Website Privacy Notice
Last revised on May 13, 2026
- Who We Are
- Definitions
- Data Protection Legislation
- Data Controllership
- Your Information
- Cookies
- Strictly Necessary Cookies
- Functionality Cookies
- Tracking and Performance Cookies
- AvenCell Cookies
- Our Purposes
- Our Partners
- Our Retention Periods
- Our Communication Channels
- Third Party Links
- Security
- Children’s Privacy
- International Transfers
- Your Rights
- EU/EEA
- Complaints
- Changes to the Notice
- Your duty to inform us of changes
- Providing Company with other people’s data
- Contact Us
1. Who We Are
AvenCell Therapeutics, Inc., along with our affiliates AvenCell Europe GmbH, and AvenCell Japan KK (“AvenCell”, “we”, “our” or “us”); is a clinical stage biopharmaceutical company and clinical trial sponsor. We have developed this Website Privacy Notice to inform you of the data we collect, what we do with your information, what we do to protect it, as well as the rights and choices you may have over your Personal Data.
As such, this AvenCell Website Privacy Notice may apply to you if you are:
- An AvenCell clinical trial participant;
- A partner of an AvenCell clinical trial participant;
- A parent or guardian of an AvenCell clinical trial participant;
- A child of an AvenCell clinical trial participant;
- A healthcare professional conducting an AvenCell clinical trial;
- An employee, contractor or other associated party associated with AvenCell;
- An employee, contractor or other associated party contracted by AvenCell’s Service Providers;
- A service user of this website (https://avencell.com); or,
- Any other individual with whom AvenCell may conduct commercial operations.
2. Definitions
For the purposes of this Notice:
| Term | Meaning |
|---|---|
| Affiliates | An entity that controls, is controlled by, or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority. |
| Aggregated Data | Summarised data derived from your Personal Data. Examples are statistical or demographic data. It is not considered Personal Data in law as this data will not directly or indirectly reveal your identity. |
| Company | Referred to as either “AvenCell”, “we”, “our” or “us” – refers to AvenCell Therapeutics Inc., 500 Forge Road, Suite 302 Watertown, MA 02472, USA and Affiliates. |
| Cookies | Small files that are placed on Your computer, mobile device, or any other device by a website, containing the details of Your browsing history on that website among its many uses. |
| Data Controller | For the purposes of EU GDPR, refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data. For the purpose of EU GDPR, the Company is the Data Controller of Your Personal Data for the purposes of this Privacy Notice. |
| Data Processor | For the purposes of EU GDPR, refers to the Company’s Service Providers. |
| Data Protection Legislation | The data protection laws which apply to the processing of your Personal Data, as defined in the Data Protection Legislation section below – including any replacement legislation coming into effect from time to time. |
| Device | Any device that can access the Service such as a computer, a mobile phone, or a digital tablet. |
| Expanded/Early/Managed Access Program | A central program which facilitates potential access to medicines prior to being granted marketing authorisation (i.e. outside of clinical trials). |
| Parent | Biological parents (including those under the age of 18), guardians, and other persons who may hold parental responsibility. |
| Personal Data | Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. |
| Processing | Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. |
| Service | Any services provided by the Company, including provision of the Website, relevant clinical trials, business to business dealings and handling of enquiries received by us. |
| Service Provider | Any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies, Investigator Sites, or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analysing how the Service is used. For the purpose of EU GDPR, Service Providers are considered Data Processors. |
| Strategic Partner | Any entity that has entered into a collaborative agreement with the Company with the aim to share skills, information and/or other resources. |
| Usage Data | Data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit). |
| Website / Site | The AvenCell Therapeutics website, accessible from https://avencell.com. |
| You | The individual accessing, requesting or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable. Under EU GDPR (General Data Protection Regulation), You can be referred to as the Data Subject or as the User as you are the individual using the Service. |
3. Data Protection Legislation
Throughout this document we refer to Data Protection Legislation – as provided above in ‘Definitions’;
- Europe:
In the European Union (EU) and the European Economica Area (EEA) – includes the General Data Protection Regulation (Regulation (EU) 2016/679) (‘EU GDPR’) as well as the ePrivacy Directive (Directive 2002/58/EC). - Japan:
Data Protection Legislation means the Act on the Protection of Personal Information (APPI), as well as any other applicable laws and regulations governing the privacy and security of personal data. - Other Jurisdictions:
Depending on your jurisdiction, additional Data Protection Legislation may apply. If you have any questions, you can contact our DPO using the details in the Contact Us section below.
