This Arvinas General Privacy Notice was last updated on October 3, 2022, at the time of the upgrade of our Website.

Arvinas, Inc. and its affiliates and subsidiaries (collectively, “Arvinas”, “we”, “us” or “our”) are committed to maintaining your privacy and recognize the importance of providing protection for any personally identifiable information that you choose to share with us or that we maintain about you (“Personal Information”). We have established this Privacy Notice to inform you about how we process your Personal Information for “Arvinas’ Services”, both when you use our website located at www.arvinas.com (the “Website”) and when we interact with you as a business contact (the “Business Services”).

Please note that in some instances we or our representatives may provide you with a separate privacy notice as legally required, in which case that privacy notice provided to you will control our processing of your Personal Information instead of this privacy notice. For example, if you are a subject participating in a clinical trial sponsored by Arvinas, you will generally receive a separate privacy notice at the time you consent to enroll in the trial that will describe Arvinas’ collection, use and disclosure of your Personal Information. If you are a clinical trial subject located in the European Economic Area (EEA) or UK, your rights under the European Union’s (or UK’s) data privacy law(s) known as the General Data Protection Regulation (GDPR) will be described in the separate notice that you are provided with at the time you provide informed consent to participate in the trial.

Please read this Privacy Notice carefully. Should you have any questions about this Privacy Notice or our data practices, please see our contact information below.

Personal Information Processed by Arvinas

Personal Information You Provide to Us

We collect Personal Information you provide directly to us. For example, we collect Personal Information when you send us a comment or question, or when you request information through our Website. This Personal Information may include your name, telephone number, e-mail address, and possibly other Personal Information. If you do not want to give us any Personal Information, you can choose not to use these features of our Website.

Personal Information We Collect Automatically When You Use our Website

When you access or use our Website, the types of Personal Information we may automatically collect about you include:

Log Information: When you visit our Website, our servers record certain log file information, such as your Internet Protocol (“IP”) address, operating system, browser type and language, referring URLs, access times, pages viewed, links clicked and other Personal Information about your activities on our Website. If this collection is not essential, then you have the right to decide if we collect this Personal Information.

Information Collected by Cookies and Other Tracking Technologies: We and our service providers use various data collection technologies, including cookies and web beacons, to collect Personal Information about you when you interact with our Website. Cookies are small data files stored on your hard drive or in device memory that help us improve our Website and your experience, see which areas and features of our Website are popular, and count the number of visits to our Website. Web beacons are electronic images that may be used in our Website or emails and help deliver cookies, count the number of visits to our Website and understand usage and email or marketing campaign effectiveness. If this collection is not essential, then you have the right to decide if we collection this Personal Information. For more information about cookies, and how to exercise your choices, please see “Your Rights” below.

• Essential Cookies: Arvinas uses first party cookies that are essential for the operation of our Website.
• Functional Cookies: Arvinas uses third party cookies to support the functionality of our Website and enable Website users to interact with our Website Services and webpages.
• Analytics Cookies: Arvinas uses Google Analytics in limited geographies to gather Website traffic information to allow Arvinas to improve our Website Services and support the functionality of our Website Services. Arvinas does not access Personal Information gathered by Google Analytics. To prevent these services from collecting your user activity on Arvinas’ Website, see https://tools.google.com/dlpage/gaoptout.

Information From Third Parties

Arvinas may obtain Personal Information through third parties such as organizations that support our business, partners, vendors, and suppliers. 

Processing of Personal Information: Website Services

Arvinas processes Personal Information about you for various Website Service purposes, including to:

• Provide, maintain and improve our Website and to provide you with relevant information and services that you request. If this purpose is not essential, then we will provide you with choices, noted below.
• Send you technical notices, updates, security alerts and support and administrative messages.
• Monitor and analyze trends, usage and activities in connection with our Website. If this purpose is not essential, then we will provide you with choices, noted below.

For EEA data subjects, the legal basis for this processing of persona information is our legitimate interest to carry out scientific research, develop medicines, conduct clinical trials, and provide information and education (Article 6(1)(f) GDPR). 

