Arvinas General Privacy Notice

Last Updated: September 11, 2023

Arvinas, Inc. and its affiliates and subsidiaries (collectively, “Arvinas,” “we,” “us” or “our”) are committed to maintaining your privacy and recognize the importance of providing protection for any personally identifiable information that you choose to share with us or that we maintain about you (“Personal Information”). We have established this Privacy Notice to inform you about how we process your Personal Information for “Arvinas’ Services”, both when you use the websites we operate (the “Websites”) and when we interact with you as a business contact (the “Business Services”).

Please note that in some instances we or our representatives may provide you with a separate privacy notice as legally required, in which case that privacy notice provided to you will control our processing of your Personal Information instead of this Privacy Notice. For example, if you are a subject participating in a clinical trial sponsored by Arvinas, you will generally receive a separate privacy notice at the time you consent to enroll in the trial that will describe Arvinas’ collection, use, and disclosure of your Personal Information as part of that trial. Also, employees and contractors, candidates, beneficiaries of Arvinas’ benefit plans, and employee emergency contacts will have access to privacy notices specific to them.

Please read this Privacy Notice carefully. Should you have any questions about this Privacy Notice or our data practices, please see our contact information below.

Personal Information Processed by Arvinas

The Personal Information we process about you may include the following categories:

Direct Identifiers, such as your name, telephone number, e-mail address, social media information, and your Internet Protocol (“IP”) address.
Information maintained in our business records, including details about your relationship with Arvinas, studies or services you are interested in, and the contents of your communications with us.
Professional or employment-related information, if you interact with us in that capacity. The Personal Information we collect may include your specialty, practice, and institution.
Internet and other electronic activity information, such as information about your device (like your operating system, browser type, and language), referring URLs, access times, pages viewed, links clicked, and other Personal Information about your activities on our Websites.

We collect your Personal Information in different ways, including:

When you provide it directly to us. For example, we collect Personal Information when you send us a comment or question, or when you request information through our Websites.
When we collect it automatically when you use our Websites, including through cookies and other data collection technologies.
When we collect it from or through third parties such as organizations that support our business, research partners, social media platforms through which you interact with us, vendors, and suppliers.

Why We Process your Personal Information

Processing of Personal Information: Website-related Services

Arvinas processes Personal Information about you related to the operation of our Websites, including to:

Provide, maintain, and improve our Websites and to provide you with relevant information and services that you request.
Send you technical notices, updates, security alerts, and support and administrative messages.
Monitor and analyze trends, usage, and activities in connection with our Websites.

For EEA data subjects, the legal basis for this processing of Personal Information is our legitimate interest to carry out scientific research, develop medicines, conduct clinical trials, and provide information and education (Article 6(1)(f) GDPR).

Processing of Personal Information: Operate and Provide Business Services to You

Arvinas may process Personal Information for its general business purposes, including those associated with the marketing, growth, maintenance, and management of Arvinas’ business. These may include our internal operations and administration and carrying out our business relationships. Specific examples include to:

Respond to your comments, questions, and requests, and provide customer service.
Communicate with you about our activities, products, and services, and to provide information we think will be of interest to you.
Carry out any other purpose for which the information was collected.

Arvinas may also process Personal Information for purposes to which you provide consent, including potentially marketing and communication materials. For EEA data subjects, the legal basis of this processing is consent (Article 6(1)(a) GDPR).

Processing of Personal Information: For Legal Purposes

Arvinas may process Personal Information to detect, investigate, and prevent risk, fraudulent transactions, and other illegal activities, to manage legal claims, subpoenas, and requests in connection with investigations and dispute-resolution processes, as permitted or required by applicable law, and to protect the rights and property of Arvinas and others. For EEA data subjects, the legal basis for this processing the Personal Information is to fulfill our legal, regulatory and risk management obligations, including regulatory filings and establishing, exercising, or defending legal claims (Article 6(1)(c) GDPR).