4. Data Controllership
AvenCell is the Data Controller (‘controller’) for the Personal Data we process, unless otherwise stated.
We have appointed a Data Protection Officer (DPO) to help us monitor internal compliance, inform, and advise on data protection obligations, and act as a point of contact for data subjects and supervisory authorities. For further details on how you can contact our DPO, please see the Contact Us section below.
5. Your Information
We collect Personal Data in accordance with the Data Protection Legislation and/or other relevant legislation such as legislation related to clinical trials (e.g. the EU Clinical Trial Regulations (EU CTR)). The type of Personal Data that we will collect about you will depend on whether you are a clinical trial participant, the partner of a clinical trial participant, the child of a clinical trial participant, a healthcare professional, an employee or contractor of AvenCell, an employee or contractor of AvenCell’s Service Providers, or a user of this website.
We collect personal information in a variety of ways depending on how you interact with us. This may include through you filling out a form on our website, through your participation in one of our clinical trials (or through your partner, child, or parent’s participation) or through you applying for employment with us.
| Data Subject | Personal Information |
|---|---|
| Users of this Site | Name. Personal contact details (mailing address/telephone number/email address). Online identity and behaviour (e.g. IP address, browser type and version, pages viewed, time spent on pages, links clicked and conversion information). |
| Clinical Trial Participant or; Patients and Parents of Expanded/Early/Managed Access Programs (both qualified and unqualified) | Name. Date of birth / Age. Gender. Race and Ethnicity. Personal contact details (mailing address/telephone number/email address). Health information (including medical records, genetic data, and family history). Pseudonymized unique ID. Where relevant: name, contact details, and health information of your partner or child. Where relevant: name and contact details of your representative (e.g. parent, guardian, caregiver, or other legal agent). Where relevant: financial information (e.g. bank details). |
| Healthcare Professional | Name. Job title. Business contact details (mailing address/telephone number/email address). Where relevant: financial information (e.g. bank details). |
| AvenCell Personnel (employee or contractor) | Name. Date of birth / Age. Gender. Race and Ethnicity. Personal contact details (mailing address/telephone number/email address). Administration information (including nationality, right-to-work status – and pseudonymized ID such as payroll no., tax ID code). Where relevant: financial information (e.g. bank details). Where relevant: health information (including sick leave). |
| Other persons involved in commercial operations (Suppliers, Strategic Partners, shareholders/investors, etc). | Name. Job title. Personal and/or Business contact details (mailing address/telephone number/email address). Where relevant: financial information (e.g. bank details). |
This identifiable information relating to participants, and, where applicable, their partners and children, is collected by AvenCell’s Research Sites, acting on their behalf as Data Controllers or Data Processors. This data may be shared with clinicians, health authorities, ethics bodies, and other personnel as authorized by AvenCell, but only where AvenCell is legally obligated to provide this data in accordance with Clinical Trial Regulations and other applicable laws.
AvenCell will generally not directly receive identifiable information relating to clinical trial participants, or, where applicable, their partners and children.
You are under no statutory or contractual requirement or obligation to provide us with your Personal Data; however, we may require at least the information above in order for us to deal with you for the purpose requested by you.
6. Cookies
We use Cookies and similar tracking technologies to track the activity on Our Website and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyse Our Website.
