Privacy Policy

Last updated: December 2024

Valneva Sweden AB (“Valneva”, “we”, “us” or “our”) has created this privacy policy (hereafter referred to as the “Privacy Policy”) in order to demonstrate our firm commitment to privacy. The following discloses our information gathering and use practices for the Valneva website, ValnevaPro and pages which are owned by Valneva or its affiliates and which refer to the present Privacy Policy (collectively referred to as the “Site“).

This Privacy Policy serves to inform you of our activities pertaining to the collection, use and disclosure of information that you may provide, whether intentionally or unintentionally, by your use of the Site and your rights as a data subject.

IT IS THUS IMPORTANT THAT YOU CAREFULLY READ AND FULLY UNDERSTAND THE ENTIRE PRIVACY POLICY PRIOR TO USING THE SITE.

Valneva recognises its responsibility to protect Personal Data. “Personal Data” (Art. 4 (1) GDPR) means personally identifiable information, i.e.any information relating to an identified or identifiable individual, such as your name, birthday, gender, address, email address, phone number, health information, and comments or enquiries you have made about our products or services when such comments or enquiries are linked to you or any other information of similar nature.

This Privacy Policy applies to individuals we deal with including consumers, patients, health care professionals and others within the health care or pharmaceutical industries (“you” or “your”), and explains how we collect, use, disclose and otherwise process and protect your Personal Data. This Privacy Policy further includes a description of your data privacy rights as a data subject.

By using this Site or otherwise supplying us with your Personal Data, you agree that we may use any Personal Data you have given, in the manner stated below.

1. Personal Data

We may collect Personal Data e.g. names, addresses, telephone numbers, email addresses, only when voluntarily provided by you when you register or otherwise voluntarily submit information to us. Some of this information may relate to your health, which is particularly sensitive. We may collect also CVs, information on your permits, licenses, potential conflicts of interest, references and merits. We may also collect information relating to adverse events.

2. Data Controller

A Data Controller (Art. 4 (7) GDPR) is the one determining the purposes and means of the processing of Personal Data. Valneva, with its principal place of business at Valneva Sweden AB, SE–105 21, Stockholm, Sweden, will collect and process your information as Data Controller.

3. Legal Basis for Processing

Valneva processes your Personal Data on defined legal grounds. As enshrined in Article 6 of the GDPR, we may process your Personal Data when it’s necessary for the performance of a contract between us, when we have a legitimate interest to do so, or when there is a legal obligation that we have to comply with. Sometimes you have given specific consent to the processing activities. If the consent concerns a child under the age of 16 (or such other lower age determined by the local laws applicable to this Privacy Policy), consent must be given or authorized by a person with parental responsibility for the child. As stated in section 14 below, Valneva does not collect Personal Data from minors.

4. Personal Data Collection

Valneva and its agents and representatives collect Personal Data, sometimes including special category data that is particularly sensitive personal data (e.g. data concerning health) in a number of circumstances, including when you provide it to us voluntarily or in other circumstances with your consent or as permitted or required by law. For example, we may collect your Personal Data when you:

• request information;

• enquire or provide comments about our products and services;

• participate in advisory boards;

• participate in clinical trials;

• fill out questionnaires or surveys;

• participate in social media, or post information on bulletins or on the Site;

• submit your resume or other Personal Data in connection with employment possibilities with us; or

• otherwise provide your Personal Data to us, including by telephone, mail, email, facsimile or through the Site.

