Privacy Declaration

Valneva USA Inc. (“Valneva”, “we”, “us” or “our”) has created this privacy declaration (hereafter referred to as the “Privacy Declaration”) to demonstrate our firm commitment to privacy. The following discloses our processing of personally identifiable information (“Personal data”) with regard to several listed aspects, for example, pharmacovigilance or customer data.

This Privacy Declaration applies to individuals we deal with including consumers, patients, health care professionals, and others within the health care or pharmaceutical industries (“you” or “your”), and explains how we collect, use, disclose and otherwise process and protect your Personal Data. This Privacy Declaration further includes a description of your data privacy rights as a data subject.

We may modify this Privacy Policy at any time without any prior notice to you and will post the revised Privacy Policy on the Service. The revised Policy will be effective when it is posted in the Service and your continued access or use of the Service after such time will constitute your acceptance of the revised Privacy Policy. We therefore recommend that you periodically review this page.

Our websites and the subsites may collect and process data regarding your behavior on our website. In such a case, we will inform you and, if necessary, ask for your consent when you first visit the website.

The websites may collect information from visitors both by asking you specific questions and by permitting you to communicate directly with us via email and/or feedback forms. Some of the information that you submit on the Site may be Personal Data. A site may further use “cookies” and Internet Protocol (“IP”) addresses. A cookie is a bit of information that a website sends to your web browser that helps the site remember information about you and your preferences and an IP address is a number assigned to your computer by your Internet service provider. The IP address can be used to diagnose problems with a server, report aggregate information, determine the fastest route for your computer to use in connecting to a site, and administer and improve the site.

To learn more about how we use these and your choices in relation to these tracking technologies, please refer to our Cookie Policy.

Please note that if you wish to subscribe and connect your personal social media account to our Site, e.g. if you would like to share information on your own social media account, certain Personal Data will be shared with us such as Personal Data linked to your profile or your friends’ profiles on the applicable social media account.

Pharmacovigilance is the process of discovering, evaluating, understanding, and preventing adverse reactions or other problems related to medicines. Their notification is of great importance for public health. We will only use and share this information for pharmacovigilance purposes. This processing is necessary for compliance with a legal obligation to which Valneva is subject.

Valneva is required to store and report information relevant to pharmacovigilance to health authorities worldwide (including countries whose data protection levels differ from those of the EU). The reports contain detailed information on the incident, but only to a limited extent personal data.

Concerning patients, the notification will contain, if available, only age, date of birth, year of birth, gender, and initials, depending on the information available, but never the name of the patient.

With regard to the person reporting a potential adverse reaction, the notification will include, depending on the information available, the name, professional activity (e.g. doctor, pharmacist), address, e-mail address, and telephone number. The contact details are necessary to be able to follow up the reporting and thus obtain high-quality and complete information on adverse events.

Information on notifications will be kept for at least ten (10) years after the product is no longer on the market in any country.

We will store and process your data for the purpose of your application based on your consent and based on Article 6/1 lit b General Data Protection Regulation. We will forward your personal data and the attachments you provided to the respective country organization with applicable open job opportunities. We will keep your personal data in evidence for filling additional positions for a maximum period of seven months from the date of the receipt of your application.

Your data will be kept strictly confidential, will not be passed on to any other companies except Valneva country organizations with applicable open job opportunities and will only be passed on within the company to the heads of departments where a suitable position is available.

Your data will be deleted automatically after twelve (12) months from the date of receipt of your application. You can revoke your consent to data processing at any time in writing via gdpr@valneva.com. In this case please refer to your job application and we will delete your personal data.

We will not use your personal data for marketing activities unless you have consented to receive marketing communications from us.

Based either on consent, Valneva’s legitimate interest to manage customer data, or, when applicable, on the fulfillment of contractual obligations, we will store your name, contact details, notes taken during meetings, dates of meetings, and your position within your company being a vendor, customer, or other business partners.

Your medical requests regarding our products will be stored due to legal obligations and in the legitimate interests of Valneva to have evidence about the information provided when replying to medical requests. We will store your name, contact details, the content of your request, and the content of our reply to your request.

We will store this data for 30 years after having received your medical request.

We collect information about personnel working for organizations that have been or will be contracted to provide services for one or more clinical trials. We collect and process this data to enable us to fulfill our legal obligation when managing clinical trials, which is to comply with applicable laws and regulations, as well as our contractual obligations, for individuals that have a direct contract with us.

