Last Updated: 30 April 2021

This Privacy Information Center explains how we collect, use, process and disclose your personal information across our business activities. In all cases, we are committed to protecting the privacy of individuals in accordance with applicable global privacy laws.

We have two sections in this Information Center:

A. Privacy Standards

B. Privacy Statement (including general information, plus some additional specific information for European and Californian individuals)

In our Privacy Standards and Privacy Statement, Antibodysystem SAS are referred to as “we”, “us” or “our” or “Antibodysystem”) to provide information about how we receive, collect, use and transfer information about individuals to whom personal information pertains (for the purposes of this Privacy Statement, “you”).

Please take the time to review the information in this Privacy Information Center. If you have any questions please contact your Antibodysystem representative or data.order@antibodysystem.com.

We also invite you to read our notice on the use of cookies.

A. Antibodysystem’s Privacy Standards

Across all of our business activities we recognize and seek to base our privacy practices on accepted principles utilized by various regulatory and industry groups. In summary, these principles are as follows:

a. Collection Limitation: To obtain personal information by lawful and fair means and, where appropriate, with the knowledge and consent of the individual about whom we process personal information (the “individual”).

b. Data Quality: To process personal information that is accurate, complete and up-to-date (taking into account the purposes for which it was collected).

c. Purpose Specification: To specify the purposes for which personal information is collected before such collection takes place.

d. Use Limitation: To use personal information only in accordance with the specified purposes except where the individual has provided their consent or by the authority of law.

e. Security Safeguards: To protect personal information using reasonable security safeguards.

f. Openness: To be open about privacy practices, policies and developments, and the details of any processing that takes place.

g. Individual Participation: As required by applicable law, to give effect to individuals’ requests to know what personal information is being processed and guide how that data should be processed.

h. Accountability: To be accountable for complying with measures that give effect to these Privacy Standards.

Privacy standards may vary by country, region, or Antibodysystem business group, depending on applicable law and regulations.

B. Antibodysystem Privacy Statement

Scope: This Privacy Statement is relevant to:

a. Any user of, or visitor to, Antibodysystem’s websites, mobile applications, or other online services or products (“Online Services”).

b. Individuals who share their business contact information and other personal information with Antibodysystem during events including tradeshows or conferences, or for other business purposes, including customer services and product or laboratory services, such as current or prospective customers and their representatives; and

c. Any members of the public who interact with Antibodysystem and individuals with whom we do business, including, but not limited to, staff of regulatory authorities and suppliers and visitors to our sites and offices.

1. Information that Antibodysystem May Process About You

Antibodysystem SAS may process information about you and may collect this information from various sources, including, but not limited to, personal information you actively share with us, personal data about you shared by your institution or company, or personal information about you collected through publicly-available sources and authorized third parties with whom we have a business relationship. We may also generate further information about you on the basis of the information collected from other sources.

If you are located in the European Economic Area (“EEA”) or United Kingdom, please also see our Additional Privacy Statement - Europe. If you are a resident of California, please also see our Additional Privacy Statement - California at paragraphs 9 and 10 of this document.

a. Information You Actively Submit

If you create an account, order products, register for services, or otherwise submit data to Antibodysystem, we will collect information about you and the company or other entity you represent (e.g., your name, organization, address, email address, phone number, fax number)

You may also provide information such as payment information to make a purchase, shipping information to receive a purchase, completing a survey to help us improve our products and services, or a resume to apply for employment. In such instances, you will know what personal information is collected by us, because you will have actively submitted it

We may collect and process contact information that you provided directly to us (e.g., your name, email address, phone number and business address) through online or offline channels, including where you interact with our systems and services or provide such information in person during tradeshows, networking events, conferences, and similar events, and information about your business and its interactions with Antibodysystem

We may collect details of your customer service requests and feedback on your experience with these and other services

We may also collect and process audio recordings of calls to customer service centers

If you visit our sites and offices, we may collect and process information about you (e.g., your name and company name) to register you in our systems, help us with screening our visitors and provide you with appropriate access credentials. We may also collect CCTV images for the purposes of access control and site security

Where permissible in accordance with applicable law, we may collect biometric data (e.g. fingerprints) to improve the operation of, or enable access to, certain products

b. Information Passively Submitted or Obtained From Other Sources

We automatically collect information during your use and navigation of the Online Services, including the URL of the website you came from, the browser software you use, your Internet Protocol (IP) address, IP ports, date/time of access, data transferred, pages visited, amount of time you spend on the Online Services and information about actions and transactions conducted

If you use our mobile applications, then we also collect technical information about your device (including device operating system version and device hardware), unique device identifiers (including device IP address), and, if you activate the relevant feature on your device, we may collect geolocation data. This data is generated and collected automatically, as part of the standard operation of the Online Services and will only be processed in accordance with applicable laws and regulations

