Privacy statement

1. Definitions

Business Concern — A business or legal entity engaged in the use of BPPS through a natural person (User).

Personal Data (PD) — Any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Data — Any electronic data and information submitted by or for the User to the platform and reasonably required to operate the Products and Services or collected by or for the User using the Products.

Business Partnering Products and Services (BPPS) — Software and Websites of Inpart :

2. Data Processing And Hosting

Publishers

Inpart can be contacted:

• by e-mail at : privacy@inpart.io
• by regular mail at: Inpart, 89 rue Tronchet, 69006, LYON, FRANCE
• by phone at : +33 478 27 9502

Head of publication: Mr. Gilles Toulemonde

Web Hosting

Inpart applications (BPPS) are hosted by our hosting partner:

GTT Managed Services is, registered in GENEVA trade register under number CHE-106.841.122, headquartered at 2 Chemin de l'Epinglier, Meyrin, Geneva, CH-1217 (Switzerland).

3. Processing Activities Covered — Purposes of Processing

This Privacy Statement applies to the processing of Personal Data collected by Inpart as the Processor on behalf of Business Concerns when you:

• Receive BPPS-related communications from us, including emails, phone calls, texts or fax;
• Use our cloud products (BPPS) and services as an authorized user;
• BPPS-related communications, including emails, phone calls, texts or fax.

This Privacy Statement applies to the processing of Personal Data collected by Inpart as the Controller for its own purposes when you:

• Visit our websites for purpose other than using BPPS
• Visit our branded social media pages;
• Visit our offices;
• Request or we provide you with demos and promotional communications (including invitations to events, webinars and contests and provision of content and resources like whitepapers and e-books) — we may also market Inpart or our partner's products and services to you;
• Receive day-to-day business communications from us, including emails, phone calls, texts or fax, unrelated to BPPS, including where you request we contact you;
• Register for, attend or take part in our events (including virtual events), conferences, webinars, or contests, organized by Inpart, or those organized by our partners together with Inpart, or when they provide information to us, which was collected via the events, webinars, or contests organized by our partners.

We may collect the following categories of personal data: User Profile: Company description; Therapeutic areas of interest; Financials; Contact Information; Company Assets; Company Services; Company Market Products; Company Management; and, any Content you upload into your BPPS User Profile. BPPS Network Interactions: A User's interactions within BPPS such as, but not limited to, scheduling preferences, searches, accepted meetings, rejected meetings, messages, notes and tasks.

• Data we collect automatically: When you interact with Inpart through the BPPS and our website, we receive and store certain information such as an IP address and your activities within the Services and the website. Inpart website and BPPS may store and use such information and pool it with other information to track, for example, the total number of visitors to our Site.
• Info through other Services: Inpart have worked with certain third-party social media providers to offer you their social networking services through our BPPS. For example, you can use third-party social networking services, including but not limited to Facebook, Twitter, and others to share information about your experience using our BPPS with your friends and followers on those social networking services.
• These social networking services may be able to collect information about you. These third-party social networking services also may notify your friends that you are a user of our BPPS or about your use of our BPPS, in accordance with applicable law and their own privacy policies. If you choose to access or make use of third-party social networking services, we may receive information about you that you have made available to those social networking services, including information about your contacts on those social networking services.
• From our business partners: We may receive your name and contact details from our business partners, which organize on our behalf, help us organize, or themselves organize events, webinars or contests and subsequently share your information with us. Such business partners may include, e.g., event organizers, trade associations, such as those representing biotechnology industry and others. · Cookies: Inpart employ cookies and similar technologies to keep track of your local computer's settings such as which account you have logged into and notification settings. Cookies are pieces of data that sites and services can set on your browser or device that can be read on future visits. We may expand our use of cookies to save additional data as new features are added to the Service. In addition, we use technologies such as web beacons and Local Shared Objects to record log data such as open rates for emails sent by the system.
• Third party web analytics tools (Google Analytics): Inpart may use third party website analytic tools such as Google Analytics on our website that employ cookies to collect certain information concerning your use of our Services. However, you can disable cookies by changing your browser settings. Further information about the procedure to follow to disable cookies can be found on your Internet browser provider's website via your help screen.

4. Use and Share of Your Information

We may use your Data in a manner reasonably required to operate the BPPS. For example, if you become a User by registering for an event, submitting your Data on a One-on-One partnering platform your Data will be reproduced, replicated, published, displayed, disseminated, and downloaded and printed for personal use by all other Users of that event, and use of its BPPS. We may use your Data for internal recording, analysis, research, product development and for answering your queries.

