Data Privacy Statement

Use of Website and Contact E-mails

This Privacy Statement explains how MC2 process your personal data in the administration of our corporate website; mc2therapeutics.com.

1) USE OF PERSONAL DATA

We may use your personal data for the following purposes:

• To answer your inquiries requested via our official e-mail accounts: info@mc2therapeutics.com, finance@mc2therapeutics.com, investor@mc2therapeutics.com, and partnering@mc2therapeutics.com. These e-mail accounts are continuously monitored, and your personal data is collected only to the extent necessary to reply. If the recipient of your e-mail is unable to answer your question, your e-mail will be forwarded to the relevant person.
• For statistical purpose in a de-identified manner.
• To collect information about your visit to our website by use of cookies.

2) CATEGORIES OF PERSONAL DATA

We may collect the following personal data about you:

Name, address, email address, telephone number, IP-addresses, and other personal data you provide in your e-mail.

3) SOURCES

You provide us with personal data in your e-mail and we may collect personal data via cookies we place on your device.

4) LEGAL BASIS

We process your personal data on the following legal basis:

Art. 6 (1)(f) of the GDPR – Legitimate interest. This means that the processing of your personal data is necessary for the purposes of the legitimate interests pursued by us when making our website functionalities available to you and for us to be able to provide you with the answers requested and needed when using our website.

5) SHARING OF YOUR PERSONAL DATA

We may share your personal data with our affiliates and service providers.

6) TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead, we have provided appropriate safeguards as required by GDPR art. 49 (1) through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@mc2therapeutics.com

7) RETENTION OF YOUR PERSONAL DATA

We will retain your personal data according to the specific purpose depending on your request and your use of our website. However, we will never keep your personal data longer than required by applicable law.

To prevent unauthorized access, maintain data accuracy, and ensure the correct use of information, we have put in place appropriate physical, electronic, and managerial procedures to safeguard and secure the information we collect online.

Engagements with Healthcare Professionals and Healthcare Organization (“HCPs”)

This Data Privacy Statement explains how MC2 process your personal data when you have an engagement with us.

1. USE OF PERSONAL DATA

We may use your personal data for the following purposes:

• To provide, collect, review, and communicate information on the proper use of drugs, medical devices, drug samples, and other goods and products handled by MC2 (hereinafter referred to collectively as “Medical Products”).
• To provide, collect, review and communicate information on quality, safety or effectiveness of Medical Products.
• To interact and collaborate with you based on your professional expertise when we have a contractual relationship with you.
• To provide, collect, review, and communicate healthcare-related information.
• To report on the occurrence of adverse effect, accident, recall of Medical Products.
• To check, review and take reasonable action to request for information and inquiry,
• To conduct research of delivery destinations, actual use, and user’s needs of Medical Products.
• To request and implement clinical trials, post marketing surveillance studies and other studies.
• To handle complaints about our products and services.
• To cultivate better communication among HCPs.
• To make notifications and reports to government and other public offices and agencies.
• To contact HCPs regarding the above tasks.

2. CATEGORIES OF PERSONAL DATA

We may collect the following personal data about you:

Name, address, email address, telephone number, employer, CV, title, occupation, affiliation, professional qualifications, and scientific activities (such as previous clinical trial experience, and participation in past or pending research studies with MC2 and other companies), transfer of value, professional license information and contract information including billing information.

3. SOURCES

We may collect your personal data from various sources such as:

• Documents or forms that you provide to participate in our sponsored or supported initiatives, such as sponsored clinical trials and development activities.
• Publicly available sources.
• Professional vendors.
• Your employer.
• Online and from databases and websites, which may be managed by third parties on our behalf.

4. LEGAL BASIS

We process your data on the following legal basis:

Art. 6 (1)(f) of the GDPR – Legitimate interest. This means that the processing of your personal data is necessary for the purposes of the legitimate interests pursued by us when assessing the activity/services and legitimate business need, adherence to local law and industry standards, and assessing fair market value.

Art. 6(1)(b) of the GDPR – Performance of Contract. If you have a working relationship with us such relationship is confirmed in writing and personal data will be collected to perform the contract.

