International Privacy Statement

Switch to: US Privacy Statement International Privacy Statement

This Privacy Statement sets forth the policy of Kuros Biosciences and its affiliates (hereinafter “Kuros”, “Company”, “we”, “us” or “our”) with respect to personal data that is collected from data subjects. This Privacy Statement describes how we may collect, use, disclose, and transfer (hereinafter “process”) your personal data.

We understand that your privacy is important to you and that you care about how information relating to you (“personal data”) is used. Kuros is committed to ensuring the privacy and security of the personal data it processes and to protect your rights in accordance with our obligations under applicable Privacy and Data Protection laws.

Please read this Privacy Statement carefully to be informed about how and why we collect, process, store, use, transfer and delete your personal data. It also explains your rights in relation to your personal data and how to contact us in the event you have any questions about how we handle your personal data.

What processing activities are covered under this Privacy Statement?

This Privacy Statement informs you how we collect, use, disclose, and process your personal data in our role as a Data Controller and in connection with:

Your use of our website(s);
Our employee recruitment processes;
Your interaction with us on social media platforms (e.g., LinkedIn, Instagram, YouTube);
Procurement and potential procurement matters;
Establishing and maintaining a customer relationship (Customer/Business contact);
Understanding, diagnosing, analysing, and resolving issues with any of our services or product;
Filing a complaint or reporting a deficiency related to any of our services or product;
Reporting any safety events related to our product;
Contacting us through any of our channels; and
Adverse event reporting.

As a sponsor or financial contributor of clinical trials, Kuros receives and processes pseudonymized data of trial participants. This means that while the data may include relevant study information, it does not contain direct identifiers related to trial participants such as names or contact details, preventing Kuros from identifying individual participants.

What personal data do we collect?

We collect the following personal data:

Contact information, such as name, job title, email address, phone number, address, any other contact information that you have voluntarily shared with us.
Resume and other information you submit when you apply for a job with us, including motivation letter, professional information, certifications, and others.
Information about your device and your usage of our website and/or e-mails, such as cookies, web beacons, or similar technologies. For further information regarding cookies, please refer to our Cookie Statement.
Professional information, such as business details, name, job title, company name, bank account, phone number, e-mails that might contain personal data, other information voluntarily shared with us.
Your complaint, deficiency or safety event report: This includes, but is not limited to, the date, email address, nature of the complaint, enquiry, or communication.
When reporting adverse events, we may collect information related to you, such as your name and contact details, medical condition, products you use, physician contact details, reaction to the product and/or other health related data associated to the product.

How do we obtain your personal data?

We collect personal data directly from you when you:

Interact or use our website or any other service that displays or links to this Privacy Statement, including accessing or downloading materials from the resources or portals available to you on this website or requesting information about our products and services;
Visit our branded social media pages;
Receive communications from us or otherwise communicate with us, including but not limited to emails, phone calls, or texts;
Register for, attend or take part in our conferences, events or webinars;
Contact us through our contact form available in our website;
Registering or sending information through our career portal, sending your personal details by email, or when you apply through any of our external recruiters;
Register to our newsletter, mailings, press releases, reports and or annual reports;
Contact us to lodge a complaint about our services or product or to report adverse events;

If you provide us personal data relating to other individuals (e.g., employees, individuals working for a customer, an affiliate or a service provider), you warrant that you have the authority to do so, and where required, have obtained the necessary consent, and acknowledge that it may be used in accordance with this Privacy Statement.

If you believe that your personal data has been provided to us improperly or want to exercise your rights relating to your personal data, please contact us by using the contact information detailed in the section “How to Contact us” available at the end of this document.

Personal data we collect from other sources:

We collect personal data from Customers / Business Partners / Vendors: We receive and store your personal data that our Customer, Business Provider or Vendor has provided to us in order to satisfy contractual obligations. The types of information we may collect directly from our customers and their employees include names, usernames, email addresses, postal addresses, phone numbers, job titles, transactional information, as well as other contact or other information they choose to provide us or upload to our systems in connection with the products or services they offer us. Other personal information we process may vary depending on the requirements specified in third party agreements. In those cases, we assume that those entities have appropriate legal grounds to share personal data with us.

