Privacy Notice – Biognosys Group

This Privacy Notice applies to the website of the Biognosys Group, consisting of Biognosys AG (Switzerland), PreOmics GmbH (Germany), and biocrates life sciences gmbh (Austria) (together, the “Biognosys Group”, “we”, “us” or “our”).

The Biognosys Group website is operated by Biognosys AG, acting on behalf of the Biognosys Group. Where personal data is processed through this website or related online services, Biognosys AG, PreOmics GmbH and biocrates life sciences gmbh act as joint controllers within the meaning of applicable data protection laws, in particular Article 26 GDPR and the Swiss Federal Act on Data Protection.

This Privacy Notice explains how we collect, use, share and otherwise process personal data in connection with the Biognosys Group website and related interactions, as well as how you can exercise your data protection rights.

If you have any questions or concerns about our use of your personal information, please contact us using the contact details provided at the end of this Privacy Notice. For more information about Biognosys Group, refer to the “About Us” section of our website.

Read this Privacy Notice carefully to ensure you don’t miss any information that may be relevant to you.

Scope of this Privacy Notice

This Privacy Notice is relevant to:

i. Any user of, or visitor to, Biognosys Group websites, platforms, applications and other online services or products under our control (“Online Services”).

ii. Individuals who share their business contact information and other personal information with us in the framework of a potential or ongoing business relationship, during webinars, trainings or events including tradeshows or conferences, or for other business purposes, including customer services and product or laboratory services, such as current or prospective customers and their representatives; and

iii. Any members of the public who interact with Biognosys Group and individuals with whom we do business, including, but not limited to, staff of regulatory authorities and suppliers and visitors to our sites and offices.

This Privacy Notice is not applicable to any applicant, employee, contractor, or other individual working on Biognosys Group sites. If you are part of the Biognosys Group staff, please refer to the Staff Privacy Notice on the intranet of your employer. Applicants may refer to the privacy notice on the respective job portal.

In certain cases, the collection and use of personal information may be described in a separate privacy notice.

Data Controllers and Joint Controllership

The following entities act as joint controllers for the processing of personal data in connection with the Biognosys Group website:

• Biognosys AG, Wagistrasse 21, 8952 Schlieren, Switzerland
• PreOmics GmbH, Fraunhoferstraße 9A, 82152 Martinsried, Germany
• biocrates life sciences gmbh, Eduard‑Bodem‑Gasse 8, 6020 Innsbruck, Austria

The joint controllers have entered into an internal arrangement pursuant to Article 26 GDPR that allocates responsibilities for compliance with data protection obligations. Biognosys AG acts as the primary contact point for data subjects and supervisory authorities in relation to the Biognosys Group website.

What personal data do we collect and why?

The personal information that we collect about you broadly falls into the following categories:

a) Information that you provide voluntarily

• We may collect personal data directly from you when you interact with us and use it for the purposes described below or as communicated to you at the time of collection.
• When you subscribe for a newsletter at our website, or when you submit a contact or feedback form, you may be asked to submit certain information to us, such as contact details (name, surname, e-mail address, phone number, etc.), your role within your company and your company’s interaction with us, geographical information (i.e. business address/country), and how you would qualify your interest in Biognosys Group.
• When you participate or are an invited speaker in seminars, workshops, tradeshows, or conferences we may ask you to provide contact details (name, surname, e-mail address, phone number etc.), your role within your company and your company’s interaction with Biognosys Group, geographical information (i.e. business address/country), and national registration number if you are a healthcare professional in certain countries, where applicable.
• When you complete a survey on your experience with our product and services, and to help us improve our products and services, we may ask you to indicate your role within your company and your company’s interaction with Biognosys Group, geographical information (i.e. business address/country).
• When you visit our sites and offices, we may collect name, surname, e-mail address, phone number, etc.), your role within your company and your company’s interaction with Biognosys Group, geographical information (i.e. business address/country) to register you as a visitor in our system, to screen our visitors against sanctioned parties list, and to provide you with appropriate access credentials. We may also collect CCTV images for the purposes of access control and site security, in accordance with the applicable laws and regulations. In the case of an epidemic or pandemic, and in accordance with the applicable local laws and regulations, we may collect information about your body temperature (e.g., but not exclusively, using a thermo-scanner), or whether you have travelled to high-risk countries or high-risk areas.
• If you are a consultant of Biognosys Group, work for a company having a contractual relationship with Biognosys Group, or otherwise provide services to us you may be asked to submit certain information to us, such as contact details (name, surname, e-mail address, phone number, etc.), your role within your company and your company’s interaction with Biognosys Group entities, geographical information (i.e. business address/country).
• If you fill out any other kind of form at a fair or other marketing event organized by us or where Biognosys Group is represented, we may collect (name, surname, e-mail address, phone number, etc.), your role within your company and your company’s interaction with Biognosys Group, geographical information (i.e. business address/country), and how you would qualify your interest in Biognosys Group.
• If you purchase a product from the website of any of our entities, we collect your name, address, telephone number, company affiliation, email address, delivery/invoicing address, and, if relevant, your professional background. A third-party data controller processes and stores your credit card information.