You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Website. Cookies can be “Persistent” or “Session” Cookies. Persistent Cookies remain on your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close your web browser. We use both session and persistent Cookies for the purposes set out below.
Strictly Necessary Cookies
Type: Session Cookies
Administered by: Us
Purpose: These Cookies are essential to provide You with services available through the Website and to enable You to use some of its features. They help to authenticate users and prevent fraudulent use of user accounts. Without these Cookies, the services that You have asked for cannot be provided, and We only use these Cookies to provide You with those services.
Functionality Cookies
Type: Persistent Cookies
Administered by: Us
Purpose: These Cookies allow us to remember choices You make when You use the Website, such as remembering your login details or language preference. The purpose of these Cookies is to provide You with a more personal experience and to avoid You having to re-enter your preferences every time You use the Website.
Tracking and Performance Cookies
Type: Persistent Cookies
Administered by: Third-Parties
Purpose: These Cookies are used to track information about traffic to the Website and how users use the Website. The information gathered via these Cookies may directly or indirectly identify you as an individual visitor. This is because the information collected is typically linked to a pseudonymous identifier associated with the device you use to access the Website. We may also use these Cookies to test new pages, features, or functionality of the Website to see how our users react to them.
AvenCell Cookies
The following cookies are used on our Website:
| Cookie Name | Cookie Description | Cookie Type |
|---|---|---|
| Google Analytics | Google Analytics Google Analytics uses cookies, specifically first-party cookies, to collect data on user behavior, identify unique users, and track their activity on a website. These cookies, such as _ga and _gid, are small text files stored in a user’s browser that allow the service to function and provide insights to website owners. | Tracking and Performance |
We use cookies and similar tracking technologies to collect Usage Data – information about your use of the Website, such as your IP address, browser type, browser version, pages viewed, time spent on pages, links clicked and conversion information. This information may be used by us to, among other things, analyse and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on the Website and other websites, provide customer support, troubleshoot issues with and improve the operation of our Website and Services, and better understand your online activity.
Google Analytics is used on this Website only where you have provided consent through our cookie banner or cookie settings tool. You may withdraw your consent at any time by adjusting your cookie preferences through the banner/settings tool available on the Website.
The information generated by these cookies about your use of the Website may be transmitted to and stored by Google on servers outside of your jurisdiction. Google may use this information to evaluate your use of the Website, compile reports on website activity, and provide other services relating to website activity and internet usage.
For more information on the privacy practices of Google, please visit the Google Privacy Terms web page: https://policies.google.com/privacy?hl=en.
7. Our Purposes
Under EU GDPR, the lawful bases we rely on for processing your information are:
- GDPR Article 6(1)(a) – your consent;*
- GDPR Article 6(1)(b) – We have a contractual obligation;
- GDPR Article 6(1)(c) – We have a legal obligation;
- GDPR, Article 6(1)(d) – In order to protect the vital interests of You or a third party;
- GDPR, Article 6(1)(e) – We have a public interest; or,
- GDPR, Article 6(1)(f) – We have a legitimate interest.
* Where the lawful basis for processing is consent, you are able to withdraw your consent at any time. You can do this by contacting our DPO using the contact details provided in the Contact Us section below.
