1) Data Controller
For employees to Y-mAbs Therapeutics A/S and Europe:
Y-mAbs Therapeutics A/S
Agern Allé 11
2970 Hørsholm
Denmark
For employees to Y-mAbs Therapeutics, Inc. and US:
Y-mAbs Therapeutics, Inc.
230 Park Avenue, Suite 3350
New York, NY 10169
USA
2) Use of personal information
We may use your personal data for recruitment purposes only.
3) Categories of personal information
We will only collect ordinary personal data: Name, contact details, data of birth and possible a picture, information included in your application and/or resume of previous jobs and education.
4) Sources
5) Legal basis
GDPR art. 6(1)(a), where the applicant has given consent for the processing. This is relevant in relation to collecting information from a former employee.
For US applicants, we will perform pre-employment and reference checks and sanctions screening.
For EU applicants, we will perform reference checks.
GDPR art. 6(1)(b) and art. 6(1)(c), where the processing is necessary for the performance of a contract to which the applicant is subject or prior steps at the request of the applicant to entering a contract.
GDPR art. 6(1)(f), where the processing is necessary for the purpose of the legitimate interest pursued by Y-mAbs or a third party, where such interests are overridden by the interest of fundamental rights and freedoms of the applicant which require protection of personal data.
Y-mAbs legitimate interest for processing personal data in terms of applicants are management of a potential employment relationship.
6) Sharing of your personal information
We will only share your personal data with
7) Transfer of personal information outside to other countries
Group entities may be located outside your country of residence and countries outside the European Economic Area or the EU that may not provide an adequate level of protection of personal information. Such transfer will only be made if appropriate safeguards are in place and in case of transfer from EEA/EU to the US by use of EU Standard Contractual Clauses for data transfer.
8) Retention of personal information
If you are unsuccessful at any stage of the recruitment process, we will retain your personal information up to six (6) months after the closure of the recruitment process.
We do not retain personal information; we receive from you in an unsolicited application or inquiry. We will respond to you by e-mail and immediately hereafter delete all personal information, we received from you.
9) Your rights
There may be conditions or limitations on these rights. It is therefore not certain for example you have the right of data portability in the specific case, which depends on the specific circumstances of the processing activity.
Y-mAbs Therapeutics, Inc., is established in the EU through our wholly-owned subsidiary, Y-mAbs Therapeutics A/S located in Denmark. In relation to personal information in clinical trials, Y-mAbs Therapeutics Inc. and Y-mAbs Therapeutics A/S are joint data controllers and must comply with US as well as EU privacy legislation, including the Health Insurance Portability and Accountability Act (“HIPAA”) and General Data Protection Regulation (“GDPR”), and other national privacy laws and regulations. Y-mAbs will always comply with the most restrictive privacy laws and regulations.
Y-mAbs conduct several clinical trials with the primary purpose of supporting marketing authorization applications and promote our medical products in a number of territories, alone and through our business and licensing partners.
Subjects participating in Clinical Trials
2) Categories of personal information
We may collect the following categories of personal information about you:
a) Ordinary personal information: Gender, data of birth, body weight and height.
b) Special categories of personal information: Race and ethnicity, medical data, including medical history,
scans, biological samples (blood, tissue, urine), genetic data, health status, and your use of the study
drug, the effect it has on you and possible side effects.
We will only receive personal information in a pseudonymized form, which means that personal information such as name, contact details and social security number are replaced with a unique code. Only the clinical trial sites will have direct contact with subjects participating in the clinical trial and will store name, contact details and social security number in the medical file at the clinical trial site. Neither Y-mAbs nor any third-party will not have access to your name, contact details and social security number.
3) Sources
We will collect your personal information in a pseudonymized form (as described above) from the Principal Investigator as part of the clinical trial.
4) Legal basis
In most of our clinical trials, Y-mAbs’s is processing the personal information of subjects participating in clinical trials based on the subjects’ consent, see GDPR article 6(1)(a) in conjunction with article 9(2)(a).
In other of our clinical trials, the legal basis of processing the personal information of subjects participating in clinical trials is Y-mAbs’ legitimate interest in developing safe and efficacious medical products and supporting marketing authorization applications, see GDPR article 6(1)(f) in conjunction with GDPR article 9(2)(i).
For all our clinical trials, additionally we process personal information in order to comply with applicable legislation related to the conduct of clinical trials such as safety reporting, retention, inspections from authorities, see GDPR article 6(1)(c) and 9(2)(i).
