Last Updated: October 2022
Under the European Union’s General Data Protection Regulation (GDPR) and similar laws in the United Kingdom and Switzerland, people in these regions and countries have certain rights regarding their Personal Information. This European Privacy Notice supplements our main Privacy Notice. If there is any conflict between this European Privacy Notice and our main Privacy Notice, the terms in this European Privacy Notice take precedence for visitors located in the European Economic Area, United Kingdom or Switzerland.
| Name of data controller and contact details | CytomX Therapeutics, Inc. 151 Oyster Point Blvd, Suite 400 South San Francisco, CA 94080-1913 Telephone: 650-515-3185 DataPrivacy@cytomx.com |
| Purposes of the processing | The purposes of the processing are described in the section of the main Privacy Notice entitled How We Use Your Information. |
| Lawful basis for the processing | Generally, we process personal data on the basis that the processing is necessary for purposes of our legitimate interest in conducting our business in a manner typical in the US pharmaceutical industry, having taken into account any risks to your fundamental rights and freedoms (including your right to privacy). We also may process personal data on other bases permitted by the EU General Data Protection Regulation (“GDPR”), the UK Data Protection Act 2018 and other applicable laws, such as when the processing is necessary for us to comply with our legal obligations. |
| The legitimate interests of the controller or third party, where applicable | Our specific legitimate interests, such as responding to your requests, comments and questions, providing you with support and improving the website, are described in the section of the main Privacy Notice entitled How We Use Your Personal Information. |
| The categories of personal data concerned | The categories of personal data that we process are described in the section of the main Privacy Notice entitled Information We Collect. |
| The recipients or categories of recipients of the personal data | The potential recipients of the personal data that we collect via the website are described in the section of the main Privacy Notice entitled Sharing of Personal Information with Third Parties. |
| Information regarding the transfers of personal data outside of the European Economic Area (EEA), Switzerland and the United Kingdom (UK) | CytomX Therapeutics, Inc., is headquartered in the USA and the website is hosted in the USA. The laws of the USA have not been deemed by the European Commission, the United Kingdom or Switzerland to provide an adequate level of protection to personal data. When you provide your personal data to us via the website or contact us by email, you are providing your personal data directly to the USA. Before you provide your personal data to us via the website, we request your explicit consent to the transfer of your personal data to the USA. When you email us, the fact that you have chosen to email us knowing that we are located in the USA will be understood to constitute your explicit consent to the transfer of the personal data in your email (including your email address) to the USA. Regardless of the differences in US and European privacy laws, we safeguard your personal data as described in our main Privacy Notice and this European Privacy Notice. If we transfer your personal data to a third party, we require the third party to commit contractually to process your personal data only in ways that are consistent with our main Privacy Notice and this European Privacy Notice. |
| The period for which the personal data will be stored, or the criteria for determining the retention period | How long we retain personal data varies according to the type of data in question and the purpose for which it is used. We delete personal data within a reasonable period after we no longer need to use it for the purpose for which it was collected or for any subsequent purpose that is compatible with the original purpose. This does not affect your right to request that we delete your personal data before the end of its retention period. We may archive personal data (which means storing it in inactive files) for a certain period prior to its final deletion, as part of our ordinary business continuity procedures. |
| Your rights to access, correct, restrict or delete your personal data and object to processing | You have the right to request access to your personal data, to have your personal data corrected, restricted or deleted, and to object to our processing of your personal data. Your rights may be subject to various limitations under the GDPR. If you wish to exercise any of these rights, or if you have any concerns about our processing of your personal data, please contact us in any of the ways listed in the section entitled How to Contact Us. The GDPR’s data portability rights are not relevant to the kinds of processing that we do. |
| The right to lodge a complaint with a supervisory authority | You have the right to file a complaint concerning our processing of your personal data with your national (or in some countries, regional) data protection authority. The EU Commission has a list here: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm See www.ico.org.uk for information about contacting the UK Information Commissioner’s Office. See www.edoeb.admin.ch/edoeb/en/home.html for information about contacting the Swiss Federal Data Protection and Information Commissioner. |
| Statutory or contractual requirement or other obligation to provide any personal data | Users of the website are under no statutory or contractual requirement or other obligation to provide personal data to us via the website. |