The Personal Data we may collect includes:

• personal and business contact information, such as name, birthday, title, address, telephone number, gender, and email address or any other information of similar nature;

• information that our sales representatives may collect during their visits with physicians and other health care professionals with whom they deal, for instance title, qualifications, areas of practice or specialisation, their questions or comments about our products, and related information about health care professionals and their administrators relevant to maintaining and managing our relationship with such persons;

• names and other contact details of patients who use our products and their physicians and, in certain circumstances, sensitive personal data, and patient medical history, for example, where we have received a report of an adverse event, where we are providing patient-specific assistance with respect to the use or reimbursement of our products, or where we are assisting in or co-coordinating product recalls;

• information collected in connection with enquiries or comments made by individuals who contact our Medical Information representatives;

• names and other contact details of physicians participating in advisory boards and the opinions or comments expressed by those physicians during advisory board meetings;

• names and other contact details of physicians involved in running clinical trials, together with their professional information such as curriculum vitae and other information that is required to be reported to relevant regulatory bodies;

• information from individuals visiting our premises such as their name and the name of the organisation for which they work or which they represent. We may also post video cameras in public-access areas on our premises; and

• other information with your consent or as permitted or required by law.

Calls to and from Valneva may be recorded and/or monitored for quality and training purposes. Recordings may also be used to help us develop and improve our products and services. Information may also be actively and passively collected by the Site. See “the Site” below for details.

You have the right to decline our request of your Personal Data, however we may not be able to provide you with the requested services should you chose to do so.

Please note that if you wish to subscribe and connect your personal social media account to our Site, e.g. if you would like to share information on your own social media account, certain Personal Data will be shared with us such as Personal Data linked to your profile or your friends profiles on the applicable social media account.

If you are sharing Personal Data of another individual, you guarantee that you have the authority to share that data and give us the permission to process the Personal Data provided in accordance with this Privacy Policy.

5. Purposes

Valneva collects Personal Data for a variety of purposes relating to the operation of our business and the delivery of services to you, including to:

1. provide our products and services and generally manage and administer our business including maintaining business records for reasonable periods and defending and bringing legal actions;

2. develop and improve our products;

3. provide you with health and product-related information;

4. reply to your requests, enquiries and comments;

5. receive and assess product enquiries, reports of adverse events, and product complaints;

6. assist in or co-ordinate product recalls;

7. establish and maintain our relationship with health care professionals and administrators and other individuals with whom we have contact in the course of our business;

8. provide assistance and advice to health care professionals and institutions with respect to our products;

9. test and analyse our products for efficacy and safety;

10. meet legal, regulatory, insurance, security, ethical and processing requirements such as adverse event and clinical reporting to relevant regulatory bodies;

11. monitor compliance with informed consent requirements when patients participate in clinical trials, and verify that clinical data collected by Valneva in the course of the clinical trial conforms to the source data available at the site of the clinical trial;

12. use feedback provided to us in the course of advisory board meetings to develop the strategic positioning of our products;

13. manage, administer, collect and enforce accounts;

14. provide remuneration to individuals who have performed services for Valneva;

15. enable us to act responsibly in the event of a health or other crisis or emergency and to enhance workplace security;

16. evaluate résumés or other Personal Data submitted to us in connection with employment possibilities. For candidates who are not offered or do not accept a position, we may retain their information in the event that an appropriate position becomes available or that they re-apply to Valneva;

17. offer and administer promotions, surveys and websites including social media;

18. ensure the security and integrity of the Site and operations.

We may also use your Personal Data for other purposes with your consent or as permitted or required by law.

6. Transfer of Personal Data and Use of Service Providers

This Site is owned and operated by Valneva in Sweden, but the information you provide may be accessible or transferred to our affiliates, vendors or suppliers in other countries, including countries outside the European Economic Area (“EEA”). We may furthertransfer Personal Data to outside agents or service providers (including affiliates acting in this capacity) that perform services on our behalf and according to our instructions, for example: certain payroll and benefits administration functions; receipt and administration of certain adverse event or product quality complaints; certain credit card, billing, mailing, marketing, information technology and/or data hosting or processing services, or similar services, or otherwise to collect, use, disclose, store or process Personal Data on our behalf for the purposes described in this Privacy Policy. Such third-party service providers are restricted from using the Personal Data for any other purpose other than to provide services for Valneva. Valneva is responsible for any processing by such third parties and will ensure that such service providers have entered into written agreements allowing Valneva to comply with our obligations under this Privacy Policy and applicable laws and regulations. Your Personal Data will not be disclosed to any other third parties unless you have explicitly given your consent to such disclosure or if it is required by laws or regulations. Some of these service providers may be located outside of the EEA. While outside of the EEA, your Personal Data will be subject to applicable foreign legal requirements, which may include lawful requirements to disclose Personal Data to government authorities in certain circumstances. In case of such transfer, Valneva will take reasonable efforts and security measures in an effort to keep your Personal Data secure, and Valneva is responsible to ensure that the transfer takes place in accordance with this Privacy Policy and applicable laws and regulations. We may also use, disclose and transfer your Personal Data in connection with a possible reorganization, merger, acquisition, assignment, transfer or other disposition of all or parts of our business, assets or shares. If you have any questions about the methods, we use to safeguard any Personal Data transferred outside the EEA please feel free to contact us using the contact details under Section 17 below.