We may collect personal information about you related to your interests or work (e.g., your position, specialty and publications) from publicly-available resources such as company, university, and publication websites, social media and other digital platforms, national registries and professional databases or directories, or third party vendors who act on our behalf, in accordance with relevant laws and regulations

We may collect certain information about you from your company, (e.g. your position, department, contact details, company address) and other information specific to your order or interests

c. Cookies

We also use “cookies” to enhance and customize your experience of the Online Services. A cookie is a small text file that may be stored on your computer or device used to access the Online Services. You may set your browser software to reject cookies, but doing so may prevent us from offering conveniences or features on the Online Services. To reject cookies, refer to information about your specific browser software. We also use eTags, which are opaque identifiers assigned by a web server to specific versions of a resource found at a URL. If the resource at that URL changes, a new and different eTag is assigned. This allows us to track which pages you visit while on the Online Services. In addition, we use electronic images known as web beacons (also called pixel tags or clear GIFs) to track users who have visited the Online Services. Web beacons allow us to deliver content and marketing communications tailored to your interests. We strive to provide a customized, personalized experience to website visitors. Our websites do not currently respond to ‘do not track’ signals in web browsers.

2. Why Antibodysystem Processes Your Information

We use the personal information that we process about you to:

a. Create an account for you or the organization for which you work.

b. Enable you to use online social media resources that we may offer from time to time.

c. Authenticate your identity, where necessary or required by law.

d. Enter into a sales or service contract with you or the organization for which you work.

e. Fulfill your orders for products and services.

f. Contact you about products and services that may be of interest to you and to obtain feedback about your experiences with Antibodysystem.

g. Perform our contractual obligations to you or the organization for which you work under any applicable contract.

h. Provide requested services, information and product support.

i. Respond appropriately to your inquiries.

j. Update your account, orders and transactions.

k. Discharge our contractual obligations to you.

l. Comply with any legal obligations that apply to us.

m. Verify financial transactions and undertake compliance screening checks.

n. Conduct analytical and profiling activities including to:

Improve the efficiency of our internal processes and procedures and overall quality of the products and services that we provide.

Customize your experience on the Online Services.

Create customer profiles of you including to prepare relevant products and services.

To the extent permitted by applicable law, including in accordance with your consent where required by applicable law, we may engage in the following activities:

a. We may use your contact details to contact you to determine whether you would like to initiate a business relationship with us or to send you marketing emails.

b. If you do not wish to receive such marketing emails, you may opt out by declining to receive such emails when registering and in our subsequent communications by following opt-out instructions included in such emails or at other information collection points on the Online Services.

c. We may collect personal information about you (e.g., your position, specialty and publications) from publicly-available resources such as company, university, and publications websites, and combine it with personal information we have collected about you, to enhance our customer profile of you in support of our sales and marketing activities.

d. We may process recordings of your calls with our customer services representatives to ensure we deliver high-quality service, assist in the training and development of Antibodysystem representatives, and generally improve our customer service to you.

e. We may display advertisements to you regarding products and services that we believe are relevant to you based on your activities on the Online Services or on other web or digital properties. Such advertisements may be shown on our Online Services or the online services of others. We achieve this by using, and allowing third parties (e.g. Facebook, LinkedIn) to use, certain cookies, eTags, web beacons and other tracking technologies to track your activities on our Online Services and other online services.

f. We may make customer offers to you based on your activities across different Online Services including activities on other web or digital properties your other interactions with Antibodysystem that are not via the Online Services (e.g. regional offers based on the location of your office listed on order forms).

We also perform statistical analyses of the users of our Online Services to improve the functionality, content, design and navigation of the Online Services.

3. Disclosure of Your Information

In accordance with our Privacy Statement, we may share your personal information across all our subsidiaries, divisions and groups worldwide.

We will only disclose your personal information to third parties in compliance with the law, including in the following circumstances:

a. To third-party service providers, who act on our behalf and instructions to fulfill product orders, deliver services, provide IT support, and fulfill the other purposes set forth above;

b. To select business partners, where necessary, to discharge the purposes set forth above or where reasonably required to pursue our legitimate business aims;

c. As required by applicable law, including, without limitation, in response to any government or regulatory agency request, to cooperate with law enforcement investigations, or upon receipt of any court order;

d. To a prospective or actual purchaser or seller in the context of a merger, acquisition or other reorganization or sale of our business or assets;

e. To courts and public authorities to protect you, us, or third parties from harm, including fraud or instances where somebody’s physical safety is at risk; or

f. We may disclose the personal information you provide in connection with a customer service request (including to our service providers as necessary to assist us responding to such requests).