We may share your Data and other personal data with companies performing services on our behalf (such as marketing, IT or delivery services) who will only use your Data to provide that service such as hosting and processing services. We may also share your personal data for which we are controllers with some of our business partners, which co-organize, help us organize or otherwise support our events, webinars or contests or with which we cooperate.

To facilitate our business practices, your PD may be collected, transferred to and stored outside of the EEA by us our business partners, vendors or suppliers, in particular in the United States (including by Inpart Inc.). Inpart has implemented safeguards to ensure an adequate level of data protection where your Personal Data is transferred to countries outside the EEA, such as standard contractual clauses for the transfer of Personal Data as approved by the European Commission (Art. 46 GDPR). Please contact us at the below details, if you would like to learn more about measures we use to protect your information when transferred to third countries.

Our legal basis for collecting and using PD as data controllers will depend on the PD concerned and the specific context in which we collect it. In many cases, we will process PD about you using the following legal basis:

• Legitimate interest — we process PD to meet our legitimate business interests, as identified above.
• Legal obligation — we process PD to comply with applicable laws and regulations.
• Performance of Agreement — we process PD in order to perform or fulfill our obligations under an agreement with you or the entity with which you are affiliated.
• Consent — We may process your PD based on consent. For example, if we want to send you a marketing communication, we may seek your consent separately at the time of collection, if necessary. You may withdraw your consent at any time by contacting us using the information in the “Contact Us” section below.

Inpart does not sell, share, or rent your Data to third parties other than as disclosed in this Privacy Policy. Any use of your Data not mentioned in this Privacy Policy will only be made with your permission.

5. Data Protection & Security

We maintain appropriate precautions including organizational, technical, and physical safeguards to protect you against the loss or unauthorized use, alteration or disclosure of, or unauthorized access to, the PD we process or use.

While we follow generally accepted standards to protect Personal Data (such as ISO27001), no security measure or transmission is 100% secure. You are solely responsible for protecting your password, limiting access to your devices and signing out of BPPS after your sessions. If you have any questions about the security of our BPPS, please contact us by using the information in the “Contacting us” section, below.

6. Data Retention

Inpart generally retain personal data for so long as it may be relevant to the purposes identified above.

PD and Data of the User are retained during the use of BPPS, and until the suppression of the User account. PD and Data may however be stored beyond this duration to be transmitted, if needed, to judicial authorities to enable criminal offences investigations. When such PD and Data is stored, the PD and Data will no longer be online but be subject to an anonymization process and kept on a safe and independent medium. Data may persist in copies made for backup and business continuity purposes for additional time. When PD is used for other purposes than the use of BPPS, we retain such PD only as long as we need it for the purpose for which we are processing it. Retention periods can vary based on the type of PD and how it is used. For example, when you contact us with a complaint, query, or other concern, we will retain your information for as long as needed to respond to your query. We retain PD in accordance with criteria that include legally mandated retention periods, pending or potential litigation, our intellectual property or ownership rights, contract requirements, operational directives or organizational needs, and historical archiving.

7. Data Rights

In accordance with French Law, notably the Act N°78-17 of 6 January 1978 on Information Technology, and the General Data Protection Regulation (GDPR), you may, if your information is subject to such laws, at any time:

• Access your PD held by us (right to access);
• Rectify inaccurate PD, ensure it is complete (right to rectification);
• Erase/delete your PD (right to erasure; right to be forgotten);
• Restrict Inpart processing of your PD to the extent permitted by law (right to restriction of processing);
• Transfer your PD to another processor, to the extent possible (right to data portability);
• Oppose the use of your PD or PD processing for marketing or unsolicited commercial communications (right to object; opt-out procedure);
• Lodge a complaint with a supervisory authority.

8. Children

Our websites and BPPS are not directed at children. We do not knowingly collect PD from children under the age of 16. If you are a parent or guardian and believe your child has provided us with Personal Data without your consent, please contact us by using the information in the “Contacting us” section below and we will take reasonable measures to promptly remove applicable information from our systems and records.

9. Notifications of Changes

We reserve the right to update the Privacy Statement and the “effective date” at the top at any time to reflect changes in our practices. Users should periodically review this Privacy Statement to stay informed about our collection, processing and sharing of your PD.

9. Contacting Us

To exercise your rights relating to your Personal Data, or if you have questions regarding our privacy practices, please mail us at: privacy@inpart.io. Inpart is committed to working with you to obtain a fair resolution of any complaint or concern about privacy. For your protection, we may take steps to verify identity before responding to your request.