5) Sharing of your personal information
Your personal information may be shared with regulatory authorities and ethics committees. This will only happen if requested and needed according to the applicable clinical trial legislation.
There may also be a need to share your personal information with Y-mAbs’ service providers, e.g., fully serviced Clinical Research Organizations, Laboratory Service Providers, etc., for the clinical trial, members of Y-mAbs groups of companies, service providers, third-party suppliers, or business partners, including our licensees. The personal information must be kept confidential and may only be used for the purpose of the clinical trial.
6) Transferring of personal information to other countries
Y-mAbs service providers, Y-mAbs groups of companies, third-party suppliers, or business partners, including our licensees, as well as public authorities to which we report data, may be located outside your country of residence, including the US and countries in and outside the European Economic Area (“EEA”). This means that your personal information may be processed in countries with a lower data protection standard than your country of residence. We will ensure that if personal information is transferred outside your country of residence, it will still be treated in accordance with this Privacy Statement. Additionally, such transfer will only be made if appropriate safeguards are in place and in case of transfer from EU/EEA to the US by use of EU Standard Contractual Clauses for data transfer.
7) Retention of your personal information
Once the clinical trial has been concluded, your personal data will be kept in accordance with regulatory requirement for clinical trial, e.g., two (2) years after the last marketing application which may happen more than twenty-five (25) years from collection of such personal information.
8) Your rights
You have several rights in relation to the personal information regarding you that we process. However, there may be conditions or limitation to these rights:
We will process personal information of Principal Investigator (“PI”) and research staff conducting the clinical trials.
1) Use of personal information for the following purpose:
The purpose of collecting, using, and retaining your personal information is to support marketing authorization applications.
2) Categories of personal information – ordinary personal information
3) The purposes of collecting the personal information from PI and research staff:
4) Legal basis
We will process the personal information of PI and research staff for the purpose of fulfilling a contract as well as complying with clinical trial legislation, transparency laws and regulations, see GDPR 6(1)(c). In relation to other staff at the clinical trial site, we do not engage directly with in the Clinical Trial Agreement, we process their personal information for the purpose of management and administration of the clinical trial, see GDPR article 6(1)(f).
5) Sharing of your personal data
We will disclose personal information of PI and research staff to regulatory authorities, auditors, ethics committees, if Y-mAbs are required to do so. In addition, we will share personal information of research staff with members of Y-mAbs groups of companies, services providers, third-party suppliers or business partners, including our licensees. The personal information must be kept confidential and may only be used for the purpose of the clinical trial.
6) Transferring of personal information to other countries
Y-mAbs service providers, Y-mAbs groups of companies, third-party suppliers, or business partners, including our licensees, as well as public authorities to which we report data, may be located outside your country of residence, including the US and countries in and outside the European Economic Area (“EEA”). This means that your personal information may be processed in countries with a lower data protection standard than your country of residence. We will ensure that if personal information is transferred outside your country of residence, it will still be treated in accordance with this Privacy Statement. Additionally, such transfer will only be made if appropriate safeguards are in place and in case of transfer from EU/EEA to the US by use of EU Standard Contractual Clauses for data transfer.
7) Retention of your personal data
Once the clinical trial has been concluded, your personal data will be kept in accordance with regulatory requirement for clinical trial, e.g., two (2) years after the last marketing application which may happen more than twenty-five (25) years from collection of such personal information.
8) Your rights
You will have right to access, rectification, erasure, objection, restriction of processing and data portability in relation to your personal data by sending a written communication to [email protected].
If you believe that we have not complied with applicable data protection laws, you can also lodge a complaint with a data protection supervisory authority. A listing of each EU (European Union) country’s data protection supervisory authority may be found here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.
Updated: November 1, 2021
INTRODUCTION
We take your privacy seriously and want you to understand our practices with respect to the handling of your personal data when you interact with Y-mAbs Therapeutics, Inc. and its group of companies (“Y-mAbs,” “we,” “us” and “our”) through this website (the “Website”). This privacy policy explains how we do this.
We may change this privacy policy from time to time and we advise you to review this privacy policy periodically to see the latest version.
WHAT PERSONAL INFORMATION DO WE COLLECT? We collect personal information that you voluntarily provide to us when expressing an interest in obtaining information about us or our business, when participating in activities on this Website or otherwise contacting us.