We may process the following information about you when you start to work on a study with us:

• Full Name, Work Address, Job Title
• Contact telephone numbers, E-mail address
• CV or resume, Qualifications, License details, Certifications, Training Records
• Area(s) of Expertise, Role in the study
• Which site(s) or organization(s) you are affiliated with
• Declaration of financial interests, if applicable
• Financial information collected for payment, if applicable
• Historical and current information regarding participation and performance in clinical studies
• Authentication information for entering data into the eCRF (electronic case report form)

The processing of data for clinical trials either by ourselves or through a service provider may include:

• To select sites, administer, and conduct the Trial, according to the respective trial protocol including monitoring, source data/document verification, verification of site staff qualifications, audits, attendance to a meeting, participation in training, pharmacovigilance and related risk management, and the maintenance of the Trial Master File, according to applicable laws and Good Clinical Practice as provided by the International Conference on Harmonisation (ICH-GCP).
• To generate management reports about the conduct of the clinical trial, including contact lists of who is working on a study.
• To provide contact details to third parties, such as clinical research organizations and relevant vendors, including laboratories or other third-party suppliers to facilitate the shipment of supplies or issuing of results.
• To perform any necessary functions or purposes related to the performance of a contract or potential contract and/or the normal conduct of our business, as outlined in any contractual agreements entered into between you and Valneva, if applicable.
• Making payment resulting from work conducted under the clinical trial agreement, if applicable.
• To maintain details of who made what updates to electronic CRF systems and when, including adding e-signatures.
• Internal business process execution and management.

Furthermore, we may be required to disclose personal data to government institutions and supervisory authorities.

We take reasonable steps to protect your Personal Data using physical (locked filing cabinets and restricted access to offices), electronic (especially firewalls), or procedural security measures appropriate to the sensitivity of the information. Valneva will take appropriate steps to ensure that Personal Data about you is protected from loss or theft, as well as unauthorized access, disclosure, copying, use, or modification.

Although we have enacted security measures, we cannot guarantee the security of any information that you submit via email or over the Internet. To the extent permitted under applicable law, we make no warranty, express or implied, concerning the security or integrity of any Personal Data. You submit your Personal Data using such networks at your own risk since no Internet transmission is ever 100% secure or error-free (in particular, emails sent to or from the Site may not be secure). You should take special care in deciding what information you send to us via email or posting on the Site. Moreover, where you use passwords, ID numbers, or other special access features on the Site, it is your responsibility to safeguard them.

The Site may contain links or references to other websites to which this Privacy Policy does not apply. Valneva is not responsible for the data collection and use practices of companies or organizations to which the Site may provide links. We encourage you to read the privacy statement/policy of every website you visit.

Valneva makes no representations whatsoever about any other website which you may access through this Site. Besides, a link to a website does not mean that Valneva endorses or accepts any responsibility for the content, or the use, of such website.

This Site is not directed to individuals under the age of sixteen (16) (or such other lower age determined by applicable laws), and we do not knowingly collect any Personal Data from children under such age.

Should we need to process the Personal Data of an individual under the age of sixteen (16) (or such other lower age determined by applicable laws) consent to such processing must be given by an authorized person with parental responsibility for the child.

This Privacy Policy may be revised from time to time. If we intend to use or disclose Personal Data for purposes materially different than those described in this Privacy Policy, we will make reasonable efforts to notify affected individuals, if necessary, including by posting the revised Privacy Policy on this Site. We recommend that you review this Privacy Policy frequently.

If you would like to access your Personal Data or get it rectified, updated, erased, or transferred to other organizations, please contact us at the address below. You also have the right to object or to restrict some processing and, where we have asked for your consent to process your Personal Data, to withdraw your consent at any time and we will stop any future use of your Personal Data (unless there is a legitimate interest that prevents us from doing so). We may request a reasonable fee for administering certain requests. Authorized employees, agents, and representatives of Valneva who require access to your Personal Data to fulfill their job requirements will have access to your Personal Data.

You may contact us by writing to us at the following address:

Valneva Austria GmbH, Campus Vienna Biocenter 3, A-1030 Vienna, Austria

You may also contact Valneva's Data Protection Officer at:

gdpr@valneva.com

NOTE: If you are a physician or other health care professional and would like to record an adverse event, please contact safety@valneva.com

If you have any comments or complaints regarding the way your Personal Data is being handled, you have the right to contact the supervisory authority in your country of residence to lodge a complaint. Please click here to obtain relevant contact information to supervisory authorities: http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm