Supplemental European Privacy Notice

Date Last Updated: January 1, 2023

European Union Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“EU GDPR”) and the Data Protection Act 2018 in the United Kingdom of Great Britain (UK) requires us as the data controller to provide additional and different information about our data processing practices to data subjects located in the European Economic Area (“EEA”) and the UK.  If you are a data subject located within the EEA or the UK, this Supplemental European Privacy Notice applies to you in addition to any other information we provide regarding data privacy.

How We Use Your Personal Data

We (Karyopharm Therapeutics Inc.) will only use your personal data when applicable law allows us to do so.  Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract that we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.
• Necessary for scientific research purposes.

We may also use your personal data in the following situations, which are likely to be rare:

• Where we need to protect your interests (or someone else’s interests).
• Where it is needed in the public interest or for official purposes.

Generally, we do not rely on consent as a legal basis for processing your personal data other than in relation conduction clinical studies in certain countries in mainland Europe.  

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data. 

Clinical Trial Data

We undertake clinical studies within the EEA and the UK and we will use information from subjects’ medical records and other health data in order to improve healthcare.  As a pharmaceutical organisation, we have a legitimate interest in using information relating to your health for research studies, when you agree to take part in a research study. Our exception to the general provision at Article 9(1) GDPR not to process special categories of data is that processing is necessary for scientific research purposes in accordance with Article 89(1) GDPR. This means that we will use your data when we act as the data controller for such studies, collected in the course of a research study, in the ways needed to conduct and analyse the research study. The Informed Consent Form will provide further detail of the processing of your personal data should you be a subject of a study. Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible.

Change of Purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

International Transfers of Personal Data

Our primary location is based outside the European Economic Area, so the processing of your personal data may involve a transfer of data outside the EEA or UK.  Information on how to contact the DPO can be found in Section A of this Notice (“How to Contact Us”).

Whenever we transfer your personal data out of the EEA or UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission or UK Government or where we have an appropriate lawful basis.
• Regarding transfers to the US, we incorporate Standard Contractual Clauses in agreements for transfer from the EEA provided by the European Commission or from the UK by the International Data Transfer Agreement provided by the Information Commissioner’s Office in the UK in order to provide similar protection to personal data shared within Europe or the UK.
• We may have previously relied on the EU-US or the Swiss-US Privacy Shield to transfer your data from the EEA, UK, or Switzerland to the US. To learn more about how we comply with Privacy Shield, please review our Privacy Shield Policy at the end of this document. Please note that as of July 16, 2020, we no longer rely on Privacy Shield as a valid data transfer mechanism.

How Long We Retain Your Personal Data

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

Your Data Protection Rights

Under certain circumstances, if you are a person located within the EEA or UK you have the following data protection rights:

• access to your personal data.
• correction of your personal data.
• erasure of your personal data.
• object to processing of your personal data.
• restrict of processing your personal data.
• transfer of your personal data.
• withdraw consent to any consent that you have previously given.

If you wish to exercise any of the rights set out above, please contact our Data Protection Officer at sar@thedpo.co.uk.  You can also contact the Supervisory Authority in the country of your residence within the EU or UK for advice or to make a complaint.  Please be aware that your rights in relation to clinical research data may be limited.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).  This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.  We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month.  Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests.  In this case, we will notify you and keep you updated.

EU-US PRIVACY SHIELD POLICY

Advisory: Please note that as of July 16, 2020, Karyopharm relies on alternative data transfer mechanisms deemed appropriate by the relevant authorities to transfer data collected from the European Economic Area (EEA), Switzerland, and the UK to the U.S., such as standard contractual clauses. We no longer rely on the EU-U.S. or the Swiss-U.S. Privacy Shield to transfer data that originated in the EEA, Switzerland, or the UK to the U.S. 

Effective Date: May 18, 2018
Karyopharm complies with the Privacy Shield as set forth by the US Department of Commerce regarding the processing of Personal Data transferred from the EU to the US (for these purposes, reference to the EU also includes the European Economic Area countries of Iceland, Liechtenstein, and Norway). Karyopharm has certified that it adheres to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability (“Privacy Shield Principles”). If there is any conflict between the policies in this EU-US Privacy Shield policy (“Policy”) and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification page and a full list of self-certified companies, please visit https://www.privacyshield.gov.

Scope: This Policy applies to Personal Data other than human resources (“HR”) personal data, that is received by Karyopharm in the US from the EU (For further information about Personal Data covered by this Policy, please see section “Types of Personal Data Collected” below.). Karyopharm commits to comply with the Privacy Shield Principles in respect of such Personal Data.

Processing of HR personal data transferred from our subsidiary located in the EU (Karyopharm Europe GmbH) to Karyopharm under the Privacy Shield is subject to an HR privacy policy that is available for viewing by all employees. 