Processing of Personal Information: To Create Anonymized Information

In some geographies, we may process your Personal Information to create anonymized information, which cannot be used to identify you. This type of information is no longer Personal Information, and it is not subject to this Privacy Notice. For EEA data subjects, the legal basis for this processing of personal information is our legitimate interest to carry out scientific research, develop medicines, conduct clinical trials, and provide information and education (Article 6(1)(f) GDPR).

Personal Information of Children

Our Websites are intended for general audiences and is not directed to minors. If we learn that we have received Personal Information directly from an individual under the age of 18 without proper parent or guardian consent, we will use that Personal Information only to respond directly to that child. We request that children do not provide Personal Information through our Websites.

How We Disclose Personal Information

We may disclose Personal Information about you as follows or as otherwise described in this Privacy Notice:

With vendors, consultants, collaborators, and other service providers, including, but not limited to, providers of Arvinas’ Website hosting services, external consultants, operating systems and platforms, third parties powering our webpages, and vendors that facilitate your submissions of Personal Information and the registration for and hosting of webcast and live events and other communication media, to the extent they need access to such Personal Information to carry out work on our behalf.
To third parties, including government bodies, to respond to a legal requirement or legal process including for example to respond to a request for information, if we believe disclosure is in accordance with, or required by, any applicable law, regulation, or legal process.
To any third parties necessary to enforce our rights or the rights of others, including if we believe your actions or the actions of those who you represent are inconsistent with our user agreements or policies, or to protect the rights, property. and safety of Arvinas or others.
To any third parties necessary in connection with a transaction involving the company, including for example during negotiations of, any merger with, sale of company assets to, financing of, or acquisition of all or a portion of our business by another entity.
To third party vendors, sites, and potential research sites and to regulatory authorities and other third parties as necessary for research-related purposes including for example recruitment and screening for participation in research studies, and to carry out research.
Between and among Arvinas companies under common control and/or ownership including for example its current and future parents, affiliates, subsidiaries.
To any third party for whom you have consent or directed us to disclose your Personal Information, or as we believe to be necessary and appropriate, including (i) as permitted or required by law; (ii) if we determine that the disclosure of specific Personal Information is necessary to comply with the request of a law enforcement or regulatory agency or other legal process; (iii) to pursue available remedies or limit damages; and (iv) to respond to an emergency.

Information Collected by Cookies and Other Tracking Technologies

We and our service providers use various data collection technologies, including cookies and web beacons, to collect Personal Information about you when you interact with our Websites. Cookies are small data files stored on your hard drive or in device memory that help us improve our Websites and your experience, see which areas and features of our Websites are popular, and count the number of visits to our Websites. We generally use the following categories of cookies on our Websites:

Essential or “Strictly Necessary” Cookies: Arvinas uses first party cookies that are essential for the operation of our Websites and enable its functionality.
Functional Cookies: These cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies, then some or all of these services may not function properly.
Performance Cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. If you do not allow these cookies we will not know when you have visited our site and will not be able to monitor its performance. Arvinas uses Google Analytics in limited geographies to gather Website traffic information to allow Arvinas to improve our Websites and support their functionality. To prevent these services from collecting your user activity on the Websites, see https://tools.google.com/dlpage/gaoptout.

We also use web beacons, which are electronic images that may be used in our Websites or emails and help deliver cookies, count the number of visits to our Websites and understand usage and email or marketing campaign effectiveness.

For more information about cookies, and how to exercise your choices, please see “Your Rights” below.

Some web browsers incorporate a “Do Not Track” (“DNT”) or similar feature that signals to websites that a user does not want to have his or her online activity and behavior tracked. Because DNT is not uniform across browsers, it is possible that website operators, like us, do not recognize or respond to browser initiated DNT signals. Despite this, we do not collect information about your browsing activities over time and across third party websites.

The Site includes content populated by third parties, which may contain its own cookies.