b) Information that we collect automatically

In certain cases, we may automatically collect personal information about you and the device you use when interacting with us:

• When you use and navigate our online services, visit our website, subscribe to a news feed on social media, watch a webinar, we automatically collect certain information from your device. This personal data may include: your IP address, device type, unique device identification numbers, browser-type, the URL of the website you came from, broad geographic location (e.g. country or city-level location), date-time of access, the amount of time you spend using the services and website, data transferred, pages visited, and other technical information. We may also collect information about how your device/hardware has interacted with our website or platform (including links clicked), what activities you have performed within an application (i.e. login history). Most of this data is generated and collected automatically, as part of the standard operation of our online services and will only be processed in accordance with applicable laws and regulations.
• When you are invited and participate to a videoconference with any entity of Biognosys Group, we automatically collect certain information about you (e.g. first and last name, e-mail address, profile picture if any), meeting metadata (e.g. date, time and duration of communication, name of the meeting, participant IP address), device data (e.g. IP addresses, MAC addresses, Clint version), text and video data (e.g. chat histories; video, audio and presentation recordings as permitted under the applicable law and under your consent, where applicable), and connection data (e.g. phone numbers, country names, start and end times, IP addresses).
• When you receive an e-mail from any entity of Biognosys Group, we may collect information on whether the e-mail was opened, and any content was accessed through the e-mail.

Some of this information may be collected using cookies and similar tracking technology, as explained further in our Cookie Notice page.

c) Information collected from third parties

We may collect information about you from third parties usually to complete the information we need to create or maintain our relationship with you.

• We may collect personal information when we acquire companies and perform post-merger integration, to evaluate the target company and its business, in accordance with relevant laws and regulations.
• We may collect additional personal information about you when we perform screenings for compliance purposes as indicated under letter a. (Information you provided voluntarily) above, to complete part of the personal information already provided by you.
• We may use publicly available resources that hold personal information provided by you and/or your company (i.e. commercial register, company websites, professional networks, university, publication websites, social media and other digital platforms) or from third-party vendors who act on our behalf, in accordance with relevant laws and regulations.

In general, we will use the personal information we collect from you only for the purposes described in this Privacy Notice or for purposes that we explain to you at the time we collect your personal information. However, we may also use your personal information for other purposes that are not incompatible with the purposes we have disclosed to you (such as scientific or historical research purposes or statistical purposes) if and where this is permitted by applicable data protection laws.

As a general principle, your granting of any consent and your provision of any personal information to one or more entities of Biognosys Group is entirely voluntary; there are generally no detrimental effects on you if you choose not to consent or to provide your personal information. However, there are circumstances in which we cannot take action without certain personal data, for example because this personal data is required to process your orders or requests, manage the contractual relationship our entities maintain with you or the company you work for, or provide you with access to a specific online content or newsletter. In these cases, it will unfortunately not be possible for us to provide you with what you request without the relevant personal data.

Why do we process your personal information?

Personal data collected via the Biognosys Group website may be processed by one or more companies within the Biognosys Group to the extent necessary for the purposes described in this Privacy Notice, including business development, customer relationship management, scientific collaborations, marketing activities, and compliance with legal obligations.

Whether you are a customer, a user of our online services (including our websites), a supplier of products and services to us, an attendee or speaker at a conference, event, or roadshow organized or attended by Biognosys Group, or you collaborate in a scientific research or project with Biognosys Group, we will process your personal information to (as applicable):

i. Create an account on our online services for you or the company or organization you work for, and maintain and update such account;

ii. Enable you to access or interact with our online resources, including webinars;

iii. Verify your identity, where required by law;

iv. Negotiate and enter into agreements (such as sales and service agreements or research collaborations) with the company or organization you work for, and fulfil your orders for products and services, and perform any obligation arising from our relationship with the company you work for, or as required by law;

v. Update orders and transactions;

vi. Contact you about products and services you may be interested in, or provide you with updates and support on products and services;

vii. Provide the company or organization for which you work with our product and services;

viii. Comply with any legal obligations that apply to us;

ix. Verify financial transactions and undertake compliance screening checks.

In accordance with the applicable local laws, and based on your consent where required, we may also:

i. Contact you to send you marketing e-mails or newsletters, marketing material via regular e-mail, or call you over the phone, to understand whether you are interested in our products and services. In these cases, you will have the opportunity to opt out from being contacted by Biognosys Group at any time;

ii. Collect personal information about you (e.g., your position, specialty, and publications) from publicly available sources such as company, university, publications websites, and combine it with personal information we have collected about you, to enhance the customer profile in support of our sales and marketing activities.