Processing of Personal Information: All Arvinas’ Services

Arvinas may process Personal Information for its general business purposes, including those associated with the marketing, growth, maintenance, and management of Arvinas’ business. These may include our internal operations and administration, and carrying out our business relationships. Specific examples include to:

• Respond to your comments, questions, and requests, and provide customer service.
• Communicate with you about our activities, products and services, and to provide information we think will be of interest to you.
• Carry out any other purpose for which the information was collected.

For EEA data subjects, the legal basis for this processing of personal information is our legitimate interest to carry out scientific research, develop medicines, conduct clinical trials, and provide information and education (Article 6(1)(f) GDPR). 

Arvinas may process Personal Information to detect, investigate and prevent risk, fraudulent transactions and other illegal activities, to manage legal claims, subpoenas, and requests in connection with investigations and dispute-resolution processes, as permitted or required by applicable law, and to protect the rights and property of Arvinas and others. For EEA data subjects, the legal basis of processing is to fulfill our legal, regulatory and risk management obligations, including establishing, exercising or defending legal claims (Article 6(1)(c) GDPR).

Arvinas may process Personal Information for purposes to which you provide consent, including potentially marketing and communication materials. For EEA data subjects, the legal basis of this processing is consent (Article 6(1)(a) GDPR).

In some geographies, we may process your Personal Information to create anonymized information, which cannot be used to identify you. This type of information is no longer Personal Information, it is not subject to this Privacy Notice. For EEA data subjects, the legal basis for this processing of personal information is our legitimate interest to carry out scientific research, develop medicines, conduct clinical trials, and provide information and education (Article 6(1)(f) GDPR).

Personal Information of Children

Our Website is intended for general audiences and is not directed to minors. If we learn that we have received Personal Information directly from an individual under the age of 18 without proper parent or guardian consent, we will use that Personal Information only to respond directly to that child. We request that children do not provide Personal Information through our Website.

Sharing of Personal Information

We may share Personal Information about you as follows or as otherwise described in this Privacy Notice:

• With vendors, consultants, collaborators and other service providers, including, but not limited to, providers of Arvinas’ Website hosting services, external consultants, operating systems and platforms, and vendors that facilitate registering and hosting webcast and live events who need access to such Personal Information to carry out work on our behalf;
• To third parties, including government bodies, as required to respond to a request for information if we believe disclosure is in accordance with, or required by, any applicable law, regulation or legal process;
• To any third parties necessary to enforce our rights if we believe your actions or the actions of those who you represent are inconsistent with our user agreements or policies, or to protect the rights, property and safety of Arvinas or others;
• To any third parties necessary in connection with, or during negotiations of, any merger with, sale of company assets to, financing of, or acquisition of all or a portion of our business by another entity;
• To third party vendors, sites, and potential research sites and to regulatory authority and other third parties as necessary for recruitment and screening for participation in research studies, and to carry out research;
• Between and among Arvinas and its current and future parents, affiliates, subsidiaries and other companies under common control and ownership; and
• To any third party with your consent or at your direction, or as we believe to be necessary and appropriate, including (i) as permitted or required by law; (ii) if we determine that the disclosure of specific Personal Information is necessary to comply with the request of a law enforcement or regulatory agency or other legal process; (iii) to pursue available remedies or limit damages; and (iv) to respond to an emergency.

Receiving Communications from Us

We may send you information or materials such as newsletters by email or postal mail when you submit your e-mail or postal mail address to us for this purpose, including via our Website or an affiliate’s website. You may “opt-out” of receiving the emails from us by using the unsubscribe feature included in the emails we send. Also, if you do not want to receive this information or materials, you can request that these stop by sending an email with your name, mailing address and email address to arvinas.dpo@mydata-trust.info. However, even if you opt-out of receiving such communications, we retain the right to send you non-marketing necessary communications (such as important transaction information).

