PRIVACY POLICY

This Privacy Policy was last modified on 07-Mar-2021.

Cortexpert may update its Privacy Policy from time to time without prior notice by updating this page.
Frequent visits to the CORTEXPERT website (Privacy Policy) and/or application will keep the User
informed about how personal data is used. Continued use of the website and/or application after
change or modification of the Privacy Policy implies acceptation thereof.

CORTEXPERT has developed a Privacy Policy that covers how personal data is collected, used,
disclosed, transferred and stored in accordance with the General Data Protection Regulation (the
“GDPR”), which applies throughout the European Union since 25 May 2018, with the Belgian Law of
30 July 2018 on the protection of personal data and any new or updated local requirements since
Cortexpert has its offices based in Belgium.

CORTEXPERT’s mission is to connect professional independent freelancers (hereinafter the
“Freelancer”) with - but not limited to - pharmaceutical and food industries, device companies,
headhunter companies, clinical research organizations (CRO), etc. registered on the CORTEXPERT
website (the “Partner”) from all over the world. Both Freelancer and Partner are considered as
CORTEXPERT’s Users (the “User”).

CORTEXPERT offers to the Freelancers the possibility to e.g. share their professional identity,
exchange already disclosed or disclosable knowledge and professional insights with the Partners,
seek for business opportunities, manage timesheets and financial contracts on behalf of the Partner
(the “Services”).

The Privacy Policy applies to Personal Data collected and processed by CORTEXPERT in
connection with the offered Services.
Your Personal Data (the “Personal Data”) are any information which makes you (the User)
identifiable as a natural person in particular by reference to an identifier such as: first name, last
name, education, academic degree(s), bank account number(s), picture(s), etc.
The processing of your Personal Data (the “Processing”) means any operation or set of operations
which is performed by CORTEXPERT and/or Partners on Personal Data or on sets of Personal
Data; whether or not by automated means, such as collection, recording, organization, structuring,
storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination, restriction, erasure or
destruction.

This Privacy Policy does not apply to:

Data collected by the Partner’s - or third party’s- websites, platforms and/or applications
which CORTEXPERT does not control;
Data collected by the Partner’s - or third party’s- websites which the User accessed via
links on the CORTEXPERT website and/or application;
Advertisements or promotions on the Partner’s - or third party’s- websites that
CORTEXPERT sponsors or participates in.

These Partner’s - or third party’s- websites may have their own privacy policy and it is recommended
to read these policies before using these websites.

The following information can be found on CORTEXPERT’s Privacy Policy:
1. Which data does CORTEXPERT collect?
2. How does CORTEXPERT collect your personal data?
3. What does CORTEXPERT use your personal data for?
4. What are the rights and obligations of the User?
5. Who is the data controller and how may you exercise your rights?
6. How CORTEXPERT protects your personal data?
7. Who may access your personal data?
8. Are your personal data transferred?
9. How long are your personal data kept by CORTEXPERT?

1. WHICH DATA DOES CORTEXPERT COLLECT?

The following categories of Personal Data are collected, allowing the User to be identified on
CORTEXPERT platform:

1.1 ALL USERS
- Personal identification: Username, e-mail, password
- Electronic identification: IP address, last update of the profile on CORTEXPERT

1.2 PARTNER
Mandatory to provide on CORTEXPERT:
- Professional data: company name, company type, first name, last name, function, address,
postal code, city/town, country, phone number
- Financial data: invoice information which are department/contact person, address, postal code,
city/town, country, e-mail, phone contact

Optional to provide on CORTEXPERT:
- Professional data: middle name, mobile number
- Financial data: VAT number, your reference (PO#)

1.3 FREELANCER
Mandatory to provide on CORTEXPERT:
- Personal identification: first name, last name, address, city-town, postal code, country, mobile
number
- Professional data: industry domain, expertise, experience level, therapeutic area experience,
preferred working location(s), residence location, availability to travel, professional availabilities
- Financial Data: remuneration proposal, currency, hourly/daily rate, working under VAT or as
individual, insurance coverage (if any)
- Other data: driving license

Optional to provide on CORTEXPERT:
- Professional data: middle name, company name, headline, landphone number, linkedin
references, skype, website, past and present work experiences, membership, professional
references, any constraints to work with a Partner.
- Professional skills: educational background, languages knowledge, scientific publications and
certificates/awards.
- Financial data: invoice information (VAT #)
- Other data (mandatory): profile picture

2. HOW DOES CORTEXPERT COLLECT YOUR PERSONAL DATA?

CORTEXPERT collects personal data via the following ways:

2.1 ONLINE REGISTRATION
Registration as a User requires entering the name, current address, e-mail address, telephone
number and password in order to create an account (hereinafter the ‘Account’). The Account of the
User is personal.
Registration implies that the User agrees that the data uploaded on the website and/or application
can be used by CORTEXPERT in accordance with this Privacy Policy.