Links to Other Sites

Some of our Websites’ features may contain links to third party websites or services that are not under our control. Such links do not constitute an endorsement of those third parties, or the content displayed on their sites. We provide these links to you only as a convenience, and any information you provide to those third parties will be used as described by the third parties in their own privacy policies.

Location of Data

We are based in the United States and our service providers may also be located here or elsewhere in the world. By accessing or using our Websites or otherwise providing Personal Information to us, you understand that your Personal Information will be processed in the U.S. and the countries where our services providers are located, which may have different privacy protections than those where you are located. Where this is the case, we will take appropriate measures to protect Personal Information about you in accordance with laws that apply to us and consistent with this Privacy Notice.

Your Rights

All users of Arvinas Services have the following privacy rights:

You may contact us to correct any Personal Information you provide to us. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be inaccurate.
You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of the Websites may then be inaccessible or not function properly.
If you do not wish to receiving marketing emails from us, you can opt-out by clicking “unsubscribe” on the email you received. You can also unsubscribe by sending us your name, mailing address, and email address. Unsubscribe requests do not apply to transactional or relationship messages we may send you.

The country or state where you are located or reside may grant you additional privacy rights with respect to the Personal Information we maintain about you. We included an explanation of these rights for some countries and states below.

We will take steps to verify your identity before processing your request. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify you are the individual about whom we collected Personal Information. We will only use the Personal Information provided in the verification process to verify your identity or authority to make a request and to track and document request responses unless you initially provided the information for another purpose.

You may use an authorized agent to submit a request. When we verify your agent’s request, we may verify your identity and request a signed document from your agent that authorizes your agent to make the request on your behalf. To protect your Personal Information, we reserve the right to deny a request from an agent that does not submit proof that they have been authorized by you to act on their behalf.

Unless you are located in the EEA or UK, contact us at privacy@arvinas.com to exercise one of these rights. Please include your name and the email address to which you would like us to respond.

Rights for Individuals Located in the EEA and UK

Arvinas, Inc. is the data controller of the Personal Information we process under this Privacy Notice.Data subjects protected by EEA/UK data protection laws have these rights:

Right to Access and Portability: the right to request information about Arvinas’ processing of the data subject’s Personal Information, and the right to request a copy of the data subject’s Personal Information.
Right to Rectify: the right to request the rectification of the data subject’s inaccurate Personal Information.
Right of Erasure: the right to request Arvinas erase the data subject’s Personal Information.
Right to Restrict Processing: the right to request Arvinas limit or restrict the processing of the data subject’s Personal Information.
Right to Object: the right to object to certain types of Personal Information processing.
Right to Lodge a Complaint: the right to submit a complaint about the processing of Personal Information. Contact information for EEA data protection authorities can be found on the European Data Protection Board website. Contact information for the UK data protection authority can be found on the Information Commissioner’s Office website.
Right to Withdraw Consent: the right to withdraw consent to the processing of the data subject’s Personal Information, where the Personal Information is processed under consent.

These rights are not absolute and will be processed on a case-by-case basis by Arvinas’ EEA/UK Data Protection Officer. Please contact us at arvinas.dpo@mydata-trust.info or 1 888 993 8544 to exercise your rights. Please include your name, your home address, your telephone number, and the email address to which you would like us to respond.

Rights and Additional Disclosures for Individuals Located in California

This Privacy Notice describes our practices over the last 12 months with respect to categories of information we collect, the sources of that information, and how we have disclosed it. Specifically, in the last 12 months, we have disclosed each category of Personal Information as follows:

