Privacy Notice

Last updated 14 July 2020

Introduction

We take your privacy seriously and want you to understand our practices with respect to the handling of your personal data when you interact with Orchard Therapeutics (Europe) Limited and its group of companies (“Orchard,” “we,” “us” and “our”).

This privacy notice explains how we do this.

We may change this privacy notice from time to time and we advise you to review this privacy notice periodically to see the latest version.

What personal information do we collect?

The personal information we may collect includes:

• Identification data, such as your name, business or personal email address, business or personal address, business or personal telephone number, IP address, location and time zone setting, operating system and platform, browser plug-in types, domain name and your choice of browser;
• Information we collect when you take part in one of our clinical studies or report a possible side effect associated with one of our products, which may include information such as your gender, date of birth and information about your health.

How do we use your personal information?

We may use your personal information to:

• improve your experience when using our websites;
• communicate with you, for example to respond to your request;
• provide you with information, support or education about our products or services;
• respond to reports you may make of a possible side effect associated with one of our products and to monitor the safety of our products;
• conduct clinical studies;
• comply with our business, regulatory and legal obligations.

On what basis do we use your personal information?

Data privacy law sets out a number of different reasons on which a company may rely to collect and use your personal information.

We use your personal information for the following reasons:

• For legitimate business purposes: We use your personal information to make our communications with you more relevant and personalised to you. It also helps us to operate and improve our business and minimise any disruption to the services that we may offer to you.
• When we are processing your personal data in the performance of a contract between us or preparatory to such a contract.
• To comply with our legal obligations and other demands for information: It is important to us that we are able to comply with laws, regulations and guidance, as well as the other requests or demands for data as set out here. They affect the way in which we run our business and help us to make our products and services as safe as we can.
• You have given your consent: At times we may need to get your consent to allow us to use your personal information for one or more of the purposes set out above. See the “Your rights regarding your personal information” section for information about the rights that you have if we process your information on the basis of your consent. Explicit consent may be required for us to process special categories of personal data, such as health data. On the occasions where we are asking you to consent to our processing of your sensitive personal data we will always tell you why and how the information will be used.

How long will we keep your personal information?

We keep your personal information for no longer than is necessary for the purpose for which the information is collected and to manage our relationship with you. Where personal information is kept, that period will be determined based on applicable local law.

Sharing your personal information with third parties

We may share your personal information with:

• members of the Orchard group of companies; and
• certain trusted third parties, including our agents and suppliers, including those who provide us with technology services such as data analytics, hosting and technical support; our professional advisors, auditors and business partners; regulators, governments and law enforcement authorities; and other third parties in connection with re-organizing all or any part of our business.

Your personal information may be processed by Orchard, its affiliated companies and Orchard’s trusted third-party suppliers outside of your home country. Data privacy laws in the countries to which your personal information is transferred may not be equivalent to, or as protective as, the laws in your home country.

We will implement appropriate organisational and technical measures to ensure that your personal information remains protected and secure when it is transferred outside of your home country, in accordance with applicable data protection and privacy laws.

We do not sell or rent the personal information we collect from you.

Protecting your personal information

We use a variety of security measures and technologies to help protect your personal information from unauthorised access, use, disclosure, alteration or destruction in line with applicable data protection and privacy laws. For example, when we share your personal information with external suppliers, we may put in place a written agreement which commits the suppliers to keep your information confidential, and to put in place appropriate security measures to keep your information secure.

The transmission to us of information via the internet or a mobile phone network connection may not be completely secure and any transmission is at your own risk.

Websites that we do not own or control

Our website may contain links to third-party sites. This privacy notice does not apply to those third-party sites. We recommend that you read the privacy notices of any other sites that you visit as we cannot accept responsibility for the privacy practices of these sites, which may be different to ours.

Your rights regarding your personal information

We set out below the rights that you may have in relation to personal data if you live in the European Union.

You may be entitled to:

• ask Orchard for access to the personal information Orchard holds about you;
• request the correction and/or deletion of your personal information;
• request the restriction of the processing of your personal information, or object to that processing;
• withdraw your consent to the processing of your personal information (where Orchard is processing your personal information based on your consent);
• request for the receipt or the transfer to another organization of the personal information that you have provided to Orchard; and
• complain to your local data protection authority if your privacy rights are violated, or if you have suffered as a result of unlawful processing of your personal information.

If you would like to exercise your rights, please let us know by getting in touch with us as set out in the “Contact us” section below.

What if you do not want to provide us with your personal information?

If you object to the processing of your personal information, or if you have provided your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations. This could mean that we may not be able to perform the actions necessary to achieve the purposes as set out in the section “How do we use your personal information?” above. However, not providing your information will not result in legal consequences for you.

Cookies and other technologies

Our website may use technology called “cookies” which allow the website to recognize and respond to you as an individual. You can choose to accept or decline cookies.

If you do choose to decline cookies, not all elements of this website may function as intended, so your website experience may be affected. For more information about our use of cookies, please see our Cookie Policy.

Contact us

If you have questions or requests regarding this privacy notice, or if you are unhappy with the way in which your personal data is managed by us or would like to exercise your rights, please contact Orchard by emailing sar@thedpo.co.uk

You may also make a complaint to the Supervisory Authority.

Data Controller

Orchard Therapeutics (Europe) Limited is the controller of your personal information.

Data Protection Officer

Our Data Protection Officer is Dr Phil Griffiths, The DPO Ltd, Capital Tower, Greyfriars Road Cardiff CF10 3AZ (sar@thedpo.co.uk)