Scenic Biotech Privacy Statement

1. INTRODUCTION

This Privacy Statement of Scenic Biotech B.V. and Scenic Immunology B.V. (collectively “Scenic,” “we,” or “us”) explains how we collect, use and disclose (together “process”) Personal Data (as defined below) about (i) the individuals that provide their biological specimen and related data to third party health institutes who collect genetic datasets and health records, (ii) website visitors, and (iii) other individuals we work with, including consultants and business partners (each such person a “Data Subject” or “you”).

“Personal Data” means any information that relates to a Data Subject and which directly or indirectly identifies him/her.

This Privacy Statement does not describe the cookies used on our website. To know more about the use of cookies, please refer to our cookies policy available in the banner of our website.

This Privacy Statement is organized according to the different roles in which you can be in contact with us. If you are for instance a website visitor, you can read in paragraph 3.2 which Personal Data is processed within the scope of a website visit, why, to which parties we disclose your Personal Data and how long we retain your Personal Data.

This Privacy Statement starts with a general part which is applicable to all Data Subjects.

2. GENERAL INFORMATION

2.1 Controllers and contact details

Scenic Biotech B.V. and Scenic Immunology B.V., located at Science Park 301, 1098 XH Amsterdam, the Netherlands, are the controllers of your Personal Data meaning that they determine the processes to be used when using your Personal Data. For questions about privacy or data protection or to exercise your rights, you can reach Scenic at +31 (0)20 7059990 or privacy@scenicbiotech.com.

2.2 Your rights

(A) Access: You have the right to request a copy of your Personal Data that are processed by or on behalf of Scenic. We can perform this request for you when we are able to identify you. In those cases, you can also request information about other details of the processing of your Personal Data, such as the retention period of your data (or the criteria to determine that period) and categories of third-party recipients. You can always find general information in this Privacy Statement.

(B)Where appropriate and where we are able to identify you, you also have the following rights:

  1. You can request us to rectify or complete your Personal Data which are incorrect, incomplete or have not been processed in accordance with applicable data protection law.
  2. You can request us to restrict the processing of your Personal Data, for example during the period that we check your request to rectify your Personal Data.
  3. You have the right to have your Personal Data deleted by Scenic. Scenic will not comply with such request where there are legal reasons, such as statutory retention requirements, to keep your Personal Data.
  4. You can request Scenic to provide you with a structured, commonly used and machine-readable copy of the Personal Data that you have provided to us. In those cases, you also have the right to have Scenic transfer such Personal Data to a third party without hindrance.
  5. You can object to the processing of your Personal Data by Scenic. Scenic can request you to state reasons related to your specific situation.
  6. Where the processing of Personal Data by Scenic was based on your consent, you can withdraw this consent at any time. Your withdrawal has no consequences for the lawfulness of the processing of your Personal Data before the withdrawal of your consent.

Note: These rights are not absolute. For example, we may decide to not fully comply with your request because we may need to protect the rights and freedoms of others, for scientific integrity, or for the establishment, exercise or defense of legal claims. If such a situation arises, we will inform you.

You can exercise all these rights by sending an email to privacy@scenicbiotech.com. We can ask you to identify yourself to make sure we perform the requested action on the correct Personal Data. When you are an individual that provides his/her biological specimen and related data to third party health institutes who collect genetic datasets and health records, we will not be able to identify you and we will refer you to your health institute first.

You always have the right to submit a complaint to the Dutch Data Protection Authority (at www.autoriteitpersoonsgegevens.nl).

3. INFORMATION PER ROLE

3.1 As an individual who provides his/her biological specimen and related data to third party health institutes who collect genetic datasets and health records

3.1.1 Which Personal Data do we process about you and why?

After we are granted access to the databases established by third party health institutes who collect genetic datasets and health records, we will process your genetic data and health records that are included in such datasets and records. Please note that we will only have access to your genetic data and health records in pseudonymous form (i.e., access in such a manner that the data/records can no longer be attributed to an individual without the use of additional information (to which we do not have access)). We will process such pseudonymized Personal Data for the purpose of health-related research:

(i)to validate/confirm genetic modifiers that we have identified through our human cell genetics platform or based on general knowledge (e.g., literature);

(ii)to discover novel genetic modifiers for rare (metabolic) genetic diseases.

The Personal Data that is collected by the third party health institutes for their genetic datasets and health records are as indicated in your information and consent form. This form was signed by you in the scope of a clinical research study and/or medical research project undertaken by such health institute. This information and consent form contains additional information about the processing of your Personal Data. Where there is a conflict between your information and consent statement and this Privacy Statement, the information and consent statement will prevail.

We will engage in this health-related research on the basis of your consent as set out in the information and consent form signed by you.

3.1.2 To which parties does Scenic disclose Personal Data?

Your pseudonymized Personal Data will only be accessed by our Senior Scientist Population Genetics.

3.1.3 How long are my Personal Data stored?

Based on the term of our agreements with the third party health institutes who collect your Personal Data, we will store your Personal Data for a period of 3 years after access thereto has been granted to us by the third party health institutes.

3.2 You are website visitor of Scenic

3.2.1 Which Personal Data do we process about you and why?

We collect the following Personal Data of individuals visiting our website for the following purposes:

(i)IP address and mobile device ID in order to calculate usage levels, diagnose server problems and administer our website;

(ii)other information that website visitors may submit via our online contact form in order to respond to their inquiries and fulfill requests.

We will engage in these activities with your consent and/or because we have a legitimate interest. Where we rely on legitimate interest, we always seek to maintain a balance between our legitimate interest and your privacy. Our legitimate interests include improving our website and communicating with our website visitors.

3.2.2 To which parties does Scenic disclose Personal Data?

Where this is required for the purposes described above, we will disclose your Personal Data to the following parties:Scenic employees; to our third party service providers to facilitate services they provide to us, such as website hosting, data analysis, information technology and related infrastructure provision.

3.2.3 How long are my Personal Data stored?

Scenic will retain your Personal Data only for the period necessary to fulfil the purposes outlined above. As an exception, we may be required to retain your Personal Data for longer periods as required or permitted by law, or a necessary to protect our rights and interests.

3.3.3 You are another individual we work with, including consultants and business partners

3.3.1 Which Personal Data do we process about you and why?

We collect the following Personal Data of other individuals we work with, including consultants and business partners:

(i)contact and identification details (such as name, telephone number, email address, home or work postal address);

(ii)data related to your professional life (such as your job title, the identity of your employer and your professional financial data).

We collect this Personal Data for the following purposes:

(iii)to communicate with you in order to:

  • perform a contract or precontractual measures;
  • discuss potential future services that may be provided to us;
  • keep you informed about our products, events and other news about Scenic;

(iv)to manage our orders and payments with you in order to:

  • perform a contract or precontractual measures;
  • verify your financial data to facilitate payments;

(v)to carry out internal audits, manage business administration (finance and accounting, fraud monitoring and prevention) and maintain the security of our services and operations.

We collect your Personal Data directly from you when you provide it to us and from third parties such as business partners and public sources.

We will engage in these activities to manage our contractual relationship, with your consent, or where we have a legitimate interest to be able to communicate with you as part of our business operations or to protect our rights and interests and comply with applicable law. Where we rely on legitimate interest, we always seek to maintain a balance between our legitimate interest and your privacy.

3.3.2 To which parties does Scenic disclose Personal Data?

Where this is required for the purposes described above, we will disclose Personal Data to the following parties:

(i)Scenic employees;

(ii)to our third party service providers to facilitate services they provide to us, such as customer service, email delivery and auditing;

(iii)legal and administrative authorities, as required by applicable laws.

3.3.3 How long are my Personal Data stored?

We will retain your Personal Data only for the period necessary to fulfil the purposes listed above. As an exception, we may be required to retain your Personal Data for longer periods as required or permitted by law, or a necessary to protect our rights and interests.

4. POSSIBLE OTHER USE AND DISCLOSURES

If we are required to do so, we may need to further use and disclose your Personal Data. This paragraph explains when this may be the case. Where possible, we will always inform you of any additional use or disclosure of your Personal Data which is not included in this Privacy Statement.

  • To comply with applicable law and regulations.
  • To cooperate with public and government authorities.
  • To respond to a specific lawful request for information or to provide information we believe is important.
  • To cooperate with law enforcement. For example, when we respond to law enforcement requests and orders or provide information we believe is important.
  • To enforce our terms and conditions and to protect our rights, privacy, safety or property, and/or that of Data Subjects or others.
  • In the event of any investment, legal restructuring, reorganization, merger, sale, acquisition, joint venture, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings). Such third parties may include, for example, an acquiring entity and its advisors.

5. JURISDICTION AND CROSS-BORDER TRANSFER

Were this is required for the purposes as mentioned in this Privacy Statement, Scenic will transfer Personal Data to countries outside the European Economic Area (EEA). Certain non-EEA countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards (the full list of these countries is available here). For transfers from the EEA to countries not considered adequate by the European Commission, we will put in place adequate measures, such as standard contractual clauses adopted by the European Commission to protect Personal Data. Data Subjects may obtain a copy of these measures via the contact details mentioned in this Privacy Statement.

6. UPDATES OF THIS PRIVACY STATEMENT

The latest version of this Privacy Statement will always be published on the Scenic website. As we may not always have the contact details to inform you separately where required, please check our website regularly for possible updates on this Privacy Statement.