We may use and disclose your information for the purposes described in the below table:
| Processing Activity | Lawful Basis |
|---|---|
| To monitor, provide, and maintain the services you select through this Site. and; To ensure the technical functions of our network. | Legitimate Interest in delivering services to you. |
| To respond to your questions, feedback, or complaints, and address any Data Subject Requests | Legitimate Interest in supporting you as a user. |
| To collect your Usage Data to maintain security measures and ensure safe access to our website | Legitimate Interest in providing a secure platform |
| To contact you, about news and information relating to our service through service messages, if you have provided your contact details and; To improve and customize the content and layout of the Site | Legitimate Interest in communicating about our services |
| To use Third Party (non-essential) tracking and sharing with others | Consent |
| Where you/your partner/your child is a clinical trial participant – to collect and process information in order to conduct the clinical trial | Depending on your country/jurisdiction and the activity within the clinical trial (as defined in your Informed Consent Form ‘ICF’):
|
| Patients and Parents of Expanded/Early/Managed Access Programs (both qualified and unqualified) – to collect and process information for referrals. | Depending on your country/jurisdiction:
|
|
|
| AvenCell Vendors’ and Partners’ personnel (employee or contractor) |
|
| AvenCell personnel (employee or contractor) – in managing AvenCell operations and affairs |
|
We will use and disclose your Personal Data for the purposes for which we collected it. We may use it for another reason if that reason is compatible with the original purpose or is otherwise permitted by the Data Protection Legislation.
If we need to use and/or disclose your Personal Data for an unrelated purpose, we will, if applicable Data Protection Legislation requires, notify you and we will explain the legal basis which allows us to do so.
8. Our Partners
We may share your personal data with other organizations in the following circumstances:
- From time to time, we may need to share your Personal Data with our strategic clinical trial partners;
- If the law or a public authority says we must share the Personal Data;
- If we need to share Personal Data in order to establish, exercise or defend our legal rights – this includes providing Personal Data to others for the purposes of detecting and preventing fraud;
- From time to time, employ the services of other parties for dealing with certain processes necessary for the operation of our services; or
- For purposes otherwise permitted under the Data Protection Legislation
We may, from time to time, expand or reduce our business and this may involve the sale and/or the transfer of control of all or part of our business. Any personal data that you have provided will, where it is relevant to any part of our business that is being transferred, may be transferred along with that part to the new owner or new controlling party.
We use Service Providers (“Data Processors”) who are third parties who provide elements of services for us. Examples of these Data Processors include, but are not limited to:
- Our Contract Research Organizations (CRO);
- Our Clinical Trial Data Processors,
- Our IT Service Providers, such as Microsoft Corporation.
We have Data Processor Agreements in place with our data processors to help protect your Personal Data.
9. Our Retention Periods
We retain a record of your Personal Data in order to provide you with a high quality and consistent service. We will retain your Personal Data in accordance with the Data Protection Legislation.
Where EU GDPR apply, AvenCell has a Retention Schedule in place which outlines how long AvenCell will retain different categories of Personal Data. AvenCell considers the retention period to begin from the point at which AvenCell last contacted you or otherwise reviewed your record to determine whether it was still active, unless otherwise required by law. As such, where EU GDPR and UK GDPR apply, unless otherwise required by law, your data will be retained for the period specified in the summarized table below and then securely deleted in accordance with our internal policies and procedures.
| Personal Information from | Retention Period |
|---|---|
| Users of this Site | 1 year |
| Clinical trial participants | 25 years following the conclusion of the clinical trial, as determined by EU Clinical Trial Regulations (EU-CTRs) |
| Healthcare professionals (HCP) or other persons (suppliers, strategic partners, shareholders/investors, etc) involved in clinical trials | 25 years following the conclusion of the clinical trial, as determined by EU Clinical Trial Regulations (EU-CTRs) |
| AvenCell Therapeutics personnel (employeesand contractors) | 10 years following the termination of employment or contract |
| Other persons involved in commercial operations (suppliers, strategic partners, shareholders/investors, etc.) | 10 years |
10. Our Communication Channels
Where you are a clinical trial participant or a Health Care Professional involved in the planning, delivery, or oversight of an AvenCell clinical trial, we will contact you through our Contracted Research Organization (CRO) where it is necessary to do so.
Where you are an employee of AvenCell, we will contact you through existing AvenCell communication channels, including email, where it is appropriate to do so.
Where you are an employee of AvenCell’s Service Providers, a user of this website who has provided us with your contact information, or any other business contact, we will send you relevant news about our services in a number of ways including by email, but only if we have a Legitimate Interest to do so or as otherwise permitted by law (including where we have your Consent).