Purposes and legal grounds for processing

We process your personal data for certain purposes, described below. Under the applicable Privacy and Data Protection laws, we are only allowed to process your personal data for such purposes if we can rely on one or more of the legal grounds for processing, as described below:

Purpose	Description	Legal grounds
Providing and improving our websites, including social media	We process your personal data to operate our website and to provide you with the content you access and request.We process your personal data to analyze overall trends and help us improve the user experience on our websites.	Our legitimate interest.
Managing Event and Webinar registrations	We process your personal data when organizing events or webinars for which you have registered or that you have joined. This includes sending communication to you related to the events and webinars.	Your consent and/or our legitimate interest.
Sending communications and marketing	We process your personal data to send you marketing information, newsletters, and other communications	Your consent to receive any direct marketing or communication from us or our legitimate interest when you are already a registered customer.
Handling complaints and compliments and other contact requests through our website	We process your personal data in order to reply to messages left on our website.	Our legitimate interest and/or your consent.
Managing our customer accounts	We process your personal data in relation to our CRM system to manage customer accounts generally, such as billing, customer correspondence, customer relationship management, and maintaining your customer account.	Our legitimate interest and performance of a contract when applicable.
Maintaining our security	We process your personal data for the purposes of maintaining Kuros’s own security, including investigating, detecting and preventing suspicious activity, fraud and cybercrime that may affect Kuros.	Our legitimate interest in promoting the safety and security of Kuros and to protect our rights and the rights of others.
Informing our investors	If you are a board member or have significant interests in Kuros, we process your personal data to inform our investors of some of your personal data to comply with our legal obligations.	Legal obligation
Complying with legal and/or regulatory obligations	As a stock-listed medical company we are subject to a variety of legal obligations that require us to send (among other things) personal data to regulators, investigators and supervisory authorities. We only process and/or disclose your personal data to the extent required by law when cooperating with authorities and jurisdictions.	Legal obligation
Litigation and claims	We may process your personal data during litigation or administrative procedures and when defending or exercising legal rights and claims.	Legal obligation or our legitimate interests
Adverse Event reporting and Complaint handling	We process and/ or disclose your personal data when you report an adverse event or complaint or report a deficiency related to our services or product either directly or through your Health Care Professional. We may use the information you provide to us to submit reports and disclose it to the European Medicines Agency or the U.S. Food and Drug Administration or any other regulatory body. We may use it to also report to other similar health and medicine government agencies across the world, and as otherwise required of us by law. We also may use the information to contact your physician to follow up regarding an unexpected event involving the use of our product.	Legal obligation
Undertaking financial reporting, managing payments, preparing internal reports, and business modelling	When necessary we process your personal data for the purposes of financial reporting, modelling purposes (e.g., forecasting), and to make or collect payments to the extent that doing so is necessary to complete a transaction and perform our contract with you, the company you represent or your organization.	Our legitimate interest or performance of a contract in which you are a party.
Managing job applications	We process your personal data in relation to the position you apply for the purpose of talent acquisition, including assessing capabilities, reference checks. If you are an employee, please refer to the Employee Handbook for further processing operations involving your personal data.	Your consent and/or performance of a contract.

How long do we store your personal data?

Kuros Biosciences does not store personal data for longer than necessary for the purposes for which the data are processed, and in any case for as long as specific regulations require. To determine the retention period, we take the following into account:

Whether we are subject to any legal obligation;
Whether retention is required considering our legal position (such as for statutes of limitations, litigation or regulatory investigations); and
The length of time that we have an ongoing relationship with you, and provide our services to you.

If you are a website visitor, the retention period at user level and for events associated with cookies can be found in our Cookie Statement.

At the end of the retention period, we will delete your personal data in a manner designed to ensure that it cannot be reconstructed.

Your rights as a data subject

You have the following rights with regard to your personal data and its processing:

Right of access: You can contact us any time to request about the personal data we may hold and request a copy and a list of purposes for which your personal data is processed.
Right to rectification: You have the right to require us to correct mistakes in your personal data should you notice any.
Right to erasure (be forgotten): You have the right to require us to delete your personal data. This is subject to some limitations. It applies, for instance, if you have withdrawn consent for processing, or if your personal data was unlawfully processed.
Right to restriction of processing: You have the right to request restriction of the processing of your personal data in certain circumstances, e.g. if you contest the accuracy of the data.
Right of data portability: Where processing is based on consent or on a contract, you have the right to obtain a copy of the data in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance.
Right of objection: You have the right to object at any time to your personal data being used for direct marketing (including profiling) and in certain other situations to our continued use of your personal data, e.g. where we use your personal data for our legitimate interests. We may however continue to process your personal data if, even if you object thereto, we have compelling legitimate grounds for the processing that override your integrity interest.
Right not to be subject to automated individual decision-making, including profiling: You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you. We do not use automated individual decision-making in our processes.

