About this Privacy Notice#
This privacy notice is intended to assist current and former employees and contractors of Comanche Biopharma in the EU, EEA and UK in understanding how we collect, use, protect and transfer your Personal Data during and after your working relationship with us. It also explains how you can exercise your privacy rights and contact us.
In this Notice, Comanche Biopharma Corp. and its affiliates are collectively referred to as “Comanche Biopharma”, “we”, “our” or “us”. We are committed to protecting the privacy and security of your Personal Data. This Notice applies throughout the employment or engagement lifecycle and, where relevant, after the relationship ends.
Who is the controller of your Personal Data?#
For the purposes of applicable Data Protection Legislation, Comanche Biopharma Corp. or its affiliate which employs or engages you is the controller of your Personal Data and determines the purposes and means of the processing.
Where the European Union (EU) GDPR applies, we process Personal Data in accordance with Regulation (EU) 2016/679 and applicable national law. Where UK law applies, we process Personal Data in accordance with the UK GDPR and Data Protection Act 2018, as amended.
What Personal Data do we collect?#
| Category | Examples |
|---|---|
| Identity, contact and family information | Name, title, date of birth, contact details, emergency contacts, dependants and beneficiaries where relevant. |
| National identifiers and work eligibility | National insurance or tax identifiers, passport or identity details, driving licence information and work-permit or right-to-work status. |
| Employment and role information | Job title, department, manager, work location, contract, working time, leave, promotions, disciplinary records, personnel-file information and employment status. |
| Pay, benefits and expenses | Salary, bonus, equity or awards, bank details, pension, insurance, benefits, expense claims and related tax information. |
| Performance and development | Objectives, appraisals, training, development plans, succession planning and professional-development information. |
| IT, security and workplace information | Corporate account identifiers, device and network logs, access-control information, security events, use of company systems and, where deployed, CCTV or building-access data. |
| Communications and recordings | Work correspondence, meeting information, photographs, audio or video where used for a stated business purpose, and information you provide in surveys or feedback channels. |
| Special Category Personal Data | Health or disability information, race or ethnicity, religious or philosophical beliefs, sexual orientation and other sensitive information where relevant and lawful. |
| Criminal convictions and offences | Information obtained through lawful role-specific screening or arising in an employment or compliance context where processing is authorised by law. |
| Compliance and investigations | Conflicts of interest, whistleblowing or investigation records, audit information and records needed to meet legal or regulatory obligations. |
How do we collect your Personal Data?#
We collect Personal Data directly from you, from the recruitment process, from managers and colleagues, and through HR, finance, IT, security and business systems used during the working relationship. We may also receive information from payroll, benefits, pension, occupational-health, background-check and other service providers, public or professional sources, regulators and authorities where appropriate.
How do we use your Personal Data and what are our lawful bases?#
| Purpose | Typical lawful basis where EU/UK law applies |
|---|---|
| Manage the employment or contractor relationship, payroll, benefits, expenses, leave, performance and separation. | Contract; legal obligation; legitimate interests for related administration not strictly necessary for contract. |
| Meet employment, tax, social-security, health and safety, immigration, corporate and regulatory requirements. | Legal obligation. |
| Allocate resources, manage projects, workforce planning, finance, internal reporting, audits, reorganisations and corporate transactions. | Legitimate interests in running and organising the business; legal obligation where applicable. |
| Provide training, development, performance management and succession planning. | Legitimate interests in developing the workforce; contract or legal obligation where applicable. |
| Protect people, facilities, systems and confidential information and investigate suspected misuse or security incidents. | Legitimate interests in maintaining security and protecting the business; legal obligation where applicable. |
| Operate whistleblowing, ethics, compliance and investigation processes. | Legal obligation where required and/or legitimate interests in detecting and addressing misconduct. |
| Manage emergency contacts and protect life or safety in an emergency. | Vital interests and/or legal obligation. |
| Equal-opportunity monitoring and legally required workforce reporting. | Legal obligation and/or legitimate interests, with an additional Article 9 and national-law condition for Special Category Personal Data. |
| Use photographs, recordings or employee stories for internal or external communications. | Legitimate interests where the use is proportionate and reasonably expected; consent or another basis may be used where appropriate for genuinely optional or higher-impact uses. |
| Establish, exercise or defend legal claims and respond to regulators, courts or law-enforcement authorities. | Legal obligation and/or legitimate interests; legal-claims condition for Special Category Personal Data where relevant. |
Workplace monitoring and information security#
Comanche Biopharma may monitor use of company systems, networks, accounts, devices, premises or access controls where this is necessary for security, compliance, operational continuity or investigation of suspected misuse. Monitoring is carried out in accordance with applicable law and internal policies and should be necessary and proportionate to the identified purpose. Where monitoring is likely to result in a high risk to individuals, we carry out a Data Protection Impact Assessment (DPIA) and implement appropriate safeguards as required.
Where monitoring could capture Special Category Personal Data, we use it only if both a lawful basis and an additional Special Category condition are available.
Device authentication and biometrics#
Where a company device is configured so that fingerprint, facial or similar biometric authentication remains encrypted on the device and the biometric template is not made available to Comanche Biopharma, Comanche Biopharma does not receive that template. If Comanche Biopharma introduces a centrally managed biometric-identification or authentication system, we will assess that processing separately and provide any additional privacy information, lawful basis, Special Category condition and safeguards required by law.
