S2 Genomics, Inc. Privacy Policy

This version was last updated in June 2020.

Introduction

At S2 Genomics, Inc., we are committed to protecting your personal data and privacy. This Privacy Policy and Notice of S2 Genomics, Inc. (privacy notice) provides you with details on how S2 Genomics, Inc. (also referred to as; S2/ the Company / we / us / our) treat your personal data when you visit our website (site) regardless of where you visit it from, and on our policy for the protection of your personal data. This privacy notice will also tell you about how the law protects you and your privacy rights.

IMPORTANT INFORMATION AND CONTACT DETAILS

Purpose of this privacy notice

This privacy notice aims to give you information on how we collect and process your personal data through your use of this site, including any data you may provide voluntarily through this site when you, for example:

• complete any customer or visitor registration, such as but not limited to:
  • registering to participate in any of our interactive services or activities including webinars;
  • subscribing to any S2 Genomics communications including our S2 newsletters;
  • signing up to receive product- and service-related information via our website including the Resources page https://s2genomics.com/resources;
• submit any on-line inquiries or requests for product and/or service information, including via our Contact Us page https://s2genomics.com/contact;
• submit any inquiries via email to inquiries@s2genomics.com
• complete any third-party forms through platforms such as Eventbrite, GenomeWeb, GoToWebinar, or Zoom Meetings, related to S2 Genomics events or online forums;
• make any inquiries or submissions in response to potential or actual S2 Genomics career opportunities;
• have your conference badge scanned for S2-related events;
• fill out any on-line order form;

So that you are fully aware of how and why we are using your data, it is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you (in particular in relation to any job application procedure). This privacy notice supplements the other notices and is not intended to override them.

It is important to note that this site is not intended for children and we do not knowingly collect data relating to children.

Contact Information

If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact us using the details set out below.

Full name of legal entity		S2 Genomics, Inc.
Email address		privacy@s2genomics.com
Mailing address		S2 Genomics, Inc. 6712 Preston Ave, Ste D Livermore, CA 94551 USA
Phone number		(925) 292-8243

You have the right to make a complaint at any time to the relevant data protection supervisory authority (for example, in the U.K., the supervisory authority for data protection is called the Information Commissioner’s Office (ICO) (www.ico.org.uk).

We would, however, appreciate the chance to learn about and work with your concerns before you approach your relevant authority so please contact us in the first instance.

Changes to the privacy notice and your duty to inform us of changes

This Privacy Policy was last updated in June 2020.

The data protection law for individuals in the European Union (EU) changed on 25 May 2018 (the effective date of the General Data Protection Regulation (GDPR)).

We are based in the United States of America (USA), however, as part of our business practices, we process personal data of individuals within the EU and we therefore ensure that we comply with the GDPR.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Third-party links

This site may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy policies. When you leave our site, we encourage you to read the privacy notice of every website you visit.

TYPES OF DATA WE COLLECT ABOUT YOU

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymized data).

We may collect, use, store and transfer different kinds of personal data about you such as the following:

• Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender.
• Usage Data includes information about how you use our site, products and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third party-applications and your communication preferences.
• Contact Data includes billing address, delivery address, email address and telephone numbers.
• Technical Data includes internet protocol (IP) address, your opt-in and opt-out times, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform (such as mobile, tablet and desktop) and other technology on the devices you use to access this site.
• Financial Data includes bank account and payment card details.
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
• Profile Data includes your username and password, purchases or orders made by you, your interests, preferences and any feedback or surveyed responses. This category may also include history of employment and education in the event that this personal data is provided to us in the case of career opportunity inquiries or submissions.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data by law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users visiting a specific page of our site. However, if we combine or connect Aggregated Data with your personal data such that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

It is important to note that we do not collect any Special Categories of Personal Data about you. Special Categories of Personal Data includes details about your race or ethnicity, philosophical or religious beliefs, sexual orientation, sex life, political views, trade union membership, information about your health and genetic and biometric data, or about criminal convictions and offences with the exception of cases where personal data is provided to us in the event of career submissions.