Service providers acting on our behalf shall be obliged to adhere to agreements including confidentiality requirements no less protective than those described in this Privacy Statement and will only process personal information as necessary to perform their functions in a manner consistent with this policy, other applicable privacy notices (e.g., our cookie policy), and as explicitly permitted or required by applicable laws, rules and regulations.

Our third-party service providers are located in the United States and other jurisdictions.

4. How Long Antibodysystem Retains Your Information

We generally retain personal information for as long as needed for the specific business purpose or purposes for which it was collected. In some cases, we may be required to retain personal information for a longer period of time by law or for other necessary business purposes. Where possible, we aim to anonymize the information or remove unnecessary identifiers from records that we may need to keep for periods beyond the specified retention period.

5. Your Choices

Please note that in many circumstances we cannot effectively do business with you without processing some personal information about you (e.g. your contact information).

You can use the Online Services without consenting to cookies (unless strictly necessary); the consequence is that some features of the Online Services may be less tailored to you, and some functionality may be reduced Please see section B 1. (c) above for more information about Cookies.

You have the right to opt out of receiving marketing communications. Please use the unsubscribe functionality on such communications.

You can make a request with respect to your personal information by contacting data.info@antibodysystem.com. More information about specific rights of European and Californian individuals is set out in paragraphs 9 and 10 below.

We will make reasonable efforts to respond promptly to your requests in accordance with applicable laws.

Where you contact customer service representatives, we may require you to provide information able to authenticate your identity in order to assist you with your request. If you are unable to provide this information, we may be unable to process your request.

Where we receive your personal information from our customers and process your personal information on their behalf, we do so in the capacity of a processor. We do not have control over our customers’ privacy and security practices and processes. If your personal information has been submitted to us by a Antibodysystem customer and you wish to exercise any of the above-mentioned rights, please contact the relevant customer directly, or provide us with the name of the customer so that we can appropriately refer your request to them.

6. Information Security

We implement technical, physical, and organizational measures intended to safeguard any information you provide through the Online Services, and to protect it from unauthorized access, loss, misuse, or alteration. Nevertheless, no computer system or transmission of information can ever be completely secure or error-free, and you should not expect that your information will remain private under all circumstances. In addition, it is your responsibility to safeguard any passwords, ID numbers, or similar individual information associated with your use of the Online Services.

7. Changes to this Privacy Statement

We reserve the right to change this Privacy Statement from time to time. We will alert you when changes have been made by indicating the date this Privacy Statement was last updated as the date the Privacy Statement became effective. It is recommended that you periodically revisit this Privacy Statement to learn of any changes.

8. Questions and Comments

If you have questions or comments about this Privacy Statement or about how your Personal Information is processed, please contact data.order@antibodysystem.com.

9. Additional Privacy Statement – Europe (Including Switzerland and UK)

The following sections apply to individuals in EEA, UK and Switzerland and should be read in addition to the main sections of the Privacy Statement.

a. Legal Bases of Processing

In accordance with applicable laws, we in most cases rely on the following legal bases to process your personal data, as appropriate:

a. Contract Performance: The processing is necessary for us to perform a contract with you or take steps at your request prior to entering into a contract;

b. Legal Obligation: The processing is necessary for us to comply with an applicable legal obligation;

c. Legitimate Interest: The processing is necessary for us to realize a justified and legitimate interest considering your privacy and other fundamental rights and interests; and

d. Consent: The processing is performed according to your consent.

The specific legal bases on which we rely for each of the purposes for which we process your personal information are set forth below:

Processing Purpose including but not limited to: Applicable Legal Basis

Create an account for you or the organization for which you work;

Enable you to use online social media resources that we may offer from time to time;

Enter into a sales or service contract with you or the organization for which you work;

Fulfill your orders for products and services;

Perform our contractual obligations to you or the organization for which you work under any applicable contract;

Update your account, orders and transactions; and

Discharge our contractual obligations to you.Contract Performance based on applicable contract.

Legitimate Interests to provide services.

Consent.

Authenticate your identity, where necessary or required by lawLegal Obligation.

Legitimate Interest.

Contract Performance.

Provide requested services, information and product support;

Respond appropriately to your inquiries; and

Request feedback.If your request or inquiry relates to a service you have ordered, registered for or otherwise contracted for, Contract Performance based on our Terms of Service or other applicable contract.

If we are legally obligated to respond to your request or inquiry, Legal Obligation.

In all other cases, Legitimate Interest as part of our commitment to provide you with good customer service.

Consent.

Comply with any legal obligations that apply to us; and

Verify financial transactions and undertake compliance screening checks.Legal Obligations per applicable laws.

Legitimate Interests in protecting customers and Antibodysystem.

Conduct analytical and profiling activities including to:

Improve the efficiency of our internal processes and procedures and overall quality of the products and services that we provide

Create customer profiles of you including to prepare relevant products and services

Legitimate Interest based on our interest to improve our services and products through data analysis.