2.2 CUSTOMER SERVICE
When contacting CORTEXPERT’s help center or customer service, data will be collected. This data
will only be used to respond questions, to identify potential problems, and to register trends, in order
to render better Services.

2.3 USE OF THE CORTEXPERT WEBSITE AND/OR APPLICATION
CORTEXPERT collects data when the CORTEXPERT website and/or application is being used.

When an account is used, the IP address will be linked to that account.

2.4 USE OF WEBSITES AND/OR APPLICATION OF PARTNERS
CORTEXPERT receives data when an account is used and the User connects to another website
and/or application via CORTEXPERT.

2.5 COOKIES
CORTEXPERT uses cookies to improve the experience on the CORTEXPERT website and/or
application, to optimize the security and protection of data and to measure the use and effectiveness
of the Services. The User is able to manage cookies via his/her browser settings. For further data
please read the CORTEXPERT Cookie Policy.
By visiting the CORTEXPERT website and/or application, the User is invited to accept or adapt the
insertion of cookies according to this Privacy Policy and the Cookie Policy.

3. WHAT DOES CORTEXPERT USE YOUR PERSONAL DATA FOR?

Any of the data we collect from you may be used for one or more of the following purposes:

3.1 To enable secure login for you;

3.2 To establish a communication path with you (via our newsletter or per e-mail regarding
opportunities, services, contracting, etc);

3.3 To provide our Services, including recruiting services (i.e. providing you with interesting
opportunities, inviting you to interviews, etc);

3.4 To identify you as a contracting party;

3.5 To enable CORTEXPERT to issue valid VAT invoices, manage timesheets and to
process payments;

3.6 For security reasons and misuse detection, prevention and reporting;

3.7 To comply with our legal obligations as well as with any valid request from policy, judicial
or governmental authorities.

3.8 To improve our Platform and services;

3.9 To personalize your experience (the information will help CORTEXPERT better respond
to your individual needs);

3.10 To produce and display cookie declarations to Users;

3.11 To enable automated handling of your profile by search functions: the search engine
allows the Freelancer to search e.g. for missions. Conversely the Partner is able to search for
Freelancers to perform missions. Additional data on the Anonymous Profile will help to
improve and refine the search results.
In addition, Personal Data, and data with regard to the activities of the User will be made public, if
disclosure is required by law, legislation, a summon of writ or other legal proceedings.

CORTEXPERT decides in its full discretion on the necessity of disclosure of the data and will
undertake to inform the User if she receives any request thereto (except when prior inform is
prohibited by a court ruling or in case of an emergency).

4. WHAT ARE THE RIGHTS AND OBLIGATIONS OF THE USER?

4.1 USERS’ RIGHTS
The User is entitled to
- modify and/or correct the content on his/her Account by going back into his/her account,
editing it and saving changes;
- get a copy of his/her Personal Data in a structured, commonly used and machine-readable
format;
- limit the processing of his/her personal data if and when (a) you contest the accuracy of that
data, (b) the processing is illegitimate or (c) the data are no longer needed for the purposes
which are outlined in section 3;
- object the processing of his/her personal data;
- withdraw his/her consent to collect, use, disclose, transfer and store his/her personal data by
deleting his/her Account.
The User is able to delete his/her Account, using the link “Cancel Account”. The request will
be sent automatically to the server of CORTEXPERT. The User will receive an e-mail in
which he/she is asked to confirm the deletion. CORTEXPERT undertakes to remove the
personal data as soon as possible after notification of deletion by the User. The departing
User will receive an e-mail confirming that his/her profile has been removed from
CORTEXPERT database.
User’s Personal Data that would be hold by CORTEXPERT outside the platform (timesheet,
contracts, etc) may undergo the same rights by contacting CORTEXPERT as specified under
section 5.
However, the rights to delete data and to object on the use of the data may be restricted:
CORTEXPERT will evaluate such request against CORTEXPERT’s own or a third party’s overriding
interests; legal or regulatory obligations or administrative or judicial orders which may contradict
such deletion or objection of use.
Personal data of the Freelancer shared and received by the Partner, outside the CORTEXPERT
platform, is not managed by CORTEXPERT and CORTEXPERT has no control over this. The
privacy policy of the respective Partner, understanding the application of the GDPR obligations for
the Partner, is applicable to this information.
If the User does not agree with the collection, use and disclosure of the personal data,
CORTEXPERT recommends not to register to, or not to use the CORTEXPERT’s website and/or
application.