Types of Personal Data Collected: “Personal Data” is any information that can be used to identify an individual that is received from the EU and is recorded in any form. Personal Data includes Sensitive Data. “Sensitive Data” is Personal Data that specifies medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or information specifying the sex life of the individual.

We may collect the following types of Personal Data: Personal Data pertaining to our vendors, contractors, and consultants, as well as clinical research participants, study investigators and their staff, medical and healthcare professionals, and pharmaceutical industry experts and opinion leaders. Personal Data may include full name, address, telephone or mobile number, business and home contact details including e-mail addresses, health information and demographic information, as well as other Personal Data that you voluntarily provide to us, such as when you contact us with inquiries. Personal Data may further include any information that identifies an individual but does not include information that has been anonymized.

Purposes of Data Processing: Personal Data that may be collected will be used for the purpose of supporting Karyopharm’s business activities related to the development of drug candidates for the treatment of diseases, including performing clinical research or programs and for maintaining and improving company internal systems.

PRIVACY SHIELD PRINCIPLES

Notice: This Policy provides notice of the Personal Data collected and transferred under the Privacy Shield, including its use and handling, and how you may exercise your Privacy Shield rights. This Policy also provides information about other Privacy Shield Principles that are set forth below.

Choice: You may tell us not to disclose (“opt out”) your Personal Data. You may contact Karyopharm’s General Counsel at privacy@karyopharm.com to exercise your opt out preferences. We will not collect or use your Sensitive Data unless you provide your affirmative express consent (“opt in”).

Accountability for Onward Transfers: Karyopharm may occasionally transfer Personal Data to a limited number of third-party contractors, service providers, and other businesses involved in the normal operations of our business to assist us in meeting business operation needs and to perform certain services and functions on our behalf and under our instructions. These parties may access, process, or store Personal Data in the course of performing their duties to Karyopharm. We maintain contracts with these providers that restrict their access, use, and disclosure of Personal Data, solely to that necessary to meet their contractual obligations in performing the specific functions described above.

Karyopharm may be required to disclose Personal Data to the extent required to meet a legal obligation, including national security or law enforcement obligations and applicable law, rule, order, or regulation.

We may also disclose Personal Data to other corporate entities in case of corporate sale, merger, reorganization, financing due diligence, dissolution, or similar event.

Security: Karyopharm maintains reasonable and appropriate security measures to protect Personal Data from loss, misuse, unauthorized access, disclosure, alteration, or destruction in light of the risks inherent in processing this information.

Data Integrity and Purpose Limitation: We will take reasonable steps to ensure that Personal Data is reliable for its intended use, accurate, complete, and current. We will adhere to the Privacy Shield Principles for as long as we retain Personal Data about you.

Access: You have certain rights with respect to your Personal Data, including those described in our Privacy Policy under the title “Your Rights in Connection with Your Personally Identifiable Information.” Please address any requests you may have with respect such rights to the following email address: privacy@karyopharm.com. We will make good faith efforts to accommodate these requests within a reasonable time frame.

Recourse, Enforcement, Liability: In compliance with the Privacy Shield Principles, Karyopharm commits to resolve complaints about our processing of your Personal Data. Individuals in the EU with inquiries or complaints regarding this Policy should first contact Karyopharm at: privacy@karyopharm.com or by regular mail addressed to:

Karyopharm Therapeutics Inc.
Attn: General Counsel
85 Wells Ave., 2nd floor
Newton, MA 02459

Any inquiries or complaints can also be addressed to our subsidiary located in Germany, by regular mail sent to:

Karyopharm Europe GmbH
Attn: Managing Director
Franziska-Bilek-Weg 9
80339 München
Germany

Karyopharm has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to the International Centre for Dispute Resolution®, the international division of the American Arbitration Association, a not-for-profit alternative dispute resolution organization located in the United States. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit http://go.adr.org/privacyshield for more information and to file a complaint.

Please note that if your complaint is not resolved through these channels, under limited circumstances, a binding arbitration option may be available before a Privacy Shield Panel. For additional information, please visit: https://www.privacyshield.gov/article?id=ANNEX-I-introduction.

With respect to Personal Data received or transferred pursuant to the Privacy Shield, Karyopharm is subject to the investigatory and enforcement powers of the Federal Trade Commission.

To the extent that Karyopharm receives or processes HR personal data from the EU for use in the context of an employment relationship under the Privacy Shield, Karyopharm agrees to cooperate with the EU data protection authorities and comply with the advice given by such authorities with respect to this data, as further described in our HR privacy policy.

Karyopharm remains responsible and liable under the Privacy Shield Principles if third-party agents that it may engage to process Personal Data on its behalf do so in a manner inconsistent with the Privacy Shield Principles, unless Karyopharm proves that it is not responsible for the event giving rise to the damage.

Changes to the Policy: We reserve the right to amend this Policy from time to time consistent with the Privacy Shield’s requirements.