Customize your experience on the Online Services;

Contact you to determine whether you would like to initiate a business relationship with us or to send you marketing emails;

Collect personal information about you (e.g., your position, specialty and publications) from publicly-available resources such as company, university, and publications websites, and combine it with personal information we have collected about you, to enhance our customer profile of you in support of our sales and marketing activities;

Display online advertisements to you regarding products and services that we believe are relevant to you based on your activities on the Online Services; and

Make customer offers to you based on your activities across different Online Services and your other interactions with Antibodysystem that are not via the Online Services (e.g. regional offers based on the location of your office listed on order forms).Legitimate Interest.

Consent as legally required.

If we are legally obliged to do so under applicable laws and regulations, we will obtain your consent and rely on Consent.

Process recordings of your calls with our customer services representatives to ensure we deliver high-quality service, assist in the training and development of Antibodysystem representatives, and generally improve our customer service to you.Legal Obligation.

Consent.

Legitimate Interest to improve our customer service and comply with any applicable legal and regulatory obligations.

Where applicable, wherever we rely on the Consent Legal Basis, you may withdraw such consent at any time, without affecting the lawfulness of processing based on consent before such withdrawal.

b. Individual Rights Requests – your rights and access to your information

You may access, correct, and/or update your information by directly accessing any accounts or profiles that you have created with us.

Where required by applicable law, e.g. EU data protection laws, such as the General Data Protection Regulation (‘GDPR’), or California privacy laws, such as the California Consumer Privacy Act (‘CCPA’) which applies to personal information Antibodysystem has collected and used in the past 12 months, you may have the right to: request access to information that we hold about you; request corrections or updates to your personal data; or, in some cases, ask us to erase your personal information to the extent that we are not required to retain it by law.

If you are located in the EEA, where the processing of your information is subject to EU data protection laws, you may have the following rights:

Right to restriction of processing: You may have the right to request restriction of processing of your personal data, in which case, it would be marked and processed by us only for certain purposes

Right to data portability: If processing is based on your consent or a contract you have entered into with us, you have the right to receive the personal information which you have provided to us in a structured, commonly used and machine-readable format and you may have the right to transmit the personal information to another entity without hindrance from us

Right to object: You have the right to object to our processing of your personal information for direct marketing purposes. You can exercise this right by clicking the ‘unsubscribe’ button in our communications to you. Where we rely on Legitimate Interest Legal Basis, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal information by us and we can be required to no longer process your personal information (e.g., where we engage in profiling activities for marketing-related purposes). If you exercise this right, your personal information will no longer be processed for such purposes unless otherwise authorized by law (e.g. if processing of your personal information is necessary to take steps prior to entering into a contract or to perform a contract already concluded)

Right to Submit Complaints: You may have a right to lodge a complaint with a local supervisory authority, for example, where you feel that we have processed your personal information in a manner that is unlawful or in breach or your rights

c. Profiling

We do not engage in automated decision-making, including profiling, which produces legal effects concerning you. We may engage in profiling and analytics activities for general improvement of our business processes and for marketing-related purposes. In particular, we may use automated means to process personal information collected via your interaction with Antibodysystem including the Online Services, or obtained from public resources such as company, university and publications websites, to help us identify products and services that we believe you may be interested in, and help us deliver relevant advertisements or marketing to you.

10. Additional Privacy Statement – Residents Of The State Of California, USA

The California Consumer Privacy Act of 2018 (“CCPA”) requires us to provide additional privacy-related information to residents of California, effective January 1, 2020.

a. California Residents’ Privacy Rights

Under the conditions set out under the CCPA, California residents have rights under Cal. Civ. Code §§ 1798.100, 1798.105, 1798.110, 1798.115 and 1798.125, including to:

(i) Request access to copies of their personal information;

(ii) Request access to information about what categories of personal information we have collected from them, the categories of sources of such information, the purposes for which we collect their personal information, the categories of third parties with whom we have shared their personal information, and the categories of personal information that we have disclosed about them for a business purpose;

(iii) Request deletion of their personal information;

(iv) Be free from unlawful discrimination because they exercised any of their rights under the CCPA; and

(v) Be notified of any financial incentives offered to them in exchange for any right we wish to have to collect, sell or delete their personal information.

Not all California residents may exercise all of the above rights in all circumstances. For example, the CCPA currently does not establish the above rights (with the exception of the right described in bullet (d) above) with respect to personal information reflecting a written or verbal communication or a transaction between a California resident and us where the California resident acts as an employee, owner, director, officer, or contractor of a company or other entity and the communication or transaction with us occurs solely within the context of us conducting due diligence regarding, or providing or receiving a product or service to or from such entity.

Californian residents may submit a request to exercise their rights under the CCPA by emailing us at data.info@antibodysystem.com.