4.2 USERS’ OBLIGATIONS
The User has the obligation to abide by the Terms and Conditions, the Privacy Policy and other
policies of CORTEXPERT to be able to use CORTEXPERT’s platform and Services.
The Freelancer undertakes to update his/her data on his profile account and warrants that the data
is correct and accurate. CORTEXPERT cannot be held responsible by the Partner for the content of
the profile account of the Freelancer.
The User will not upload and disseminate data that potentially infringes the rights of other
Freelancers, Partners and/or CORTEXPERT.
The User undertakes to keep his/her Username and password confidential. He/she will not share
this data with others.
Non-compliance with the guidelines set forth in the Conditions & Terms, the Privacy Policy, the
Cookie Policy or any other policy of CORTEXPERT gives CORTEXPERT unilateral the right to
restrict, suspend or terminate the account.

5. WHO IS THE DATA CONTROLLER AND HOW MAY YOU EXERCISE YOUR RIGHTS?

Red Cortex SPRL with registered office in Belgium at 1495 Sart-Dames-Avelines, Rue du Vieux
Chemin 90, is responsible for the data stored and processed by CORTEXPERT. CORTEXPERT is a
product of Red Cortex SPRL, a limited liability company.
If you have questions, concerns, complaint or if you would like to exercise your rights, please
contact Red Cortex at tel. 0032 477 51 53 75 or info@cortexpert.com.
You may exercise your rights directly on CORTEXPERT’s platform. However, in case you would like
to exercise a right outside the CORTEXPERT platform regarding data held by CORTEXPERT, we
will ask you to inform Red Cortex in written specifying which right(s) you wish to exercise and the
reasons for it, if such is required. Your request must be dated and signed, and accompanied by a
digitally scanned copy of your valid identity card proving your identity.
Red Cortex undertakes to examine and reply all such communications at the latest thirty (30)
calendar days after having received a request, if the request proves to be valid.
If you are still unsatisfied with our response, you may file a complaint with the adequate supervisory
authority.
Partner may be also responsible for the collection and processing of the Freelancer’s personal data.
This will be the case when the Freelancer uses CORTEXPERT (its platform and/or Services) to
establish an agreement directly or indirectly with the Partner.

6. HOW CORTEXPERT PROTECTS YOUR PERSONAL DATA?

CORTEXPERT is under the obligation, as Data Controller, to comply with the GDPR in order to

process your personal data necessary for the applied Services and as such will request a consent to
process the Personal Data of each User.
When processing your Personal Data, CORTEXPERT undertakes to comply with the following
principles under which Personal Data shall be:
- Processed lawfully, fairly and in a transparent manner;
- Collected for specified, explicit and legitimate purposes;
- Adequate, relevant and limited to what is necessary;
- Accurate and, where necessary, kept up to date;
- Kept in a form which permits identification for no longer than is necessary for the purposes for which Personal Data are processed;
- Processed in a manner that ensures integrity and confidentiality.
CORTEXPERT utilizes a cloud-based environment to ensure high availability of User’s data at all
time. CORTEXPERT takes the following technical, physical and organizational measures to
maintain the safety of your personal data against accidental or unlawful destruction or accidental
loss, alteration, unauthorized use, unauthorized modification, disclosure or access and against all
other unlawful forms of processing:
- The physical security of CORTEXPERT’s platform is maintained by CORTEXPERT’s
subcontractors which complies with industry standards such as ISO 27001 for physical
security and availability. The servers are located in a protected data centre in France, to
which physical access is controlled and restricted e.g. by using security staff around the
clock, two-factor access control using biometric and card readers, barriers, fencing, security
cameras and other measures.
- The electronic (cloud-based) security management of CORTEXPERT website includes the
managing of Drupal security patches as well as server security. CORTEXPERT uses the SSL
(Security Sockets Layer) in its URL to enable the highest protection of the data. To protect
the data stored on the CORTEXPERT servers, CORTEXPERT regularly checks its systems
for security vulnerabilities and attacks.
Backup of data takes place weekly. A physical copy of the data is also kept in a safe.
CORTEXPERT’s subcontractor has a data center disaster recovery mechanism. All failover
mechanisms are fully automated.
No personal data is stored permanently outside CORTEXPERT’s cloud platforms.
- CORTEPXERT communicates the privacy and security guidelines to its employees and
strictly enforces privacy safeguards within the company.
- Any third-party companies contracted by CORTEXPERT to develop, make the Services and
features available or to improve them (including, but not limited to maintenance, audit,
marketing, development) have limited access to the data on the CORTEXPERT website
and/or application. Third party companies are contractually obliged not to disclose the data
and not to use it for other purposes than those specified under section 3.
- All Users are required to consent to CORTEXPERT’s Privacy Policy. The Partners are also requested to apply GDPR whenever accessing to Freelancer’s personal data.
- Access to a Users’ Account is secured with a password. The User is responsible for the
security and protection of his/her credentials. All access to personal data is blocked by
default without proper User’s login/password. Access to personal data is restricted to
individually authorized personnel at CORTEXPERT.
In the event of a Personal Data Breach, CORTEXPERT will take immediately all deemed possible
measures to stop the breach to limit any possible detrimental effect on the User and will analyze the
impact of the breach. According to article 33.1/34.1 GDPR, CORTEXPERT shall exclusively decide,
at its own discretion and in compliance with the relevant and applicable data protection laws,
whether or not Users whose Personal Data have been impacted by a personal data breach shall be
notified of this, and/or whether or not notifying the Supervisory Authority.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction,
loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or
otherwise processed in connection with the provision of the Service.