If you fail or decline to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail or decline to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

HOW WE COLLECT YOUR PERSONAL DATA

We use different methods to collect data from and about you including through:

• Direct interactions. You may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by mail, phone, email or otherwise. This includes but not limited to any personal data you provide when you: fill out any on-line order form; create an account for our site, including completing any customer or visitor registration; submit an on-line inquiries or requests for product and/or service information; apply for our products or services; and/or request marketing to be sent to you.
• Automated technologies or interactions. As you interact with our site, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies.
• Third parties or publicly available sources. We may receive personal data about you from various third parties and public sources as set out below:
  • Technical Data from the following parties:
    • analytics providers such as Google based outside the EU; and
    • advertising networks such as Google AdWords Remarketing based outside the EU;
  • Contact, Financial and Transaction Data from providers of technical, payment and delivery services;
  • Identity and Contact Data from data brokers or aggregators such as DeciBio and Data.com
  • Identity and Contact Data from publicly availably sources, including but not limited to printed and electronic publications as well as other published works. We additionally source publications from grant and funding databases, pre-print servers, conference, meetings and symposium programs, and public directories.

HOW WE USE YOUR PERSONAL DATA

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• When we need to comply with a legal or regulatory obligation.
• When necessary to perform the contract we are about to enter into or have entered into with you.
• When it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

Other than in relation to sending third party direct marketing communications to you via email, generally we do not rely on consent as a legal basis for processing your personal data.

You have the right to withdraw consent to marketing at any time by contacting us.

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you.

Promotional offers from us

You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving that marketing.

Third-party marketing

We will get your express opt-in consent before we share your personal data with any company outside the S2 Genomics Group for marketing purposes.

(We will also aggregate personal data with such information from other visitors to the Site such that the information no longer personally identifies you. We may use the aggregated information for the general purpose of market research and/or business trends analyses, our customer demographics, interests and behavior, our past and future product or service offerings and/or pricing, or other aspects of our business. We may share such aggregated information with our business partners, vendors, distributors or other collaborators, for these same purposes. We may also sell or license such aggregate information to one or more third parties for use in a similar manner.) 

Opting Out

If you have agreed to receive marketing messages from us, you may opt-out at any time. We provide an opt-out link at the bottom of each email message. Because we plan our communications in advance, it may take several weeks for your opt-out request to take effect. If you continue to receive marketing messages from us after you opt-out, please let us know so that we can investigate the situation.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase or other transactions.

Cookies

Our site may utilize “cookies” to monitor portions of the site visited by users in order to improve the user experience on our site. These cookies are files stored on your computer by our site that are accessible by our site. We may also use cookies when you register, order, or submit requests for information through the site, that allow our site to identify your computer on return visits, and help us to improve your experience in using our site.

To manage or delete browser cookies, please see your browser’s privacy settings. If you disable or refuse cookies, please note that some parts of this site may become inaccessible or not function properly. 

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

DISCLOSURES OF YOUR PERSONAL DATA

We may have to share your personal data with the External third parties set out below so they can perform services for us:

• Service providers based in the US who provide IT and system administration services.
• Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers based in the US and in the EU who provide consultancy, banking, legal, insurance and accounting services.
• United States Revenue & Customs, regulators and other authorities acting as processors or joint controllers based in the United States who require reporting of processing activities in certain circumstances.
• Third parties whom we choose to work with for marketing communications or customer and prospect data management.
• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

TRANSFERRING YOUR PERSONAL DATA TO OTHER COUNTRIES

We are based in the USA, however, whenever we transfer your personal data to any country other than within the EU, we ensure an EU level of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the EU Commission. For further details, see EU Commission: Adequacy of the protection of personal data in non-EU countries.
• Where we use certain service providers, we may use specific contracts approved by the EU Commission which give personal data the same protection it has in the EU. For further details, see EU Commission: Model contracts for the transfer of personal data to third countries.
• Where we use providers that are also based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to your personal data, as individuals within the EU. For further details, see EU Commission: EU-US Privacy Shield.