The personal information that we collect depends on the context of your interactions with us and this Website, the choices you make and the features you use.
The personal information we collect can include the following:
We do not collect or retain sensitive personal data relating to your health, ethnic origin, religious beliefs or political conviction etc. at this Website unless you submit such information to us which we will only be willing to accept through use of a specially designed contact form or other written indication of your agreement thereto. In the rare cases where we do seek to collect sensitive data we will do so in strict compliance with local data privacy law and you will be asked to actively consent to our processing.
INFORMATION AUTOMATICALLY COLLECTED. We automatically collect certain information when you visit, use or navigate this Website. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use this Website and other technical information. This information is primarily needed to maintain the security and operation of our Site, and for our internal analytics and reporting purposes. Like many businesses, we also collect information through cookies and similar technologies.
Web log data. When you use this Website, we may automatically receive and record certain information from your computer (or other device) and your browser. This may include such data as the pages you visit on this Website, the date and time of your visit, the files that you download, the URLs from the websites you visit before and after navigating to this Website, your software and hardware attributes (including device IDs), your general geographic location (e.g., your country, city, state, or metropolitan region), and certain cookie information. To obtain such information, we may use web logs or applications that recognize your computer and gather information about its online activity.
Cookies. We or our service providers may use cookies on this Website. Cookies are small files that are stored on your computer by your web browser. A cookie allows this Website to recognize whether you have visited before and may store user preferences and other information. For example, cookies can be used to collect information about your use of this Website during your current session and over time (including the pages you view and the files you download), your computer’s operating system and browser type, your Internet service provider, your domain name and IP address, your general geographic location, the website that you visited before this Website, and the link you used to leave this Website. If you are concerned about having cookies on your computer, you can set your browser to refuse all cookies or to indicate when a cookie is being set, allowing you to decide whether to accept it. You can also delete cookies from your computer. However, if you choose to block or delete cookies, certain features of this Website may not operate correctly.
Web beacons. This Website or the emails that you receive from Y-mAbs may use an application known as a “web beacon” (also known as a “clear gif” or “web bug”). A web beacon is an electronic file that usually consists of a single-pixel image. It can be embedded in a web page or in an email to transmit information, which could include personal information. For example, it allows an email sender to determine whether a user has opened a particular email.
Third party analytics. We also may partner with certain third parties to collect, analyze, and use some of the information described in this section. For example, we may allow these third parties to set cookies or use web beacons on this Website or in email communications from Y-mAbs.
HOW DO WE USE YOUR PERSONAL INFORMATION? We may use your personal information to:
ON WHAT BASIS DO WE USE YOUR PERSONAL INFORMATION? We use personal information for:
Legitimate business purposes: We use your personal information to make our communications with you more relevant and personalized to you. It also helps us to operate and improve our business and minimize any disruption to the services that we may offer to you. We use the personal information that we collect automatically when you visit this Website for such purposes as: counting and recognizing visitors to this Website; analyzing how visitors use this Website and various Site features; improving this Website and enhancing users’ experiences with this Website; creating new products and services or improving our existing products and services; enabling additional website analytics and research concerning this Website; and managing our business. Y-mAbs may link non-personal information gathered using cookies and web beacons with personal information. But in that event, we will treat the combined information as personal information.
To comply with our legal obligations and other demands for information: It is important to us that we are able to comply with laws, regulations and guidance, as well as the other requests or demands for data as set out here. They affect the way in which we run our business and help us to make our products and services as safe as we can.
You may have given your consent: At times we may need to get your consent to allow us to use your personal information for one or more of the purposes set out above.
SHARING YOUR PERSONAL INFORMATION WITH THIRD PARTIES. We may share your personal information with:
We do not sell or rent the personal information we collect from you.
HOW LONG WILL WE KEEP YOUR PERSONAL INFORMATION? We keep your personal information for no longer than is necessary for the purpose for which the information is collected and to manage our relationship with you. Where personal information is kept, that period will be determined based on applicable local law.
PROTECTING YOUR PERSONAL INFORMATION. We will take appropriate legal, organizational, and technical measures to protect your personal data consistent with applicable privacy and data security laws. When Y-mAbs uses a third-party service provider, that provider will be required to use appropriate measures to protect the confidentiality and security of personal data. We use a variety of security technologies and procedures to help protect your personal data from unauthorized access, use, or disclosure. Although we will do our best to protect your personal data, we cannot guarantee the security of the personal data you transmit to us. While we cannot guarantee that loss, misuse, or alteration to data will not occur, once we have received your data, we will employ appropriate technical security measures to prevent such unfortunate occurrences.