7. Disclosures

Valneva may disclose your Personal Data (including Sensitive Personal Data) in the following circumstances:

We may disclose Personal Data when required in order to meet legal, regulatory, industry self-regulatory, insurance, audit, security or ethical requirements, including obligations to health and drug regulatory and self-regulatory bodies, physicians, hospitals, or other health care facilities.

Your Personal Data may be used by Valneva and disclosed to parties connected with the contemplated or actual financing, insuring, sale, assignment or other disposal of all or part of Valneva’s business or assets, including for the purpose of permitting such parties to determine whether to proceed or continue with such transaction or business relationship and to fulfil reporting or audit requirements. Assignees or successors of Valneva or our business or assets may use and disclose your Personal Data for similar purposes as those described in this Privacy Policy.

We also may disclose your Personal Data to third parties, located in the EEA and/or any other country, where required or permitted by applicable laws, court orders, or government regulations (including as required by national and foreign laws applicable to Valneva or our agents and service providers).

8. Security

We take reasonable steps to protect your Personal Data using physical (locked filing cabinets and restricted access to offices), electronic (especially firewalls) or procedural security measures appropriate to the sensitivity of the information. Valneva will take appropriate steps to ensure that Personal Data about you is protected from loss or theft, as well as unauthorised access, disclosure, copying, use or modification.

Although we have enacted security measures, we cannot guarantee the security of any information that you submit via email or over the Internet. To the extent permitted under applicable law, we make no warranty, express or implied, concerning the security or integrity of any Personal Data. Submission of Personal Data using such networks is done at your own risk, since no Internet transmission is ever 100% secure or error-free (in particular, emails sent to or from the Site may not be secure). You should take special care in deciding what information you send to us via email or posting on the Site. Moreover, where you use passwords, ID numbers or other special access features on the Site, it is your responsibility to safeguard them.

9. Links to other Websites

The Site may contain links or references to other websites to which this Privacy Policy does not apply. Valneva is not responsible for the data collection and use practices of companies or organisations to which the Site may provide links. We encourage you to read the privacy statement/policy of every website you visit.

Valneva makes no representations whatsoever about any other website which you may access through this Site. In addition, a link to a website does not mean that Valneva endorses or accepts any responsibility for the content, or the use, of such website.

10. The Site

The Site may collect information from visitors both by asking you specific questions and by permitting you to communicate directly with us via email and/or feedback forms. Some of the information that you submit on the Site may be Personal Data. A site may further use “cookies” Internet Protocol (“IP”) addresses. A cookie is a bit of information that a website sends to your web browser that helps the site remember information about you and your preferences and an IP address is a number assigned to your computer by your Internet service provider. The IP address can be used to diagnose problems with a server, report aggregate information, determine the fastest route for your computer to use in connecting to a site, and administer and improve the site. Please read more here: cookie policy.

11. Analytics

We may use third-party Service providers to monitor and analyze the use of our Service. These third-party analytics companies use cookies, pixels and other tracking technologies to collect usage data to provide us with reports and metrics that help is analyze, improve and enhance performance and user experience.