Art. 6(1)(a) of the GDPR – Consent. In certain situations, we also ask for your consent to process your personal data, e.g., for disclosure of transfer of value, if such disclosure is not a legal obligation.

Art. 6(1)(c) of the GDPR – Legal Obligation. For clinical trials we may also process your personal data in relation to adverse event reporting to adhere to a legal obligation.

5. SHARING OF YOUR PERSONAL DATA

We may share your personal data with:

Our affiliates, collaborative partners, authorities, and other HCPs.

6. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead, we have provided appropriate safeguards as required by GDPR art. 49 (1) through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@mc2therapeutics.com

7. RETENTION OF YOUR PERSONAL DATA

We retain personal data where we have an ongoing legitimate business need to do so (e.g., to maintain our engagement with you).

When we have no ongoing legitimate business need to process your personal data, we will either delete or anonymize it or, if this is not possible (e.g., because your personal data has been stored in back-up archives), we will securely store your personal data and isolate it from any further processing until deletion is possible.

Clinical Trials

The protection of personal data is of utmost importance to MC2, and we are committed to protecting your rights as a clinical trial subject when processing your personal data as the sponsor of clinical trials.

In our Informed Consent Form, we provide clinical trial subjects participating in our clinical trials with relevant information about our use and processing of their personal data.

1. USE OF PERSONAL DATA

We collect and use your personal data to conduct our clinical trials to investigate efficacy, safety etc. of our investigative clinical trial medicine. If you are a participant in one of our clinical trials, you will be able to read more about the purpose of that specific clinical trial in the Informed Consent Form.

2. CATEGORIES OF PERSONAL DATA

We may collect the following personal data about you, for example:

• Ordinary personal data: your gender, year of birth, body weight and height.
• Special categories of data: medical history, current and past medications (prescription and/or over-the-counter medications) that you are taking, whether you are taking part in any research studies or using any other experimental therapies or treatments, your race and ethnicity, scans, blood samples, biopsies, and information about your use of the clinical trial medicine, the effect it has on you, and its potential side effects.

As the sponsor of the clinical trial, we will not know your name. A unique ID will be assigned to you and all personal data processed by us will be linked to that ID, i.e., we will only receive your personal data in pseudonymous form. Only the investigator of the clinical trial will know your name.

3. SOURCES

We receive your pseudonymized personal data from the investigator as part of the clinical trial.

4. LEGAL BASIS

We may process your personal data on the following legal basis:

Art. 9 (2)(i) cf. Art 6(1)(f) of the GDPR. We have a legitimate purpose in collecting and using your personal data for scientific research purposes as described above.

Art. 9(2)(i) cf. Art. (6)(1)(c) of the GDPR. The processing of your personal data is necessary for us to comply with a legal obligation to collect and report safety incidents to regulatory authorities.

Art. 9(2)(i) cf. Art. 6(1)(a) of the GDPR – Consent. In certain situations, we also ask for your consent to process your personal data, e.g., for disclosure to your general practitioner or for future use of your personal data.

5. SHARING OF YOUR PERSONAL DATA

We may share your personal data with other companies and organizations commissioned by us to conduct the clinical trial. These companies and organizations may only use your personal data for the purposes described in the Informed Consent Form and this Data Privacy Statement.

Furthermore, personal data stored at the investigator may be accessed by our monitors and auditors and authorized employees of the regulatory authorities of your country of residence and other countries to verify that the clinical trial is being conducted correctly and to analyse the personal data collected during the clinical trial. All third parties are obligated to observe the rules of professional confidentiality and will only use your personal data as described in the Informed Consent document.

We may also share your personal data with third parties to the extent required by law, for example if we are obligated to disclose your personal data to comply with any legal obligation or to establish, exercise or defend our legal rights. Your general practitioner may be informed of your participation in one of our clinical trials if you consent to such disclosure.

6. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead, we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@mc2therapeutics.com

7. RETENTION OF YOUR PERSONAL DATA

Your personal data will be retained in accordance with regulatory requirements for clinical trials, i.e., up to 2 years after the last marketing application which may be more than 25 years from collection of your personal data.

Interaction with Patients and Patient Organizations (“POs”)

This Data Privacy Statement explains how MC2 process your personal data when you have an engagement with us.