You can contact the DPO using the details provided in the Contact Us section below.
11. Third Party Links
Our Website may contain links to other sites operated by third parties. The Company does not control such other sites and is not responsible for their content, their privacy policies, or their handling of personal information. The Company’s inclusion of such links does not imply any endorsement of the content on such sites or of their owners or operators except as disclosed through the Services. Any information submitted by you directly to these third parties is subject to that third party’s privacy policy.
12. Security
Data security is of great importance to AvenCell. We implement appropriate technical and organizational measures to help prevent your Personal Data from being accidently lost, used, accessed, altered, or disclosed in an unauthorized way.
We implement technical and organizational security measures to help protect your information including:
- Managing a data security breach reporting and notification system which allows us to monitor and communicate information on data breaches with you or with the applicable regulator when required to do so by law;
- Regular staff training on personal information handling relevant to their role;
- Implementing access controls to our information technology; and,
- Deploying appropriate procedures and technical security measures (including strict encryption, anonymization and archiving techniques) to safeguard your information across all our computer systems, networks, websites, mobile apps, offices, and stores.
13. Children’s Privacy
We do not seek or knowingly collect any personal information about children under 13 years of age, or the applicable age of a minor as defined by local law. If we become aware that we have unknowingly and/or unintentionally collected personal information from a child under the age of 13, we will make commercially reasonable efforts to delete such information from our database. If you are the parent or guardian of a minor child who has provided us with personal information, you may Contact Us using the information below to request it be deleted.
14. International Transfers
Your Personal Data is processed at the Company’s operating offices and in any other places where the parties involved in the processing are located. This means that this information may be transferred to Devices located outside of Your state, province, country, or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction. In particular, when AvenCell shares clinical trials data with Trusted Data Processors, your Personal Data would be stored and processed within third countries. Where you are based in the EU, EEA AvenCell will ensure that:
- any Data Controller receiving your Personal Data has entered into an agreement with AvenCell contains standard data protection clauses as required by EU GDPR or there is an alternative appropriate safeguard in place governing the transfer, such as an adequacy decision; and,
- any Data Processor receiving your Personal Data has entered into an agreement with AvenCell which contains the required Data Processor clauses as well as standard data protection clauses as required by EU GDPR or there is an alternative appropriate safeguard in place governing the transfer, such as an adequacy decision.
Where you are based in the EU and we were required to transfer your Personal Data out of the EU, EEA to countries not deemed by the European Commission to provide an adequate level of Personal Data protection, the transfer will be based on safeguards that allow us to conduct the transfer in accordance with the Data Protection Legislation, such as the specific contracts containing standard data protection clauses approved by the European Commission providing adequate protection of Personal Data. You can obtain a copy of this documentation by contacting our DPO using the details identified in the Contact Us section below.
15. Your Rights
You have legal rights over your Personal Data Depending on your country/jurisdiction. To exercise your rights, you can contact us using the details identified in the Contact Us section below.
For security reasons, you may need to submit a written request or prove your identity in other ways. We may ask you to verify your identity first before processing your request. If you are not satisfied with the reply, you can also make a complaint to us via the ways provided in “Contact Us “.
We will not be able to respond to your request under the following circumstances:
the fulfilment of our legal obligations; national security or national defence security;
public security, public health, or major public interests;
criminal investigations, prosecutions, trials, or the execution of court rulings;
where there is sufficient evidence to prove that you are ill-minded or abusing your rights;
where we can’t respond to your request for the sake of protecting your or other individuals’ lives or properties or major legitimate rights and interests, but it is very difficult for us to get your consent for this;
where responding to your request will cause serious damages to the legitimate rights and interests of yours or other individuals or organizations;
business secrets.
EU/EEA
Where EU GDPR apply, you have the right to;
- request a copy of your personal information which AvenCell holds about you.