If you are not content with the way your request was processed, you also have the right to lodge a complaint with the Data Protection Authority within your country.

If you wish to exercise any of your rights mentioned above, please contact us using the information in the section ‘How to contact us’ at the end of this Privacy Statement. We will respond to your request within 30 days of receiving such request. If we are unable to honour or otherwise deny your request, we will provide a reason why. We may need to confirm your identity before acting on your rights.

Please note that not all requests regarding your privacy rights can be completed; for example, deletion of your personal data is a right that can be limited due to Kuros’s compliance with legal obligations derived from the corresponding Medical Device and Clinical Trials laws and regulations. In such cases, we will inform you about this at the time of your request.

Who do we share your personal data with?

Access to personal data relating to you is limited. It is Kuros’s policy that persons within the organization should only have access to personal data on a need-to-know basis. Where applicable, we share your personal data in the following circumstances:

Kuros Biosciences Companies, subsidiaries, partners, and affiliates

We may share your personal data with subsidiaries and/or affiliates for purposes consistent with this Privacy Statement. Personal data is transferred between Kuros entities to ensure efficient and effective business operations and to enable Kuros to provide customer, sales, marketing, human resources, finance, information technology, legal, quality assurance, product development, and other support services.

Third Parties: Vendors, contractors, and other service providers

Kuros may share personal data with other service providers or other third parties that carry out functions or services on our behalf or that assist or enable our operations. These providers include, but are not limited to, hosting, e-mail and collaboration service providers, freelancers, consultants, product feedback or customer support, head-hunters, travel agencies and travel service providers, HR system providers, payrolling program vendors, and IT processing systems.

Personal data will only be disclosed if such service providers have provided sufficient guarantees to implement appropriate technical and organizational measures to protect your personal data and that is consistent with this Privacy Statement and applicable law.

Business transfers

Kuros may share personal data with other parties in connection with a significant corporate transaction or restructuring, including mergers, acquisitions, asset sales or insolvency. We may also transfer your personal data to law enforcement agencies, courts, tribunals, and regulatory bodies to comply and demonstrate compliance with our legal and regulatory requirements.

Regulatory bodies and Health agencies and authorities

We may share your personal data with third parties, such as the European Medicines Agency and the US Food & Drug Administration or any other regulatory body and/or health authority when it is necessary for product safety reports, adverse event reporting, or any other situation where we are required to share your personal data by law.

Under certain circumstances, we may be required to disclose your personal data in response to valid requests by public authorities, including to meet national security or law enforcement requirements or to investigate fraud.

No commercial use: Kuros will not sell your personal data to third parties.

Third parties to whom we transfer your personal data are themselves responsible for compliance with data protection law unless they act as our data processor. We are not responsible for the processing of your personal data by third parties if they act as an independent data controller.

Personal data transfer outside the European Economic Area, the UK, or Switzerland

Your personal data will be processed within the European Economic Area (EEA) and stored on servers located within the EEA whenever possible. However, your personal data may be transferred to and stored by us or by our affiliates and third parties described above, located in countries outside the EEA, the UK, or Switzerland. Should processing be outside of the EEA, the UK, or Switzerland, we ensure that the recipient of your personal data provides an adequate level of protection. We will ensure this by entering into appropriate processing agreements, and, if necessary, standard contractual clauses (as adopted by the ICO, European Commission, and the FDPIC) or an alternative lawful data transfer mechanism such as an adequacy decision. For data transfer from the EEA to the UK and Switzerland, we rely on the adequacy decision by the European Commission.

Changes to this Privacy Statement

We reserve the right to make changes to this Privacy Statement at any time and from time to time. Therefore, we encourage you to review it periodically.

How to Contact Us

We have appointed a Data Protection Officer who is responsible for overseeing questions in relation to this Privacy Statement. If you have any questions or comments about this Privacy Statement and/or the processing of your personal data, or if you wish to exercise your rights, please reach out to our Data Protection Officer via privacy@kurosbio.com.

Alternatively, you may write to us through regular mail at the following addresses:

Switzerland

Kuros Biosciences AG

Attn: Privacy Regulation Wagistrasse 25 8952

Schlieren Zürich Switzerland

Netherlands

Kuros Biosciences BV

Attn: Privacy Regulation Prof. Bronkhorstlaan 10 Building 48 3723 MB

Bilthoven The Netherlands

USA

Kuros Biosciences USA, Inc.

Attn: Privacy Regulation 10 Glenlake Parkway South Tower, Ste. 150

Atlanta, GA 30328 USA

This Privacy Statement was last modified in April 2025.