California Privacy Notice and Policy

We collect this information directly from you when you provide it by applying for a job, accepting a job offer and joining Prime as an employee. This information may also be collected during an acquisition, by, third-party vendors that conduct pre-employment background checks and provide employee benefits, IT infrastructure to establish and maintain access to Prime’s systems to perform your role and when you visit external Prime websites.
 

Data retention

Prime keeps your personal information no longer than necessary for the purposes described above.
 

How we use your personal information

We use the personal information that you provide us, or that we collect about you, for the following purposes:
 

• To create and maintain an internal employment or contractor record which allows you appropriate access in the Company’s systems.
• For workforce management (e.g., appraisals, promotions, succession planning and career development).
• To create and maintain appropriate records with our third-party vendors that require your information to provide benefits or various services to you or Prime throughout your candidacy and employment, including through termination.
• To consider you for current or future employment opportunities and to process applications that you submit for other positions within Prime.
• To fulfill any other purpose for which you provide it, such as subscribing you to an email newsletter for budgeting, financial management and reporting purposes.
• For conducting investigations, audits, compliance with government inspections and other requests from government or other public or regulatory authorities, detecting and preventing crime and fraud, and complying with internal policies procedures, and contractual obligations.
• To allow you to participate in interactive features on our website, if any.
• To comply with applicable laws, regulations, and legal process.
• To manage mergers, acquisitions, and re-organizations.
• To operate and manage the IT and communications systems, including for security and business continuity purposes.
• To keep a record of our transactions and communications.
• For the protection of our operations or those of any of our affiliates, or to protect our rights, privacy, safety, or property, or that of our affiliates, you, or other parties.
• In any other way we may describe when you provide the information.
• For any other purposes with your consent.

Disclosure of personal information

We may disclose all the categories of Personal Information listed above for our business purposes. Prime requires third parties who perform services for the Company agree to treat our personnel Personal Information confidentially and securely. Prime does not sell, rent, or lease its personnel Personal Information to third parties with which we do not have a formal agreement to provide services to the Company and our customers or prospects. We may transfer Personal Information about you outside the United States for the purposes described in this Personnel Privacy Policy or as permitted or required by law. Prime will not obtain any personnel consent prior to processing and disclosing their personal information, if consistent with this policy or required by law.

The categories of recipients include:

• Service providers: We engage service providers that perform services to help us administer Personnel compensation and benefits, facilitate our recruiting and immigration sponsorship efforts, assist with facilitating our employment relationship with Personnel, operate and maintain our IT resources, provide data or physical security, ensure compliance with government filings, and otherwise operate our business. Unless otherwise specified, these companies will only use your Personal Information in the ways described in this Notice.
• Benefit providers: We arrange for you to receive certain benefits from third parties, such as insurance or financial benefit companies.   We disclose information with those parties to facilitate the provision of those services.
• Consultants: We may provide your Personal Information to consultants and advisors that help us operate and improve our business.
• Group companies: Company has affiliates around the world. We may disclose your Personal Information to affiliates for employment, recruiting, security, and internal reporting purposes. Unless otherwise specified, Company affiliates will only use your information in the ways described in this Policy.
• Recipients of legal disclosures: We may disclose your personal information to law enforcement agencies, courts, other government authorities or other third parties where we believe necessary to comply with a legal or regulatory obligation. We may disclose personal information as we deem reasonably necessary to support lawful investigations or requests, or as reasonably necessary to protect our rights or the rights of you or any other party.
• In the context of a transaction: We may disclose Personal Information to potential transaction partners, service providers, advisors, and other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company, or we sell or transfer all or a portion of our assets or business.
• In the context of public relations: We may disclose Personal Information to highlight our employees on Prime sponsored social media pages and our corporate website for employment branding and other business-related public relation purposes.

Prime has not sold any categories of personal information to third parties within the past twelve (12) months. We do not “sell” personal information associated with Personnel for monetary or other valuable compensation, and we do not “disclose” personal information associated with Personnel, as those terms are respectively defined under applicable law. Relatedly, we do not knowingly sell or disclose personal information of children under 16 years of age with third parties.

We do not use or disclose sensitive personal information associated with Personnel for purposes other than those expressly permitted under California law.
 

Your rights under the CPRA

The CPRA provides California residents with the rights detailed below.  For convenience, and as required by the CPRA, we explain how you can exercise those rights, to the extent they are applicable.