Please contact us if you want further information on the specific mechanism used by us when making any transfers of your personal data.

SECURITY OF YOUR PERSONAL DATA

We use appropriate technical and organizational measures to protect your personal data and to prevent your personal data from being accidentally lost, intercepted, used or accessed in an unauthorized way, altered or disclosed.

In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

However, you should know that neither we nor any other Internet site can fully eliminate these security risks and S2 Genomics shall not be liable for any such unauthorized access.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

DATA RETENTION

How long will you use my personal data for?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

YOUR PERSONAL DATA RIGHTS

Under certain circumstances, you have rights under data protection laws regarding the Personal Data we have about you. You may object to, or restrict, our collection, use, sharing, transfer and/or storage of your personal information. You may also request a copy of the information that we have about you. You may also ask us to correct or remove personal information you think is incorrect.

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please notify us using contact information detailed in Section 1 above.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

No fee is usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, if your request is clearly unfounded, repetitive or excessive, we may charge a reasonable fee. Alternatively, we may refuse to comply with your request in these circumstances.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

LAWFUL BASIS FOR PROCESSING

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

CALIFORNIA RESIDENT DATA PRIVACY RIGHTS

Residents of California should be aware that California law affords them certain rights regarding their Personal Information. In this section, we provide information for California residents, as required under California privacy laws, including the California Consumer Privacy Act (CCPA), which requires that we provide California residents certain specific information about how we handle their personal information, whether collected online or offline.

Under the CCPA, “personal information” is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. It does not include publicly available data as defined by the CCPA. This section does not address or apply to our handling of personal information that is subject to an exemption under the CCPA. Except for the Right to Opt-out and the Right of Non-Discrimination, this section does not apply to California residents with whom we transact or communicate solely in the context of providing or receiving a product or service to or from a company that employs such residents or engages such residents as contractors. This section also does not apply to personal information we collect about job applicants, independent contractors, or current or former full-time, part-time and temporary employees and staff, officers, directors or stockholders of S2 Genomics, Inc.

Notice at Collection and Categories of Personal Information that We Collect, Disclose, and Sell

The table below sets out generally the categories of personal information (as defined by the CCPA) about California residents that we collect, sell, and disclose to others for a business purpose. We collect these categories of personal information from the sources described in paragraph 3 above, and for the purposes described in paragraph 4 above. Our collection, use and disclosure of personal information about a California resident will vary depending upon the circumstances and nature of our interactions or relationship with such resident.

Categories of personal information	Do we collect?	Do we disclose for a business purpose(s)?	Do we sell?
a.    Name, Contact Information and other Identifiers: Identifiers such as a real name, alias, address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.	Yes	Yes	No
b.    Customer Records: Paper and electronic customer records containing personal information, such as name, signature, physical characteristics or description, address, telephone number, education, current employment, employment history, social security number, passport number, driver’s license or state identification card number, insurance policy number, bank account number, credit card number, debit card number, or any other financial or payment information, medical information, or health insurance information.	Yes	Yes	No
c.    Protected Classification Characteristics Under California or Federal Law:  race, color, sex, age, religion, national origin, disability, citizenship status, and genetic information.	No	No	No
d.    Commercial Information: including records of personal property, products or services purchased, obtained, or considered, or other purchasing or use histories or tendencies.	Yes	Yes	No
e.    Biometric Information: Physiological, biological or behavioral characteristics that can be used alone or in combination with each other to establish individual identity, including DNA, imagery of the iris, retina, fingerprint, faceprint, hand, palm, vein patterns, and voice recordings, keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.	Yes	Yes	No
f.      Internet Or Other Electronic Network Activity Information: including, but not limited to, browsing history, clickstream data, search history, and information regarding a resident’s interaction with an internet website, application, or advertisement, including access logs and other activity information related to your use of any S2 Genomics, Inc. websites, applications or other online services.	Yes	Yes	No
g.    Geolocation Data: Precise geographic location information about a particular individual or device.	Yes	Yes	No
h.    Audio, Video and other Electronic Data: Audio, electronic, visual, thermal, olfactory, or similar information such as CCTV footage, photographs, and call recordings and other audio recording (e.g., recorded meetings and webinars).	Yes	Yes	No
i.      Professional or employment-related information: Employment history, qualifications, licensing, disciplinary record.	Yes	Yes	No
j.      Education Information: Information about education history or background that is not publicly available personally identifiable information as defined in the federal Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99).	Yes	Yes	No
k.    Profiles and Inferences: Inferences drawn from any of the information identified above to create a profile reflecting a resident’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.	Yes	Yes	No