1. USE OF PERSONAL DATA

We may use your personal data to interact with you based on your own experiences as a patient or the expertise as a caregiver for a patient or member of a PO. This interaction may be by you providing expert advice in relation to our research and development activities, responding to surveys or participating in expert meetings.

2. CATEGORIES OF PERSONAL DATA

We may collect the following personal data about you:

• Ordinary personal data: name, contact information, and other data relevant for our interaction.
• Special categories of data: your medical diagnosis and treatments and your experiences living with your medical diagnosis.

3. SOURCES

We receive your personal data from a PO and directly from you.

4. LEGAL BASIS

We may process your personal data on the following legal basis:

Art. 6(1)(b) of the GDPR – Performance of Contract. If you have a working relationship with us such relationship is confirmed in writing and personal data will be collected to perform the contract.

Art. 9(2)(i) cf. Art. 6(1)(a) of the GDPR – Consent. In some situations, we may ask for your consent to process your personal data.

5. SHARING OF YOUR PERSONAL DATA

We may share your personal data with our affiliates, public authorities and other companies and organizations commissioned by us to conduct research and development. These companies and organizations may only use your personal data for the purposes described in this Data Privacy Statement or as agreed in a contract with you.

6. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead, we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@mc2therapeutics.com

7. RETENTION OF YOUR PERSONAL DATA

We retain personal data where we have an ongoing legitimate business need to do so (e.g., to maintain our engagement with you).

When we have no ongoing legitimate business need to process your personal data, we will either delete or anonymize it or, if this is not possible (e.g., because your personal data has been stored in back-up archives), we will securely store your personal data and isolate it from any further processing until deletion is possible.

Safety Reporting / Pharmacovigilance

The protection of personal data is of utmost importance to MC2, and we are committed to protecting your rights when processing your personal data to report unwanted effects experienced in relation to use of one of our products and/or participation in one of our clinical trials.

1. USE OF PERSONAL DATA

We collect and use your personal data to report safety and pharmacovigilance incidents to local and international authorities in accordance with applicable legislation. We may ask for your permission to contact your general practitioner.

2. CATEGORIES OF PERSONAL DATA

Other entities, such as your physician, reporting incidents to us may collect the following personal data about you, but we will only receive it in a pseudonymized form:

• Ordinary personal data: your name, contact information, gender, year of birth, and your general practitioner.
• Special categories of data: medical history, current and past medications (prescription and/or over-the-counter medications) that you are taking, your race and ethnicity, information about your use of the medicine, the effect it has on you, and its potential side effects.

3. SOURCES

We receive your personal data directly from you, your caregiver, physician, or other reporter.

4. LEGAL BASIS

We may process your personal data on the following legal basis:

Art. 9(2)(i) cf. Art. (6)(1)(c) of the GDPR. The processing of your personal data is necessary for us to comply with a legal obligation to collect and report safety incidents to regulatory authorities.

Art. 9(2)(i) cf. Art. 6(1)(a) of the GDPR – Consent. In certain situations, we also ask for your consent to process your personal data, e.g., for disclosure to your general practitioner or for future use of your personal data.

5. SHARING OF YOUR PERSONAL DATA

We may share your personal data with our affiliates, other companies and organizations commissioned by us to collect and report the data. These companies and organizations may only use your personal data for the purposes described above.

We will share your personal data with local and international authorities to the extent required by law.

6. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead, we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@mc2therapeutics.com

7. RETENTION OF YOUR PERSONAL DATA

Your personal data will be retained indefinitely in accordance with regulatory requirements.

Product Quality Complaints

This Privacy Statement explains how MC2 process your personal data in relation to any complaints received by you regarding the use of any of our products and its quality.

1. USE OF PERSONAL DATA

We may use your personal data for to assess, handle and respond to your complaint

2. CATEGORIES OF PERSONAL DATA

When submitting your complaint to quality.complaint@mc2therapeutics.com we may process the following personal data about you:

• Name, e-mail and other contact details, telephone number, and the product you complain about.

You should only include information relevant for your complaint. You should not include information about your race or ethnic origin, religion or belief, political opinion, sexual orientation, or union membership.

3. SOURCES

We collect the personal data directly from you as provided in your complaint.