Google Analytics: Our websites uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookies to help the website analyse how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. Valneva has activated IP anonymization on its websites, therefore, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases the full IP address might be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this anonymized information for the purpose of evaluating the use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link (https://tools.google.com/dlpage/gaoptout?hl=en). We would like to point out that on our websites Google Analytics has been extended by the code “anonymizeIp” in order to ensure anonymized collection of IP addresses (so-called IP masking)

Please note that if you wish to subscribe and connect your personal social media account to our Site, e.g. if you would like to share information on your own social media account, certain Personal Data will be shared with us such as Personal Data linked to your profile or your friends’ profiles on the applicable social media account.

You can opt-out of having made your activity on the Service available to Google Analytics by installing the Google Analytics opt-out browser add-on. The add-on prevents the Google Analytics JavaScript (ga.js, analytics.js and dc.js) from sharing information with Google Analytics about visits activity.

For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy.

12. Advertising

We work with third parties, such as ad networks, channel partners, mobile ad networks, analytics and measurement services and other third-party ad companies to personalize content and display advertising within our Service, as well as to manage our advertising on third-party websites, mobile apps and online services. We may share certain information with third-party ad companies, and we and third-party ad companies may use cookies, pixel tags and other tools to collect usage and browsing information within our Services, as well as on third-party websites, apps and services. This information may include IP address, location information, cookie and advertising IDs and other identifiers as well as browsing information.

You have certain choices available to help you manage the use of cookies and other technologies provided by third parties:

Google AdSense & DoubleClick Cookie

You may opt out of the use of the DoubleClick Cookie for interest-based advertising by visiting the Google Ads Settings web page: http://www.google.com/ads/preferences/.

Bing Ads

You can opt-out from Bing Ads by following the instructions on Bing Ads Opt-out page: https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads.

For more information about Bing Ads, please visit their Privacy Policy: https://privacy.microsoft.com/en-us/PrivacyStatement.

Email Marketing

We may use Your Personal Data to contact You with newsletters, marketing or promotional materials and other information that may be of interest to You. You may opt-out of receiving any, or all, of these communications from Us by following the unsubscribe link or instructions provided in any email We send or by contacting Us.

We may use Email Marketing Service Providers to manage and send emails to You.

Mailchimp

Mailchimp is an email marketing sending service provided by The Rocket Science Group LLC.

For more information on the privacy practices of Mailchimp, please visit their Privacy policy: https://mailchimp.com/legal/privacy/.

VeevaCRM

Veeva CRM is a cloud-based customer relationship management platform designed for the life sciences industry. For more details about its privacy practices, you can refer to their Privacy Policy here: https://www.veeva.com/privacy/.

Behavioral Remarketing

The Company uses remarketing services to advertise to You after You accessed or visited our Service. We and Our third-party vendors use cookies and non-cookie technologies to help Us recognize Your Device and understand how You use our Service so that We can improve our Service to reflect Your interests and serve You advertisements that are likely to be of more interest to You.

These third-party vendors collect, store, use, process and transfer information about Your activity on Our Service in accordance with their Privacy Policies and to enable Us to:

• Measure and analyze traffic and browsing activity on Our Service

• Show advertisements for our products and/or services to You on third-party websites or apps

• Measure and analyze the performance of Our advertising campaigns

Some of these third-party vendors may use non-cookie technologies that may not be impacted by browser settings that block cookies. Your browser may not permit You to block such technologies. You can use the following third-party tools to decline the collection and use of information for the purpose of serving You interest-based advertising:

The NAI's opt-out platform: http://www.networkadvertising.org/choices/

The EDAA's opt-out platform: http://www.youronlinechoices.com/

The DAA's opt-out platform: http://optout.aboutads.info/?c=2&lang=EN

You may opt-out of all personalized advertising by enabling privacy features on Your mobile device such as Limit Ad Tracking (iOS) and Opt Out of Ads Personalization (Android). See Your mobile device Help system for more information.

We may share information, such as hashed email addresses (if available) or other online identifiers collected on Our Service with these third-party vendors. This allows Our third-party vendors to recognize and deliver You ads across devices and browsers. To read more about the technologies used by these third-party vendors and their cross-device capabilities please refer to the Privacy Policy of each vendor listed below.