 California Resident Rights

California law grants California residents certain rights and imposes restrictions on particular business practices as set forth below.

• Right to Opt-out of Sale of Personal Information. California residents have the right to opt-out of our sale of their personal information. Opt-out rights can be exercised by emailing Inquiries@S2Genomics.com. We do not sell personal information about residents who we know are younger than 16 years old without opt-in consent.
• Notice at Collection. At or before the point of collection of personal information, notice must be provided to California residents of the categories of personal information collected and the purposes for which such information is used.
• Verifiable Requests to Delete and Requests to Know. Subject to certain exceptions, California residents have the right to make the following requests, at no charge:
  • Request to Delete. California residents have the right to request deletion of their personal information that we have collected about them and to have such personal information deleted, except where an exemption applies.
  • Request to Know. California residents may make Requests to Know up to twice every 12 months. California residents have the right to request and, subject to certain exemptions, receive a copy of the specific pieces of personal information that we have collected about them in the prior 12 months and to have this delivered either (a) by mail or (b) electronically in a portable and, to the extent technically feasible, readily useable format that allows the resident to transmit this information to another entity without hindrance. California residents also have the right to request that we provide them certain information about how we have handled their personal information in the prior 12 months, including the following.
    • categories of personal information collected;
    • categories of sources of personal information;
    • business and/or commercial purposes for collecting and selling their personal information;
    • categories of third parties/with whom we have disclosed or shared their personal information;
    • categories of personal information that we have disclosed or shared with a third party for a business purpose;
    • categories of personal information collected; and
    • categories of third parties to whom the residents’ personal information has been sold and the specific categories of personal information sold to each category of third party.
• Submitting Requests. Requests to Opt-out of Sale of Personal Information, Requests to Know, and Requests to Delete may be submitted by contacting us at Inquiries@S2Genomics.com. We will respond to verifiable requests received from California consumers as required by law.
• Right to Non-Discrimination. The CCPA prohibits discrimination against California residents for exercising their rights under the CCPA. Discrimination may exist where a business denies or provides a different level or quality of goods or services, or charges (or suggests that it will charge) different prices, rates, or penalties on residents who exercise their CCPA rights, unless doing so is reasonably related to the value provided to the business by the residents’ data.
• Financial Incentives. A business may offer financial incentives for the collection, sale or deletion of California residents’ personal information, provided the incentive is not unjust, unreasonable, coercive or usurious, and is made available in compliance with applicable transparency, informed consent, and opt-out requirements. California residents have the right to be notified of any financial incentive offers and their material terms, and the right to opt-out of such incentives at any time; residents may not be included in such incentives without their prior informed opt-in consent. We do not offer any incentives at this time.
• For more information about our privacy practices, you may contact us as set forth in the Contact Details section above.

CHANGES TO S2 GENOMICS, INC. PRIVACY POLICY

We keep this Privacy Policy under regular review, and we will notify you when we make changes in the future. Please review this policy periodically, and especially before you provide any Personal Data to us. We will also place any updates on our website. This privacy policy was last updated on the date indicated at the top of this document.