Privacy Notice

1. Introduction

1.1 This Privacy Notice outlines how we protect your personal data (which means data that identifies you as an individual or relates to an identifiable individual and which we will refer to in this Privacy Notice as “Personal Data”) to ensure that Astrea Bioseparations Limited and its subsidiaries or affiliates within the Biotage group (whose privacy notice can be found here: https://www.biotage.com/legal-terms) (together referred to in this Privacy Notice as “we”, “us” or “our”) provide an adequate level of protection of the Personal Data we collect about you and it explains:

• what Personal Data we collect about you when visiting our website from which this Privacy Notice is linked (“Website”) or otherwise in the course of your relationship with us;
• for what purpose we collect your Personal Data and how we use it;
• who your Personal Data is disclosed to and how long we keep it; and
• your legal rights in respect of your Personal Data that we collect, including how to access and update the information we hold about you.

1.2 Our Website is not targeted at or intended for use by individuals under the age of 18 and we do not knowingly collect Personal Data from such individuals.

1.3 By using this Website and/or by providing us with your Personal Data, you are agreeing to the terms of this Privacy Notice.

2. What personal data we collect about you and for what purpose

2.1 We collect Personal Data in various ways on our Website, including through registrations, applications, surveys, in connection with your enquiries, and automatically when you browse our Website. We may request more specific information or Personal Data from you when you place an order on our Website. We also collect Personal Data at conferences, trade shows and meetings (both in-person and virtual) from individuals who engage with us directly and voluntarily provide us with their Personal Data.

2.2 We will generally process Personal Data about you in the following circumstances:

• If you are visiting our Website: we may collect and process data about your use of our Website such as your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and Website navigation paths, as well as information about the timing, frequency and pattern of your Website use (“Usage Data”) for Website analytics. Our legal basis for doing this is legitimate interests (system administration, market research and improving our business offering, and to protect the security and integrity of our Website).
• For marketing purposes: we may collect and process Personal Data that you provide to us when (i) navigating on our Website or entering our competitions or subscribing to our emails or other communications to receive marketing materials such as webinar information and/or newsletters, or (ii) when requesting a customer account with us or raising enquiries regarding our goods or services (“Enquiry Data”). Our legal basis for doing this is legitimate interests.
• For responding to enquiries and communications you make with us: We may collect and process Personal Data contained in or relating to any communication or enquiries that you send to us (“Communication Data”). Communication Data may include the communication content and metadata associated with it as well as any information you provide to us directly (such as in-person, at a virtual meeting or via email). Our Website will automatically generate the metadata associated with communications sent to us using our Website contact forms.
• The Communication Data may be collected and processed for the purposes of communicating with you and any other parties necessary for that communication (such as other parties copied into the correspondence) and record keeping for the administration of our Website and our business operations. Our legal basis for doing this is for performance of a contract with you or taking pre-contractual steps at your request.
• For job applications: If you are making a job application or enquiry, you may provide us with a copy of your CV or other relevant information including your Personal Data. We may use this information for the purpose of assessing your application or enquiry. We may also keep this information on file to contact you about future opportunities unless you ask us not to do this. Our legal basis for doing this is legitimate interests.

• For our legitimate interests we may collect and process any of your Personal Data where we believe in good faith that it is reasonably necessary to do so for our business purposes, including:
  - to negotiate and enter into commercial or corporate transactions;
  - for audits, monitoring and prevention of infringement or other misuse of our products, services and/or intellectual property rights or any other rights;
  - for the establishment, exercise or defence of legal claims and to enforce our legal rights, whether in court proceedings or in an administrative or out-of-court procedure or as part of any criminal or other legal investigation;
  - to manage risks or obtain professional advice; operating and ensuring the security of our Website, network and services and to maintain back-ups of our records and systems; and
  - to obtain or maintain insurance coverage.
• If you are one of our customers, we may collect and process the following Personal Data:
  - basic business contact information about you, such as your name and contact details (email, address, phone number);
  - contractual information (such as details about your purchase form us); and
  - financial information, such as your bank account details for managing transactions.

Customer Personal Data is collected when you complete the relevant registration form on our Website, navigate on our Website or otherwise correspond with us and is processed by us on the following legal bases:

3. Disclosing your personal data to others

3.1. We may disclose your Personal Data to any member of the Biotage group of companies. Such disclosure will only be as reasonably necessary for the purposes, and on the legal bases, set out in this Privacy Notice.

3.2 We may disclose your Personal Data to third parties who we act for or who act on our behalf such as our insurers, distributors, resellers, agents, service providers, and/or professional advisers for further processing in accordance with the purpose for which the data was originally collected by us, or insofar as reasonably necessary for the purposes of, amongst other things, for the provision of services to us, obtaining or maintaining insurance coverage, managing risks, obtaining professional advice, obtaining technical support, to protect your safety or the safety of others, to ensure our Website integrity and security or the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure or in connection with a criminal or other legal investigation.

3.3 We may share Usage Data that is collected by or transferred to us, with third party websites including, but not limited to Google Analytics. We use your Usage Data to monitor and improve our Website and services. The legal basis for this processing is our legitimate interests.

3.4 Financial transactions made through our Website and services are handled by our third party payment services providers.. We will share account data and transaction data with our payment services providers only to the extent necessary for the purposes of processing your payments, making refunds and dealing with complaints and queries relating to such payments and refunds.