Links to Other Sites

Some of our Website features may contain links to third party websites or services that are not under our control. Such links do not constitute an endorsement of those third parties or the content displayed on their sites. We provide these links to you only as a convenience, and any information you provide to those third parties will be used as described by the third parties in their own privacy policies.

Location of Data

We are based in the United States and the Personal Information we collect is governed by U.S. laws. By accessing or using our Website or otherwise providing Personal Information to us, you understand that your Personal Information may be processed in the U.S. and you may not have the same rights as you do under local laws in jurisdiction in which you are located at the time we collect your Personal Information. Where this is the case, we will take appropriate measures to protect Personal Information about you in accordance with laws that apply to us and consistent with this Privacy Notice.

Updating Personal Information

If you later decide that you do not want your Personal Information used for the purposes described in this Privacy Notice, you may contact us at our mailing address below to request removal of your Personal Information from our database. You may also contact us to correct or update any Personal Information you have provided us, but note that we may continue to store Personal Information about you as required by law.

Your Rights

Some laws provide data subjects with rights over their Personal Information. Arvinas honors those rights provided by laws and responds to data subjects’ verified requests. 

To exercise one of these rights, contact us at: Arvinas, Inc., arvinas.dpo@mydata-trust.info. Please include your name and the address to which you would like us to respond.

Your California Privacy Rights: California law grants the following rights to residents of California and their personal representatives:

• Right to Access: the right to request information about Arvinas’ processing of the resident’s Personal Information, including the sale of the resident’s Personal Information, and the right to request a copy of the resident’s Personal Information.
• Right of Deletion: the right to request Arvinas delete the resident’s Personal Information.
• Right to Opt Out of the Sale of Personal Information: if Arvinas sells (as defined by the California Consumer Privacy Act) a resident’s Personal Information, the right to request Arvinas not sell the resident’s Personal Information.

Beginning on January 1, 2023, residents of California will also have the following additional rights:

• Right to Correct: the right to request the correction of the resident’s inaccurate Personal Information.
• Right to Limit Sensitive Personal Information: the right to direct Arvinas to limit the use of the resident’s sensitive Personal Information to only uses that are necessary.

Your EEA/UK Privacy Rights: Data subjects protected by EEA/UK data protection laws have these rights:

• Right to Access and Portability: the right to request information about Arvinas’ processing of the data subject’s Personal Information, and the right to request a copy of the data subject’s Personal Information.
• Right to Rectify: the right to request the rectification of the data subject’s inaccurate Personal Information.
• Right of Erasure: the right to request Arvinas erase the data subject’s Personal Information.
• Right to Restrict Processing: the right to request Arvinas limit or restrict the processing of the data subject’s Personal Information.
• Right to Object and Rights Concerning Automated Decision Making: the right to object to or complain about the processing of the data subject’s Personal Information, including for allegations of profiling.
• Right to Withdraw Consent: the right to withdraw consent to the processing of the data subject’s Personal Information, where the Personal Information is processed under consent.

These rights are not absolute and will be processed on a case-by-case basis by Arvinas’ DPO.

Security

We use reasonable physical, technical, and administrative measures designed to protect your Personal Information. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is not secure, please immediately notify us in accordance with the “Contact Us” section below.

Updates to Privacy Notice

Arvinas reserves the right to update this Privacy Notice from time to time. If we decide to change this Privacy Notice, we will endeavor to notify you by revising the date at the top of this Privacy Notice and, in some cases (for example, if we plan to use your Personal Information in a way that materially differs from this Privacy Notice), we may provide you with additional notice (such as adding a statement to our Website homepage or by providing you a notification). You are encouraged to review this Privacy Notice regularly to stay informed about our Personal Information practices and the choices available to you.

Contact Us

Arvinas’ Data Protection Officer: Arvinas.DPO@mydata-trust.info

Arvinas’ EU Data Protection Representative:

MyData-TRUST France, Rue Louis Duvant, 1, 59220, Rouvignies, France

Arvinas’ UK Data Protection Representative:

MyData-Trust UK, Waldeck House, Lyne Lane, Chertsey, KT16 0AW, UK