4. LEGAL BASIS

Art. 6 (1)(f) of the GDPR – Legitimate interest. This means that the processing of your personal data is necessary for the purposes of the legitimate interests pursued by us when assessing your complaint.

5. SHARING OF YOUR PERSONAL DATA

We will only share your personal data with third parties that are involved in the complaint process.

6. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead, we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@mc2therapeutics.com

7. RETENTION OF YOUR PERSONAL DATA

We store your personal data no longer than strictly necessary to achieve the objectives for which your personal data is collected.

Corporate Governance

This Privacy Statement explains how MC2 process your personal data for our corporate governance.

1. USE OF PERSONAL DATA

We may use your personal data for the following purposes:

If you are a board member or management, we process your personal data for the purpose of making official registrations with public authorities, i.e., the Danish Business Authority and the Danish Registration Court.

2. CATEGORIES OF PERSONAL DATA

We may collect the following personal data about you:

Information about your name, address, place of birth and nationality; confirmation of identity in the form of a scanned copy of a passport, driver’s license, health insurance card and/or a birth certificate. If beneficial owners are not Danish, or do not have permanent residence in Denmark, it may be necessary to collect additional data.

3. SOURCES

We collect the personal data directly from you.

4. LEGAL BASIS

Art. 6(1)(c) – Legal obligation – we are obliged to collect and provide the personal data to authorities.

Art. 6 (1)(f) – Legitimate interests – this means that the processing of your personal data is necessary for the purposes of the legitimate interests pursued by us in relation to corporate governance matters, including communicating with you and the relevant authorities.

5. SHARING OF YOUR PERSONAL DATA

We may share your personal data with our affiliates, public authorities, suppliers, and vendors that assist our company, i.e., service providers, technical support, supply services, and financial institutions.

6. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead, we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@mc2therapeutics.com

7. RETENTION OF YOUR PERSONAL DATA

Personal data will be retained for as long as necessary in accordance with legal requirements to retain such personal data. In general, we will not keep your data for more than current year plus five years after the expiry of the business relationship.

Vendor Management

This Privacy Statement explains how MC2 process your personal data in administration of our contracts.

1. USE OF PERSONAL DATA

We may use your personal data to maintain a working relationship with you and/or your employer.

2. CATEGORIES OF PERSONAL DATA

We may collect the following personal data about you:

Name, contact information, CV, employer, title, job role, billing information, TAX ID, contract terms, training certificates, etc.

3. SOURCES

We collect the information directly from your employer, you or from the contracts we enter into with your employer or with you.

4. LEGAL BASIS

Art. 6(1)(b) of the GDPR – Performance of Contract. Personal data will be collected to perform the contract.

Art. 6 (1)(f) – Legitimate interests – this means that the processing of your personal data is necessary for the purposes of the legitimate interests pursued by us in relation to our on-going business relation and this is not to perform the contract.

5. SHARING OF YOUR PERSONAL DATA

We may share your personal data with our affiliates, public authorities, suppliers, and vendors that assist our company.

6. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead, we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@mc2therapeutics.com

7. RETENTION OF YOUR PERSONAL DATA

Personal data will be retained for as long as necessary. We may keep your personal data for up to 30 years to fulfil legal requirements, such as bookkeeping, GxP documentation, etc.

Job Applicant

This Privacy Statement explains how MC2 process your personal data in connection with the recruitment process, including the receipt of unsolicited applications for future job opportunities via our e-mail account career@mc2therapeutics.com.

1. USE OF PERSONAL DATA

We may use your personal data for the following purposes:

• To assess your qualifications and skills and comparing your profile with a current job offering and any potential vacancies and future job opportunities within MC2.
• To communicate the recruitment procedure of MC2 to you.
• To contact you.

2. CATEGORIES OF PERSONAL DATA

When applying, you decide which personal data to share with us. We may process the following personal data about you as an applicant:

• Name, e-mail and other contact details, telephone number, motivation, CV.

You should only include information relevant for the review of your application. You should not include information about your race or ethnic origin, religion or belief, political opinion, sexual orientation, or union membership. Please do not provide your personal identification number (CPR number) and/or copies of identification papers together with your application, unless we expressly ask for this.