1)   Right to request and access information.  You have the right to request that we disclose certain information about our collection and use of your personal information during the past twelve (12) months.  Specifically, you may request that we disclose:

• The categories of personal information we collected about you;
• The categories of sources for the personal information we collected about you;
• The business and commercial purposes for collecting your personal information;
• The categories of third parties with whom we shared your personal information;
• The specific pieces of personal information we collected about you; and
• If we disclosed your personal information for a business or employment purpose, the categories of personal information received by each category of third party.

2)   Right to correct. You have the right to request that we correct personal information we collected from you, subject to any exceptions or limitations under the CPRA.

3)   Right to restrict use of sensitive data. You have the right to request to limit any use of sensitive personal information, which includes precise geolocation, race, ethnicity, religion, genetic data, private communications, and certain sexual orientation, health, and biometric information. Prime Therapeutics does not share any of this sensitive data with third party vendors that are not using the information for legally required purposes, such as HR reporting services to meet government contract and reporting obligations. Prime does not collect or process your sensitive personal information for the purpose of inferring characteristics, and therefore, this right does not apply.

4)   Right against retaliation. If a California employee, contractor, or job applicant exercises the rights discussed above, consistent with the CPRA, Prime will not discriminate or retaliate against that individual.

5)   Right to request deletion.  You have the right to request that we delete personal information we collected from you, subject to any exceptions or limitations under the CPRA.
 

How to make requests

To exercise the rights described above, you, or someone authorized to act on your behalf, must submit a request to us by either emailing us at  HumanResources@PrimeTherapeutics.com  with the email subject “California Privacy Request”  or contacting Human Resources directly at: 866.469.1257.
 

Responding to requests

Your request must allow us to reasonably verify that you are the individual regarding whom we collected the personal information and must describe the request with enough detail that we can understand and respond to it. You may only submit requests for access twice within any twelve (12) month period.  As indicated above, please be aware that the CPRA provides certain limitations and exception to the foregoing rights, which may result in us denying or limiting our response to your request.

The CPRA requires us to respond to a verifiable consumer request within forty-five (45) days but permits us to extend that period by an additional forty-five (45) days, provided we notify you of the reason for the extension in writing.  We will notify you that we have received your request within ten (10) business days of its receipt.  In general, we will not charge a fee to respond to a verifiable request.  However, a request may be refused, or a reasonable administrative fee may be charged if the request is manifestly unfounded or excessive, in particular because of repetitiveness.

Privacy and data protection laws, other than the CPRA, apply to much of the personal information that we collect, use, and disclose. When these other laws apply, personal information may be exempt from, or outside the scope of, a request to know, delete, or correct. For example, information subject to certain federal privacy laws, such as the

Gramm-Leach-Bliley Act or the Health Insurance Portability and Accountability Act, is exempt from CPRA requests. As a result, we may decline all, or part of your request related to exempt personal information. This means that we may not provide some, or all, of this personal information when you make a request to know. Additionally, we may not delete or correct some, or all, of this Personal Data when you make a request to delete or correct.
 

Authorized agents

If you are a California resident, you may authorize an agent to make a request on your behalf. A California resident’s authorized agent may make a request on behalf of the California resident by using the submission methods listed above under “How to Make Requests.”  

As part of our verification process, we may request that you provide, as applicable:
 

• For an individual (“requestor”) making a request on behalf of a California resident:
   
  • The requestor’s name; at least one of the following email address, phone number, or home address and a copy or photo of the driver’s license, state ID, or matricula card.
  • The name; at least one of the following email address, phone number, and home address; Social Security or individual taxpayer identification number; date of birth; and a copy or photo the driver’s license, state ID, or matricula card of the California resident on whose behalf the request is being made.
  • A document to confirm that the requestor is authorized to make the request. We may accept, as applicable, a signed permission by the California resident on whose behalf the request is made, copy of a power of attorney, legal guardianship, or conservatorship order.
     
• For a company or organization (“legal entity requestor”) making a request on behalf of a California resident:
   
  • The legal entity requestor’s active registration with the California Secretary of State.
  • Proof that the California resident has authorized the legal entity requestor to make the request. We accept as applicable, a signed permission by the California resident on whose behalf the request is made, copy of power of attorney, or legal guardianship or conservatorship order.
  • The name; at least one of the following: email address, phone number, or home address; Social Security or individual taxpayer identification number; data of birth of the California resident on whose behalf the request is being made. From the individual who is acting on behalf of the legal entity requestor, proof that the individual is authorized by the legal entity requestor to make the request. We accept a letter on the legal entity requestor’s letterhead, signed by an officer of the organization.