Special Category Personal Data#
We process Special Category Personal Data only where an additional legal condition applies. Depending on the purpose and jurisdiction, this may include employment and social-protection law, occupational health, vital interests, substantial public interest, legal claims, or explicit consent where consent is genuinely appropriate.
Examples include health information for sickness absence, occupational health or reasonable adjustments; equality information for monitoring and reporting; and sensitive information that may arise in a whistleblowing, grievance, safeguarding or legal-claims context.
Because of the imbalance of power in an employment relationship, we rely on consent only where you have a genuine choice and refusing or withdrawing consent will not result in disadvantage. Where consent is not appropriate, we use another lawful basis and, for Special Category Personal Data, another applicable Article 9 or local-law condition.
Criminal convictions and offences#
We process criminal-offence data only where it is authorised by applicable law and appropriate to the role or purpose, and subject to the additional safeguards required by local law.
Information about other people#
If you provide Personal Data about dependants, beneficiaries, emergency contacts or other people, please make sure that you are entitled to provide it. We will use that information only for the relevant employment, benefits, emergency or administrative purpose and will provide privacy information where required.
Who do we share your Personal Data with?#
We share Personal Data on a need-to-know basis with:
- managers, HR, finance, legal, compliance, IT, security and other relevant Comanche Biopharma teams and group entities;
- payroll, pension, benefits, insurance, occupational-health, travel, expense, training, HR-system, IT and other service providers;
- professional advisers, auditors and insurers;
- regulators, tax authorities, courts, law-enforcement bodies and other public authorities where required or permitted;
- business partners where necessary for your role and subject to appropriate safeguards; and
- prospective purchasers or transaction counterparties in connection with a reorganisation, financing, merger, acquisition or sale.
International transfers#
Comanche Biopharma operates internationally and uses service providers in multiple countries. Your Personal Data may therefore be transferred to, or accessed from, a country outside the country in which it was collected.
Where EU/EEA transfer restrictions apply, we use a mechanism permitted by the EU GDPR. Depending on the destination and recipient, this may include an adequacy decision, the European Commission Standard Contractual Clauses or another lawful safeguard. Where required, we assess whether additional measures are needed to ensure an essentially equivalent level of protection.
Where UK transfer restrictions apply, we use a mechanism permitted by UK law, such as UK adequacy regulations or an appropriate safeguard including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Where required, we assess the transfer against the UK statutory data protection test and apply additional protections if necessary.
You can contact our privacy contact if you would like more information about the safeguards used for a particular transfer.
How long do we keep your Personal Data?#
We retain employee and contractor Personal Data according to the record type, Comanche Biopharma’s retention schedule and applicable legal requirements. As a general company retention approach, core employment records may be kept for the duration of the working relationship and for up to six years afterwards, but this is not a statement that every jurisdiction requires a six-year period. Some categories are deleted earlier or retained longer under tax, pension, health and safety, regulatory, limitation, litigation or other legal requirements.
We may keep information for longer where necessary to establish, exercise or defend legal claims, respond to an investigation, or comply with a specific legal or regulatory requirement.
How do we protect your Personal Data?#
We use appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include, as appropriate to the processing, access controls, confidentiality obligations, security awareness, encryption where technically suitable, and incident-response procedures.
Access to Personal Data is limited to people who need it for their role. Where a service provider processes Personal Data on our behalf, we require appropriate privacy and security obligations in the relevant agreement.
What are your privacy rights?#
Depending on the law that applies and the reason we use your Personal Data, you may have the right to:
- ask whether we process your Personal Data and obtain a copy;
- ask us to correct inaccurate or incomplete Personal Data;
- ask us to erase Personal Data in certain circumstances;
- ask us to restrict processing in certain circumstances;
- object to processing based on legitimate interests and object at any time to direct marketing;
- receive or transmit certain Personal Data in a portable format where the right applies;
- withdraw consent at any time where processing is based on consent, without affecting processing already carried out; and
- lodge a complaint with a competent privacy or data protection authority at any time, however, we would appreciate the opportunity to address your concerns first, so please contact us in the first instance.
These rights are not absolute. For example, we may need to keep information where a legal or regulatory retention obligation applies. We may ask for information needed to verify your identity before responding to a request.
Where UK data-protection law applies, Comanche Biopharma will handle data-protection complaints in accordance with applicable UK requirements. You may also complain directly to the competent supervisory authority or privacy regulator. In the UK, this is the UK data-protection regulator (ICO). In the EU/EEA, you may complain to the competent supervisory authority under the EU GDPR.
Automated decision-making#
We do not currently make employment decisions that have legal or similarly significant effects based solely on automated processing. If such processing is introduced, we will provide the information and safeguards required by applicable law, including any right to human involvement or to challenge the decision.
Changes to this Privacy Notice#
We may update this notice to reflect changes in employment practices, systems or applicable law. If a change is material, we will provide additional notice where appropriate. The current version will remain available in the Privacy Centre.
Contact Us#
If you would like to exercise a privacy right, or you have a question or complaint about this notice or the way your Personal Data is processed, please contact our Data Protection Officer using the details below.
Data Protection Officer (DPO)
The DPO Centre Netherlands B.V.
Vijzelstraat 68, Amsterdam 1017HL, Netherlands
UK Representative (where applicable)
The DPO Centre Limited
50 Liverpool Street, London EC2M 7PY, United Kingdom
The Organisation
Comanche Biopharma Corp.
50 Beharrell Street, Unit B, Concord, MA 01742, United States