Third Parties

We may disclose your personal information to the following categories of recipients:

• within the Biognosys Group, where necessary to operate the website, manage business relationships, respond to inquiries, organize events, or carry out sales, marketing, or compliance activities, in accordance with this Privacy Notice;
• to our website or application hosting partners and other third parties who assist us in operating our platforms, conducting our business, or servicing you, as long as these parties agree to process any personal data in compliance with applicable data protection law;
• to our affiliated companies, third party services providers and partners, including distributors and other sales intermediaries, who provide data processing services to us or who otherwise process personal information for purposes that are described in this Privacy Notice or notified to you when we process your personal information;
• A list of our current affiliated companies is made available on request. Third party service providers and partners include Customer Relationship Management (“CRM”) solution providers or Marketing Automation Solution providers and a list of the third-party service providers and partners relevant with regard to your personal information is made available on request;
• to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person;
• to an actual or potential buyer (and its agents and advisers) in connection with any actual or proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Notice;
• to any other person with your consent to the disclosure.

Cookies and similar tracking technology

We use cookies and similar tracking technology (collectively, “Cookies”) to collect and use personal information about you, including to understand and save your preferences for future visits and serve interest-based advertising. For further information about the types of Cookies we use, why, and how you can control Cookies, please consult our Cookies Notice.

How does Biognosys Group keep your personal information secure?

We use appropriate technical and organizational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information. Specific measures we use include regular malware scanning, creating regular backups. Your personal information is contained behind secure networks and is only accessible by a limited number of people who have special access rights to such systems and are required to keep the information confidential. We require the same level of diligence from any third party involved in the processing of your personal information in accordance with applicable law.

International data transfers

Since Biognosys Group is operating within a global network of partners, your personal information may be transferred to and processed in countries other than the country in which you reside, including the USA and the EU. Transfers of personal data outside of your country of origin are made according to the applicable data protection laws, based on your consent where required, or with the implementation of appropriate safeguards such as, but not limited to, a decision taken by the competent data protection authority declaring that the level of data protection of the country of destination is adequate, the EU Standard Contractual Clauses or similar contracts where legally permitted.

If you’d like to know more about how we ensure compliance when transferring your personal information internationally, please contact us at the contact details provided below.

How long do we keep your personal information for?

We retain personal information we collect from you as long as it is necessary or technically required to achieve the purposes for which it was collected, to comply with statutory retention periods and for our legitimate interests in documentation (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Your rights over your personal information

Please note that in many circumstances we cannot effectively do business with you without processing some personal information about you (e.g. your contact information).

You can use our online services without consenting to cookies (unless strictly necessary); the consequence is that some features may be less tailored to you.

You have the right to opt out of receiving marketing communications at any time. Please use the unsubscribe functionality on such communications.

You may exercise your rights in respect of personal data processed under this Privacy Notice against any of the joint controllers. For efficiency and coordination purposes, requests should preferably be submitted by completing this form to Biognosys AG as the designated contact point; however, this does not affect your statutory rights vis‑à‑vis the other joint controllers. More information about specific rights for individuals domiciled in the EU/EEA or Switzerland is described below.

We will make reasonable efforts to respond promptly to your requests in accordance with applicable laws. When you contact us, we may require you to provide information to authenticate your identity to assist you with your request. If you are unable to provide this information, we may be unable to process your request.

Where we receive your personal information from our customers and process your personal information on their behalf when fulfilling our contractual duties, we may do so in the capacity of a processor. We do not have control over our customers’ privacy and security practices and processes. If your personal information has been submitted to us by a customer and you wish to exercise any of the above-mentioned rights, please contact the relevant customer directly, or provide us with the name of the customer so that we can appropriately refer your request to them.

Privacy Statement EU/EEA and Switzerland

If you are located in the EU/EEA or Switzerland the following additional privacy notice applies.

Legal Basis for processing your personal data

In accordance with applicable laws, we in most cases rely on the following legal basis to process your personal data, as appropriate:

• Contract Performance: The processing is necessary for us to perform a contract with you or take steps at your request prior to entering into a contract;
• Legal Obligation: The processing is necessary for us to comply with an applicable legal obligation;
• Legitimate Interest: The processing is necessary for us to realize a justified and legitimate interest considering your privacy and other fundamental rights and interests;
• Consent: The processing is performed according to your consent.

The specific legal basis on which we rely for each of the purposes which we process your personal information for are set forth below:

Your Data Subject Rights

• If you wish to access, correct, update or request deletion of your personal information, you can do so at any time by completing the Data Subject Request Form.
• In addition, you can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. Again, you can exercise these rights by contacting us using the contact details provided under the “How to contact us” heading below.
• You have the right to opt-out of marketing communications from Biognosys at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you. To opt out of other forms of marketing (such as postal marketing or telemarketing), please contact us using the contact details provided under the “How to contact us” heading below.
• Similarly, if we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
• You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority.

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. The competent data protection authority of Switzerland is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).

Updates to this Privacy Notice

We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.

You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the top of this Privacy Notice.

How to contact us

Biognosys AG acts as the central contact on behalf of the Biognosys Group for data protection matters relating to the Group website.

If you have any questions or concerns about our use of your personal information, please contact us using the following details:

• by post at Wagistrasse 21, 8952 Schlieren;
• by email using our Data Subject Request Form that you can send to our Data Protection Officer at dpo@biognosys.com; or
• by telephone on +41 (0) 44 244 50 00.