Personal data collected may be transferred to, stored, and processed in your country of residence or any other country in which Y-mAbs (including its affiliates) maintain facilities, including the United States and countries in or outside the European Economic Area (EEA). This means that your data may be processed in countries with lower data protection standards than your country of residence. We will ensure that if data is transferred outside your country of residence, it will still be treated in accordance with this Privacy Statement. Additionally, such transfer will only be made if appropriate safeguards are in place, in the case of transfer from the EU/EEA to the US by use of EU Model Clauses for data transfer, a copy of which can be obtained by contacting us.
WEBSITES THAT WE DO NOT OWN OR CONTROL. Our website may contain links to third-party sites. This privacy policy does not apply to those third-party sites. We recommend that you read the privacy statements of any other sites that you visit as we cannot accept responsibility for the privacy practices of these sites, which may be different to ours.
YOUR RIGHTS REGARDING YOUR PERSONAL INFORMATION. We set out below the rights that we will respect in relation to your personal data.
You may be entitled to:
If you would like to exercise your rights, please let us know by getting in touch with us as set out in the “Contact us” section below.
WHAT IF YOU DO NOT WANT TO PROVIDE US WITH YOUR PERSONAL INFORMATION? The provision of your personal information is voluntary for you and not required by law. Therefore, where you are given the option to share your personal information with us, you can always choose not to do so.
If you object to the processing of your personal information, or if you have provided your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations. This could mean that we may not be able to perform the actions necessary to achieve the purposes for which the information was collected.
DATA CONTROLLER. Y-mAbs Therapeutics Inc. is data controller of the personal data provided. We are established in the EU through our wholly-owned subsidiary Y-mAbs Therapeutics A/S located in Denmark.
QUESTIONS/CONTACT US
If you have any questions about this privacy policy, please email us at [email protected] or at:
Updated: October 1, 2020
1) Data Controller
Y-mAbs Therapeutics, Inc.
230 Park Avenue, Suite 3350
New York, NY 10169
USA
Y-mAbs Therapeutics, Inc., is establish in the EU/EEA by its affiliated company:
Y-mAbs Therapeutics A/S
Agern Allé 11
2970 Hørsholm
Denmark
If you have inquiries and/or questions to our processing of your personal information:
[email protected]
2) Use of personal information
We interact and collaborate with Healthcare Professionals and other stakeholder to gain valuable insights.
We use the information to manage our relationship with you, to plan protentional collaboration, contacts, meetings, etc. Also, we evaluate the information Y-mAbs Therapeutics provided to you and to understand your scientific approach.
3) Categories of personal information
Depending on the interaction and collaboration with you, we may collect the following personal and professional information:
4) Sources
We collect the information directly from you, Also, we collect the information from publicly accessible websites, and social media platforms, clinical trials and publications databases, cooperative groups and societies, other Healthcare Professionals and stakeholders, our collaborations partners, and third parties providing access to their databases or preforming services on our behalf.
5) Legal basis
The legal basis for processing your personal information is based on our legitimate interest to pursue the above purposes of maintaining our relationship with you, evaluating the information, we provide to you and understanding your scientific approach according to GDPR art. 6(1)(f). In some situation, we will only collect your personal information with your consent, see GDPR art. 6(1)(a). The legal basis is GDPR art. 6(1)(b) and 6(1)(c), when we process your personal data to conclude an agreement and comply with legal obligations such as transfer of value.
6) Sharing of your personal information
We may share your personal information with group entities and collaborators, such as conference organizers and agencies working with Y-mAbs Therapeutics and partners.
7) Retention
We will keep your personal information as long as this is required according to applicable legislation and to fulfill a specify purposes.
8) Transferring to counties outside EEA
Your personal information may be transferred to countries outside of EEA, which are not deemed to provide an adequate level of protection of your data compared to the EEA. We will provide appropriate safeguards through EU Standard Contractual Clauses.
9) Your rights
In some instances, you have the following rights:
INTRODUCTION. We regularly receive questions from parents to children affected with cancer about treatment possibilities.
We understand the difficult position and the worries of parents and we have, therefore, decided to establish the contact form to handle and respond to requests in a structured and efficient manner.