- be informed about the collection and use of your personal information. We ensure we do this with our Privacy Notices (including this document). These are regularly reviewed and updated to ensure they accurately reflect our processing activities.
- request that AvenCell correct any personal information if it is found to be inaccurate or out of date;
- request your personal information be erased where it is no longer necessary for AvenCell to retain such data;
- withdraw your consent to the processing of personal information to which you earlier provided consent for processing;
- request that AvenCell provides you with an export of your personal information and where possible, to transmit that data directly to another data controller (known as the right to data portability);
- where there is a dispute in relation to the accuracy or processing of your personal information, to request a restriction be placed on further processing;
- object to the processing of personal information (where applicable); and
- lodge a complaint with a data supervisory authority.
16. Complaints
In the event of a privacy related complaint, we will investigate and attempt to promptly resolve any complaints and disputes regarding use and disclosure of personal data.
For complaints that cannot be resolved by AvenCell, we commit to cooperating with the relevant regulatory bodies;
- Individuals in the EU can choose to contact their national Data Protection Authority (DPA), or use the form at: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.
- Individuals in Japan can choose to contact the Personal Information Protection Commission (PPC) at Toranomon Althea Tower 12th Floor, 2-2-3 Toranomon, Minato-ku, Tokyo, 105-0001, Japan, TEL: +81-3-6457-9680 at Contact Us |PPC Personal Information Protection Commission,Japan
Independent dispute resolution processes are provided at no cost to the individual.
17. Changes to the Notice
We keep our privacy notices under regular review. We reserve the right, at our discretion, to change, modify, add or remove sections of this Notice at any time. You are encouraged to review this Notice from time to time for updates, or to contact AvenCell for more information.
18. Your duty to inform us of changes
It is important that the Personal Data we hold about you is accurate and current. You are responsible for making sure the information you give us is accurate and up to date. You must tell us if anything changes, as soon as possible.
19. Providing Company with other people’s data
If you give us any Personal Data that does not relate to you (e.g., information about your family, employer/colleagues, or other third parties), you must ensure that you have the required legal basis to collect and share their Personal Data. You must also provide them with a copy of this Notice, tell them what information you have given to us, and make sure they agree we can use it as set out in this Notice.
20. Contact Us
If you have any questions or concerns about this Privacy Notice, the use of your data, or if you would like to make a request to exercise your data protection rights, please contact us by email as follows:
If you are in the EU/EEA, please contact our EU Representative as follows;
By email: dataprotection@avencell.com
By telephone: +49 351 4466 4500
By post: AvenCell Europe, GmbH., Tatzberg 47, 01307 Dresden, Germany.
If you are in the USA or Japan, please see how to contact us:
By email: dataprotection@avencell.com
By telephone: +1 (617) 941-7468
By post: 500 Forge Road Watertown, MA 02472 U
Category of Data | Purpose for Data Processing |
Contact details (example: your name, nationality, postal address, telephone number, e-mail address) |
|
Compensation Information (example: bank account details, financial information, salary and expenses details) |
|
Employment history (example: job titles, location of employment/workplace, employment history, working hours) |
|
Professional Credentials (example: training records, qualifications and professional memberships) |
|
Research-Related Data (example: research interests and output) |
|
We also collect, use and share Aggregated Data for various purposes. For example, your website usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this Notice.
We may receive information about you from other sources including business partners, third parties, affiliates, and publicly available information.
6. Legal basis for processing your Personal Data
We process your Personal Data using the follow lawful bases:
- Processing necessary for the purpose of the legitimate interests pursued by AvenCell to conduct its business (including for research and development of new medicines creating value for people living with diseases in AvenCell’s therapeutic areas of interest), to manage our human and financial resources efficiently and for internal reporting purposes.
- To comply with legal and regulatory obligations, including assessment of your potential participation in the study and/or the participation of the investigative site by reviewing your eligibility and qualifications and conducting screening measures or to support applications for approval of the product under investigation.