3.5 We may disclose your Enquiry Data to other companies with which we collaborate regarding particular products or services. These may include any member of the Biotage group of companies and our co-promotion partners for products that we jointly develop and/or market.

3.6 We may use and disclose your Personal Data where we believe in good faith that such disclosure is reasonably necessary or appropriate:

• to comply with a legal obligation (i) to comply with applicable law or our regulatory monitoring and reporting obligations (which may include laws outside your country of residence), (ii) to respond to requests from public and government authorities (which may include authorities outside your country of residence), or (iii) to cooperate with law enforcement organisations or authorities, or for other legal reasons;
• to enforce our terms and conditions;
• to protect our rights, privacy, safety or property and/or that of our group; or
• to protect your rights, privacy, safety or property or that of others.

3.7 We may use or disclose your Personal Data to third parties in the event of the sale, merger, assignment or transfer of some or all of our business.

4. International Data Transfers

4.1 The Personal Data we collect may be transferred to, stored and processed by third parties in any country inside or outside the EEA and the UK where we or any member of the Biotage group of companies have facilities or in which we engage service providers, including in the United States.

4.2 In some cases, your Personal Data may be processed by third parties (including any member of the Biotage group of companies) in countries outside of the EEA or the UK which do not meet the standard of data privacy protection of the EEA or the UK. In such cases, we sign contractual agreements (such as Standard Contractual Clauses or similar) as required in relation to the processing of Personal Data which is subject to applicable data protection laws with the relevant third parties to ensure that they provide an adequate level of protection for your Personal Data.

5. Retaining your personal data

5.1 We will retain your Personal Data for as long as is reasonably necessary to fulfil the purpose or those purposes for which it was collected and as outlined in this Privacy Notice. The criteria used to determine our retention periods include (i) the length of time we have an ongoing relationship with you and make the Website available to you; (ii) if retention is necessary for compliance with a legal obligation or a legal basis to protect our interest to which we are subject, or in order to protect your interests or the interests of another natural person; or (iii) whether retention is advisable in light of our legal position (such as in regard to the enforcement of the Website Terms of Use, applicable statutes of limitations, litigation or regulatory investigations).

6. Your rights

6.1. Under applicable data protection laws, you may have rights in relation to the Personal Data we hold about you. In accordance with rights under UK or EU laws, if applicable, you can make a request to us in order to:

• access the Personal Data we hold about you. Please note that we reserve the right to request proof of your ID to process your request, and to charge you a reasonable administrative fee for any repetitive, manifestly unfounded or excessive requests. If we refuse your request to exercise this right, we will give reasons for our refusal and allow you to challenge our decision;
• rectify any incorrect or incomplete Personal Data we hold about you. It is in both our interest and yours that any Personal Data we hold about you is accurate, complete and current;
• delete, restrict or remove the Personal Data we hold about you;
• transfer the Personal Data we hold about you to another party;
• revoke any consent you have granted to us to have your Personal Data collected, processed, and used; or
• object to any further processing of your Personal Data by us or a third party as set out in this Privacy Notice.

6.2 You can make all such requests or let us know if you have any concerns about how we process your Personal Data via the contact details under the “Contact” section below. Please note that in respect of each of these rights we reserve the right to refuse your request based on the exemptions set out in the applicable data protection laws.

6.3 If you are in the EEA or UK, you also have the right to lodge a complaint with the local data protection authority if you believe that we have not complied with applicable data protection laws.

7. Third party websites

7.1 Our Website contains links or references to external websites of other organisations. This Privacy Notice applies only to our Website and not any external websites that we link or refer to, who will have their own privacy policies.

7.2 We have no control over, and are not responsible for, the privacy policies and practices of third parties.

7.3 In addition, if you visit our Website from a link on an external website, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party website and we recommend that you check the privacy policy and practices of that external site.

8. Data Security

8.1 While we strive to protect your Personal Data, no data transmission or storage can be guaranteed as 100% secure. We endeavour to protect all Personal Data using reasonable and appropriate physical, administrative, technical, and organisational measures, and in accordance with our internal security procedures and applicable law.

9. Cookies

9.1 A cookie is a piece of text that gets entered into the memory of your browser by a website, allowing the website to store information on your machine and later retrieve it.

9.2 Our Website and services may use cookies, unique device identifiers, and other tracking technologies (“Cookies”) to distinguish you from other users of our Website and to allow us to better serve you when you return to our Website, and to monitor and analyse the usage of our Website. Cookies also enable us and our third-party partners to track and target the interests of our users to enhance the onsite or customer experience through the provision of content, features, and advertisements.

9.3 Further information about the cookies that we and our third-party partners may store on your machine and how you can manage them can be found at our Cookie Policy.

10. Changes to this Privacy Notice

10.1 We may from time to time update this Privacy Notice. Any changes will become effective when we post the updated Privacy Notice on the Website. The Privacy Notice was last updated and shall take effect as of the “Last Updated” date shown below.

11. Contact us

11.1 The company responsible for collection, use and disclosure of your Personal Data under this Privacy Notice is Astrea UK Services Limited.

11.2 If you have any queries about this Privacy Notice, or you would like to exercise any data privacy rights, please contact us at dataprotection@astrea-bio.com or write to the following address: Unit 1 Horizon Park, Barton Road, Comberton, Cambridgeshire, CB23 7AJ, UK

Last update on 9 Sep 2024