European Union (“EU”) Regulation EU 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “General Data Protection Regulation” or “EU GDPR”) and the Retained Regulation (EU) 2016/679 (“UK GDPR”) (collectively the “GDPRs”), require C4 Therapeutics, Inc. (“C4T”, “We”, “Our”, or “Us”) as the data controller of “personal data” to provide additional information to Data Subjects in the EEA or the UK about the processing of their personal data. If you are a Data Subject within the EEA or UK, this Supplemental EEA/UK Privacy Policy applies to you in addition to the provisions of C4T’s Privacy Policy.
1. HOW WE USE YOUR PERSONAL DATA
We will only use your personal data when the law allows us to do so. Most commonly, we will use your personal data in the following circumstances:
- Where we need to perform the contract we are about to enter into or have entered into with you;
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
- Where we need to comply with a legal or regulatory obligation;
- Where necessary for scientific research purposes;
- We may also use your personal data in the following situations, which are likely to be rare:
- Where we need to protect your interests (or someone else’s interests); or
- Where it is needed in the public interest or for official purposes.
Generally we do not rely on consent as a legal basis for processing your personal data other than in relation to sending direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us using the contact information listed in Section A of our Privacy Policy (“How to Contact Us”).
We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely upon to do so. We have also identified what our legitimate interests are where appropriate.
Note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need additional details about the specific legal basis we are relying on to process your personal data where more than one basis has been set out in the table below.
| Purpose/Activity | Category of personal data | Lawful basis for processing |
| To engage you as a new vendor or other service provider, contractor or employee | (a) Identity (b) Contact |
(a) Performance of a contract with you (b) Necessary for our legitimate interests
|
| To process and deliver products or services including: (a) Managing payments, fees and charges (b) Collecting and recovering money owed to us |
(a) Identity (b) Contact (c) Financial / Transaction (d) Marketing and Communications |
(a) Performance of a contract with you (b) Necessary for our legitimate interests
|
| To manage our relationship with you which will include: (a) Notifying you about changes to our terms or Privacy Policy (b) Asking you to provide feedback or take a survey (c) Other communications as a contractor or an employee(d) Responding to your requests |
(a) Identity (b) Contact (c) Profile/Usage (d) Marketing and Communications (e) Financial / Transaction(f) Professional or Employment-related |
(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests
|
| To enable you to complete a survey | (a) Identity (b) Contact (c) Profile/Usage (d) Marketing and Communications |
(a) Performance of a contract with you (b) Necessary for our legitimate interests
|
| To administer and protect our business and our intranet and website(s) (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) | (a) Identity (b) Contact (c) Profile/Usage (d) Technical |
(a) Necessary for our legitimate interests
(b) Necessary to comply with a legal obligation |
| To deliver relevant website content and marketing to you and to understand the effectiveness of our marketing activities | (a) Identity (b) Contact (c) Profile/Usage (d) Marketing and Communications (e) Technical |
(a) Necessary for our legitimate interests
|
| To use data analytics to improve our website(s), products/services, marketing, customer relationships and experiences | (a) Technical (b) Profile/Usage |
(a) Necessary for our legitimate interests
|
| To make suggestions and recommendations to you about goods or services that may be of interest to you | (a) Identity (b) Contact (c) Technical (d) Profile/Usage |
(a) Necessary for our legitimate interests
|
| To conduct a research program (including conducting clinical trials) | (a) Identity (b) Contact (c) Financial / Transaction (d) Special Categories (health data) |
(a) Necessary for our legitimate interests
(b) Necessary to comply with a legal obligation
(c) Necessary for scientific research purposes |
2. CLINICAL TRIALS
We undertake or plan to undertake studies within the EEA and UK and we will use information from subjects’ medical records and other health data in order to improve healthcare. C4T contracts with service providers, such as Contract Research Organizations (“CROs”), or other service partners, typically as data processors, to collect the personal data of the subjects of the clinical trial and to manage the clinical trials that we sponsor. C4T processes key-coded or pseudonymized personal data of clinical trial subjects which means that we do not have direct or immediate access to their identifiable personal data (except, for example, to comply with legal requirements such as those related to our pharmacovigilance obligations).
As a pharmaceutical organization we have a legitimate interest in using information relating to your health for research studies, when you agree to take part in a research study by providing your informed consent to participate. One exception to the general provision at Article 9(1) of the GDPRs not to process special categories of data is that processing is necessary for scientific research purposes in accordance with Article 89(1) of the GDPRs. This means that we will use your personal data collected in the course of a research study when we act as the data controller for such studies in the ways needed to conduct and analyze the research study. Your rights to access, change or move your personal data may be limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use only the minimum personal data needed for these purposes.
In addition, the personal data of potential and actual site investigators, employees or contractors may also be collected directly by C4T or through the CRO that we work with and is typically used, for example, to verify the individual’s qualifications, satisfy documentation requirements for the purpose of the clinical trial, to verify financial disclosures to avoid any conflict of interest and to otherwise conduct and analyze the research study.
Please see the “How we use your personal data” section of this Supplemental Notice to EEA/UK Data Subjects above for additional information about the collection and use of personal data.
3. CHANGE OF PURPOSE
We will only use your personal data for the purposes for which we collected it, unless we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
4. INTERNATIONAL TRANSFERS OF PERSONAL DATA
We are based outside the EEA and the UK, so the processing of your personal data may involve a transfer of data outside the EEA or the UK.
Whenever we transfer your personal data out of the EEA or UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data;
- We will only transfer your personal data to countries pursuant to binding agreement to and compliance with standard contractual clauses or binding corporate rules, each as approved by the European Commission or other regulators, as applicable;
- We will only transfer your personal data to countries pursuant to the consent of the individual to whom the personal data pertains; or
- We will only transfer your personal data to countries as otherwise authorized by the EEA or UK or permitted by applicable EEA or UK requirements.
5. HOW LONG WE RETAIN YOUR PERSONAL DATA
We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
6. YOUR DATA PROTECTION RIGHTS
This section provides information on the rights that you have under EEA or UK law in relation to your personal data. Under certain circumstances, individuals located in the EEA or UK have the following data protection rights:
- To access their personal data;
- To correct their personal data;
- To erase their personal data;
- To object to the processing of their personal data;
- To restrict the processing of their personal data;
- To transfer their personal data;
- To not be subject to a decision based solely on automated processing, including profiling; and
- To withdraw any consent that they have previously provided for the processing of their personal data.
To exercise any of the rights described above, please contact us using our contact information listed in Section A of our Privacy Policy (“How to Contact Us”). If you are a clinical study participant, your request may be shared and handled by the study site and/or applicable local data protection representatives. Clinical study participants can also contact their treating physician, study site, or applicable local data protection representatives directly to exercise their rights with respect to their personal data. As we work to process your request, we may need to request additional information from you, either to confirm your right to access your data (as a security measure) or as it relates to your request. Further, we may charge a reasonable fee or refuse to comply if it is clearly unfounded, repetitive or excessive.
For advice or to make a complaint, you can also contact the applicable Supervisory Authority within the EEA at this link (https://edpb.europa.eu/about-edpb/board/members_en) or the Information Commissioner’s Office within the UK at this link (https://ico.org.uk/make-a-complaint/).
Please be aware that your rights in relation to clinical research data may be limited.
Supplemental Notice to EEA/UK Data Subjects Last Revised: [Insert Date]
