensuring compliance with mandatory training requirements within the organization by delivering training and awareness campaigns on security best practices or compliance (identifying training needs, scheduling sessions, tracking completion status, and maintaining records of training participation and outcomes).

Legitimate interest.

In some cases, the processing of your Personal Data is not strictly necessary for the performance of the employment contract. In such cases, we process your Personal Data to pursue our legitimate interest to:

• to manage access to and occupation of offices, plants, facilities and other professional premises and to provide on-site services, for example through surveillance, access controls, and logging mechanisms to ensure the physical and digital integrity of the infrastructure, prevent unauthorized access to the site or to specific areas of the site, and maintain the safety and security of these areas (this encompasses issuing and monitoring access cards or badges); to assign workspaces, desks, or office rooms, manage shared workspace reservations, and monitor workspace utilization for space optimization, to manage and administer on-site services such as cafeterias, gyms, parking spaces or day-care centers, and to track service usage and gather feedback; 

• to manage internal communication and events, for example to plan, coordinate, and execute events and communication initiatives targeting internal stakeholders. This encompasses activities such as organizing workshops, townhall meetings, retreats, or company-wide celebrations, as well as distributing effective, clear, and timely communication within the organization. Information such as dietary preferences, attendance confirmations, logistical requirements, and feedback on events may be collected to ensure smooth operation and continuous improvement of these gatherings. Various communication platforms, including internal newsletters, intranet posts, email bulletins, digital message boards, and proprietary communication tools, are employed to foster a well-informed workforce, promote transparency, drive alignment with company goals, and cultivate a cohesive organizational culture; 

• to manage labor and industrial relations, for example to facilitate various aspects of the relationship between the organization and its unions or representative bodies. This includes organizing workers' representative elections, conducting collective bargaining negotiations, administering union membership and dues, and ensuring compliance with relevant agreements and regulations. The process aims to foster transparent and productive communication, uphold employee representation rights, and maintain constructive relationships with labor organizations; 
• to establish, exercise or defend our legal rights, for example to handle and oversee disputes, claims, and litigations; 
• to develop and operate our digital platforms and tools, for example to oversee the company's digital infrastructure, backup, and disaster recovery processes, or to track, monitor, and manage the company's inventory of digital devices and assets; 
• to protect our staff, visitors, assets and information, for example to ensure employees’ safety and security during business travels, to establish a list of emergency contacts, to ensure compliance with health, safety, and environmental (HSE) regulations and standards, as well as to manage incidents, to monitor our premises through CCTV and surveillance systems, to handle and respond to security incidents; 
• to engage and ensure satisfaction and wellbeing of our staff, for example to assess, monitor, and improve employee engagement within the organization. This involves conducting surveys, collecting feedback, analyzing responses, and implementing initiatives or programs based on the insights obtained, including Diversity, Equity and Inclusion (DEI) initiatives. The goal is to foster a positive work environment, improve retention, enhance productivity, and promote a culture of continuous feedback and improvement. Data may also be used to segment and tailor engagement efforts for specific departments, roles, or demographic groups within the workforce;
• to maintain a favorable operating environment for the company, for example to handle public affairs by performing activities such as engaging with policymakers, communicating with media outlets, advocating for industry interests, monitoring regulatory landscapes, and coordinating with community and public interest groups;

• to protect ourselves from financial, reputational and regulatory risk and liability, for example to design, implement, monitor, and refine Ethics and Business Integrity programs within the organization, to monitor and enforce compliance with internal policies and procedures, to prepare, plan and execute audit activities, to distribute reports and to manage possible findings and follow-ups, to evaluate and rate the inherent and residual risks associated with specific processes, projects, or departments, to document mitigating actions and their status, and to distribute reports to relevant stakeholders.

Consent.

In limited circumstances, we may seek your explicit consent as a legal basis for specific activities. These include, for example, participation in voluntary employee engagement surveys, inclusion in corporate marketing materials (e.g., photographs or videos), or processing of Data in relation to optional wellness programs. If we require your consent for any processing activity, we will provide clear and detailed information to ensure that your choice is fully informed. You have the right to withdraw your consent at any time without any negative consequences to your employment.

Activities under responsibility of other Opella companies.

In some circumstances, Opella Healthcare Group SAS, a company with registered office at 157 avenue Charles de Gaulle, 92200 Neuilly-sur-Seine, France, is also responsible for processing your Personal Data:

• to develop and operate our digital platforms and tools;
• to protect our staff, visitors, assets and information;
• to engage and ensure satisfaction and wellbeing of our staff;
• to maintain a favorable operating environment for the company;
• to protect ourselves from financial, reputational and regulatory risk and liability.

This happens, in particular, with regards to some processing of your Data that is performed for the benefit of Opella as a whole, or for goals that can only be achieved by pooling Data from staff members across different affiliates.

When this happens, the processing is performed to pursue the legitimate interests of Opella Healthcare Group SAS and its affiliates (as the case may be) to: ensure efficient group-level operations and maintain a favorable operating environment; safeguard security and integrity of individuals, assets, and information across Opella, allow to fulfill legal, regulatory, ethical and compliance obligations and protect the group’s interests and ensure compliance with legal and regulatory requirements.

Data processed by independent medical or occupational health professionals.

As mentioned in previous paragraphs, we process Data about you that qualifies as “Medical, health and impairment information”. However, in most cases, the processing of health-related Data is carried out by independent medical or occupational health professionals who operate and are autonomously responsible for using and protecting such Data. These professionals are subject to strict confidentiality obligations and legal or ethical duties that govern the handling of sensitive health information. As a result, while we may facilitate medical assessments, workplace accommodations, or health-related support programs, we generally do not have direct access to detailed medical records or diagnoses, unless required by law or when you voluntarily share such information with us.