7. WHO MAY ACCESS YOUR PERSONAL DATA?

Your Personal Data may be disclosed to and/or processed by the following entities:
- Yourselves
- CORTEXPERT’s personnel;
- CORTEXPERT’s Service Providers contracted to manage the CORTEXPERT’s platform and
have a data processing agreement with CORTEXPERT;
- Partners, as described below
- Whenever required by laws, to relevant government authorities, independent audit body and
other regulatory bodies or agencies who requires to be provided with your personal data for
the purposes of verifying the compliance with legal and regulatory requirements.
Your personal data will not be sold, exchanged, transferred, or given to any other company for any
reason whatsoever, without your consent, other than for the express purpose of delivering the
Services requested.
The Public Profile, Anonymous Profile, Full Profile and the Partner Profile are hereinafter referred to
as the ‘Profile’ or ‘Profiles’.

With regard to the Freelancer:
The CORTEXPERT website uses a three-layer profile.
The public profile of the Freelancer contains a short, partly anonymized, presentation of the
Freelancer that can be viewed on a permanent base and is available for everybody (hereinafter the

‘Public Profile’). The Public Profile gives the following data on the Freelancer: pixeled picture
(blurred), description of the Freelancer, country and region of residence, hourly rate and availability.
In order for the Partners to view additional data on the Freelancer, registration via an Account is
required (registered Freelancers cannot see the anonymous profile of other Freelancers). Only
registered Partners have access to the partly anonymous profile of the Freelancer. In comparison
with the Public Profile the following data is added to the partly anonymous profile of the Freelancer:
language, education, level of experience, countries where the Freelancer wants to work, driving
license, willingness to travel. All relevant professional data is being displayed, with the exception of
contact details such as name and telephone number (hereinafter the ‘Anonymous Profile’)
The contact details of a Freelancer will only be disclosed by CORTEPXERT to a Partner in the
context of providing Freelancer’s own services to the demanding Partner.
The contact details together with the data on the Anonymous Profile contain the full profile of the
Freelancer (hereinafter the ‘Full Profile’). The data on the Full Profile enables the Partner to contact
the chosen Freelancer(s) directly by means found adequate by the Partner and Freelancer (private
e-mailing, phone, etc).
By adding additional data to the Anonymous Profile CORTEXPERT will be able to better align the
professional needs between the Freelancer and the Partner.
Data on Freelancer Anonymous Profile can be viewed by the registered Partners. The Freelancer
will not implement any data to his/her Anonymous Profile that he/she does not want to make public.

With regard to the Partner:
The creation of an account (‘Partner Profile’) enables the Partner to access to the Freelancer’s
database. The Partner profile is not accessible to Freelancers. Nevertheless, the Partner will not
implement any data on his Partner Profile that he does not want to make public to CORTEXPERT’s
personnel.

8. ARE YOUR PERSONAL DATA TRANSFERRED?

8.1 DATA TRANSFERRED WITHIN CORTEXPERT SERVERS
Personal data located on CORTEXPERT’s servers are backed-up in a protected data centre in
France (in a different server than the main servers) and will therefore not leave the European Union.
By using the CORTEXPERT website and/or application or providing CORTEXPERT with personal
data, the User agrees to CORTEXPERT doing so in accordance with the terms of this Privacy Policy.

8.2 FREELANCER’S DATA CONSULTED BY PARTNERS
Your Personal Data as Freelancer may be consulted outside the European Union and the European
Economic Area (EEA) for proposing the Services. Third countries may not provide for the adequate

level of personal data protection as required per GDPR and/or as in your home country. Transfer of
your personal data to such third countries will be done provided that you explicitly accepted it prior to
the transfer occurred in the framework of proposing your freelancer services.
The User should be aware that while personal data is in another country, this data may be accessed
by the courts, law enforcement and national security authorities in that country in accordance with its
laws.

9. HOW LONG ARE YOUR PERSONAL DATA KEPT BY CORTEXPERT?
Your Personal Data are included in the CORTEXPERT database for a duration of 10 years upon
your last log in onto CORTEXPERT website. Prior to deleting your account, you will be prompted
(per mail) to reconnect on CORTEXPERT website if you would like to keep your User account on
CORTEXPERT database. Without any action for your side, your User account will be deleted.