- To establish, exercise or defend our legal rights and/or for the purpose of (or in connection with) legal proceedings (including for the prevention of fraud).
- With your consent (for example, collecting your ethnicity information for DEI reporting purposes, where required). Where we do rely on your consent, you have the right to withdraw it at any time in the manner indicated when your consent was provided.
- Processing necessary for performance of a contract with you, including maintaining a professional relationship with you, payment of salary and expenses, managing your participation in the clinical trial, and/or in order to take steps at your request prior to entering into a contract.
Providing your Personal Data to AvenCell is voluntary but it is necessary if you are to take part in any of our clinical trial activities. Should you choose not to provide your Personal Data to us, your interaction with us may be adversely impacted, you cannot take part in any of our clinical trial activities, and we will not be in a position to perform a contract with you.
7. Disclosures of your Personal Data
Where necessary to fulfil the purposes described in this Notice, AvenCell may disclose your Personal Data to third-parties. Not all of these parties are located in the country where the clinical trial is conducted. AvenCell may therefore transfer your Personal Data to locations outside of your country of residence for the purposes described in this Notice.
Whenever AvenCell shares your Personal Data with third parties, such as companies acting as our authorised agents and service providers, these companies agree to use your Personal Data only for specified purposes and upon our instructions. Furthermore, the recipient will implement and maintain reasonable security procedures and practices appropriate to the nature of your information to protect your Personal Data from unauthorised access, destruction, use, modification or disclosure.
We will transfer and disclose your Personal Data to the following categories of recipients where it is lawful to do so, and subject to the implementation of appropriate safeguards:
Category of Third-Party | Purpose for Disclosure |
Our Subsidiaries and affiliated entities |
|
Service Providers who work for, or provide services to us (including their employees, sub-contractors, officers, such as IT systems providers and IT contractors, payroll and HR system providers, employee expense management providers, pension administration / providers, benefits providers). |
|
Cloud storage solutions |
|
Law enforcement, government, courts, regulators, governmental or quasi- governmental organisations, tribunals and arbitrators. |
|
Professional Advisors, such as insurers, accountants, auditors or lawyers |
|
Other financial institutions, fraud prevention agencies, tax authorities, trade associations, credit reference agencies and debt recovery agents. |
|
Any prospective or new AvenCell companies (e.g. if we restructure, or acquire or merge with other companies) or any businesses that buy part of or all of AvenCell (including the rights to the study drug and all related data) to other AvenCell |
If this occurs the new owners of the business will only be permitted to use your information in the same or similar way as set out in this privacy notice. |
Potential or future employers |
|
Other researchers, research institutions, collaborators, licensees, and strategic partners |
|
8. International cross-border data transfers
Because AvenCell operates globally, your data may be transferred outside of the country in which you interact with AvenCell, including to countries whose data protection laws substantially differ from the country in which you work or reside and may not provide the same level of data protection as in your country of residence. To accomplish the purposes described in this Notice, we may also disclose and transfer Personal Data to personnel and other departments throughout AvenCell, or to service providers and/or collaborators, licensees and strategic partners based overseas, to the extent that your Personal Data is shared with service providers, AvenCell affiliates or other third parties processing Personal Data on our behalf, which are located outside your country of residence.
For example, your Personal Data may be transferred or accessed by AvenCell and its affiliate entities in the United States of America.
AvenCell shall seek to maintain confidentiality as required within the limits of local laws in these countries.
Whenever we are required to transfer your Personal Data out of EEA, we ensure that at least one of the following safeguards is implemented:
- transferring your Personal Data to countries that have been deemed to provide an adequate level of protection for Personal Data by the European Commission.
- using specific contracts approved which give Personal Data the same protection it has in Europe including standard data protection clauses approved by the European Commission.
Please contact us on Dataprotection.eu@avencell.com if you want further information on the specific mechanism used by us when transferring your Personal Data out of the EEA.