3. SOURCES

We collect the personal data directly from you, from your references, from recruitment agencies and if you apply through LinkedIn, we also collect personal data from LinkedIn.

4. LEGAL BASIS

Art. 6 (1)(f) of the GDPR – Legitimate interest. This means that the processing of your personal data is necessary for the purposes of the legitimate interests pursued by us when assessing your application for a job opportunity.

Art. 6(1)(b) of the GDPR – Performance of Contract. If you have a working relationship with us such relationship is confirmed in writing and personal data will be collected to perform the contract.

Art. 6(1)(a) of the GDPR – Consent. In certain situations, we also ask for your consent to process your personal data, e.g., if we need to process your social security no., if such information is not a legal obligation.

5. SHARING OF YOUR PERSONAL DATA

We will only share your personal data with third parties that are involved in the recruitment process (e.g., recruitment agencies) or if such third parties are needed for the preparation and issuing of your employment contract.

6. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead, we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@mc2therapeutics.com

7. RETENTION OF YOUR PERSONAL DATA

We store your personal data no longer than strictly necessary to achieve the objectives for which your personal data is collected. This means that personal data of applicants for a job offering will be kept until the recruitment process is completed and for further 6 months to document the fairness of the recruitment process.

If you are employed, your personal data will be transferred to your personnel file as an employee of MC2.

Personal data provided in connection with an unsolicited application will be kept for a period of up to 6 months from its receipt to match it with new openings. Hereinafter the personal data will be properly deleted from our systems.

Marketing

This Privacy Statement explains how MC2 process your personal data for marketing related purposes.

1. USE OF PERSONAL DATA

We may use your personal data for the following purposes:

Personal data will be processed for marketing-related purposes, including sending relevant information regarding our products and services (direct marketing), and for targeting our communication with you. We will not send you direct marketing unless you have given your consent. You may revoke your consent at any time and discontinue the use of the service.

2. CATEGORIES OF PERSONAL DATA

We may collect the following personal data about you:

E-mail address, name, address, telephone number, profession, workplace.

3. SOURCES

We collect the personal data directly from you.

4. LEGAL BASIS

Art. 6(1)(a) – Consent – we will ask for your explicit consent before sending you direct marketing and targeting our communication with you.

5. SHARING OF YOUR PERSONAL DATA

We may share your personal data with suppliers and vendors working for us.

6. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead, we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@mc2therapeutics.com

7. RETENTION OF YOUR PERSONAL DATA

Personal data will be retained for as long as necessary to provide you with the given service. If you withdraw your consent, we will delete your personal data two years after the date of your withdrawal in accordance with guidance from the Danish Consumer Ombudsman.

Social Media

This Privacy Statement explains how MC2 process your personal data collected on social media pages such as LinkedIn.

1. USE OF PERSONAL DATA

We may use your personal data for the following purposes:

To administer our pages and communicate with users, including potential patients.

2. CATEGORIES OF PERSONAL DATA

We may collect the following categories of personal data about you:

Information made public by you, including your name, e-mail address, profession, workplace, interests, pages you like or follow, preferences, friends, health information in the form of adverse events, racial or ethnic origin, political opinions, etc.

3. SOURCES

We collect the personal data directly from you.

4. LEGAL BASIS

Art. 6(1)(f) – Legitimate Interest – this means that the processing of your personal data is necessary for the purposes of the legitimate interests pursued by us in relation to our communication with you.

Art. 9(2)(e) – Information manifestly made public by you.

5. SHARING OF YOUR PERSONAL DATA

We may share your personal data with our affiliates, suppliers and vendors working for us, and public authorities.

6. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

Your personal data may be transferred within the EEA or to countries outside the EEA, that are not deemed to provide an adequate level of protection of your personal data compared to the EEA. Instead, we have provided appropriate safeguards as required by Art. 49 (1) of the GDPR through EU standard contractual clauses.

You may obtain a copy of the EU standard contractual clauses by contacting us on: DataPrivacy@mc2therapeutics.com

7. RETENTION OF YOUR PERSONAL DATA

Personal data will be retained for as long as necessary to handle your requests on social media, answer your enquiries, or to undertake marketing-related initiatives based on the information provided by you on social media.