The third-party vendors We use are:

Google Ads (AdWords)

Google Ads (AdWords) remarketing service is provided by Google Inc.

You can opt-out of Google Analytics for Display Advertising and customize the Google Display Network ads by visiting the Google Ads Settings page: http://www.google.com/settings/ads

Google also recommends installing the Google Analytics Opt-out Browser Add-on - https://tools.google.com/dlpage/gaoptout - for your web browser. Google Analytics Opt-out Browser Add-on provides visitors with the ability to prevent their data from being collected and used by Google Analytics.

For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy.

Bing Ads Remarketing

Bing Ads remarketing service is provided by Microsoft Inc.

You can opt-out of Bing Ads interest-based ads by following their instructions: https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads

You can learn more about the privacy practices and policies of Microsoft by visiting their Privacy Policy page: https://privacy.microsoft.com/en-us/PrivacyStatement.

Twitter

Twitter remarketing service is provided by Twitter Inc.

You can opt-out from Twitter's interest-based ads by following their instructions: https://support.twitter.com/articles/20170405.

You can learn more about the privacy practices and policies of Twitter by visiting their Privacy Policy page: https://twitter.com/privacy.

Facebook

Facebook remarketing service is provided by Facebook Inc.

You can learn more about interest-based advertising from Facebook by visiting this page: https://www.facebook.com/help/516147308587266.

To opt-out from Facebook's interest-based ads, follow these instructions from Facebook: https://www.facebook.com/help/568137493302217.

Facebook adheres to the Self-Regulatory Principles for Online Behavioural Advertising established by the Digital Advertising Alliance. You can also opt-out from Facebook and other participating companies through the Digital Advertising Alliance in the USA http://www.aboutads.info/choices/, the Digital Advertising Alliance of Canada in Canada http://youradchoices.ca/ or the European Interactive Digital Advertising Alliance in Europe http://www.youronlinechoices.eu/, or opt-out using your mobile device settings.

For more information on the privacy practices of Facebook, please visit Facebook's Data Policy: https://www.facebook.com/privacy/explanation.

13. Collection of Personal Data from Children

This Site is not directed to individuals under the age of sixteen (16) (or such other lower age determined by applicable laws), and we do not knowingly collect any Personal Data from children under such age.

Should we need to process Personal Data of an individual under the age of sixteen (16) (or such other lower age determined by applicable laws) consent to such processing must be given by an authorised person with parental responsibility for the child.

14. Retention Periods of Personal Data

We will retain your Personal Data only for the period necessary to fulfil the purposes for which it was obtained and as outlined in this Privacy Policy or as required by laws and regulations.

15. Privacy Policy Changes

This Privacy Policy may be revised from time to time. If we intend to use or disclose Personal Data for purposes materially different than those described in this Privacy Policy, we will make reasonable efforts to notify affected individuals, if necessary, including by posting the revised Privacy Policy on this Site. We recommend that you review this Privacy Policy frequently.

16. Information Regarding Your Rights

If you would like to access your Personal Data or get it rectified, updated, erased or transferred to other organizations please contact us at the address below. You also have the right to object or to restrict some processing and, where we have asked for your consent to process your Personal Data, to withdraw your consent at any time and we will stop any future use of your Personal Data (unless there is a legitimate interest that prevents us from doing so). Authorised employees, agents and representatives of Valneva who require access to your Personal Data in order to fulfil their job requirements will have access to your Personal Data.

You may contact us by writing to us at the following address:

Valneva Sweden AB, SE–105 21, Stockholm, Sweden

You may also contact Valneva`s Data Protection Officer at: gdpr@valneva.com

NOTE: If you are a physician or other health care professional and would like to record an adverse event, please contact safety@valneva.com

17. Contact the Supervisory Authority

If you have any comments or complaints regarding the way your Personal Data is being handled, you have the right to contact the supervisory authority in your country of residence to lodge a complaint. Please click here to obtain relevant contact information to supervisory authorities:http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.