9. Data security
AvenCell will implement appropriate technical and organizational security measures necessary to adequately safeguard your Personal Data. These safeguards will include, for example:
Security Measures
- Access to Personal Data is restricted and provided only where necessary, to those employees, agents, contractors and other third parties who have a business need-to-know.
- All employees handling Personal Data receive security and data protection awareness training, will only process your Personal Data on our instructions and are subject to a duty of confidentiality.
- Employees with access to Personal Data are given the least privilege required.
- We have robust procedures in place to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
- A disciplinary policy is enforced to prevent unauthorised access.
- Where technically feasible, data is encrypted in transit and at rest.
10. Data retention
We will only retain your Personal Data for as long as required under applicable local, state, national and/or international laws, rules and/or regulations, which may be for a period of up to 25 years (or longer if required by law) after completion of the clinical trial and to fulfil the purposes we collected it for, including for the purposes any legal, regulatory, tax, accounting or reporting requirements. We may retain your Personal Data for a longer period in the event where we receive a complaint and we reasonably believe there is a prospect of litigation in respect to our relationship with you, or there is an investigation and proceedings.
To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
Where we do not have a reason or legal obligation to retain your Personal Data, it will be deleted in accordance with the relevant section of our Data Protection Policy.
In some circumstances you can ask us to delete your data: see your legal rights below for further information.
In some circumstances we will anonymise your Personal Data (so that it is no longer your personal information as it cannot be associated with you) for research or statistical purposes, in which case we may use and retain this information indefinitely without further notice to you.
11. Your legal rights
Subject to certain limitations and exclusions under applicable laws, you may be entitled to contact us and request to exercise your rights in respect of your personal data. You may have the right to request confirmation as to whether AvenCell is processing your Personal Data, and if so:
- To request information relating to the categories of data involved, purposes of processing, recipients of your data, retention periods/criteria, and your rights as a Data Subject.
- To request access to your Personal Data that AvenCell is processing.
- To request AvenCell rectifies any inaccurate or incomplete Personal Data that AvenCell is processing about you.
- To request erasure or restriction of processing of any Personal Data that AvenCell is processing about you, subject to certain exceptions.
- To obtain a copy of your Personal Data in a commonly-used and machine-readable format and have it ported to another data controller.
- To object to the processing of, your Personal Data in certain circumstances.
- To request your information not be sold or otherwise disclosed to a third-party.
- To lodge a complaint with your local Data Protection Authority or Supervisory Authority.
To exercise any of the rights described above, please email Dataprotection.eu@avencell.com with a description of your request.
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making unless we have a lawful basis for doing so and we have notified you.
12. Changes to the Notice
We keep our privacy notices under regular review. We reserve the right, at our discretion, to change, modify, add or remove sections of this Notice at any time. You are encouraged to review this Notice from time to time for updates, or to contact AvenCell for more information.
13. Your duty to inform us of changes
It is important that the Personal Data we hold about you is accurate and current. You are responsible for making sure the information you give us is accurate and up to date. You must tell us if anything changes, as soon as possible.
14. Providing Company with other people’s data
If you give us any Personal Data that does not relate to you (e.g., information about your next of kin/dependants), you must ensure that you have the required legal basis to collect and share their Personal Data. You must also tell them what information you have given to us, and make sure they agree we can use it as set out in this Notice. You must also tell them how they can see what information we have about them, correct any mistakes or request copies of their information.
15. Questions
If you have any questions about this Notice, the use of your data, or if you would like to make a request to exercise your data protection rights, please contact the Data Protection Officer using the details set out below.
By email: Dataprotection.eu@avencell.com
By telephone: +49 351 4466-45046
By post: AvenCell Europe GmbH, Tatzberg 47, 01307 Dresden, Germany
You have the right to make a complaint at any time to the Supervisory Authority in the EU member state where you reside. We would, however, appreciate the chance to deal with your concerns before you approach the Supervisory Authority so please contact us in the first instance.