Category of Personal Information (described above)	Recipients To Whom Data is Disclosed for a Business Purpose	Recipients to Whom Data is Sold or Shared by Arvinas
Direct Identifiers	With vendors, consultants, collaborators, and other service providers; to third parties to respond to a legal requirement or legal process; to third parties necessary to enforce our rights and the rights of others; to third parties necessary in connection with a transaction involving the company; to third party vendors, sites, and potential research sites and to regulatory authorities and other third parties as necessary for research-related purposes; between and among Arvinas companies under common control and/or ownership; and to third parties for whom you’ve consented or directed us to disclose your Personal Information.	Not sold or shared
Information in our business records	With vendors, consultants, collaborators, and other service providers; to third parties to respond to a legal requirement or legal process; to third parties necessary to enforce our rights and the rights of others; to third parties necessary in connection with a transaction involving the company; to third party vendors, sites, and potential research sites and to regulatory authorities and other third parties as necessary for research-related purposes; between and among Arvinas companies under common control and/or ownership; and to third parties for whom you’ve consented or directed us to disclose your Personal Information.	Not sold or shared
Professional or employment-related information	With vendors, consultants, collaborators, and other service providers; to third parties to respond to a legal requirement or legal process; to third parties necessary to enforce our rights and the rights of others; to third parties necessary in connection with a transaction involving the company; to third party vendors, sites, and potential research sites and to regulatory authorities and other third parties as necessary for research-related purposes; between and among Arvinas companies under common control and/or ownership; and to third parties for whom you’ve consented or directed us to disclose your Personal Information.	Not sold or shared
Internet and other electronic activity information	With vendors, consultants, collaborators, and other service providers; to third parties to respond to a legal requirement or legal process; to third parties necessary to enforce our rights and the rights of others; to third parties necessary in connection with a transaction involving the company; between and among Arvinas companies under common control and/or ownership; and to third parties for whom you’ve consented or directed us to disclose your Personal Information.	Not sold or shared

California residents also have the right to request the following under the California Consumer Privacy Act:

Right to Know: the right to request to know the categories and specific pieces of Personal Information we have collected about you; the categories of sources from which that Personal Information was collected; and how we have sold, shared, or otherwise disclosed your Personal Information.
Right to Correct: the right to request that we correct inaccurate Personal Information that we maintain about you.
Right to Delete: the right to request that we delete the Personal Information that we have collected or maintain about you. We may deny your request under certain circumstances, such as if we need to comply with our legal obligations or complete a transaction for which your Personal Information was collected. If we deny your request for deletion, we will let you know the reason why.
Right to Opt Out of Sale/Sharing: the right to opt out of the sale of your Personal Information or the sharing of your Personal Information for targeted advertising purposes. We do not currently sell or share your Personal Information.

To exercise your CCPA rights, contact us at privacy@arvinas.com or 1 888 993 8544.

Retention

We retain your Personal Information for only as long as we need it to provide our products and services, operate our business, and comply with our legal obligations. When we decide how long to keep your Personal Information, we keep in mind the nature and sensitivity of the information, the potential harm from unauthorized use, the reasons we collected the Personal Information, and our legal obligations.

Security

We use reasonable physical, technical, and administrative measures designed to protect your Personal Information. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is not secure, please immediately notify us in accordance with the “Contact Us” section below.

Updates to Privacy Notice

Arvinas reserves the right to update this Privacy Notice from time to time. If we decide to change this Privacy Notice, we will endeavor to notify you by revising the date at the top of this Privacy Notice and, in some cases (for example, if we plan to use your Personal Information in a way that materially differs from this Privacy Notice), we may provide you with additional notice (such as adding a statement to our Website homepage or by providing you a notification). You are encouraged to review this Privacy Notice regularly to stay informed about our Personal Information practices and the choices available to you.

Contact Us

For general questions about our privacy practices, please contact us at privacy@arvinas.com.

Additional contacts:

EEA/UK Data Protection Officer: DPO@mydata-trust.info
EU Data Protection Representative: MyData-TRUST France, Rue Louis Duvant, 1, 59220, Rouvignies, France
UK Data Protection Representative: MyData-Trust UK, Waldeck House, Lyne Lane, Chertsey, KT16 0AW, UK