By providing us with personal data you consent to our processing of the data provided to us as outlined below. When you provide information about a child you at the same time declare that you have custody of the child and authority to give the consent on your child’s behalf also.
You have the right to withdraw your consent to our processing of the personal data you provide at any time, without reason and without losing any rights.
WHY WE PROCESS DATA AND THE LEGAL BASIS. We process the personal data that you provide only to handle and respond to your request. This means that we use the data to assess if you/your child could be eligible for enrollment in clinical trials that are conducted with our involvement. The processing is based solely on the consent that you have provided and no other legal basis.
TYPES OF PERSONAL DATA PROCESSED. We process the personal data that you yourself provide to us. We do not collect any other data about you or your child. The data includes: Name, address, telephone number, E-mail address, age and the specifics regarding the diagnosis or illness that you provide.
To reduce any unnecessary data processing we kindly ask that data provided initially is kept to a minimum as necessary for an assessment of eligibility.
RECIPIENTS OR CATEGORIES OF RECIPIENTS. Where we are engaged in clinical trials that covers the disease described, we share the personal data with principal investigators (medical professionals) at the medical sites that we engage with in order for them to assess whether you/your child could be eligible for enrollment in a particular clinical study. These persons may thereafter contact you directly without our involvement. We ourselves do not decide on eligibility – we facilitate a contact to the relevant investigator and we are not involved in the discussions on treatment that you may have.
We use selected third parties to provide IT support services in the normal course of business. These parties may, from time to time, have access to your personal data to enable them to provide those services to us. We require all companies providing such support services to meet the same standards of data protection as our own. They are prohibited from using the personal data for their own purposes.
HOW WE PROTECT THE PERSONAL DATA. We will take appropriate legal, organizational, and technical measures to protect your personal data consistent with applicable privacy and data security laws. When Y-mAbs uses a third-party service provider, that provider will be required to use appropriate measures to protect the confidentiality and security of personal data. We use a variety of security technologies and procedures to help protect your personal data from unauthorized access, use, or disclosure. Although we will do our best to protect your personal data, we cannot guarantee the security of the personal data you transmit to us. While we cannot guarantee that loss, misuse, or alteration to data will not occur, once we have received your data, we will employ appropriate technical security measures to prevent such unfortunate occurrences.
Personal data collected may be transferred to, stored, and processed in your country of residence or any other country in which Y-mAbs (including its affiliates) maintain facilities, including the United States and countries in or outside the European Economic Area (EEA). This means that your data may be processed in countries with lower data protection standards than your country of residence. You consent to any transfer, processing, or storing of data outside of your country of residence and outside the EEA. We will ensure that if data is transferred outside your country of residence, it will still be treated in accordance with this Privacy Statement. Additionally, such transfer will only be made if appropriate safeguards are in place, in the case of transfer from the EU/EEA to the US by use of EU Model Clauses for data transfer, a copy of which can be obtained by contacting us.
SOURCES OF PERSONAL DATA. We only process the personal data that you yourself provide to us using the form. We do not collect any other data about you or your child.
RETENTION PERIOD. We retain the personal data received only until the data is no longer needed to assess eligibility in a clinical trial.
AUTOMATED DECISION MAKING, PROFILING. Personal data is not used in automated decision making or profiling.
RIGHT TO WITHDRAW CONSENT. You have the right to withdraw your consent to our processing of personal data at any time, without reason and without losing any rights. You can do so by simply sending us an e-mail at: [email protected] or by contacting us at +1 646 885 8505 or by ordinary mail.
YOUR RIGHTS. You have the right to review, modify and/or delete the personal data collected in the event that the collected personal data is incorrect and to restrict and/or object to any further processing and storage of the personal data. You also have the right to be informed about any personal data about you/your child held by Y-mAbs and you have the right to get the personal data you have provided to Y-mAbs in a structured and machine-readable way (data portability). You have the right to complain about the collection and processing of personal data to the relevant data protection supervisory authority.
DATA CONTROLLER. Y-mAbs Therapeutics Inc. is data controller of the personal data provided. We are established in the EU through our wholly-owned subsidiary Y-mAbs Therapeutics A/S located in Denmark.
QUESTIONS/CONTACT US. If you have any questions about this privacy policy, please email us at [email protected] or at:
Y-mAbs Therapeutics, Inc.
Updated: October 1, 2020
