APAC Privacy Notice

Corin APAC Privacy Notice

Introduction

Corin International Limited companies in the APAC region ("Corin") provide this Privacy Notice to explain how Corin processes your personal data and the rights you have in relation to it ("Privacy Notice").

This Privacy Notice is intended to comply with applicable privacy laws in the APAC region. Further details, including the categories of personal data processed, purposes, and legal bases, may be provided on the Corin webpage, or in the specific privacy notices at the point of data collection.

Data Controller

The specific Corin company that you interact with is the data controller responsible for processing your personal data. To exercise your privacy rights or raise any questions or concerns about the processing of your personal data, please contact the Corin Group DPO at: dpo@coringroup.com

Categories of Personal Data

We may collect and process the following categories of personal data:

• Web browsing data (e.g. website visits, IP address, device information, browser type, logs, language preferences)
• Contact and professional information collected through web forms, telephone, sales channels or email (e.g. name, email address, employer, phone number, billing address, job title, medical specialty, organization, clinical interests, expertise, resume, usernames and passwords)
• Marketing preferences and feedback (e.g. survey results)

Purposes and Legal Basis for Processing

We may process your personal data to:

• Communicate with you and respond to inquiries, feedback, complaints, or support requests;
• Provide our products or services as agreed upon
• Process payments and fulfil orders
• Manage optional cookies, web beacons and other site functionality;
• Personalize, maintain, and improve our products, services, websites and user experience
• Send marketing communications where you have consented
• Process employment applications
• Prevent fraud and protect network and information security
• Comply with legal obligations

We process personal data where necessary for the purposes described in this Privacy Notice and in accordance with applicable law. We generally do not use solely automated decision-making and will obtain consent before doing so where required.

If you choose not to provide the requested personal data, we may be unable to provide the relevant services.

Recipients of Personal Data

We may share your personal data with the following recipients:

• Corin Group affliates and subsidiares,
• Corin’s sister company, Arthrex Group companies and its subsidiaries
• Service providers acting as data processors contracted by Corin,
• Third-party service providers that help deliver our products or services (e.g. payment processors, shipping companies),
• Government authorities or law enforcement agencies where required by law.

We only share personal data with service providers that have appropriate data protection measures in place and are contractually required to protect its confidentiality and security.

International Data Transfers

In certain cases, we may transfer your personal data to other countries. When such transfers occur, we use appropriate safeguards such as standard contractual clauses and technical and organizational measures, to protect your personal data. To request a translated copy of these measures, please contact dpo@coringroup.com.

As Corin is part of an international group headed by Corin International Limited, The Corinium Centre Cirencester Gloucestershire, GL7 1YJ, United Kingdom, your personal data may be transferred within the Corin group on a need-to-know basis. Recipients of personal data are most likely located in the United Kingdom, Australia, Japan, or the United States.

Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including to meet any contractual, legal, or reporting requirements. Retention periods depend on the nature of the data and the purposes of processing. When personal data is no longer required, we will delete or anonymize it.

Your Rights

You may have the following privacy rights, subject to applicable law:

• Access your personal data and related processing information;
• Correction of inaccurate or incomplete personal data;
• Withdraw consent, where processing is based on consent;
• Request deletion of personal data in certain circumstances:
  • Where personal data is no longer required for the intended purpose
  • When you withdraw consent, where processing is based on consent
  • Where personal data has been unlawfully processed, or
  • When personal data has to be erased for compliance with a legal obligation
• Request restriction of data processing where deletion is not possible or disputed
• Seek appropriate redress for any damage caused by the processing of your personal data
• Lodge a complaint with a competent data protection authority in your jurisdiction or where Corin is established. Relevant authorities may include:
  • Australia: Office of the Australian Information Commissioner (OAIC)
  • Japan: Personal Information Protection Commission Japan
  • United Kingdom: Information Commissioner's Office

Corin may charge a fee for access requests where permitted by law and may refuse requests that are excessive, malicious, unlawful, or would infringe the rights of others.

For specific countries, you may exercise the following additional privacy rights:

Australia

• Remain anonymous or use a pseudonym where possible, unless this is impracticable or required by law.

Last Updated: 2026 August